Diffusion: see it, and landing refreshes the pin index 757195ad7a5d

-- Diffusion (#150): each indexed pin also names the upstream's repository

-- on this hub, when it is one, so the Diffusion views and the tab need no

-- lookup by Oxygen id.

ALTER TABLE diffusion_pins ADD COLUMN upstream_repo_id INTEGER;

//! Diffusion's views (#150, docs/diffusion.md): a repository's Diffusion

//! tab (the consumers that pin it, and what it follows itself), and Admin ›

//! Diffusion across the hub. Each consumer shows green, amber, red, grey

//! or up to date (`diffusion::Colour`).

use super::{filters, lookup, Error, Page, RepoShell, Shell};

use crate::auth::Viewer;

use crate::db::repos::RepoRow;

use crate::diffusion::Consumer;

use crate::Shared;

use askama::Template;

use axum::extract::{Path, State};

#[derive(Template)]

#[template(path = "diffusion.html")]

pub struct DiffusionPage {

    shell: Shell,

    repo: RepoShell,

    used_by: Vec<Consumer>,

    follows: Vec<(RepoRow, Consumer)>,

    /// This repository has no checks of its own: its bumps are amber.

    unverified: bool,

}

/// `GET /{owner}/{name}/diffusion`.

pub async fn page(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

) -> Result<Page<DiffusionPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/diffusion"), &viewer);

    let (_, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let used_by = crate::diffusion::consumers(&app, &row, viewer.account()).await.unwrap_or_default();

    let follows = crate::diffusion::follows(&app, &row, viewer.account()).await;

    let unverified = crate::diffusion::unverified(&app, &row).await;

    Ok(Page(DiffusionPage { shell, repo: RepoShell::new(&app, &row, "diffusion").with_role(role), used_by, follows, unverified }))

}

#[derive(Template)]

#[template(path = "admin_diffusion.html")]

pub struct AdminPage {

    shell: Shell,

    upstreams: Vec<(RepoRow, Vec<Consumer>, bool)>,

}

/// `GET /admin/diffusion`: every upstream on the hub and its consumers.

pub async fn admin(State(app): State<Shared>, viewer: Viewer) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin/diffusion", &viewer);

    if !viewer.is_admin() {

        return Err(Error::not_found(shell));

    }

    let upstreams = crate::diffusion::everything(&app, viewer.account()).await;

    Ok(Page(AdminPage { shell, upstreams }))

}

{% extends "base.html" %}

{% import "diffusion_rows.html" as d %}

{% block title %}Diffusion · Administration{% endblock %}

{% block mainclass %} class="wide"{% endblock %}

{% block content %}

<div class="head"><h1>Diffusion <small>{{ upstreams.len()|plural("upstream", "upstreams") }} · <a href="/admin">Administration</a></small></h1></div>

<p class="small mute df-key"><span class="df-chip df-green">green</span> checked upstream, passed in the consumer · <span class="df-chip df-amber">amber</span> passed, upstream has no checks · <span class="df-chip df-red">red</span> the consumer's run failed · <span class="df-chip df-grey">testing</span> running · <span class="df-chip df-current">up to date</span></p>

{% if upstreams.is_empty() %}<p class="empty">No repository on this hub is pinned by another yet.</p>{% endif %}

{% for (up, list, unverified) in upstreams %}

<h2><a href="/{{ up.owner }}/{{ up.name }}/diffusion">{{ up.owner }}/{{ up.name }}</a> <small>{{ list.len()|plural("consumer", "consumers") }}{% if *unverified %} · <span class="df-chip df-amber">no checks of its own</span>{% endif %}</small></h2>

{% call d::rows(list) %}

{% endfor %}

{% endblock %}

{% extends "base.html" %}

{% import "repo_tabs.html" as m %}

{% import "diffusion_rows.html" as d %}

{% block title %}Diffusion · {{ repo.owner }}/{{ repo.name }}{% endblock %}

{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}

{% block tabs %}{% call m::tabs(repo, "diffusion") %}{% endblock %}

{% block content %}

<div class="head"><h1>Diffusion <small>how changes move between this repository and the ones that pin it</small></h1></div>

