toolroll 0.9.76 → 0.9.78

package/dist/scope.d.ts

@@ -412,6 +412,9 @@ export type Scope = SavedScopeTerms & {
      * carry policy, grant, check access, expiry. Part of the digest when present; a person's seal of them opens the
      * release's authority record. */
     releaseTerms?: ReleaseTerms | null;
+    /** v138 (docs/plans/pipeline-speed.md, P0): a release check's purpose when the release can't carry (no terms) — this
+     * exact candidate is a release's check. Part of the digest when present; never present beside terms. */
+    releaseCheck?: ReleaseCheckPurpose | null;
 };
 /** Who wrote a scope's text, when not a person (approval-policy plan §1.4). */
 export type ScopeAuthor = "mate" | "coordinator" | "scout" | "lead";
@@ -464,6 +467,9 @@ export type ScopeInput = {
     /** v135: release terms (release-carry.ts releaseTermsFor), from the plane's own records. Undefined keeps any terms
      * the scope already carries; null removes them. */
     releaseTerms?: ReleaseTerms | null;
+    /** v138: a release check's purpose (release-carry.ts releaseCheckPurposeFor), from the plane's own records. Undefined
+     * keeps any purpose the scope already carries; null removes it. */
+    releaseCheck?: ReleaseCheckPurpose | null;
     now: Date;
     mutation?: Mutation;
 };
@@ -488,6 +494,8 @@ export declare function digestOf(scope: Pick<Scope, "goal" | "outOfScope" | "tou
     candidate?: string | null;
     /** v135: release terms, folded in only when present. */
     releaseTerms?: ReleaseTerms | null;
+    /** v138: a release check's purpose, folded in only when present. */
+    releaseCheck?: ReleaseCheckPurpose | null;
 }, target?: ExecutionProfile | null | {
     chain: readonly ChainEntry[];
 }, route?: PhaseRoute | null): string;
@@ -864,10 +872,12 @@ export declare function scopeRouteWords(scope: Pick<Scope, "proposedRouteJson">,
 export declare function describeScope(scope: Scope, readiness?: ReadinessLookup): string[];
 /** The approval sheet's release lines (release-once.md): the release in one sentence, then what asks again. */
 export declare function releaseTermsSentence(terms: ReleaseTerms): string;
+/** The approval sheet's line for a release check purpose (pipeline-speed.md, P0): a release that can't carry. */
+export declare function releaseCheckSentence(purpose: ReleaseCheckPurpose): string;
 /** What asks again, in full: the terms behind the sentence. */
 export declare function releaseAsksAgainWords(terms: ReleaseTerms): string[];
 export { personProof } from "./person-proof.js";
-import { type ReleaseTerms } from "./contracts/release-terms.js";
+import { type ReleaseCheckPurpose, type ReleaseTerms } from "./contracts/release-terms.js";
 import { type AutoEvidence, type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export declare const machineActing: () => boolean;
@@ -955,6 +965,14 @@ export declare function mainDebtProblem(store: Store, repo: string, taskId: stri
  * chat it is approved only through the release card.
  */
 export declare function deployGateScope(scope: Pick<Scope, "candidate" | "releaseTerms">): boolean;
+/**
+ * Whether a scope's check is a release's check (docs/plans/pipeline-speed.md, P0): it carries signed release terms, or a
+ * release check purpose sealed with it. Read from the scope's signed fields only, independent of whether the release can
+ * carry. It makes the check stricter (a complete, valid report; CI never stands in for its units) and, through
+ * check-failure.ts recheckReleaseTask, lets the plane rerun the identical candidate after confirmed infrastructure; it
+ * never carries a later commit or approves anything.
+ */
+export declare function releaseCheckScope(scope: Pick<Scope, "releaseTerms" | "releaseCheck"> | null): boolean;
 /**
  * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
  * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly

