[ufna]

Event data plane M4 (epic zerus-604d, task zerus-604d.4). Stacked on #368 (M3), which is stacked on #367 (M1). The M4 change is the last commit.

What changes

• EventStream (tray/src/EventStream.{h,cpp}) runs one hgs [@host] watch --json per computer whose CLI prints Event stream ABI: watch-v1. The child, NDJSON framing, JSON parsing and the per-computer catalog and Activity store live on the stream's own thread. The GUI thread receives the same BoxState a listing poll delivers and inspect-shaped Activity increments (summary + new events + cursor, or replace_events after a gap), so onLocalReady/onPeerReady/acceptInspection are unchanged.
• TrayAgent owns the EventStreams hub (local plus every known peer). Periodic listing polls skip a computer while its stream is live. Write-triggered refreshes still poll once.
• SessionsWindow follows the selected session's Activity through its computer's live stream. Only the Processes section is still polled, at its existing interval (2.5 s on the tab, 30 s otherwise). A run whose subscription ends (subscription_ended/session_changed) goes back to polling.
• Cadence: Activity within 50 ms. Listings are applied at most every 2 s, because applying one still rebuilds on the GUI thread (about 150 ms on the Mac) until M2. An unchanged listing is re-applied every 10 s, because automatic approvals need a peer listed within 30 s and 3 minutes mean stale.
• Fallback: a missing marker means Unsupported, which polls and rechecks after 10 minutes. A failed or 30 s silent stream restarts after 5 s, 15 s, 60 s and then every 5 minutes, polling meanwhile. Frames prepared just before a failure are dropped. ZERUS_EVENT_STREAM=0 or dataPlane/eventStream=false opts out.
• Documented in docs/reference.md (Event stream) and the design spec.

Verification (arch)

• test_eventstream (8 cases, 3 consecutive passing runs): listing order and host, a peer keeps its alias, Activity increments with cursor, deltas with removals, no GUI-thread parse, Unsupported without the marker, an ended stream fails and never goes Live afterwards, an unchanged listing is re-applied.
• Full Qt suite with ZERUS_GUI_THREAD_CHECKS=fatal: 84/84 suites, 3008 test functions, 0 failed, 23 skipped (platform-only). test_source_*: 26 OK; privacy guard: 0 findings.
• End to end against the real hgs watch from feat(cli): hgs watch --json event stream (event data plane M3) #368 on arch, following a busy session (raw data on the review page):
  • stream live in 327 ms; first Activity about 170 ms after follow;
  • event lag (receive minus event at) p50 0.20 s, p90 0.28 s, max 0.38 s;
  • today's 2.5 s inspect polling of the same session: p50 2.34 s, p90 2.70 s.

Peers need the new CLI on both sides. Until a peer has it, the desktop keeps polling that peer.

🤖 Generated with Claude Code

[ufna]

Update: #367 (M1) is merged. This PR now carries M3 (#368's commit) plus three more commits:

• test(watch): wait for writer output with a deadline: feat(cli): hgs watch --json event stream (event data plane M3) #368/feat: event stream (hgs watch) and the desktop consumer (event data plane M3+M4) #369 CI failed on macOS because the heartbeat writer test slept a fixed 180 ms and a loaded runner produced one heartbeat. Both writer tests now wait with a 5 s deadline.
• perf(cli): refresh only changed rows in hgs watch (zerus-604d.6/.7): per-row refresh under the listing's lock, a 5 s probe for what no file shows, and a whole listing every 5 s. One shared capture per pane inside the status observation (62 → 35 capture-pane per listing on arch). Watcher CPU on arch: 12.9 % → 6.1 % of a core. ls/inspect output is unchanged. Rust: 1244 passed. test_watch: 11/11. The subagent also ran 514 focused Python tests (0 failures).
• The M4 desktop consumer, unchanged.

#368's macOS desktop failure was TestTasksView::taskDocumentAndDiscussionUseActivityComposition timing out on a fake-CLI round trip. #367 passed with identical tray code; watching whether it recurs here.

🤖 Generated with Claude Code