<p class="small mute df-key"><span class="df-chip df-green">green</span> checked here and passed there · <span class="df-chip df-amber">amber</span> passed there, but the upstream has no checks · <span class="df-chip df-red">red</span> its run on the bump failed · <span class="df-chip df-grey">testing</span> running · <span class="df-chip df-current">up to date</span> nothing to bump</p>

{% if !used_by.is_empty() %}

<h2>Used by <span class="count-chip">{{ used_by.len() }}</span></h2>

{% if unverified %}<div class="strip warn">{{ repo.owner }}/{{ repo.name }} has no checks of its own, so its consumers' bumps are amber: only their own pipelines test them. A <code>.flow/pipeline.kdl</code> here that passes turns them green.</div>{% endif %}

{% call d::rows(used_by) %}

{% endif %}

{% if !follows.is_empty() %}

<h2>Follows <span class="count-chip">{{ follows.len() }}</span></h2>

<div class="table"><table class="diffusion">

  <tr><th>Upstream</th><th>Subrepo</th><th>Behind</th><th>Status</th><th>Open bump</th><th>Last landed</th></tr>

  {% for (up, c) in follows %}

  <tr>

    <td><a href="/{{ up.owner }}/{{ up.name }}/diffusion">{{ up.owner }}/{{ up.name }}</a></td>

    <td class="small">{{ c.path }} <span class="lbl lbl-bm">{{ c.bookmark }}</span></td>

    <td class="small">{% match c.behind %}{% when Some(n) %}{{ n }}{% when None %}<span class="mute">?</span>{% endmatch %}</td>

    <td>{% call d::chip(c) %}</td>

    <td class="small">{% if let Some(n) = c.bump %}<a href="{{ repo.url }}/proposal/{{ n }}">#{{ n }}</a>{% if let Some((r, st)) = c.run %} · <a href="{{ repo.url }}/flow/{{ r }}">run #{{ r }}</a> <span class="mute">{{ st }}</span>{% endif %}{% else %}<span class="mute">none</span>{% endif %}</td>

    <td class="small">{% if let Some((n, at)) = c.landed %}<a href="{{ repo.url }}/proposal/{{ n }}">#{{ n }}</a> <time class="mute" title="{{ at|when_i }}">{{ at|ago_i }}</time>{% else %}<span class="mute">—</span>{% endif %}</td>

  </tr>

  {% endfor %}

</table></div>

{% endif %}

{% if used_by.is_empty() && follows.is_empty() %}<p class="empty">No repository on this hub pins this one, and it pins none that this hub holds.</p>{% endif %}

<p class="small mute">Diffusion opens a proposal in a consumer when its upstream moves, and never lands one itself. How each repository follows is under its Settings › Diffusion. <a href="/help#diffusion">How it works</a></p>

{% endblock %}

{% macro chip(c) %}<span class="df-chip {{ c.colour.class() }}" title="{{ c.colour.label() }}">{{ c.colour.label() }}</span>{% endmacro %}

{% macro rows(list) %}

<div class="table"><table class="diffusion">

  <tr><th>Repository</th><th>Pin on</th><th>Behind</th><th>Status</th><th>Open bump</th><th>Last landed</th><th>Follows</th></tr>

  {% for c in list %}

  <tr>

    <td><a href="/{{ c.owner }}/{{ c.name }}">{{ c.owner }}/{{ c.name }}</a> <span class="small mute">{{ c.path }}</span></td>

    <td class="small"><span class="lbl lbl-bm">{{ c.bookmark }}</span></td>

    <td class="small">{% match c.behind %}{% when Some(0) %}<span class="mute">0</span>{% when Some(n) %}{{ n }}{% when None %}<span class="mute" title="Its pin names changes this repository does not hold">?</span>{% endmatch %}</td>

    <td>{% call chip(c) %}</td>

    <td class="small">{% if let Some(n) = c.bump %}<a href="/{{ c.owner }}/{{ c.name }}/proposal/{{ n }}">#{{ n }}</a>{% if let Some((r, st)) = c.run %} · <a href="/{{ c.owner }}/{{ c.name }}/flow/{{ r }}">run #{{ r }}</a> <span class="mute">{{ st }}</span>{% endif %}{% else %}<span class="mute">none</span>{% endif %}</td>