package/dist/scope.js

@@ -1,5 +1,6 @@
 // The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
+import { mintSecret } from "./secret-mint.js";
 import { passwordlessOn } from "./passwordless.js";
 import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
@@ -47,10 +48,11 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
+import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
-    return randomBytes(32).toString("base64url");
+    return mintSecret(32);
 }
 export function hashToken(token) {
     return createHash("sha256").update(token, "utf8").digest("hex");
@@ -617,6 +619,7 @@ route) {
         ...(scope.qualityMode === "strict" ? { qualityMode: "strict" } : {}),
         ...(scope.candidate ? { candidate: scope.candidate } : {}),
         ...(scope.releaseTerms == null ? {} : { releaseTerms: releaseTermsDigest(scope.releaseTerms) }),
+        ...(scope.releaseCheck == null ? {} : { releaseCheck: releaseCheckPurposeDigest(scope.releaseCheck) }),
         // The single outer key, whichever target produced its inner value:
         // absent => the golden and every profileless approval are untouched;
         // a legacy profile => its exact profileDigestOf; an explicit chain
@@ -670,6 +673,7 @@ function proposeLocked(store, input) {
         ...(input.qualityMode === undefined ? {} : { qualityMode: input.qualityMode }),
         ...(posture === undefined ? {} : { posture }),
         ...(input.releaseTerms === undefined ? {} : { releaseTerms: input.releaseTerms }),
+        ...(input.releaseCheck === undefined ? {} : { releaseCheck: input.releaseCheck }),
         proposedVia,
     });
     // The store may have RECOMPUTED the digest to bind the resolved profile
@@ -1098,6 +1102,10 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const releaseProblem = scope.releaseTerms == null ? null : releaseSealProblem(store, scope.releaseTerms);
         if (releaseProblem !== null)
             return { ok: false, reason: "policy", message: releaseProblem };
+        // Filed while CI still ran: nobody approves it before the plane read exact-head CI passing (round 1, finding 4).
+        const ciHold = releaseCiHoldOf(store, taskId);
+        if (ciHold !== null)
+            return { ok: false, reason: "policy", message: releaseCiHoldWords(ciHold) };
         const gate = store.approvalGate(taskId, by, "person");
         if (gate.verdict === "refuse")
             return { ok: false, reason: gate.reason };
@@ -1259,7 +1267,7 @@ export function scopeAuthorityOf(scope, env = {}) {
     const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
     if (parity !== null)
         return { ok: false, reason: "parity", problem: parity };
-    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null }, profile, route);
+    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null, releaseCheck: scope.releaseCheck ?? null }, profile, route);
     if (digest !== scope.digest) {
         return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
     }
@@ -1319,6 +1327,7 @@ export function describeScope(scope, readiness = NO_READINESS) {
         // Its sandbox terms (project-sandbox.ts), part of what the yes agrees to: what it reads, and any widening.
         ...(scope.profile === null || scope.profile === undefined ? [] : ((terms) => [`  reads        ${terms.reads}`, ...(terms.mach === null ? [] : [`  services     ${terms.mach}`])])(sandboxTermsWords(scope.profile))),
         ...releaseTermsWords(scope.releaseTerms ?? null),
+        ...(scope.releaseCheck == null ? [] : [`  release      ${releaseCheckSentence(scope.releaseCheck)}`]),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];
@@ -1330,6 +1339,10 @@ export function releaseTermsSentence(terms) {
     const outside = terms.access === "sandboxed" ? "" : " This project's checks don't run in the sandbox: those later test-only commits will run outside the sandbox without being shown to you first.";
     return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Later commits on this pull request that only change tests, docs or the changelog ship without asking you again, until it merges or for 3 days. You'll see each one in the release summary.${outside}`;
 }
+/** The approval sheet's line for a release check purpose (pipeline-speed.md, P0): a release that can't carry. */
+export function releaseCheckSentence(purpose) {
+    return `Release ${purpose.packageVersion} from pull request #${purpose.pr} at ${purpose.approvedSha.slice(0, 7)}. Every later commit asks for your approval again. If Toolroll's own machine fails during the check, it reruns this same commit's check (at most twice).`;
+}
 /** What asks again, in full: the terms behind the sentence. */
 export function releaseAsksAgainWords(terms) {
     const p = terms.policy;
@@ -1358,7 +1371,7 @@ function describeApproval(approval) {
 // ---- Only a person approves (docs/plans/approval-policy.md, phase 1). Kept last: the freshness tripwire pins places.
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
-import { releaseTermsDigest } from "./contracts/release-terms.js";
+import { releaseCheckPurposeDigest, releaseTermsDigest } from "./contracts/release-terms.js";
 import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
@@ -1542,6 +1555,16 @@ export function mainDebtProblem(store, repo, taskId) {
 export function deployGateScope(scope) {
     return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
 }
+/**
+ * Whether a scope's check is a release's check (docs/plans/pipeline-speed.md, P0): it carries signed release terms, or a
+ * release check purpose sealed with it. Read from the scope's signed fields only, independent of whether the release can
+ * carry. It makes the check stricter (a complete, valid report; CI never stands in for its units) and, through
+ * check-failure.ts recheckReleaseTask, lets the plane rerun the identical candidate after confirmed infrastructure; it
+ * never carries a later commit or approves anything.
+ */
+export function releaseCheckScope(scope) {
+    return scope !== null && ((scope.releaseTerms ?? null) !== null || (scope.releaseCheck ?? null) !== null);
+}
 /**
  * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
  * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly

package/dist/scout.js

@@ -21,7 +21,7 @@ import { run } from "./exec.js";
 import { checkoutGit } from "./teardown-git.js";
 import { auditOf } from "./provider.js";
 import { currentClaim, heartbeat } from "./claim.js";
-import { heartbeat as runnerHeartbeat } from "./runner.js";
+import { heartbeat as runnerHeartbeat, RUNNER_HEARTBEAT_MS } from "./runner.js";
 import { parseDecision } from "./decision.js";
 import { scoutHandbackSchema } from "./contracts/scout-report.js";
 import { parseReport, REPORT_IMAGE_FILE, REPORT_LIMITS, REPORT_VERSION, SCOUT_OUTPUT_JSON_SCHEMA } from "./scout-report.js";
@@ -43,7 +43,7 @@ const GIT = "git";
 const AGENT_ENV_DENYLIST = [...TELEGRAM_TOKEN_ENVS];
 const DEFAULT_SCOUT_TIMEOUT_MS = 20 * 60_000;
 const DEFAULT_SCOUT_TURNS = CLAUDE_LIMITS.maxTurns;
-const DEFAULT_PULSE_MS = 60_000;
+const DEFAULT_PULSE_MS = RUNNER_HEARTBEAT_MS;
 /** The scout's own headless browser: the pinned Playwright tool, saving its
  * screenshots straight into the run's image folder. */
 export const SCOUT_BROWSER = "toolroll-browser";

