great-cto 3.62.0 → 3.62.2

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.62.0",
+  "version": "3.62.2",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/fixtures/beads-read-owner.mjs

@@ -0,0 +1,3 @@
+// Fixed test-only parent, killed after the child-start handshake.
+import { getTasksAsync } from '../lib/beads.mjs';
+await getTasksAsync(process.cwd());

package/board/packages/board/fixtures/fake-bd-controlled.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+// Fixed local test protocol. No shell commands or operator stores.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+const root = process.env.FAKE_BD_CONTROL_ROOT;
+if (!root || !path.isAbsolute(root)) process.exit(2);
+const key = path.basename(process.cwd());
+const marker = name => path.join(root, `${key}.${name}`);
+if (process.argv.includes('--descendant')) {
+  process.on('SIGTERM', () => {});
+  fs.writeFileSync(marker('descendant'), String(process.pid));
+  setInterval(() => {}, 1000);
+} else {
+  fs.appendFileSync(marker('started'), `${process.pid}\n`);
+  fs.writeFileSync(marker('worker'), String(process.ppid));
+  if (process.env.FAKE_BD_CONTROL_MODE === 'fail') {
+    process.exit(1);
+  } else if (['gate-receipt', 'gate-receipt-race'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
+    const tasks = [{ id: 'FIXTURE-GATE', title: 'gate:ship', labels: ['gate'], status: 'open', priority: 0 }];
+    if (process.env.FAKE_BD_CONTROL_MODE === 'gate-receipt-race') tasks.push({ id: 'NEW-GATE', title: 'gate:plan', labels: ['gate'], status: 'open', priority: 0 });
+    process.stdout.write(JSON.stringify(tasks), () => process.exit(0));
+  } else if (['hang', 'leader-exit'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
+    process.on('SIGTERM', () => {});
+    spawn(process.execPath, [new URL(import.meta.url).pathname, '--descendant'], { stdio: 'inherit' });
+    if (process.env.FAKE_BD_CONTROL_MODE === 'leader-exit') {
+      setInterval(() => { if (fs.existsSync(marker('descendant'))) process.exit(0); }, 25);
+    }
+    setInterval(() => {}, 1000);
+  } else if (process.env.FAKE_BD_CONTROL_MODE === 'large-success') {
+    process.stdout.write(JSON.stringify([{ id: 'FIXTURE-1', title: 'x'.repeat(131072), status: 'open', priority: 0 }]), () => {
+      fs.writeFileSync(marker('output-written'), 'ready');process.exit(0);
+    });
+  } else if (['closed-success', 'closed-fail'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
+    const descendant = spawn(process.execPath, [new URL(import.meta.url).pathname, '--descendant'], { stdio: 'ignore' });
+    descendant.unref();
+    const ready = setInterval(() => {
+      if (!fs.existsSync(marker('descendant'))) return;
+      clearInterval(ready);
+      process.stdout.write(JSON.stringify([{ id: 'FIXTURE-1', title: 'Fixture task', status: 'open', priority: 0 }]),
+        () => process.exit(process.env.FAKE_BD_CONTROL_MODE === 'closed-fail' ? 1 : 0));
+    }, 25);
+  } else if (process.env.FAKE_BD_CONTROL_MODE === 'oversize') {
+    process.stdout.write(Buffer.alloc(16 * 1024 * 1024 + 1, 120));
+    setInterval(() => {}, 1000);
+  } else {
+    const timer = setInterval(() => {
+      if (!fs.existsSync(marker('release'))) return;
+      clearInterval(timer);
+      process.stdout.write(JSON.stringify([{ id: 'FIXTURE-1', title: 'Fixture task', status: 'open', priority: 0 }]));
+    }, 25);
+  }
+}

package/board/packages/board/fixtures/held-receipt-git.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// A fixed Git-read fixture. It never reads operator stores or invokes a shell.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+const root = process.env.GCTO_RECEIPT_CONTROL_ROOT, binary = process.env.GCTO_RECEIPT_REAL_GIT;
+if (!root || !path.isAbsolute(root) || !binary || !path.isAbsolute(binary)) process.exit(2);
+const args = process.argv.slice(2);
+const run = () => {
+  const result = spawnSync(binary, args, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000 });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exit(result.status ?? 1);
+};
+if (args.includes('hash-object') || args.includes('--show-object-format') ||
+    (args.includes('rev-parse') && args.includes('HEAD') && fs.existsSync(path.join(root, 'hold-head')))) {
+  fs.appendFileSync(path.join(root, 'git-held'), `${process.pid}\n`);
+  const timer = setInterval(() => {
+    if (fs.existsSync(path.join(root, 'git-release'))) { clearInterval(timer); run(); }
+  }, 25);
+} else run();

package/board/packages/board/lib/alerts.mjs

@@ -27,7 +27,7 @@ import { getCostHistory, getInbox } from './data-readers.mjs';
 // reporting "live · synced just now". `sweep: true` must NEVER be added to
 // an interactive read's opts: an ordinary request is someone waiting on
 // THIS project's answer, and the fill path answers `[]` instead.
-import { getTasks, SWEEP_MAX_AGE_MS } from './beads.mjs';
+import { getTasks, getTasksAsync, getReadDegradation, SWEEP_MAX_AGE_MS } from './beads.mjs';
 const SWEEP = { maxAgeMs: SWEEP_MAX_AGE_MS, sweep: true };
 import { readVerdicts } from './verdicts.mjs';
 import { isFailure } from './fleet.mjs';
@@ -303,11 +303,16 @@ function startAlertCron() {
   }, FIVE_MIN);
 
   // cost.threshold: monthly LLM spend at 80% / 100% of budget
-  setInterval(() => {
+  setInterval(async () => {
     try {
       const projects = listProjects();
       for (const proj of projects) {
-        const m = getMetrics(proj.path);
+        let tasks;
+        try {
+          tasks = await getTasksAsync(proj.path);
+          if (getReadDegradation(proj.path)) continue;
+        } catch { continue; } // Unknown spend must not be treated as zero.
+        const m = getMetrics(proj.path, 30, { tasks });
         const meta = readProjectMd(proj.path) || {};
         const budget = parseFloat(meta['monthly-budget']?.replace?.(/[$\s]/g, '') || '0');
         if (!budget) continue;
@@ -356,7 +361,12 @@ function startAlertCron() {
       // next project reads alerts-fired.json. Prevents the race condition where
       // all N projects read an empty map simultaneously and all fire.
       for (const proj of projects) {
-        const m = getMetrics(proj.path);
+        let tasks;
+        try {
+          tasks = await getTasksAsync(proj.path);
+          if (getReadDegradation(proj.path)) continue;
+        } catch { continue; } // Unknown is not a zero-activity weekly report.
+        const m = getMetrics(proj.path, 30, { tasks });
         const dedupeKey = `digest.weekly:${proj.slug}:${isoWeek}`;
         const weeklyPayload = {
           title: `${proj.slug} weekly — ${m.tasks?.done || 0} shipped, $${(m.cost?.llm_usd || 0).toFixed(2)} spent`,
@@ -395,18 +405,22 @@ function startAlertCron() {
       const projects = listProjects();
       for (const proj of projects) {
         const dedupeKey = `digest.daily:${proj.slug}:${isoDay}`;
+        let tasks;
+        try {
+          tasks = await getTasksAsync(proj.path);
+          if (getReadDegradation(proj.path)) continue;
+        } catch { continue; } // Do not send or record a fabricated quiet day.
         // Pull last 2 days so "yesterday" is always in the window
-        const cost = getCostHistory(proj.path, 2);
+        const cost = getCostHistory(proj.path, 2, { tasks });
         const yBucket = (cost.series || []).find(s => s.date === yesterday);
         const ySpend = yBucket ? yBucket.llm : 0;
         // Feature breakdown for yesterday
         const topFeatures = (cost.by_feature || []).slice(0, 3);
         // Inbox for blocked + gates
-        const inbox = (() => { try { return getInbox(proj.path); } catch { return {}; } })();
+        const inbox = getInbox(proj.path, { tasks });
         const blocked = inbox.summary?.blocked ?? 0;
         const gates = inbox.summary?.gates ?? 0;
         // Tasks closed yesterday
-        const tasks = (() => { try { return getTasks(proj.path, SWEEP); } catch { return []; } })();
         const doneYesterday = tasks.filter(t => {
           if (!t.closed_at) return false;
           return t.closed_at.slice(0, 10) === yesterday;

