@adrrr/tarmac 0.3.0 → 0.4.0

package/README.md

@@ -87,6 +87,14 @@ does not mark same-origin — your cwd paths and costs never leave the machine.
 **default** port walks up to the next free one and says so; a port you chose yourself — flag,
 environment or config file — refuses instead, because you chose it.
 
+In the header are the account's **two rate-limit gauges** — the five-hour window and the
+seven-day one, each with its used percentage and its reset spelled as the time left. They are
+page-level because that is what a rate limit is: one account, which every session below is
+spending from. A fleet whose snapshots carry no limits says `— no reading` on a dotted rail
+rather than drawing a window at 0%, and a reading past the freshness threshold is dated
+`! 40m ago` — the countdown is recomputed every poll, the percentage is as old as its snapshot,
+and a page that showed both as now would be lying with the moving one.
+
 ### The map
 
 The tab in the header swaps the table for the same fleet as nodes — one per session, the arc
@@ -101,6 +109,15 @@ sharing its working directory, because the working directory is the only thing t
 share; nothing is nested, and no edge is drawn for a relationship the sources do not publish.
 Details in [the manual](docs/MANUAL.md#the-map).
 
+Under the map is a **scrubber over the day this serve has seen**. Drag it and the dials render
+the fleet as it was at that minute; press play and the day walks past. The record is fetched on
+load, never per position, so scrubbing asks the server nothing. A replay never poses as the present: a banner names
+the minute and holds the way back, the live fragment is hidden while it is up, halos stay off
+because a sample never "just landed", and a session absent from a minute is absent from the
+map. The range says what it truly covers — a serve ten minutes old offers ten minutes. The
+account's gauges replay too, counted from the minute being shown rather than from now, so the
+five-hour window can be watched draining and refilling across a day.
+
 ## Why it does not break
 
 The usual ways to watch a Claude Code fleet read something Claude Code never promised would
@@ -111,7 +128,7 @@ tarmac reads two things instead:
 
 | Source | What it gives | How solid |
 |---|---|---|
-| `claude agents --json` | which sessions exist, busy or idle, cwd, uptime | a documented CLI surface (`--help`: *"Print active sessions … as a JSON array … for scripting"*) |
+| `claude agents --json` | which sessions exist, busy, idle or waiting on you, cwd, uptime | a documented CLI surface (`--help`: *"Print active sessions … as a JSON array … for scripting"*) |
 | the status line payload | context %, model, effort, cost | the JSON Claude Code hands to your own `statusLine.command` on every frame — **observed, not published as a schema** |
 
 That second line is the honest caveat, and it is the reason the real defence is not
@@ -129,7 +146,7 @@ table is in [`docs/MANUAL.md`](docs/MANUAL.md).
 | Command | What it does | Options |
 |---|---|---|
 | `tarmac list` | one-shot fleet table — the default, so bare `tarmac` runs it | `--home`, `--stale-after`, `--snapshots-dir`, `--claude-bin`, `--json`, `--watch` |
-| `tarmac serve` | local dashboard, `GET /` for the table, `GET /map` for the map, `GET /live` for the fragment both refresh from, `GET /api/fleet` for JSON | `--home`, `--port`, `--stale-after`, `--snapshots-dir`, `--claude-bin` |
+| `tarmac serve` | local dashboard, `GET /` for the table, `GET /map` for the map, `GET /live` for the fragment both refresh from, `GET /api/fleet` for JSON, `GET /api/history` for the last 24h of readings it took while it ran | `--home`, `--port`, `--stale-after`, `--snapshots-dir`, `--claude-bin` |
 | `tarmac install` | chain the status line under `<home>/.claude/settings.json`, after confirmation | `--home`, `--yes` |
 | `tarmac uninstall` | restore it, and say which of the four restore modes ran | `--home`, `--yes` |
 
@@ -170,10 +187,11 @@ filable.
 