package/dist/secret-mint.d.ts

@@ -0,0 +1 @@
+export declare function mintSecret(bytes: number, draw?: (size: number) => Buffer): string;

package/dist/secret-mint.js

@@ -0,0 +1,14 @@
+/**
+ * Secrets a person types or pastes on a command line (passwords, invite and approver tokens, runner credentials):
+ * random base64url, never starting with "-". A value starting with "--" reads as a flag to many parsers (`--token
+ * --abc…` was refused as a missing value: about 1 in 4096 minted passwords), so it is drawn again. The CLI accepts one
+ * anyway (an older secret), but a new one never needs that.
+ */
+import { randomBytes } from "node:crypto";
+export function mintSecret(bytes, draw = randomBytes) {
+    for (;;) {
+        const secret = draw(bytes).toString("base64url");
+        if (!secret.startsWith("-"))
+            return secret;
+    }
+}

package/dist/serve.js

@@ -14,19 +14,15 @@ import { signInsUnavailableWords } from "./check-access.js";
 import { LIVE_VIEW_CONSENT, liveCommandsShown, liveViewConsentDigest } from "./live-detail.js";
 import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
-import { NO_COUNTS, projectStates, STATE_WORDS } from './agent-state.js';
+import { accessKey, countsKey, indexKey, projectSummaryOf, RevisionCache, summaryKey } from './console-chrome.js';
 import { usageChipOf } from './limits-ui.js';
-/** Tasks the rail lists under a project; the rest are a count that links to the project's tasks. */
-const RAIL_TASKS = 6;
 /** Any header a proxy adds: a request carrying one is never "from this computer" (password freshness, one-time links). */
 const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
-/** Asks a project names for the chime (its count is complete beyond them). */
-const ASKS_PER_PROJECT = 100;
 /** How often the background checks look at what is due (docs/plans/get-side-effects.md), and how often this
  * computer's agent sign-ins are asked again. */
 const BACKGROUND_CHECKS_MS = 30_000;
 const LOCAL_AGENTS_EVERY_MS = 2 * 60_000;
-import { boundProjectSummary, browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
+import { browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
 import { sharedActionPayload } from './chat-actions.js';
 import { prepareCodingContext } from './coding-context.js';
 import { CodingWorkspace } from './coding-workspace.js';
@@ -104,6 +100,7 @@ import { prepareWorkspaceRevision, WorkspaceValidatorCache } from "./workspace-r
  * repo, only runs whose task belongs to that repo (or to no repo yet).
  */
 import { createHash, randomBytes } from "node:crypto";
+import { keepSlowRequest, Timeline } from "./latency-timeline.js";
 import { readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { homedir, hostname } from "node:os";
@@ -255,6 +252,9 @@ export function createDecisionServer(options) {
         };
     };
     const workspaceRevision = prepareWorkspaceRevision(store);
+    // The sidebar, the Tasks count and the crew: read at most once per workspace revision per reader's exact access
+    // (console-chrome.ts), and filled from a read worker before a page renders when one is attached.
+    const chromeReads = new RevisionCache(workspaceRevision, clock);
     const workspaceIncarnation = randomBytes(16).toString('hex');
     const workspaceValidators = new WorkspaceValidatorCache();
     const providerHome = options.connectionHome ?? homedir();
@@ -776,6 +776,9 @@ export function createDecisionServer(options) {
         // uses the address it reached), reads one row, and says nothing else about the installation.
         const method = request.method ?? "GET";
         const matchedRoute = matchRoute(method, hook.pathname);
+        // Where a slow answer's time went (latency-timeline.ts): milestones by route id only, kept when it took a second.
+        const timeline = new Timeline();
+        timeline.mark("route matched");
         const edgeRoute = matchedRoute?.stage === 'edge' ? matchedRoute : null;
         const wrongMethodEdge = edgeRoute === null ? ROUTES.find(row => row.stage === 'edge' && new RegExp(row.pattern).test(hook.pathname)) ?? null : null;
         // D7: a password on a request still signs in this release, announced on every answer and named in every refusal;
@@ -838,6 +841,7 @@ export function createDecisionServer(options) {
             return;
         const refusedToken = {};
         const who = identify(request, touch, edgeRoute?.domain === 'live', refusedToken);
+        timeline.mark("signed in");
         if (refusedToken.principal !== undefined) {
             if (refuseBudget(requestBudget.admit(refusedToken.principal.tokenId, "api")))
                 return;
@@ -881,8 +885,12 @@ export function createDecisionServer(options) {
                 get fresh() { return freshFacts.getStore() != null && ssoNowAvailable(who.name); } } : undefined,
             refusal: (answer, status, body) => sendScreen(answer, status, screen(status === 404 ? "Not found" : "Request refused", body, { chrome: chromeFor(who.via === "cookie" ? who.session.project : null, "work") })),
             workspaceRead,
+            freshWork: ["request", "task", "result"].some(name => url.searchParams.has(name)),
+            ...(workspaceRead && typeof request.headers['if-none-match'] === 'string' ? { workspaceIfNoneMatch: request.headers['if-none-match'] } : {}),