package/board/packages/board/lib/bd-read-worker.mjs

@@ -0,0 +1,70 @@
+// A read's process-group lifetime must not depend on the HTTP event loop.
+// Forked into a newly owned group; ordinary module imports do not start work.
+import { fork, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+const entry = fileURLToPath(import.meta.url);
+export function spawnBdRead(binary, { readDeadlineMs = 20250, commandArgs, ...options }) {
+  const args = [binary, String(readDeadlineMs)];
+  if (commandArgs !== undefined) args.push(JSON.stringify(commandArgs));
+  return fork(entry, args, { ...options, silent: true });
+}
+if (process.argv[1] === entry) {
+  const grouped = process.platform !== 'win32';
+  let child;
+  function killOwnedGroup() {
+    // POSIX fork is detached: the worker PID is exclusively this read's PGID.
+    if (grouped) {
+      try { process.kill(-process.pid, 'SIGKILL'); } catch { process.exit(1); }
+    } else {
+      try { child?.kill('SIGKILL'); } catch { /* already gone */ }
+      process.exit(1);
+    }
+  }
+  process.on('disconnect', killOwnedGroup);
+  process.on('SIGTERM', () => {}); // keep the independent KILL deadline alive
+  process.stdout.on('error', killOwnedGroup);
+  process.stderr.on('error', killOwnedGroup);
+  // Independent upper bound even if the parent's event loop is stalled.
+  const budget = Number(process.argv[3]);
+  if (!Number.isFinite(budget) || budget < 1 || budget > 20250) process.exit(2);
+  setTimeout(killOwnedGroup, budget);
+  let completing = false;
+  function complete(code) {
+    if (completing) return;
+    completing = true;
+    // A successful leader can leave descendants with closed/ignored pipes.
+    // Flush the result over IPC before killing the whole owned group. Keep
+    // the independent deadline alive until cleanup, even if IPC stalls.
+    if (!process.connected) return killOwnedGroup();
+    // child 'close' means its pipes ended, not that this worker's output
+    // queues reached the parent. Flush before announcing success or KILL
+    // can truncate an otherwise valid snapshot under pipe backpressure.
+    try { process.stdout.write('', stdoutError => {
+      if (stdoutError) return killOwnedGroup();
+      process.stderr.write('', stderrError => {
+        if (stderrError || !process.connected) return killOwnedGroup();
+        try { process.send({ type: 'bd-read-result', code }, () => killOwnedGroup()); }
+        catch { killOwnedGroup(); }
+      });
+    }); }
+    catch { killOwnedGroup(); }
+  }
+  try {
+    const args = process.argv[4] === undefined
+      ? ['list', '--json', '--all', '--include-gates'] : JSON.parse(process.argv[4]);
+    if (!Array.isArray(args) || args.length > 8 || args.some(arg => typeof arg !== 'string' || arg.includes('\0'))
+        || JSON.stringify(args).length > 4096) throw Error('Invalid read command arguments');
+    child = spawn(process.argv[2], args, {
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    child.stdout.pipe(process.stdout, { end: false });
+    child.stderr.pipe(process.stderr, { end: false });
+    child.on('error', () => complete(1));
+    child.on('close', code => {
+      // No background descendants are part of a completed read contract.
+      // Wait for inherited pipes too: exiting on leader 'exit' would remove
+      // the IPC watchdog while a descendant was still holding those pipes.
+      complete(Number.isInteger(code) ? code : 1);
+    });
+  } catch { complete(1); }
+}

package/board/packages/board/lib/beads.mjs

@@ -5,6 +5,7 @@ import { spawnSync, spawn } from 'child_process';
 import { readSafe } from './util.mjs';
 import { bdCache } from './state.mjs';
 import { log } from './log.mjs';
+import { spawnBdRead } from './bd-read-worker.mjs';
 
 // ── Beads data ─────────────────────────────────────────────────────────────────
 // Cache bdList output per cwd for BD_CACHE_TTL_MS. Invalidated when the project's
@@ -39,13 +40,11 @@ import { log } from './log.mjs';
 const BD_CACHE_TTL_MS = Number(process.env.GREAT_CTO_BD_CACHE_TTL_MS || 300000);
 
 /**
- * When a cwd was last told "your cache entry is wrong" — by an invalidate or
- * a stale-mark, whichever most recently ran. A background fetch that STARTED
- * before this timestamp answers a question nobody is asking anymore: see
- * `bdRefreshAsync`, which compares its own start time against this map before
- * committing its result, so a slow fetch racing a write always loses to it.
+ * Per-project invalidation generation. A background fetch may publish only
+ * when its generation is still current. Wall-clock timestamps cannot order
+ * an invalidate followed by a read within the same millisecond.
  */
-const lastInvalidatedAt = new Map();
+const invalidationGeneration = new Map();
 
 /**
  * Drop a directory's entry so the next read is guaranteed fresh.
@@ -56,7 +55,7 @@ const lastInvalidatedAt = new Map();
  */
 function bdCacheInvalidate(cwd) {
   clearSelfTouch(cwd);
-  lastInvalidatedAt.set(cwd, Date.now());
+  invalidationGeneration.set(cwd, (invalidationGeneration.get(cwd) || 0) + 1);
   bdCache.delete(cwd);
 }
 
@@ -73,7 +72,7 @@ function bdCacheInvalidate(cwd) {
  */
 function bdCacheStale(cwd) {
   clearSelfTouch(cwd);
-  lastInvalidatedAt.set(cwd, Date.now());
+  invalidationGeneration.set(cwd, (invalidationGeneration.get(cwd) || 0) + 1);
   const cached = bdCache.get(cwd);
   if (cached) bdCache.set(cwd, { ...cached, ts: 0 });
 }
@@ -297,6 +296,17 @@ const EMPTY_TTL_MS = Number(process.env.GREAT_CTO_BD_EMPTY_TTL_MS || 5000);
  * Without this, ten requests arriving while one refresh runs start ten more.
  */
 const refreshing = new Set();
+const refreshWaiters = new Map();
+const refreshQueue = [];
+let activeReads = 0;
+const READ_TIMEOUT_MS = 20000;
+const READ_MAX_BYTES = 16 * 1024 * 1024;
+function drainRefreshQueue() {
+  while (activeReads < 4 && refreshQueue.length) {
+    activeReads++;
+    refreshQueue.shift()();
+  }
+}
 