    <td class="small">{% if let Some((n, at)) = c.landed %}<a href="/{{ c.owner }}/{{ c.name }}/proposal/{{ n }}">#{{ n }}</a> <time class="mute" title="{{ at|when_i }}">{{ at|ago_i }}</time>{% else %}<span class="mute">—</span>{% endif %}</td>

    <td class="small mute">{% match c.follow %}{% when crate::diffusion::Follow::Off %}off{% when crate::diffusion::Follow::Green %}when green{% when crate::diffusion::Follow::Any %}every move{% endmatch %}</td>

  </tr>

  {% endfor %}

</table></div>

{% endmacro %}

    // The upstream's repository on this hub, when it is one.

    let mut upstreams = Vec::new();

    for (_, id, _) in &pins {

        upstreams.push(repo_by_oxy_id(app, &hex::encode(id)).await.map(|r| r.id));

    }

    for ((path, id, pinned), upstream_row) in pins.iter().zip(&upstreams) {

        ok &= sqlx::query(

            "INSERT INTO diffusion_pins (consumer_id, bookmark, path, upstream, heads, updated_ms, upstream_repo_id) VALUES (?, ?, ?, ?, ?, ?, ?)",

        )

        .bind(row.id)

        .bind(bookmark)

        .bind(path)

        .bind(hex::encode(id))

        .bind(heads.join("+"))

        .bind(now)

        .bind(upstream_row)

        .execute(&mut *tx)

        .await

        .is_ok();

        if let Some(u) = upstream_row {

            mark(app, row.id);

            mark(app, *u);

        }

}

static INVOLVED: std::sync::Mutex<Option<std::collections::HashSet<String>>> = std::sync::Mutex::new(None);

fn key(app: &Shared, repo_id: i64) -> String {

    format!("{}#{repo_id}", app.repos.root().display())

}

fn mark(app: &Shared, repo_id: i64) {

    INVOLVED.lock().unwrap_or_else(|p| p.into_inner()).get_or_insert_with(Default::default).insert(key(app, repo_id));

/// Whether a repository takes part in Diffusion, as an upstream or a

/// consumer on this hub: its Diffusion tab shows (#150).

pub fn involved(app: &Shared, repo_id: i64) -> bool {

    INVOLVED.lock().unwrap_or_else(|p| p.into_inner()).as_ref().is_some_and(|s| s.contains(&key(app, repo_id)))

}

    /// How it follows the upstream (from its setting, or the site's).

    pub follow: Follow,

    /// Its open bump proposal's number, if it has one.

    pub bump: Option<i64>,

    /// The newest run of its bump bookmark: number and status.

    pub run: Option<(i64, String)>,

    /// Its last landed bump: number and when.

    pub landed: Option<(i64, i64)>,

    /// What the views show (#150).

    pub colour: Colour,

}

/// A consumer's Diffusion status at a glance (#150, Andy's colours):

/// green when the upstream was checked and the consumer's run on the bump

/// passed; amber when the run passed but the upstream has no checks; red

/// when the run failed; grey while it runs; up to date when there is

/// nothing to bump; off when it does not follow.

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]

#[serde(rename_all = "kebab-case")]

pub enum Colour {

    Green,

    Amber,

    Red,

    Grey,

    UpToDate,

    Off,

impl Colour {

    pub fn class(&self) -> &'static str {

        match self {

            Colour::Green => "df-green",

            Colour::Amber => "df-amber",

            Colour::Red => "df-red",

            Colour::Grey => "df-grey",

            Colour::UpToDate => "df-current",

            Colour::Off => "df-off",

        }

    }

    pub fn label(&self) -> &'static str {

        match self {

            Colour::Green => "green",

            Colour::Amber => "amber: upstream unverified",

            Colour::Red => "red: its run failed",

            Colour::Grey => "testing",

            Colour::UpToDate => "up to date",

            Colour::Off => "not following",

        }

    }

    /// The colour from what is known of a consumer.