             workspaceRequest: url.searchParams.get('request'),
+            timeline,
         };
+        response.once("finish", () => keepSlowRequest(store, timeline, matchedRoute?.id ?? "unmatched", response.statusCode, clock()));
         if (method === "GET" || method === "POST")
             return freshFacts.run(fresh, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
                 if (edgeRoute?.domain === 'live')
@@ -935,6 +943,17 @@ export function createDecisionServer(options) {
                             facts.workspaceValidator = { key, revision, expiresAt,
                                 etag: '"' + createHash('sha256').update(`${key}:${revision}:${expiresAt}`).digest('hex') + '"' };
                         }
+                        await prefetchChrome(route, url, who);
+                        timeline.mark("chrome and worker reads");
+                        // The worker wait lets a sign-out, credential/access change or console ceiling change land. Prove the
+                        // cookie and route again before rendering protected content or answering with a content validator.
+                        if (who.via === 'cookie') {
+                            const current = identify(request, false);
+                            if (current?.via !== 'cookie' || current.session !== who.session)
+                                return redirect(response, loginHref(url.pathname + url.search));
+                            if (!projectRequestAllowed(route, route.project, url, who, request, response, null))
+                                return;
+                        }
                         return handleGet(route, url, who, request, response);
                     }
                     return handlePost(route, url, who, request, response, body);
@@ -1443,6 +1462,7 @@ export function createDecisionServer(options) {
      * are what sensitivity strips.
      */
     function sendScreen(response, status, s) {
+        requestContext.getStore()?.timeline?.mark("handler done; rendering");
         // Sensitivity is the page as authored (cockpit §2, R14): its own explicit word, else a password field it was written
         // with — judged before an identity-provider sign-in replaces that field, so an SSO step-up page stays sensitive.
         const authored = s.sensitive ?? (s.forceSensitive === true ||
@@ -1475,12 +1495,17 @@ export function createDecisionServer(options) {
                 notices.push(s.chrome.modeBanner.words);
             if (s.chrome.updateWaiting)
                 notices.push(s.chrome.updateWaiting.words);
+            if (options.draining?.() === true)
+                notices.push('Toolroll is restarting (draining). Saved work is kept; new builds start once it is back.');
             let crew = { crew: [], crewTruncated: false };
             try {
                 const project = s.chrome.active === 'chat' ? null : s.chrome.project;
                 crew = extras.team?.tasks ? browserCrewFromIndex(extras.team.tasks, extras.team.selected?.id) : requestFacts.workCrew?.project === project ? browserCrewFromIndex(requestFacts.workCrew.page)
                     // The reader's own lead's claims read "<name> is on it" here too.
-                    : browserCrewOf(store, clock(), { principal: 'operator', repos: managedRepos(), includeUnplaced: false, viewer: requestFacts.actor ?? null }, { evidenceRoot, project });
+                    : (() => {
+                        const access = { principal: 'operator', repos: managedRepos(), includeUnplaced: false, viewer: requestFacts.actor ?? null };
+                        return chromeRead(`crew\u0000${accessKey(access)}\u0000${project ?? ''}`, () => browserCrewOf(store, clock(), access, { evidenceRoot, project }));
+                    })();
             }
             catch {
                 notices.push('Crew updates are unavailable. Open Tasks to inspect saved work.');
@@ -1586,7 +1611,17 @@ export function createDecisionServer(options) {
                     workspaceValidators.set(validator.key, validator);
                     response.setHeader('ETag', validator.etag);
                 }
-                return respond(response, status, 'application/json; charset=utf-8', JSON.stringify(workspace));
+                const body = JSON.stringify(workspace);
+                // Every other page's re-read after a live `change` (chat keeps its own validator, and its receipt, task and
+                // result reads none): when what it renders now is exactly what the page holds, it hears 304 and keeps its view
+                // (no transfer, no re-render).
+                if (status === 200 && validator === undefined && path.pathname !== '/chat') {
+                    const etag = '"w' + createHash('sha256').update(body).digest('base64url') + '"';
+                    response.setHeader('ETag', etag);
+                    if (requestFacts.workspaceIfNoneMatch === etag)
+                        return respond(response, 304, 'application/json; charset=utf-8', '');
+                }
+                return respond(response, status, 'application/json; charset=utf-8', body);
             }
             const nonce = randomBytes(16).toString('base64');
             // React owns the conversation and its refresh/draft lifecycle. Native