 /**
  * Refresh a directory's entry WITHOUT holding the event loop.
@@ -304,44 +314,108 @@ const refreshing = new Set();
  * `spawnSync` is what made this board unanswerable: `bd list` costs seconds and
  * blocks everything for the whole of it — /api/version, one readdirSync,
  * measured at 1-10 s because it was queued behind a task read. Warming at boot
- * moved the first stall out of sight; this removes the rest.
+ * moved the first stall out of sight; HTTP cold reads now await this path.
+ * Direct synchronous write broadcasts and background readers remain separate.
  *
- * `onDone`, if given, fires exactly once at every exit point (success,
- * failure, or "already refreshing"). Every existing caller omits it and stays
- * fire-and-forget — the ONE caller that wants to know when the fill finished
- * is the boot warm-up (see `warmTasksAsync`), which logs how long it took.
+ * `onDone`, if given, fires exactly once when the shared read finishes. A
+ * concurrent reader joins it rather than receiving a premature "skipped".
+ * Background callers omit it and stay fire-and-forget. Boot warm-up and
+ * interactive cold reads join the same completion through `warmTasksAsync`.
  */
-function bdRefreshAsync(cwd, onDone = () => {}) {
-  if (refreshing.has(cwd)) { onDone({ ok: false, skipped: true }); return; }
+function bdRefreshAsync(cwd, onDone = null) {
+  if (refreshing.has(cwd)) { if (onDone) refreshWaiters.get(cwd).push(onDone); return; }
   refreshing.add(cwd);
+  refreshWaiters.set(cwd, onDone ? [onDone] : []);
+  const due = performance.now() + READ_TIMEOUT_MS;
+  const run = () => {
+    clearTimeout(queuedDeadline);
+    startRefresh(cwd, Math.max(1, due - performance.now()));
+  };
+  const queuedDeadline = setTimeout(() => {
+    const index = refreshQueue.indexOf(run);
+    if (index < 0) return;
+    refreshQueue.splice(index, 1);
+    refreshing.delete(cwd);
+    bdFailures.set(cwd, 'bd read timed out waiting for a slot');
+    const waiters = refreshWaiters.get(cwd) || [];
+    refreshWaiters.delete(cwd);
+    for (const done of waiters) done({ ok: false });
+  }, READ_TIMEOUT_MS);
+  refreshQueue.push(run);
+  drainRefreshQueue();
+}
+
+function startRefresh(cwd, remainingMs) {
   const startedAt = Date.now();
+  const generation = invalidationGeneration.get(cwd) || 0;
   lastBdRunAt.set(cwd, startedAt);
-  let out = '';
+  let out = '', outBytes = 0;
+  let child, deadline, killDeadline, finished = false, workerResult;
+  const grouped = process.platform !== 'win32';
+  function signalOwned(signal) {
+    if (!child?.pid) return;
+    try { if (grouped) process.kill(-child.pid, signal); else child.kill(signal); } catch { /* already exited */ }
+  }
+  function finish(result) {
+    if (finished) return;
+    finished = true;
+    clearTimeout(deadline); clearTimeout(killDeadline);
+    refreshing.delete(cwd);
+    const waiters = refreshWaiters.get(cwd) || [];
+    refreshWaiters.delete(cwd);
+    activeReads--;
+    for (const done of waiters) done(result);
+    drainRefreshQueue();
+  }
+  function stop(reason) {
+    if (finished || killDeadline) return;
+    bdFailures.set(cwd, reason);
+    signalOwned('SIGTERM');
+    // TERM alone can leave a read and inherited pipes alive indefinitely.
+    killDeadline = setTimeout(() => {
+      signalOwned('SIGKILL');
+      child.stdout?.destroy(); child.stderr?.destroy();
+      finish({ ok: false });
+    }, 250);
+  }
   try {
-    // Bounded like every other bd call. Without a timeout a hung bd never fires
-    // 'close', so `refreshing` stays held for this cwd forever and the cache
-    // silently serves stale tasks with no error anywhere — the async twin of the
-    // sync path's 500s. Node kills on timeout, which DOES fire 'close' with a
-    // non-zero code, so the failure handling below reports it rather than the
-    // board simply going quiet.
-    const child = spawn(BD_BIN, ['list', '--json', '--all', '--include-gates'], { cwd, env: bdEnv(), timeout: 20000 });
-    child.stdout?.on('data', (d) => { out += d; });
+    // At most four reads run concurrently. The fixed deadline escalates TERM
+    // to KILL for this newly owned process group; Node's TERM-only timeout did
+    // not release the slot when a child ignored it or inherited pipes stayed open.
+    child = spawnBdRead(BD_BIN, { cwd, env: bdEnv(), detached: grouped, readDeadlineMs: Math.ceil(remainingMs) + 250 });
+    child.on('message', message => {
+      if (message?.type === 'bd-read-result' && Number.isInteger(message.code)) workerResult = message.code;
+    });
+    deadline = setTimeout(() => stop('bd read timed out'), remainingMs);
+    child.stdout?.setEncoding('utf8');
+    child.stdout?.on('data', (d) => {
+      if (finished || killDeadline) return;
+      outBytes += Buffer.byteLength(d);
+      if (outBytes > READ_MAX_BYTES) { stop('bd output exceeded limit'); return; }
+      out += d;
+    });
+    // Drain stderr without retaining arbitrary private subprocess output.
+    child.stderr?.resume();
     child.on('error', (e) => {
-      refreshing.delete(cwd);
       bdFailures.set(cwd, `bd could not be run: ${e?.message || e}`.slice(0, 300));
-      onDone({ ok: false });
+      finish({ ok: false });
     });
     child.on('close', (code) => {
-      refreshing.delete(cwd);
+      if (finished) return;
+      if (killDeadline) { signalOwned('SIGKILL'); finish({ ok: false }); return; }
+      // The worker reports its leader result, then terminates its entire
+      // owned group, including itself. A bare signal without that result
+      // remains a failed read, never a fabricated successful empty list.
+      code = workerResult ?? code;
       lastBdRunAt.set(cwd, Date.now());
-      if (code !== 0) { bdFailures.set(cwd, `bd exited ${code}`); onDone({ ok: false }); return; }
+      if (code !== 0) { bdFailures.set(cwd, `bd exited ${code}`); finish({ ok: false }); return; }
       try {
         const parsed = JSON.parse(out || '[]');
         // Same guard as the sync path: bd 0.6x can answer 0 with a JSON object,
         // and a non-array rendered as no tasks is the silent zero again.
         if (!Array.isArray(parsed)) {
           bdFailures.set(cwd, String(parsed?.error || 'bd returned something that is not a task list').slice(0, 300));
-          onDone({ ok: false });
+          finish({ ok: false });
           return;
         }
         // This fetch answers "what was true at `startedAt`?" — if anyone has
@@ -353,24 +427,23 @@ function bdRefreshAsync(cwd, onDone = () => {}) {
         // `tests/pipeline-e2e.test.mjs`'s gate-approval assertions flake once
         // this function started running from a COLD cache (the boot warm-up)
         // instead of only ever refreshing an already-populated one.
-        const supersededByInvalidation = (lastInvalidatedAt.get(cwd) || 0) >= startedAt;
+        const supersededByInvalidation = (invalidationGeneration.get(cwd) || 0) !== generation;
         const supersededByFresherEntry = (bdCache.get(cwd)?.ts || 0) >= startedAt;
         if (supersededByInvalidation || supersededByFresherEntry) {
-          onDone({ ok: true, count: parsed.length, discarded: true });
+          finish({ ok: true, count: parsed.length, discarded: true });
           return;
         }
         bdFailures.delete(cwd);
         bdCache.set(cwd, { ts: Date.now(), data: parsed });
-        onDone({ ok: true, count: parsed.length });
+        finish({ ok: true, count: parsed.length });
       } catch (e) {
         bdFailures.set(cwd, `bd output could not be parsed: ${e?.message || e}`.slice(0, 300));
-        onDone({ ok: false });
+        finish({ ok: false });
       }
     });
   } catch (e) {
-    refreshing.delete(cwd);
     bdFailures.set(cwd, `bd could not be spawned: ${e?.message || e}`.slice(0, 300));
-    onDone({ ok: false });
+    finish({ ok: false });
   }
 }
 