    pub fn of(follow: Follow, behind: Option<usize>, bump: Option<i64>, run: Option<&str>, unverified: bool) -> Colour {

        if follow == Follow::Off {

            return Colour::Off;

        }

        match (bump, run) {

            (Some(_), Some("passed")) if unverified => Colour::Amber,

            (Some(_), Some("passed")) => Colour::Green,

            (Some(_), Some("failed" | "error" | "cancelled")) => Colour::Red,

            (Some(_), _) => Colour::Grey,

            (None, _) if behind == Some(0) => Colour::UpToDate,

            (None, _) => Colour::Grey,

        }

    }

}

    let unverified = unverified(app, row).await;

            continue;

        }

        // One row per consumer and subrepo: the bookmark its work lands on.

        if bookmark != target(&app.db, &c).await {

        let bump_bm = bump_bookmark(&path);

        let mine: Vec<db::proposals::ProposalRow> = db::proposals::list(&app.db, c.id, &[])

            .await

            .unwrap_or_default()

            .into_iter()

            .filter(|p| p.source_bookmark == bump_bm)

            .collect();

        let bump = mine.iter().find(|p| p.state == "open" || p.state == "draft").map(|p| p.number);

        let landed = mine.iter().filter(|p| p.state == "landed").max_by_key(|p| p.landed_ms).map(|p| (p.number, p.landed_ms));

        let run: Option<(i64, String)> =

            sqlx::query_as("SELECT number, status FROM flow_runs WHERE repo_id = ? AND bookmark = ? ORDER BY id DESC LIMIT 1")

                .bind(c.id)

                .bind(&bump_bm)

                .fetch_optional(&app.db)

                .await

                .ok()

                .flatten();

        let follow = rule(&app.config.diffusion.follow, &c, None, &path).follow;

        out.push(Consumer {

            owner: c.owner,

            name: c.name,

            bookmark,

            path,

            pinned,

            behind: None,

            follow,

            bump,

            run,

            landed,

            colour: Colour::Off,

        });

        c.colour = Colour::of(c.follow, b, c.bump, c.run.as_ref().map(|r| r.1.as_str()), unverified);

}

/// What `consumer` follows, as its Follows panel shows: each upstream on

/// this hub it pins, with its status there.

pub async fn follows(app: &Shared, consumer: &RepoRow, account: Option<&Account>) -> Vec<(RepoRow, Consumer)> {

    let ups: Vec<i64> =

        sqlx::query_scalar("SELECT DISTINCT upstream_repo_id FROM diffusion_pins WHERE consumer_id = ? AND upstream_repo_id IS NOT NULL")

            .bind(consumer.id)

            .fetch_all(&app.db)

            .await

            .unwrap_or_default();

    let mut out = Vec::new();

    for id in ups {

        let Ok(Some(up)) = db::repos::get_by_id(&app.db, id).await else { continue };

        if !roles::allows(roles::role_for(&app.db, account, &up).await.ok().flatten(), crate::auth::Access::Read) {

            continue;

        }

        for c in consumers(app, &up, account).await.unwrap_or_default() {

            if c.owner == consumer.owner && c.name == consumer.name {

                out.push((up.clone(), c));

            }

        }

    }

    out

}

/// Every upstream on this hub with its consumers, for Admin › Diffusion.

pub async fn everything(app: &Shared, account: Option<&Account>) -> Vec<(RepoRow, Vec<Consumer>, bool)> {

    let ups: Vec<i64> = sqlx::query_scalar("SELECT DISTINCT upstream_repo_id FROM diffusion_pins WHERE upstream_repo_id IS NOT NULL")

        .fetch_all(&app.db)

        .await

        .unwrap_or_default();

    let mut out = Vec::new();

    for id in ups {

        let Ok(Some(up)) = db::repos::get_by_id(&app.db, id).await else { continue };

        let list = consumers(app, &up, account).await.unwrap_or_default();

        let unverified = unverified(app, &up).await;

        out.push((up, list, unverified));

    }

    out

mod diffusion;

        .route("/admin/diffusion", get(diffusion::admin))

        .route("/{owner}/{name}/diffusion", get(diffusion::page))

    /// Whether it pins, or is pinned by, another repository here: the

    /// Diffusion tab (#150).