@@ -1623,8 +1658,9 @@ export function createDecisionServer(options) {
         return page(response, status, document, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
     /** The needs-you count every surface wears, read from this request's own
-     * Work counts (one query per request, never a cached earlier one), so a
-     * live page's badge and its Needs you tab always agree. */
+     * Work counts (one read per request, kept only while the workspace revision
+     * it was read at stands), so a live page's badge and its Needs you tab
+     * always agree. */
     function needsYouBadge(project) {
         return needsYouCount(project);
     }
@@ -1653,44 +1689,8 @@ export function createDecisionServer(options) {
     function projectSummary() {
         const projects = sidebarProjects();
         const actor = requestContext.getStore()?.actor ?? '';
-        const states = new Map(projectStates(store, workAccess(), actor, clock(), evidenceRoot, projects.map(one => one.path)).map(one => [one.repo, one]));
-        // A row that needs a person or failed says what the Tasks list says it needs (its own next step); a row at work says
-        // what its agent did last; a finished one says Done.
-        const asking = [...states.values()].flatMap(one => one.families.slice(0, RAIL_TASKS)).filter(one => one.state === 'needs-you' || one.state === 'failed').map(one => one.rootId);
-        const needWords = new Map();
-        if (asking.length > 0) {
-            try {
-                // Every row the rail may list, in pages the index allows.
-                for (let at = 0; at < asking.length; at += WORK_INDEX_MAX_LIMIT)
-                    for (const item of workIndexPage(store, clock(), workAccess(), { roots: asking.slice(at, at + WORK_INDEX_MAX_LIMIT), limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot }).items)
-                        needWords.set(item.rootId, item.status.detail !== '' ? item.status.detail : item.status.label);
-            }
-            catch { /* the rows keep their state's words */ }
-        }
-        // The chime's subjects: an opaque key per obligation and version, scoped to this reader (no words, no ids in it).
-        const keyOf = (...parts) => createHash('sha256').update([actor, ...parts].join('\u0000')).digest('base64url').slice(0, 22);
-        // Newest first, so a new ask always has a key however many older ones wait (those were heard when they were new).
-        const asksOf = (state) => [
-            ...(state?.families ?? []).flatMap(one => one.ask === undefined ? [] : [{ at: one.ask.at, ask: { key: keyOf('task', one.rootId, one.ask.version), task: one.rootId, run: one.ask.run, at: one.ask.at } }]),
-            ...(state?.flowAsks ?? []).map(one => ({ at: one.at, ask: { key: keyOf('flow', one.card, one.stage, one.entry), task: null, run: null, at: one.at } })),
-        ].sort((a, b) => b.at.localeCompare(a.at)).slice(0, ASKS_PER_PROJECT).map(one => one.ask);
-        const railOf = (state) => {
-            const families = state?.families ?? [];
-            const tasks = families.slice(0, RAIL_TASKS).flatMap((one) => {
-                const task = store.getTask(one.rootId);
-                const line = one.state === 'needs-you' || one.state === 'failed' ? needWords.get(one.rootId) ?? null : one.line;
-                return task === null ? [] : [{ id: one.rootId, title: task.title, href: `/t/${encodeURIComponent(one.rootId)}`, state: one.state, line: line ?? STATE_WORDS[one.state] }];
-            });
-            return { tasks, more: Math.max(0, families.length - RAIL_TASKS), asks: asksOf(state) };
-        };
-        const rows = projects.map(one => {
-            const state = states.get(one.path);
-            return { path: one.path, name: one.name, href: `/work?project=${encodeURIComponent(one.path)}`, state: state?.state ?? 'idle', counts: state?.counts ?? { ...NO_COUNTS }, ...railOf(state) };
-        });
-        const unplaced = states.get(null);
-        if (unplaced !== undefined && unplaced.state !== 'idle')
-            rows.push({ path: null, name: 'No project', href: '/work', state: unplaced.state, counts: unplaced.counts, ...railOf(unplaced) });
-        return boundProjectSummary(rows);
+        const access = workAccess();
+        return chromeRead(summaryKey(actor, access, projects), () => projectSummaryOf(store, clock(), access, actor, projects, evidenceRoot));
     }
     /** What one account may see now, as the summary room keys it: a narrowed ceiling or grant is a different key, so a
      * snapshot read for the wider scope never reaches it. Null: no such account. */
@@ -1777,13 +1777,15 @@ export function createDecisionServer(options) {
             ...(scope === undefined ? {} : { scope }),
         };
     }
-    // All project counts are read together. No task artifacts or processes are
-    // inspected to paint a badge or a project switcher.
+    // All project counts are read together, at most once per workspace revision
+    // for this reader's access. No task artifacts or processes are inspected to
+    // paint a badge or a project switcher.
     function projectCounts(now) {
         const facts = requestContext.getStore();
         if (facts?.workCounts !== undefined)
             return facts.workCounts;
