security watch reads zstd layers in CI by itself (R-1327): pinned zstandard 0.25.0 wheel, sha256-checked; RUNTIME log line; HA 2026.9.4 and RomM 5.4.1 dropped from the cache for the CI fill proof; Immich v3.3.5 power-cut repair evidence

scripts/security_watch.py

@@ -275,6 +275,14 @@ def cached_runtime_reader(cache, resolve=None, read=None):
     caches a COMPLETE result only (an unchecked one is tried again the next night). `cache` lives in the state file."""
     resolve = resolve or image_runtime.resolve_digest
     read = read or image_runtime.read_image
+    import threading
+    import time
+    lock = threading.Lock()
+    stats = {"cached": 0, "read": 0, "read_s": 0.0, "not_checked": 0}
+
+    def count(key, n=1):
+        with lock:
+            stats[key] += n
 
     def reader(ref):
         try:
@@ -287,12 +295,21 @@ def cached_runtime_reader(cache, resolve=None, read=None):
             hit = dict(cache[digest], ref=ref)
             hit["_used"] = True
             cache[digest]["_seen"] = True
+            count("cached")
             return hit
+        t0 = time.monotonic()
         res = read(ref)
+        count("read_s", time.monotonic() - t0)
+        count("read")
+        print("RUNTIME-READ %s %.0f s %s" % (ref, time.monotonic() - t0, "NOT CHECKED: " + "; ".join(res["unchecked"])[:160]
+                                             if res.get("unchecked") else "ok"), flush=True)
         if digest and not res.get("unchecked"):
             cache[digest] = {k: v for k, v in res.items() if k != "ref"}
             cache[digest]["_seen"] = True
+        else:
+            count("not_checked")
         return res
+    reader.stats = stats   # the RUNTIME line of the log: how much was read tonight and how long it took (R-1327)
     return reader
 
 
@@ -855,14 +872,19 @@ def main(argv):
     if state_path and os.path.isfile(state_path):
         prior = json.load(open(state_path, encoding="utf-8"))
     rcache = {k: dict(v, _seen=False) for k, v in (prior.get("runtime_cache") or {}).items()}
-    run(items, net, today, rotate=not token,
-        runtime=None if "no-runtime" in opts else cached_runtime_reader(rcache))
+    rreader = None if "no-runtime" in opts else cached_runtime_reader(rcache)
+    run(items, net, today, rotate=not token, runtime=rreader)
     for line in table(items):
         print(line)
     counts = {}
     for it in items:
         counts[it["class"]] = counts.get(it["class"], 0) + 1
     print("COUNTS " + " ".join("%s=%d" % (k.replace(" ", "_"), v) for k, v in sorted(counts.items())))
+    if rreader:
+        st = rreader.stats
+        print("RUNTIME read=%d (%.0f s) from-cache=%d not-checked=%d zstd-decoder=%s" % (
+            st["read"], st["read_s"], st["cached"], st["not_checked"],
+            image_runtime.zstd_decoder()[1] if st["read"] else "not needed"))
     print("REQUESTS " + " ".join("%s=%d" % kv for kv in sorted(net.requests.items())))
     state_path = opts.get("state")
     state, missing = {}, True