    pub diffusion: bool,

            diffusion: crate::diffusion::involved(app, row.id),

    // Diffusion (#150): a landing moves the target as a push would, so the

    // pin index follows it, and the consumers of a moved default bookmark

    // are bumped.

    let heads = loaded.heads.clone();

    let moved = vec![(p.target.clone(), state.clone(), heads.clone())];

    crate::diffusion::after_push(app, row, &moved).await;

    if p.target == row.default_bookmark {

        let (app, row) = (app.clone(), row.clone());

        tokio::spawn(async move { crate::diffusion::propagate(&app, &row, heads, false).await });

    }

    /// The upstreams it pins, with its status there (#150).

    follows: Vec<(crate::db::repos::RepoRow, crate::diffusion::Consumer)>,

    let follows = crate::diffusion::follows(&app, &row, viewer.account()).await;

        follows,

    // The views (#150): the upstream's Diffusion tab lists the game with its

    // status; the game's tab and overview say what it follows.

    pass_all().await;

    let (st, page) = call(&h.app, "GET", "/andy/api/diffusion", None, None).await;

    assert_eq!(st, StatusCode::OK);

    assert!(page.contains("Used by") && page.contains("andy/game") && page.contains(&format!("#{}", p2.number)), "the bump is listed");

    assert!(page.contains("df-green"), "a passing run of a checked upstream is green");

    let (_, page) = call(&h.app, "GET", "/andy/game/diffusion", None, None).await;

    assert!(page.contains("Follows") && page.contains("andy/api"));

    let (_, overview) = call(&h.app, "GET", "/andy/game", None, None).await;

    assert!(overview.contains("Follows") && overview.contains(">Diffusion</a>"), "the tab and the panel");

    let (st, _) = call(&h.app, "GET", "/admin/diffusion", None, None).await;

    assert_eq!(st, StatusCode::NOT_FOUND, "administrators only");

    // Landing the bump on the hub moves the game's pin as a push would:

    // the index follows, so it is no longer behind.

    let (st, body) =

        call(&h.app, "POST", &format!("/api/v1/repos/andy/game/proposals/{}/land", p2.number), Some("site"), Some("{}".into())).await;

    assert_eq!(st, StatusCode::OK, "{body}");

    let mut behind = serde_json::Value::Null;

    for _ in 0..100 {

        let (_, list) = call(&h.app, "GET", "/api/v1/repos/andy/api/consumers", Some("site"), None).await;

        let list: Vec<serde_json::Value> = serde_json::from_str(&list).unwrap();

        behind = list.iter().find(|c| c["name"] == "game").map(|c| c["behind"].clone()).unwrap_or_default();

        if behind == 0 {

            break;

        }

        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

    }

    assert_eq!(behind, 0, "the index followed the landing");

### 4.5 Seeing it (#150)

A repository's **Diffusion** tab lists who pins it (Used by) and what it

pins (Follows), each with a status Andy chose on 2026-10-13: **green**

(the upstream was checked and the consumer's run on the bump passed),

**amber** (the run passed but the upstream has no checks), **red** (the run

failed), **grey** (running), **up to date**. The overview shows the same in

brief; Admin › Diffusion shows the whole hub.