-        const counts = workCountsByProject(store, now, workAccess());
+        const access = workAccess();
+        const counts = chromeRead(countsKey(access), () => workCountsByProject(store, now, access));
         if (facts !== undefined)
             facts.workCounts = counts;
         return counts;
@@ -1793,6 +1795,64 @@ export function createDecisionServer(options) {
             .reduce((sum, one) => sum + one.totals['needs-you'], 0);
         return { count, saturated: false };
     }
+    /** One work index page for an already-admitted reader, through the chrome cache: a whole view the chat landing reads
+     * on every refresh. */
+    function sharedIndexPage(access, options) {
+        // Receipt reconciliation, task and result reads always read work afresh (disk state included).
+        if (requestContext.getStore()?.freshWork === true)
+            return workIndexPage(store, clock(), access, options);
+        return chromeRead(indexKey(access, options), () => workIndexPage(store, clock(), access, options));
+    }
+    /** A chrome read for this request: what it already read (its prefetch included) stands for the whole request, else
+     * the revision cache's value, else `compute()` now. */
+    function chromeRead(key, compute) {
+        const facts = requestContext.getStore();
+        const held = facts?.chromeReads?.get(key);
+        if (held !== undefined)
+            return held;
+        const value = chromeReads.read(key, compute);
+        if (facts !== undefined)
+            (facts.chromeReads ??= new Map()).set(key, value);
+        return value;
+    }
+    /** The chat landing's three whole views (chat.ts chatHomeOf), as it asks for them. */
+    const chatHomeViews = () => ["all", "needs-you", "completed"]
+        .map(view => ({ view, limit: WORK_INDEX_MAX_LIMIT, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) }));
+    /** Pages that wear the chrome (the sidebar's states and the Tasks count). */
+    const CHROME_PAGES = new Set(["home", "work", "board", "agents", "agents.live", "task.page", "run.page", "chat.page", "review", "tasks", "inbox",
+        "next", "done", "projects.page", "flows.page", "flow.page", "settings.page", "decision.page", "menu"]);
+    /** Before a chromed page renders: its chrome reads (and the chat landing's views) run on a read worker, so the
+     * request thread finds them cached instead of computing them. The reader is the one this request admitted; the keys
+     * carry its exact access (console-chrome.ts). Without a worker, or when one fails, the page computes them as before. */
+    async function prefetchChrome(route, url, who) {
+        if (reads === null || who.via !== "cookie" || !CHROME_PAGES.has(route.id))
+            return;
+        try {
+            const actor = requestContext.getStore()?.actor ?? "";
+            const access = workAccess(), projects = sidebarProjects(), now = clock();
+            // Populate only the revision cache. Each answer must still pass its revision/expiry check when rendering:
+            // another job can remain pending while an earlier answer's approval or Needs-you state changes.
+            const fill = async (key, read) => { await chromeReads.fill(key, read); };
+            const jobs = [
+                fill(countsKey(access), () => reads.workCounts(now, access)),
+                fill(summaryKey(actor, access, projects), () => reads.projectSummary(now, access, actor, projects, evidenceRoot)),
+            ];
+            if (route.id === "chat.page") {
+                if (!["project", "room", "team"].some(name => url.searchParams.has(name)) && requestContext.getStore()?.freshWork !== true)
+                    for (const options of chatHomeViews())
+                        jobs.push(fill(indexKey(access, options), () => reads.workIndexPage(now, access, options)));
+                // The conversation's briefing (chat.ts: the fleet snapshot's states), read as chat reads it.
+                const repos = managedRepos();
+                if (repos.length > 0 && requestContext.getStore()?.freshWork !== true) {
+                    const fleet = { principal: "operator", repos, includeUnplaced: false, viewer: who.name };
+                    const options = { limit: 100, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) };
+                    jobs.push(fill(indexKey(fleet, options), () => reads.workIndexPage(now, fleet, options)));
+                }
+            }
+            await Promise.all(jobs);
+        }
+        catch { /* the page computes what is missing */ }
+    }
     /** A live page's own beat without a docked chat: 10 s while any admitted task is building, else 30 s. */
     function liveRefreshSeconds() {
         return projectCounts(clock()).some(one => one.totals.running > 0) ? 10 : 30;
@@ -2073,6 +2133,7 @@ export function createDecisionServer(options) {
         get projectFamilyPeek() { return projectFamilyPeek; },
         get needsYouBadge() { return needsYouBadge; },
         get liveRefreshSeconds() { return liveRefreshSeconds; },
+        get sharedIndexPage() { return sharedIndexPage; },
         get chatKeyFor() { return chatKeyFor; },
         get chatCatalog() { return chatCatalog; },
         get chatCatalogKnown() { return chatCatalogKnown; },