@@ -410,6 +483,34 @@ function warmTasksAsync(cwd) {
   });
 }
 
+/** Wait for an actual cold snapshot without blocking Node or inventing []. */
+async function getTasksAsync(cwd = process.cwd()) {
+  if (!bdCache.has(cwd)) {
+    const result = await warmTasksAsync(cwd);
+    if (!bdCache.has(cwd)) {
+      // tasks.md-only projects remain supported, but never hide a failed
+      // initialized Beads store or a snapshot invalidated during this read.
+      if (!result.ok && checkBeadsAvailable(cwd)) {
+        bdCache.set(cwd, { ts: Date.now(), data: [] });
+        return getTasks(cwd);
+      }
+      throw new Error(bdFailureFor(cwd) || 'Task snapshot changed while being read; retry');
+    }
+  }
+  return getTasks(cwd);
+}
+
+/** Other-project badges may be incomplete, but must never block HTTP. */
+function getTasksCached(cwd = process.cwd()) {
+  if (!bdCache.has(cwd)) {
+    bdRefreshAsync(cwd);
+    throw new Error('Task snapshot is loading');
+  }
+  const tasks = getTasks(cwd);
+  if (getReadDegradation(cwd)) throw new Error('Task snapshot is unavailable');
+  return tasks;
+}
+
 function bdList(cwd = process.cwd(), runner = bd, opts = {}) {
   const maxAge = Number.isFinite(opts.maxAgeMs) ? opts.maxAgeMs : BD_CACHE_TTL_MS;
   const cached = bdCache.get(cwd);
@@ -864,6 +965,8 @@ export {
   getReadDegradation,
   setTaskStatusInTasksMd,
   getTasks,
+  getTasksAsync,
+  getTasksCached,
   mapStatus,
   detectAgent,
 };

package/board/packages/board/lib/data-readers.mjs

@@ -3,7 +3,7 @@ import fs from 'fs';
 import path from 'path';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { readFileSafe } from './util.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasks, getTasksAsync, getTasksCached } from './beads.mjs';
 import { readVerdicts, readSecStats } from './verdicts.mjs';
 import { datePlans } from './plan-date.mjs';
 
@@ -73,7 +73,7 @@ function getMemory(cwd = process.cwd()) {
 }
 
 // ── Pipeline state ────────────────────────────────────────────────────────────
-function getPipeline(cwd = process.cwd()) {
+function getPipeline(cwd = process.cwd(), { tasks = getTasks(cwd) } = {}) {
   const stages = ['product-owner', 'architect', 'pm', 'senior-dev', 'reviewers', 'qa-engineer', 'security-officer', 'devops', 'l3-support'];
   const verdicts = readVerdicts(cwd);
   const now = Date.now();
@@ -87,7 +87,6 @@ function getPipeline(cwd = process.cwd()) {
   }
 
   // Tasks in_progress give us "active" agents
-  const tasks = getTasks(cwd);
   const activeAgents = new Set(
     tasks.filter(t => t.status === 'in_progress').map(t => (t.agent || '').toLowerCase()).filter(Boolean)
   );
@@ -179,7 +178,7 @@ function getPipeline(cwd = process.cwd()) {
 }
 
 // ── Cost history (daily LLM burn) ────────────────────────────────────────────
-function getCostHistory(cwd = process.cwd(), days = 30) {
+function getCostHistory(cwd = process.cwd(), days = 30, { tasks: suppliedTasks } = {}) {
   // Build a map<dateISO, { llm, human, plans, verdictCost }>.
   // Inclusive window: `days=30` means [today-30 ... today] = 31 buckets.
   // Previous behaviour (days buckets only) created a one-day gap on the
@@ -315,7 +314,7 @@ function getCostHistory(cwd = process.cwd(), days = 30) {
   const LLM_RATE_PER_HR   = parseFloat(process.env.GREATCTO_LLM_RATE_PER_HR || '0.30');
   const DEFAULT_TASK_MIN  = 30;
   try {
-    const tasks = getTasks(cwd);
+    const tasks = suppliedTasks ?? getTasks(cwd);
     for (const t of tasks) {
       if (!t.closed_at) continue;
       if (!t.agent) continue;
@@ -401,8 +400,7 @@ function getCostHistory(cwd = process.cwd(), days = 30) {
 }
 
 // ── Inbox: what needs the user's decision right now ──────────────────────────
-function getInbox(cwd = process.cwd()) {
-  const tasks = getTasks(cwd);
+function getInbox(cwd = process.cwd(), { tasks = getTasks(cwd) } = {}) {
   // Use raw_status here: mapStatus() rewrites status to 'gate' for any task with the
   // 'gate' label, regardless of bd-native state. Filtering on the mapped value would
   // leave closed/blocked gates in the inbox forever.
@@ -502,7 +500,7 @@ function getInbox(cwd = process.cwd()) {
  * `readInbox` is injectable so the walk can be tested with stub projects
  * without a beads store behind each one.
  */
-function inboxElsewhere(projects, currentPath, { readInbox = getInbox } = {}) {
+function inboxElsewhere(projects, currentPath, { readInbox = getInboxCached } = {}) {
   const same = (a, b) => {
     if (!a || !b) return false;
     try { return fs.realpathSync(a) === fs.realpathSync(b); } catch { return path.resolve(a) === path.resolve(b); }
@@ -521,4 +519,6 @@ function inboxElsewhere(projects, currentPath, { readInbox = getInbox } = {}) {
   return out;
 }
 
-export { getMemory, getPipeline, getCostHistory, getInbox, inboxElsewhere };
+async function getInboxAsync(cwd) { return getInbox(cwd, { tasks: await getTasksAsync(cwd) }); }
+function getInboxCached(cwd) { return getInbox(cwd, { tasks: getTasksCached(cwd) }); }
+export { getMemory, getPipeline, getCostHistory, getInbox, getInboxAsync, getInboxCached, inboxElsewhere };

package/board/packages/board/lib/gate-tokens.mjs

@@ -19,6 +19,7 @@ import fs from 'fs';
 import path from 'path';
 import { randomUUID } from 'crypto';
 import { treeReceipt, receiptHash, compareReceipts } from '../../../scripts/lib/receipt.mjs';
+import { readBindingReceipt } from './receipt-read.mjs';
 
 export const TOKENS_FILE = 'gate-tokens.json';
 export const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
@@ -36,6 +37,30 @@ export function tokenTtlMs(env = process.env) {
 }
 
 const storePath = (cwd) => path.join(cwd, '.great_cto', TOKENS_FILE);
+// One board owns its HTTP listener. Fence awaited projections against that
+// board's decision lifecycle; this is not a distributed multi-board lock.
+const decisions = new Map();
+function decisionState(cwd) {
+  let key;
+  try { key = fs.realpathSync(cwd); } catch { return null; }
+  if (!decisions.has(key)) decisions.set(key, { generation: randomUUID(), active: false });
+  return decisions.get(key);
+}
+export function approvalSnapshot(cwd) {
+  const state = decisionState(cwd);
+  return state ? { generation: state.generation, active: state.active } : { generation: null, active: true };
+}
+function snapshotFresh(cwd, snapshot) {
+  const state = decisionState(cwd);
+  return state && snapshot && !snapshot.active && !state.active && snapshot.generation === state.generation;
+}
+export function beginGateDecision(cwd) {
+  const state = decisionState(cwd);
+  if (!state || state.active) return null;
+  state.active = true; state.generation = randomUUID();
+  let ended = false;
+  return () => { if (!ended) { ended = true; state.active = false; state.generation = randomUUID(); } };
+}
 
 /** @returns {{state:'none'|'ok'|'unreadable', tokens:object, why?:string}} */
 export function readTokens(cwd) {
@@ -77,7 +102,7 @@ export function bindingReceipt(cwd) {
  * @param {{id:string, gate?:string, guarded?:boolean}[]} gates
  * @returns {{state:'ok'|'unreadable', tokens:Record<string,string>, why?:string}}
  */
-export function issueTokens(cwd, gates, { now = Date.now(), env = process.env } = {}) {
+export function issueTokens(cwd, gates, { now = Date.now(), env = process.env, readReceipt = bindingReceipt } = {}) {
   const store = readTokens(cwd);
   if (store.state === 'unreadable') return { state: 'unreadable', tokens: {}, why: store.why };
   const ttl = tokenTtlMs(env);
@@ -90,7 +115,7 @@ export function issueTokens(cwd, gates, { now = Date.now(), env = process.env }
     else toMint.push(g);
   }
   if (toMint.length) {
-    const receipt = bindingReceipt(cwd);
+    const receipt = readReceipt(cwd);
     const hash = receiptHash(receipt);
     for (const g of toMint) {
       next[g.id] = {
@@ -104,6 +129,29 @@ export function issueTokens(cwd, gates, { now = Date.now(), env = process.env }
   return { state: 'ok', tokens: Object.fromEntries(Object.entries(next).map(([id, e]) => [id, e.token])) };
 }
 