- **Architecture** (OxygenFlow spec §11.2–§11.3, oxygenflow#36): a runner reports each image's architecture on its claims (`image_archs`), kept in `flow_images`; a job is offered only to a runner whose architecture matches its sandbox's `arch`, else its image's as known; unknown matches, as before. The queue says which architecture a waiting job asks for. **Images by hash** (oxygenflow#39, Jetstream): `flow rootfs push HASH` sends a rootfs image as the FastCDC chunks the hub lacks (`POST /flow/images/missing`, `PUT /flow/images/chunks/{hash}`, by a token that may write repositories) and then its manifest (`PUT /flow/images/{hash}`), which the hub accepts only when every chunk is held and they make an image with that hash; chunks are kept zstd-compressed under `<data>/images`, shared by every image, and `jet_images` lists what is held. Runners and accounts fetch with `GET /flow/images/{hash}` and `GET /flow/images/chunks/{hash}`. A runner whose claims say `fetches_images` is offered jobs whose image only the hub holds, and fetches it before its preflight. Each claim also carries the runner's `facts` (OxygenFlow spec §11.1, oxygenflow#40): free disk, load, speed score and class, kernel; the hub keeps the latest on the runner, shows them on Admin › Runners and in `GET /runners`. A job's finish carries the most disk and memory it took (`peak_disk_mib`, `peak_memory_mib`, oxygenflow#41); a new job's `need_disk_mib` is the most its last five runs of the same repository and name took, plus a quarter and 64 MiB, and it is offered only to a runner whose claim reports at least that much free disk; the waiting reason says so. **Ranking** (oxygenflow#42): a job that another free runner which polled in the last 10 s would do better (it holds the job's image while the claimant would fetch it, or has a higher speed class) is held from the claimant for up to 15 s, then any runner that fits takes it; each job records why it ran where it did (`placed`: "holds the image, idle, speed 100 (class 3)", with "after N s held for a better runner" when it was), shown on the run page, in the API and by `oh run view`. A run whose jobs pin an image held by neither the hub nor a runner sets a failing `pipeline/images` check on its state (#137), naming the images and how to send them (`flow rootfs push`), so a proposal pinning a new image shows it before it lands; a later run of the state turns it to passed once every image is held. A placement pass every 15 seconds works out why each ready queued job no runner can take waits, from what each online runner offered at its last claim (scope, tier, architecture, image held, labels, memory and CPUs, a recent decline), and shows it on the job (API `waiting`, `oh run view` and `oh run watch`, its panel open on the run page) and in its check's summary, so a proposal says why its check is stuck (#28). **Diffusion** (#148, `docs/diffusion.md`): a push that moves a repository's default bookmark, or the bookmark its work lands on (the most common target of its proposals landed in the last 90 days), records each Oxygen subrepo pin in the new state (`diffusion_pins`: consumer, bookmark, path, the upstream's Oxygen repository id, the pinned heads); a hub that had no index fills it at start. `GET /repos/{owner}/{name}/consumers` lists the consumers the caller may read, each with its pin and how many changes of this repository's default bookmark it lacks (`behind`, null when the pin names changes this repository does not hold), and the overview shows them as Used by. A repository that pins, or is pinned by, another on the hub has a **Diffusion tab** (#150): Used by (each consumer's pin bookmark, how far behind, its status, its open bump and that bump's newest run, its last landed bump, how it follows) and Follows (each upstream it pins, with the same); its overview shows both in brief, and Admin › Diffusion lists every upstream with its consumers. The status is green when the upstream is checked and the consumer's run on the bump passed, amber when that run passed but the upstream has no checks, red when the run failed, grey while it runs, and up to date when there is nothing to bump. Landing a proposal on the hub refreshes the pin index and propagates as a push does. A consumer follows a subrepo's upstream as its `.oxymodules` entry says (`follow = off | green | any`, `land = propose | auto`, `target` naming the bookmark to bump, `watch` listing paths whose upstream changes are flagged), else as its repository setting says (Settings › Diffusion, or `PUT /repos/{owner}/{name}/diffusion {"follow": ...}` by its owners and admins; migration 0058), else as `[diffusion] follow` in hub.toml says (default `off`). A **bump** moves a consumer's pin at a path to a newer upstream state: one change on the target bookmark's heads that replaces only the pin (oxy-core `build_pin_change`), signed with the hub's key, on the bookmark `diffusion/<path>`, which the hub owns and rebuilds on the target each time (a forced update). When the pin has changes the upstream's state lacks (say, from an upstream proposal not landed yet), the bump moves to both, so a consumer never loses changes it relies on; it is skipped when that combination would conflict, when the pin names changes the upstream does not hold, when the pin already holds the state, or when the bump bookmark already moves it there, and the hub logs why. A bump is **proposed** once per bump bookmark, by the hub's `diffusion` account (made on first use, never able to sign in), into the target, labelled `dependencies`, its body the upstream changes the pin lacks (newest first, linking to the upstream's change pages); a later bump edits the same open proposal. It is triggered when a push moves the upstream's default bookmark (for consumers following `any`) or when a run of that bookmark passes (for `green`). Diffusion never lands a proposal. An upstream with no checks of its own (Flow off, or no run ever of its default bookmark) is **unverified**: it never turns green, so its moves also bump consumers following `green`, and those proposals are marked amber with the `upstream unverified` label and a note in the body; a later bump from a passing run removes the label. A bump already in place refreshes its proposal's text and labels. A consumer's `watch` patterns (`*` within a path segment, `**` across them, `?` one character; a plain path covers everything below it) flag the upstream changes touching a matching file: they are listed first under "Touches what you watch", with the files, and marked ⚑ in the changelog. Turning Diffusion on for a consumer (the setting or the API) catches it up at once: it is bumped to each upstream's newest state whose default-bookmark run passed, or to its newest state when it follows every move. **Images page** (#146): Admin › Runners › Images lists every rootfs image a runner holds, the hub keeps, or a job ran on in the last 90 days (from each job's sandbox), newest use first: its size and architecture, where it is (the hub, each runner holding it, each runner fetching it from the swarm now), the repositories whose jobs used it, and who sent it; an image held nowhere is marked. **The swarm** (#144, oxygenflow docs/jetstream.md §8.1): a runner in an image swarm reports its peer address, its site and the BLAKE3 of its TLS certificate with each claim (`swarm`; without a certificate it is not in the swarm), kept in memory and shown on Admin › Runners. `POST /flow/swarm/announce {image, state}` (by a runner; `fetching`, `done` or `stopped`) returns the online runners in its site that hold the image or announced fetching it in the last 45 seconds, each with its certificate's fingerprint, which the fetcher pins its TLS connection to, and a ticket signed with the hub key (JSON naming the runner, its site and an expiry 15 minutes on, hex, then the signature) that peers check against `/.well-known/oxyhub-key` before serving chunks; a runner that has not reported an address is told to add `[runner.swarm]` (409).