package/dist/server/chat.js

@@ -44,7 +44,7 @@ import {} from "./render-pages.js";
 import { completionForm, hardBlockerOf, homePhaseWords, owedAcceptanceOf, resultPanelHtml } from "./render-results.js";
 import { browserCaller, oneLineUa } from "./session.js";
 export function createChatHandlers(runtime) {
-    const { firstRunStepsNow, managedRepos, leadWords, store, options, phoneSetup, visible, liveTurns, leadSaid, evidenceRoot, clock, sessions, CHAT_CANDIDATE_TTL_MS, chatFetcher, CHAT_CANDIDATES_PER_APPROVER, chatCeilingDigest, workAccess, familyOf, firstTasks, leadPrincipal, taskChatFocus, chatScopeOf, leadConversationRows, demoLeadHere, sendScreen, chromeFor, teamBrowserReply, team, teamChatProvider, runVisible, runIsLive, resultDetailOf, pullRequestTargetOf, chatEnablement, startLeadConversation, projectFamilyPeek, needsYouBadge, liveRefreshSeconds, chatKeyFor, chatCatalog, chatCatalogKnown, providerHome, mintApprovalNonce, checkLocalAgents, agentSignInCommand, bustBadge, authenticateApprover, revisionDestination, armTaskResume, consumeApprovalNonce } = runtime;
+    const { firstRunStepsNow, managedRepos, leadWords, store, options, phoneSetup, visible, liveTurns, leadSaid, evidenceRoot, clock, sessions, CHAT_CANDIDATE_TTL_MS, chatFetcher, CHAT_CANDIDATES_PER_APPROVER, chatCeilingDigest, workAccess, familyOf, firstTasks, leadPrincipal, taskChatFocus, chatScopeOf, leadConversationRows, demoLeadHere, sendScreen, chromeFor, teamBrowserReply, team, teamChatProvider, runVisible, runIsLive, resultDetailOf, pullRequestTargetOf, chatEnablement, sharedIndexPage, startLeadConversation, projectFamilyPeek, needsYouBadge, liveRefreshSeconds, chatKeyFor, chatCatalog, chatCatalogKnown, providerHome, mintApprovalNonce, checkLocalAgents, agentSignInCommand, bustBadge, authenticateApprover, revisionDestination, armTaskResume, consumeApprovalNonce } = runtime;
     // The read-only refresh (package 2): the same JSON status as before —
     // session binding, the send receipt, the live turn — plus a version
     // of the DISPLAYED facts and, only when the caller's version differs,
@@ -273,7 +273,7 @@ export function createChatHandlers(runtime) {
         if (repos.length > 0) {
             try {
                 fleetSnapshot = store.chatSnapshot(repos, now);
-                const summaries = workIndexPage(store, now, { principal: 'operator', repos, includeUnplaced: false, viewer: who.name }, { limit: 100, root: evidenceRoot }).items;
+                const summaries = sharedIndexPage({ principal: 'operator', repos, includeUnplaced: false, viewer: who.name }, { limit: 100, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) }).items;
                 fleetSnapshot.assignmentStates = Object.fromEntries(summaries.flatMap(value => [value.rootId, value.activeTaskId].map(id => [id, { state: value.assignmentState, label: value.status.label, detail: value.status.detail }])));
                 fleetSnapshot.attentionCount = needsYouBadge(null);
             }
@@ -1452,9 +1452,9 @@ export function createChatHandlers(runtime) {
                 agent: `${providerName(run.provider)} on ${run.runner}`, phase: homePhaseWords(run), project: run.repo === null ? null : projectName(run.repo), since: run.startedAt,
                 activity: runActivityOf(store, run, now) };
         });
-        const all = workIndexPage(store, now, access, { view: "all", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
-        const needs = workIndexPage(store, now, access, { view: "needs-you", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
-        const done = workIndexPage(store, now, access, { view: "completed", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
+        // The three whole views, read at most once per workspace revision (and on a read worker first when one is attached).
+        const view = (name) => sharedIndexPage(access, { view: name, limit: WORK_INDEX_MAX_LIMIT, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) });
+        const all = view("all"), needs = view("needs-you"), done = view("completed");
         const weekAgo = new Date(now.getTime() - 7 * 86_400_000).toISOString();
         const counts = [
             { key: "working", label: "Working now", value: agents.length, href: "/work?view=running" },

package/dist/server/http.d.ts

@@ -148,6 +148,8 @@ export type ServeOptions = {
     ssoFetch?: typeof fetch;
     /** Cockpit B1: this `up` console's instance secret (null: none — the instance route answers 404). */
     instanceSecret?: () => string | null;
+    /** v137: whether this console is draining (its `up` is stopping): /healthz says so at once, and pages say Toolroll is restarting. */
+    draining?: () => boolean;
     /** Cockpit E: how Finder is asked to reveal a proved checkout (tests pass their own; never a launch). True: shown. */
     revealPath?: (path: string) => Promise<boolean> | boolean;
     chatEnv?: Record<string, string | undefined>;