+export async function issueTokensAsync(cwd, gates, { env = process.env, readReceipt = readBindingReceipt, snapshot = approvalSnapshot(cwd) } = {}) {
+  const stale = () => ({ state: 'unreadable', tokens: {}, why: 'Gate decisions changed during this snapshot; reload the inbox' });
+  if (!snapshotFresh(cwd, snapshot)) return stale();
+  const store = readTokens(cwd), now = Date.now(), ttl = tokenTtlMs(env);
+  if (store.state === 'unreadable') return { state: 'unreadable', tokens: {}, why: store.why };
+  const needsReceipt = (gates || []).some(g => g?.id &&
+    (!store.tokens[g.id] || typeof store.tokens[g.id].token !== 'string' || !Number.isFinite(store.tokens[g.id].firstSeenAt) || now - store.tokens[g.id].firstSeenAt > ttl));
+  try {
+    const receipt = needsReceipt ? await readReceipt(cwd) : undefined;
+    if (!snapshotFresh(cwd, snapshot)) return stale();
+    const current = readTokens(cwd);
+    // Also refuse disappearance/replacement of an existing token by another
+    // store writer. Concurrent mint-only consumers remain safe to coalesce.
+    if (Object.entries(store.tokens).some(([id, entry]) => current.tokens[id]?.token !== entry?.token)) return stale();
+    // Reread the store after await: another consumer may already have minted
+    // these tokens, or corruption may have appeared. Never replace that state.
+    return issueTokens(cwd, gates, { now: Date.now(), env, readReceipt: () => {
+      if (!needsReceipt) throw Error('Receipt no longer available');
+      return receipt;
+    } });
+  } catch { return { state: 'unreadable', tokens: {}, why: 'Approval receipt is unavailable; retry' }; }
+}
+
 /**
  * Is `token` the live token for gate `id`?
  * @returns {{ok:true, entry:object} | {ok:false, status:number, outcome:string, why:string}}
@@ -143,6 +191,9 @@ export function checkBinding(cwd, entry) {
 
 /** Single use: drop the gate's token once it has been decided. */
 export function consumeToken(cwd, id) {
+  const state = decisionState(cwd);
+  if (!state) return;
+  state.generation = randomUUID();
   const store = readTokens(cwd);
   if (store.state !== 'ok' || !(id in store.tokens)) return;
   const next = { ...store.tokens };

package/board/packages/board/lib/metrics.mjs

@@ -43,11 +43,10 @@ function acceptanceMetrics(verdicts = [], windowCostUsd = null) {
 }
 
 // ── Metrics ────────────────────────────────────────────────────────────────────
-function getMetrics(cwd = process.cwd(), days = 30) {
+function getMetrics(cwd = process.cwd(), days = 30, { tasks = getTasks(cwd) } = {}) {
   // `days` controls the window for cost/agents_cost and for "shipped in window".
   // Tasks shipped within the window are returned in `tasks.done_in_window`.
   // Full lifetime `tasks.done` is still returned for backwards compatibility.
-  const tasks = getTasks(cwd);
   // BH-28: resolved gates (approve→closed, reject→blocked) get mapped to
   // status='done' by mapStatus(). Those are governance decisions, not shipped
   // features — counting them inflates velocity / tasks-shipped on the report.

package/board/packages/board/lib/receipt-read-worker.mjs

@@ -0,0 +1,37 @@
+// Invoked only by the independent read supervisor, never by an HTTP argument.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { treeReceipt, latestApproval, compareReceipts, mergeBase } from '../../../scripts/lib/receipt.mjs';
+import { secondOpinionForTree } from '../../../scripts/lib/second-opinion-for-tree.mjs';
+const entry = fileURLToPath(import.meta.url);
+export const receiptReadEntry = entry;
+if (process.argv[1] === entry) {
+  try {
+    const mode = process.argv[2] || 'binding';
+    if (!['binding', 'approval', 'second-opinion'].includes(mode) || process.argv.length > 3) throw Error('Invalid evidence operation');
+    let receipt;
+    if (mode === 'second-opinion') {
+      receipt = secondOpinionForTree(process.cwd());
+    } else if (mode === 'approval') {
+      const approval = latestApproval(process.cwd());
+      if (!approval?.receipt) {
+        receipt = { state: 'no-receipt', why: 'no approving verdict carries a receipt yet', agent: approval?.agent || null, ts: approval?.ts || null };
+      } else {
+        const current = treeReceipt(process.cwd(), { base: approval.receipt.base || mergeBase(process.cwd()), hashFilesInProcess: true });
+        receipt = { ...compareReceipts(approval.receipt, current, { cwd: process.cwd() }), agent: approval.agent, ts: approval.ts };
+      }
+    } else {
+      let dir = process.cwd(), gitMetadata = false;
+      for (;;) {
+        try { fs.lstatSync(path.join(dir, '.git')); gitMetadata = true; break; } catch (e) { if (e.code !== 'ENOENT') throw e; }
+        const parent = path.dirname(dir); if (parent === dir) break; dir = parent;
+      }
+      receipt = treeReceipt(process.cwd(), { exclude: ['.great_cto', '.beads'], hashFilesInProcess: true });
+      // Preserve explicit non-Git binding, but never mint an unbound token when
+      // a real repository's evidence read failed.
+      if (!receipt && gitMetadata) throw Error('Repository receipt unavailable');
+    }
+    process.stdout.write(JSON.stringify({ receipt }), error => process.exit(error ? 1 : 0));
+  } catch { process.exit(1); }
+}

package/board/packages/board/lib/receipt-read.mjs

@@ -0,0 +1,70 @@
+import path from 'node:path';
+import { spawnBdRead } from './bd-read-worker.mjs';
+import { receiptReadEntry } from './receipt-read-worker.mjs';
+const pending = new Map();
+const MAX_ACTIVE = 2, MAX_BYTES = 16 * 1024 * 1024;
+export function readBindingReceipt(cwd, { timeoutMs = 20000 } = {}) {
+  return readEvidence(cwd, 'binding', timeoutMs);
+}
+export function readApprovalReceipt(cwd, { timeoutMs = 20000 } = {}) {
+  return readEvidence(cwd, 'approval', timeoutMs);
+}
+export function readSecondOpinion(cwd, { timeoutMs = 20000 } = {}) {
+  return readEvidence(cwd, 'second-opinion', timeoutMs);
+}
+function readEvidence(cwd, mode, timeoutMs) {
+  cwd = path.resolve(cwd);
+  const key = JSON.stringify([cwd, mode]);
+  if (pending.has(key)) return pending.get(key);
+  if (pending.size >= MAX_ACTIVE) return Promise.reject(Error('Receipt reader busy; retry'));
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 1 || timeoutMs > 20000) return Promise.reject(Error('Invalid receipt deadline'));
+  const operation = new Promise((resolve, reject) => {
+    let child, deadline, escalation, settled = false, resultCode, out = '', bytes = 0;
+    const grouped = process.platform !== 'win32';
+    const signal = s => { try { if (grouped) process.kill(-child.pid, s); else child.kill(s); } catch {} };
+    const finish = (error, value) => {
+      if (settled) return; settled = true; clearTimeout(deadline); clearTimeout(escalation);
+      if (error) reject(error); else resolve(value);
+    };
+    const stop = message => {
+      if (settled || escalation) return;
+      signal('SIGTERM');
+      escalation = setTimeout(() => {
+        signal('SIGKILL'); child.stdout?.destroy(); child.stderr?.destroy(); finish(Error(message));
+      }, 250);
+    };
+    try {
+      child = spawnBdRead(process.execPath, { cwd, detached: grouped, commandArgs: [receiptReadEntry, mode], readDeadlineMs: timeoutMs + 250 });
+      deadline = setTimeout(() => stop('Receipt read timed out'), timeoutMs);
+      child.on('message', m => { if (m?.type === 'bd-read-result' && Number.isInteger(m.code)) resultCode = m.code; });
+      child.stdout.setEncoding('utf8');
+      child.stdout.on('data', chunk => {
+        if (settled || escalation) return;
+        bytes += Buffer.byteLength(chunk);
+        if (bytes > MAX_BYTES) stop('Receipt output exceeded limit'); else out += chunk;
+      });
+      child.stderr.resume();
+      child.on('error', () => finish(Error('Receipt worker unavailable')));
+      child.on('close', code => {
+        if (settled) return;
+        if (escalation) { signal('SIGKILL'); finish(Error('Receipt read unavailable')); return; }
+        if ((resultCode ?? code) !== 0) { finish(Error('Receipt worker failed')); return; }
+        try {
+          const value = JSON.parse(out);
+          if (!value || !Object.hasOwn(value, 'receipt')) throw Error();
+          const evidence = value.receipt;
+          if (mode === 'binding') {
+            if (evidence !== null && (!evidence?.head || !evidence.files)) throw Error();
+          } else {
+            const states = mode === 'approval' ? ['no-receipt', 'unreadable', 'differs', 'extended', 'matches'] : ['not-run', 'unmeasured', 'unreadable', 'ok'];
+            if (!states.includes(evidence?.state)) throw Error();
+          }
+          finish(null, evidence);
+        } catch { finish(Error('Receipt worker returned invalid evidence')); }
+      });
+    } catch { finish(Error('Receipt worker unavailable')); }
+  });
+  pending.set(key, operation);
+  operation.then(() => pending.delete(key), () => pending.delete(key));
+  return operation;
+}