  <a href="/admin/diffusion">Diffusion ↗</a>

    <ul class="plain used-by">{% for c in used_by %}<li><a href="/{{ c.owner }}/{{ c.name }}">{{ c.owner }}/{{ c.name }}</a> <span class="df-chip {{ c.colour.class() }}" title="{{ c.colour.label() }}">{% match c.behind %}{% when Some(0) %}up to date{% when Some(n) %}{{ n }} behind{% when None %}?{% endmatch %}</span></li>{% endfor %}</ul>

    <p class="small"><a href="{{ repo.url }}/diffusion">Diffusion ›</a></p>{% endif %}

    {% if !follows.is_empty() %}<h3>Follows</h3>

    <ul class="plain used-by">{% for (up, c) in follows %}<li><a href="/{{ up.owner }}/{{ up.name }}">{{ up.owner }}/{{ up.name }}</a> <span class="df-chip {{ c.colour.class() }}" title="{{ c.colour.label() }}">{{ c.colour.label() }}</span>{% if let Some(n) = c.bump %} <a class="small" href="{{ repo.url }}/proposal/{{ n }}">#{{ n }}</a>{% endif %}</li>{% endfor %}</ul>

    <p class="small"><a href="{{ repo.url }}/diffusion">Diffusion ›</a></p>{% endif %}

    {% if repo.diffusion %}<a href="{{ repo.url }}/diffusion"{% if tab == "diffusion" %} class="on" aria-current="page"{% endif %}>Diffusion</a>{% endif %}

/* Diffusion (#150): each consumer's status at a glance. */

.df-chip { display: inline-block; font-size: 12px; padding: 1px 8px; border-radius: 10px; border: 1px solid; white-space: nowrap; }

.df-green { color: var(--ok); border-color: var(--ok); }

.df-amber { color: #b7791f; border-color: #e3a008; background: color-mix(in srgb, #e3a008 12%, transparent); }

.df-red { color: var(--bad); border-color: var(--bad); }

.df-grey { color: var(--mute); border-color: var(--line); }

.df-current { color: var(--acc); border-color: var(--acc); }

.df-off { color: var(--dim); border-color: var(--line); border-style: dashed; }

.df-key .df-chip { margin-right: 2px; }

table.diffusion td { vertical-align: middle; }