package/dist/server/pages.js

@@ -43,6 +43,7 @@ import { healthWords } from "../server-telemetry.js";
 import { tally } from "../summary.js";
 import { serveInstallAsset } from "./pages-assets.js";
 import { healthz } from "./remote-hooks.js";
+import { slowRequestLines, SLOW_REQUEST_MS } from "../latency-timeline.js";
 import { leadsStillAdmitted, leadTilesFor } from './agents-live-lead.js';
 import { refuse, regionScript, screen, settingsRows, WORKSPACE_STYLE, workToolRows } from "./chrome.js";
 import { redirect, respond, safeReturn, SAFETY, taskHref } from "./http.js";
@@ -627,9 +628,12 @@ export function createPagesHandlers(runtime) {
     async function health(ctx) {
         const { request, response } = ctx;
         const health = store.telemetry.snapshot();
+        // Beside /healthz, for an instance operator: where the slowest recent console answers spent their time (route ids
+        // and milestones only).
+        const slow = slowRequestLines(store);
         return request.headers.accept?.includes('application/json')
-            ? respond(response, 200, 'application/json; charset=utf-8', JSON.stringify(health))
-            : respond(response, 200, 'text/plain; charset=utf-8', `${healthWords(health)}\n`);
+            ? respond(response, 200, 'application/json; charset=utf-8', JSON.stringify({ ...health, slowRequests: slow }))
+            : respond(response, 200, 'text/plain; charset=utf-8', `${healthWords(health)}\n${slow.length === 0 ? "" : `\nSlow console requests (over ${SLOW_REQUEST_MS} ms), newest first:\n${slow.join("\n")}\n`}`);
     }
     // v104: Prometheus metrics, for an instance operator (a scraper sends one's API token).
     async function metrics(ctx) {
@@ -984,7 +988,7 @@ export function createPagesHandlers(runtime) {
     }
     async function healthzEdge(ctx) {
         const { response, method } = ctx;
-        return healthz(store, response, method === 'HEAD');
+        return healthz(store, response, method === 'HEAD', options.draining?.() === true);
     }
     async function browserAsset(ctx) {
         const { request, response, url } = ctx;

package/dist/server/remote-hooks.d.ts

@@ -26,4 +26,4 @@ export declare function telegramHook(ctx: RemoteHookContext, request: IncomingMe
 export declare function flowHook(ctx: RemoteHookContext, request: IncomingMessage, response: ServerResponse, url: URL): Promise<void>;
 /** A shared button as a public form (v84): its questions, and one card per submission. No sign-in, no session, nothing about the flow shown. */
 export declare function flowForm(ctx: RemoteHookContext, request: IncomingMessage, response: ServerResponse, url: URL): Promise<void>;
-export declare function healthz(store: Store, response: ServerResponse, head: boolean): void;
+export declare function healthz(store: Store, response: ServerResponse, head: boolean, draining?: boolean): void;

package/dist/server/remote-hooks.js

@@ -122,7 +122,7 @@ export async function flowForm(ctx, request, response, url) {
         return page({ status: 500, html: "" });
     }
 }
-export function healthz(store, response, head) {
+export function healthz(store, response, head, draining = false) {
     let healthy = true;
     try {
         store.handle.prepare("SELECT 1 FROM schema_version").get();
@@ -130,7 +130,9 @@ export function healthz(store, response, head) {
     catch {
         healthy = false;
     }
-    const body = JSON.stringify({ status: healthy ? "ok" : "unavailable" });
-    response.writeHead(healthy ? 200 : 503, { "content-type": "application/json", "cache-control": "no-store", "x-content-type-options": "nosniff" });
+    // A draining console (its `up` is stopping) still answers pages, but says so here at once: a probe moves on instead
+    // of waiting for it to disappear.
+    const body = JSON.stringify(draining && healthy ? { status: "draining", message: "Toolroll is restarting (draining)" } : { status: healthy ? "ok" : "unavailable" });
+    response.writeHead(healthy && !draining ? 200 : 503, { "content-type": "application/json", "cache-control": "no-store", "x-content-type-options": "nosniff" });
     response.end(head ? undefined : body);
 }

package/dist/server/render-results.d.ts

@@ -185,6 +185,8 @@ export type ReviewCockpitView = {
     efficiency?: RunEfficiency | null;
     /** What the run's network was and what its proxy saw (egress.ts): display only. */
     network?: RunNetworkRecord | null;
+    /** Where the time went (latency-timeline.ts): its release check's parts and the task's deploys, display only. */
+    timing?: import("../latency-timeline.js").TimingView | null;
     /** How far its checks reached (check-access.ts): shown only when wider than sandboxed. */
     checkAccess?: CheckAccess;
     taskId: string;

package/dist/server/render-results.js

@@ -625,6 +625,7 @@ export function reviewCockpitDetailParts(view, csrf, noted, canRetryReview, tab,
         notes: view.notes.map(one => ({ author: one.author, at: one.createdAt, note: one.note })),
         efficiency: view.efficiency ?? null,
         network: view.network ?? null,
+        timing: view.timing ?? null,
         acts: { primary: null, secondary: null, line: null }, runChecks: null, mismatch: null,
         // The raw run record lives under Details now (2026-10-02): /r/<id> for this result redirects here.
         record: run === null ? null : { build: run.id, href: `/r/${run.id}?record=1`, facts: [

package/dist/server/render-tasks.d.ts

@@ -533,6 +533,8 @@ export declare function taskBodyParts(data: {
         kind: "checking" | "approved";
         candidate: string;
     } | null;
+    /** A release task filed while its pull request's CI still runs (a person may approve now; nothing deploys before CI passes). */
+    releaseCiRunning?: boolean;
     /** One approval per release (release-once.md): the release this task belongs to, and whether this reader may stop it. */
     release?: ReleaseView | null;
     canStopRelease?: boolean;