package/board/packages/board/lib/routes.mjs

@@ -27,12 +27,12 @@ import { status as routerKeyStatus, writeKey as writeRouterKey, verifyKey as ver
 let routerKeyCheck = null;
 import { broadcastTasks } from './sse.mjs';
 import { saveNotifHistory } from './notifications.mjs';
-import { getMemory, getPipeline, getCostHistory, getInbox, inboxElsewhere } from './data-readers.mjs';
+import { getMemory, getPipeline, getCostHistory, getInbox, getInboxAsync, inboxElsewhere } from './data-readers.mjs';
 import { log } from './log.mjs';
-import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
+import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, getTasksAsync, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { agentActivity, agentActivitySince } from './agent-activity.mjs';
-import { issueTokens, checkToken, checkBinding, consumeToken } from './gate-tokens.mjs';
+import { issueTokensAsync, checkToken, checkBinding, consumeToken, approvalSnapshot, beginGateDecision } from './gate-tokens.mjs';
 import { readTurns, turnPatch } from '../../../scripts/lib/turn-snapshot.mjs';
 import { appendEvent } from '../../../scripts/lib/agent-events.mjs';
 
@@ -63,6 +63,7 @@ import { upsertCapability, capabilitiesFromProjectMd } from '../../../scripts/li
 // Moved to scripts/lib so the cross-review Stop hook can ask the same question
 // without importing a server. Re-exported here: this module's callers are unchanged.
 import { secondOpinionForTree } from '../../../scripts/lib/second-opinion-for-tree.mjs';
+import { readApprovalReceipt, readSecondOpinion } from './receipt-read.mjs';
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
 import { getResume, getShareState, toggleShare } from './share.mjs';
 import { listSessions, readSession, editedFiles, searchSessions } from './transcripts.mjs';
@@ -124,6 +125,32 @@ async function dispatch(req, res, url, cwd) {
   const scopedProject = ['/api/skills', '/api/usage', '/api/outcomes'].includes(pathname)
     ? scopedReadProject(cwd, serverCwd, requestedProject) : null;
 
+  // Existing synchronous projections may consume a completed snapshot, but
+  // HTTP cold reads must await async I/O instead of freezing unrelated clients.
+  const taskRead = ['/api/work', '/api/sse', '/api/tasks', '/api/metrics',
+    '/api/memory', '/api/pipeline', '/api/heartbeat', '/api/share', '/api/cost', '/api/resume'].includes(pathname)
+    || /^\/api\/tasks\/[^/]+\/history$/.test(pathname);
+  const unknownWork = pathname === '/api/work' && requestedProject
+    && resolveProjectInfo(requestedProject).resolved === 'fallback';
+  let sseClosed = false;
+  if (pathname === '/api/sse') {
+    // Install lifecycle ownership before the cold snapshot await. Request
+    // 'close' also occurs for normally completed GET bodies; response close
+    // is the actual stream lifetime signal.
+    res.once('close', () => { sseClosed = true; sseClients.delete(res); });
+  }
+  const closedSse = () => pathname === '/api/sse'
+    && (sseClosed || req.aborted || res.destroyed || res.writableEnded);
+  if (req.method === 'GET' && taskRead && !unknownWork) {
+    try { await getTasksAsync(cwd); }
+    catch {
+      if (closedSse()) return true;
+      res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Task snapshot is unavailable; retry', state: 'unreadable' }));
+      return true;
+    }
+  }
+
   if (pathname === '/api/work/publication') {
     const respond = (status, body) => { res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(body)); };
     if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') { respond(404, { error: 'Unknown project' }); return true; }
@@ -222,6 +249,7 @@ async function dispatch(req, res, url, cwd) {
 
   // SSE
   if (pathname === '/api/sse') {
+    if (closedSse()) return true;
     res.writeHead(200, {
       'Content-Type': 'text/event-stream',
       'Cache-Control': 'no-cache',
@@ -229,7 +257,11 @@ async function dispatch(req, res, url, cwd) {
     });
     res._gctoCwd = cwd;  // remember which project this client wants
     sseClients.add(res);
-    res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`);
+    if (getReadDegradation(cwd)) {
+      res.write(`event: task-read-state\ndata: ${JSON.stringify({ ok: false, state: 'unreadable' })}\n\n`);
+    } else {
+      res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`);
+    }
     // ADR-021: the agent activity strip starts from a snapshot, then follows pushes.
     // Phase 2: a client that hands back the cursor of the last frame it saw — the
     // Last-Event-ID header, or ?since= from a page that had to recreate its
@@ -243,7 +275,6 @@ async function dispatch(req, res, url, cwd) {
     }
     res._gctoAgentCursor = a.cursor;
     res.write(`${a.cursor ? `id: ${a.cursor}\n` : ''}event: agent\ndata: ${JSON.stringify(a)}\n\n`);
-    req.on('close', () => sseClients.delete(res));
     return true;
   }
 
@@ -713,12 +744,18 @@ async function dispatch(req, res, url, cwd) {
       // Named outside the serialised block so the wake below can say WHICH gate a
       // human approved; the lookup itself belongs inside the lock.
       let gateTitle = id;
+      const endDecision = beginGateDecision(gateCwd);
+      if (!endDecision) {
+        refuse({ status: 409, outcome: 'refused-busy', why: 'A gate decision is in progress for this project; retry' });
+        return;
+      }
+      try {
 
       // BH-16 fix: serialise gate writes through bd-write queue.
       // Without this, concurrent approve+reject on the same gate produced
       // TWO appendDecisionLog entries (one wrong) — log says approved AND
       // rejected. bdWriteSerialised guarantees one-at-a-time semantics.
-      const result = await bdWriteSerialised(() => {
+      const result = await bdWriteSerialised(async () => {
         const status = action === 'approve' ? 'closed' : 'blocked';
         let via = 'beads';
         // Try beads first (unless there's no store at all); on any bd failure
@@ -761,7 +798,7 @@ async function dispatch(req, res, url, cwd) {
         const projectSlug = parsed.project && !/^[\/~]/.test(parsed.project) ? parsed.project : path.basename(gateCwd);
         let title = id;
         try {
-          const gateTask = getTasks(gateCwd).find((t) => t.id === id);
+          const gateTask = (await getTasksAsync(gateCwd)).find((t) => t.id === id);
           if (gateTask?.title) title = gateTask.title;
         } catch { /* the id is a documented fallback; the record still gets written */ }
         gateTitle = title;
@@ -841,13 +878,21 @@ async function dispatch(req, res, url, cwd) {
             .catch(e => log.warn(`report: republish after gate failed: ${e.message}`));
         }
       }
+      } finally { endDecision(); }
     });
     return true;
   }
 
   // Inbox — what needs your attention right now
   if (pathname === '/api/inbox') {
-    const inbox = getInbox(cwd);
+    const snapshot = approvalSnapshot(cwd);
+    let inbox;
+    try { inbox = await getInboxAsync(cwd); }
+    catch {
+      res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Task snapshot is unavailable; retry', state: 'unreadable' }));
+      return true;
+    }
     // BRD-R3: the Decisions row shows both reviewers. The second opinion is a
     // fact about the TREE, not about a gate — every pending gate on this tree
     // shares it — so it is resolved once: the newest cross-review line whose
@@ -855,23 +900,25 @@ async function dispatch(req, res, url, cwd) {
     // verdict: `not-run` (capability none / undeclared / unavailable),
     // `unmeasured` (declared, no line for this sha), `unreadable` (only
     // pre-join-key lines exist), `ok` (a paired verdict).
-    const second_opinion = secondOpinionForTree(cwd);
+    let second_opinion;
+    try { second_opinion = await readSecondOpinion(cwd); }
+    catch { second_opinion = { state: 'unreadable', why: 'Second opinion evidence is unavailable; retry', verdict: null }; }
     // What is waiting on the person in their OTHER projects. The headline and
     // the badge are about the person, and the person is not scoped to `cwd`.
     // If the registry itself cannot be walked, say so — `unreadable` is not
     // `{p0: 0}`, and the page must not print "nothing elsewhere" from it.
     let elsewhere;
-    try { elsewhere = inboxElsewhere(listProjects(), cwd, { readInbox: getInbox }); }
+    try { elsewhere = inboxElsewhere(listProjects(), cwd); }
     catch (e) { elsewhere = { state: 'unreadable', why: String(e?.message || e) }; }
     // ADR-024 §1: each pending gate carries the token an approval must present,
     // bound to the project as it is now. The typed name stored with it is the one
     // the page asks for; a store that cannot be read issues nothing and says so.
     const gates = inbox.pending_gates || [];
-    const issued = issueTokens(cwd, gates.map((g) => ({
+    const issued = await issueTokensAsync(cwd, gates.map((g) => ({
       id: g.id,
       gate: g.reversibility?.gate ? `gate:${g.reversibility.gate}` : g.id,
       guarded: ['expensive', 'unclassified'].includes(g.reversibility?.state),
-    })));
+    })), { snapshot });
     const pending_gates = gates.map((g) => ({ ...g, token: issued.tokens[g.id] || null }));
     const approval_tokens = { state: issued.state, ...(issued.why ? { why: issued.why } : {}) };
     res.writeHead(200, verdictHeaders(cwd, { 'Content-Type': 'application/json' }));
@@ -890,15 +937,7 @@ async function dispatch(req, res, url, cwd) {
     const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
     let out;
     try {
-      const { latestApproval, treeReceipt, compareReceipts, mergeBase } = await import('../../../scripts/lib/receipt.mjs');
-      const approval = latestApproval(c);
-      if (!approval?.receipt) {
-        out = { state: 'no-receipt', why: 'no approving verdict carries a receipt yet', agent: approval?.agent || null, ts: approval?.ts || null };
-      } else {
-        const current = treeReceipt(c, { base: approval.receipt.base || mergeBase(c) });
-        const cmp = compareReceipts(approval.receipt, current, { cwd: c });
-        out = { ...cmp, agent: approval.agent, ts: approval.ts };
-      }
+      out = await readApprovalReceipt(c);
     } catch (e) {
       // Never "matches" on an error. Not knowing whether the approval still
       // holds is its own state, and calling it a match would put the strongest

package/board/packages/board/lib/share.mjs

@@ -3,7 +3,7 @@ import path from 'path';
 import { GREAT_CTO_DIR, PUBLIC, SHARE_ENDPOINT } from './config.mjs';
 import { readProjectMd } from './projects.mjs';
 import { getMetrics } from './metrics.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasks, getTasksAsync, getReadDegradation } from './beads.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { readDecisionsLog } from './fleet.mjs';
 
@@ -87,8 +87,10 @@ async function toggleShare(enable, cwd = process.cwd(), force = false) {
     // Generate and publish
     // Share report is a marketing artifact — show LIFETIME numbers, not a
     // rolling window. 365 days × 100 = effectively-lifetime cap for any project.
-    const html = generateShareHTML(getTasks(cwd), getMetrics(cwd, 36500), cwd);
     try {
+      const tasks = await getTasksAsync(cwd);
+      if (getReadDegradation(cwd)) return { error: 'Task snapshot is unavailable; report not published' };
+      const html = generateShareHTML(tasks, getMetrics(cwd, 36500, { tasks }), cwd);
       const result = await publishReport(html);
       const newState = { enabled: true, url: result.url, hash: result.hash, published_at: new Date().toISOString() };
       saveShareState(newState, cwd);

package/board/packages/board/lib/sse.mjs

@@ -1,5 +1,6 @@
 import { sseClients } from './state.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasksAsync, getReadDegradation, warmTasksAsync, checkBeadsAvailable } from './beads.mjs';
+import { getPipeline, getInbox } from './data-readers.mjs';
 
 function broadcast(event, data) {
   const msg = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
@@ -8,13 +9,41 @@ function broadcast(event, data) {
   }
 }
 
-function broadcastTasks(cwd) {
-  const msg = `event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`;
-  for (const res of sseClients) {
-    if (res._gctoCwd === cwd) {
+async function broadcastTasks(cwd, { fresh = false, projections = false } = {}) {
+  // A completed write invalidates its cache. Reading it synchronously here
+  // froze every HTTP client even though the write response was already sent.
+  // With no subscriber there is no projection to refresh at all.
+  for (const res of sseClients) if (res.destroyed || res.writableEnded) sseClients.delete(res);
+  const clients = [...sseClients].filter(res => res._gctoCwd === cwd);
+  if (!clients.length) return { ok: true, subscribers: 0 };
+  let msg, result;
+  try {
+    if (fresh && !checkBeadsAvailable(cwd)) {
+      const read = await warmTasksAsync(cwd);
+      if (!read.ok || read.discarded) throw Error('fresh snapshot unavailable');
+    }
+    const tasks = await getTasksAsync(cwd);
+    if (getReadDegradation(cwd)) throw Error('snapshot unavailable');
+    msg = `event: tasks\ndata: ${JSON.stringify(tasks)}\n\n`;
+    if (projections) {
+      // All projections describe the same snapshot, without another Beads read.
+      msg += `event: pipeline\ndata: ${JSON.stringify(getPipeline(cwd, { tasks }))}\n\n`;
+      msg += `event: inbox\ndata: ${JSON.stringify(getInbox(cwd, { tasks }))}\n\n`;
+    }
+    result = { ok: true };
+  } catch {
+    // Preserve the last visible tasks instead of publishing a fabricated [].
+    // Explicit transport state; clients retain the last visible snapshot.
+    result = { ok: false, state: 'unreadable' };
+    msg = `event: task-read-state\ndata: ${JSON.stringify(result)}\n\n`;
+  }
+  for (const res of clients) {
+    // A client may have disconnected or changed project while the read ran.
+    if (sseClients.has(res) && res._gctoCwd === cwd && !res.destroyed && !res.writableEnded) {
       try { res.write(msg); } catch { sseClients.delete(res); }
     }
   }
+  return result;
 }
 
 export { broadcast, broadcastTasks };

package/board/packages/board/lib/watchers.mjs

@@ -3,8 +3,8 @@ import path from 'path';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { sseClients } from './state.mjs';
 import { listProjects } from './projects.mjs';
-import { bdCacheStale, getTasks, isSelfInflictedTouch } from './beads.mjs';
-import { getPipeline, getInbox } from './data-readers.mjs';
+import { bdCacheStale, isSelfInflictedTouch } from './beads.mjs';
+import { broadcastTasks } from './sse.mjs';
 import { agentActivitySince, activityStamp } from './agent-activity.mjs';
 
 // ── File watcher ───────────────────────────────────────────────────────────────
@@ -51,17 +51,9 @@ function watchBeads() {
     if (isSelfInflictedTouch(dir)) return;
     // Stale, not deleted. A change we NOTICED must not make the next reader pay
     // for it — they asked for something else. The broadcast below still reads
-    // fresh, because a stale entry refreshes on read.
+    // fresh, because it explicitly awaits the shared asynchronous refresh.
     bdCacheStale(dir);
-    for (const res of sseClients) {
-      if (res._gctoCwd === dir) {
-        try {
-          res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(dir))}\n\n`);
-          res.write(`event: pipeline\ndata: ${JSON.stringify(getPipeline(dir))}\n\n`);
-          res.write(`event: inbox\ndata: ${JSON.stringify(getInbox(dir))}\n\n`);
-        } catch {}
-      }
-    }
+    void broadcastTasks(dir, { fresh: true, projections: true });
   };
 
   // Debounce per-dir: dolt writes can fire 3-5 events in <50ms during a single
@@ -130,12 +122,9 @@ function watchVerdicts() {
     if (pushTimer) clearTimeout(pushTimer);
     // debounce: collapse a burst of writes (multiple agents finishing within ~150ms)
     pushTimer = setTimeout(() => {
-      for (const res of sseClients) {
-        const dir = res._gctoCwd || process.cwd();
-        try {
-          res.write(`event: pipeline\ndata: ${JSON.stringify(getPipeline(dir))}\n\n`);
-          res.write(`event: inbox\ndata: ${JSON.stringify(getInbox(dir))}\n\n`);
-        } catch { sseClients.delete(res); }
+      const dirs = new Set([...sseClients].map(res => res._gctoCwd || process.cwd()));
+      for (const dir of dirs) {
+        void broadcastTasks(dir, { projections: true });
       }
     }, 150);
   };

package/board/packages/board/public/index.html

@@ -1768,8 +1768,8 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .pl-gate.active .pl-msg, .pl-gate.active .pl-meta { opacity: 1; color: var(--text); }
 .pl-gate .gate-badge {
   margin-left: auto;
-  background: var(--status-blocked); color: var(--on-solid);
-  font-size: var(--fs-eyebrow); font-weight: 700;
+  background: var(--status-blocked); color: var(--on-status);
+  font-size: var(--fs-eyebrow); font-weight: 500;
   min-width: 16px; height: 16px; padding: 0 4px;
   border-radius: 0;
   display: inline-flex; align-items: center; justify-content: center;
@@ -8117,6 +8117,12 @@ function connectSSE() {
   };
   es.addEventListener('tasks', e => {
     const newTasks = JSON.parse(e.data);
+    delete BOARD_DEGRADED['/api/tasks'];
+    renderDegradedBanner('degraded-read', null, '');
+    if (es.readyState === EventSource.OPEN) {
+      document.getElementById('live-dot').className = 'live-dot pulse';
+      document.getElementById('live-label').textContent = 'live · synced just now';
+    }
     // A transient bd failure (dolt lock, timeout) can produce an empty
     // snapshot indistinguishable from "no tasks" (great_cto-e2ew). Don't
     // blindly wipe a populated board — refetch once via the regular API
@@ -8130,6 +8136,20 @@ function connectSSE() {
     }
     applyTasksSnapshot(newTasks);
   });
+  es.addEventListener('task-read-state', e => {
+    try {
+      const state = JSON.parse(e.data);
+      if (state.state !== 'unreadable') return;
+      BOARD_DEGRADED['/api/tasks'] = 'Task snapshot is unavailable. Showing the last loaded tasks.';
+      document.getElementById('live-dot').className = 'live-dot error';
+      document.getElementById('live-label').textContent = 'connected · task data unavailable';
+      // Re-evaluate existing healthy claims as well as adding the banner.
+      // A previously painted "All clear" must not survive a failed refresh.
+      if (window.__inboxData) renderInbox(window.__inboxData);
+      renderDegradedBanner('degraded-read', degradedFor('/api/tasks'),
+        'Project data could not be refreshed. Counts may be out of date.');
+    } catch { /* Malformed transport data must not erase the last snapshot. */ }
+  });
   es.addEventListener('pipeline', e => {
     try {
       const stages = JSON.parse(e.data);
@@ -8165,8 +8185,10 @@ function connectSSE() {
   });
   es.onopen = () => {
     const d = document.getElementById('live-dot');
-    d.className = 'live-dot pulse';
-    document.getElementById('live-label').textContent = 'live · synced just now';
+    const unreadable = degradedFor('/api/tasks');
+    d.className = unreadable ? 'live-dot error' : 'live-dot pulse';
+    document.getElementById('live-label').textContent = unreadable
+      ? 'connected · task data unavailable' : 'live · synced just now';
   };
   es.onerror = () => {
     document.getElementById('live-dot').className = 'live-dot error';

package/board/scripts/lib/receipt.mjs

@@ -88,9 +88,34 @@ const excludeLogs = ACTIVITY_LOGS.map((p) => `:(exclude)${p}`);
  * Returns `null` outside a git repository rather than a fabricated receipt: a
  * receipt that cannot be built must not look like one that matched.
  */
-export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_FILES, verdictsDir = null, exclude = [] } = {}) {
+export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_FILES, verdictsDir = null, exclude = [], hashFilesInProcess = false } = {}) {
   const head = git(['rev-parse', 'HEAD'], cwd)?.trim();
   if (!head) return null;
+  // Off-loop board readers avoid one process per untracked file. Preserve Git's
+  // blob format (including SHA-256 repositories) and --no-filters semantics.
+  const algorithm = hashFilesInProcess ? git(['rev-parse', '--show-object-format'], cwd)?.trim() : null;
+  if (hashFilesInProcess && !['sha1', 'sha256'].includes(algorithm)) return null;
+  const digest = p => {
+    if (!hashFilesInProcess) return fileDigest(cwd, p);
+    try {
+      const fd = fsModule.openSync(join(cwd, p), 'r');
+      try {
+        const before = fsModule.fstatSync(fd, { bigint: true });
+        if (!before.isFile()) return null;
+        const hash = createHash(algorithm).update(`blob ${before.size}\0`);
+        const chunk = Buffer.allocUnsafe(64 * 1024);
+        let remaining = before.size;
+        while (remaining > 0n) {
+          const count = fsModule.readSync(fd, chunk, 0, Number(remaining > BigInt(chunk.length) ? BigInt(chunk.length) : remaining), null);
+          if (!count) return null;
+          hash.update(chunk.subarray(0, count)); remaining -= BigInt(count);
+        }
+        const after = fsModule.fstatSync(fd, { bigint: true });
+        if (after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) return null;
+        return hash.digest('hex');
+      } finally { fsModule.closeSync(fd); }
+    } catch { return null; }
+  };
 
   // Directories a caller does not want in this receipt, ON TOP OF the activity logs.
   // ADR-024: a gate token binds to the project outside .great_cto/, because an
@@ -121,7 +146,9 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
   if (diff === null || untrackedOutput === null) return null;
   const untracked = untrackedOutput
     .split('\n').map((s) => s.trim()).filter(Boolean);
-  const untrackedDigest = untracked.map((p) => `${p}:${fileDigest(cwd, p) ?? '?'}`).join('\n');
+  const untrackedDigests = untracked.map(p => [p, digest(p)]);
+  if (hashFilesInProcess && untrackedDigests.some(([, value]) => !value)) return null;
+  const untrackedDigest = untrackedDigests.map(([p, value]) => `${p}:${value ?? '?'}`).join('\n');
   const dirty = (diff.trim() || untrackedDigest) ? sha(`${diff}\n--untracked--\n${untrackedDigest}`) : null;
 
   // Which files the change touches. `--diff-filter=d` drops deletions: a file
@@ -170,7 +197,7 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
   let truncated = false;
   for (const p of names) {
     if (Object.keys(files).length >= maxFiles) { truncated = true; break; }
-    const blob = fileDigest(cwd, p);
+    const blob = digest(p);
     if (!blob) return null;
     files[p] = blob;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.62.0",
+  "version": "3.62.2",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",