 ## What it deliberately does not do
 
-- **No "waiting for you" signal.** The obvious missing column — which session is blocked on
-  a human — is deliberately absent: the status line payload carries nothing that means it,
-  and `agents --json` reports `idle` for a session waiting on you and for one that finished.
-  Inferring it would mean reading a transcript, which is the one thing this tool will not do.
+- **No inferred "waiting for you".** `agents --json` reports `waiting` with a reason —
+  a permission prompt, an open dialog — and tarmac draws exactly that, on both surfaces.
+  What it will not do is guess at the rest: a session that asked you a question in prose
+  still reports `idle`, and the only way to know better is to read a transcript, which is
+  the one thing this tool will not do. The signal is as good as the surface, and no better.
 - **No history.** Each run is a snapshot in time; context and cost curves come later.
 - **No Windows.** The generated wrapper is POSIX `sh`.
 - **No remote fleets.** It watches the machine it runs on.

package/dist/fleet.js

@@ -13,6 +13,7 @@
 import path from 'node:path';
 import { DEFAULT_STALE_AFTER_MS } from './config.js';
 import { guardVersions } from './schema.js';
+import { isWaiting } from './sessions.js';
 import { SID_NAME } from './wrapper.js';
 export function buildFleet({ sessions, snapshots, now, staleAfterMs = DEFAULT_STALE_AFTER_MS, discovery = null, }) {
     const rows = sessions.map((s) => {
@@ -25,6 +26,7 @@ export function buildFleet({ sessions, snapshots, now, staleAfterMs = DEFAULT_ST
             pid: s.pid,
             kind: s.kind,
             status: s.status,
+            waitingFor: s.waitingFor,
             busy: s.busy,
             uptimeMs: typeof s.startedAt === 'number' ? now - s.startedAt : null,
             ctxState: t ? t.ctxState : 'absent',
@@ -76,7 +78,10 @@ export function buildFleet({ sessions, snapshots, now, staleAfterMs = DEFAULT_ST
             // Tested tolerance from the fleet: `fresh` never counts, or a recycled fleet would
             // raise this every single night.
             schemaBroken: covered > 0 && drift === covered,
-            unknownStatus: rows.filter((r) => r.busy === null).length,
+            // Recomputed from the rows rather than taken from `discovery`, which may be null — so
+            // the exemption the reader grants a waiting session has to be granted again here, or
+            // the banner accuses a session both surfaces are drawing as waiting.
+            unknownStatus: rows.filter((r) => r.busy === null && !isWaiting(r)).length,
             busy: rows.filter((r) => r.busy === true).length,
             // A sum over 3 of 7 sessions is not the fleet's cost. Same rule as `sumUsage` one
             // layer down: add only what is really a number, and count those — a payload with no
@@ -91,6 +96,34 @@ export function buildFleet({ sessions, snapshots, now, staleAfterMs = DEFAULT_ST
         },
     };
 }
+/**
+ * The account's rate limits, as this fleet's sessions report them.
+ *
+ * They belong to the ACCOUNT and not to any one session, but they arrive per snapshot — so the
+ * rows do not carry contradicting numbers, they carry the same number at different ages, and
+ * the youngest is the one still true. Same rule as everything else in this module: the freshest
+ * reading wins.
+ *
+ * A snapshot dated AFTER the clock that read it is refused rather than believed, which is the
+ * verdict `map.ts` reaches on the same value: an NTP correction or a mount whose time runs
+ * ahead does not produce a small age, it produces something that is not an age at all — and
+ * being negative it would beat every real reading for as long as the skew lasts.
+ *
+ * Here rather than in either of its readers: the ring samples it every minute and the page's
+ * header draws it, and two copies of "which session's word counts" is two answers about one
+ * account the day either one is touched.
+ */
+export function accountLimits(rows) {
+    let freshest = null;
+    for (const r of rows) {
+        if (r.rateLimits === null || r.snapshotAgeMs === null || r.snapshotAgeMs < 0)
+            continue;
+        if (freshest === null || r.snapshotAgeMs < freshest.ageMs) {
+            freshest = { rateLimits: r.rateLimits, ageMs: r.snapshotAgeMs };
+        }
+    }
+    return freshest;
+}
 // busy first, then unknown (it might be busy), then idle
 const rank = (r) => (r.busy === true ? 0 : r.busy === null ? 1 : 2);
 const round2 = (n) => Math.round(n * 100) / 100;

package/dist/history.js

@@ -0,0 +1,88 @@
+// P5 — what the serve already read, kept for a day.
+//
+// The dashboard reads the whole fleet on every request and forgets it on the next one, so a
+// number that moved is a number nobody can point at afterwards. This is that reading, held.
+//
+// In memory and nowhere else, by design. A fleet journal on disk is the one file this tool
+// promised never to write — it would outlive the process that made it, sit in someone's home
+// carrying session ids, working directories and costs, and turn "tarmac reads, it does not
+// keep" into a sentence with an asterisk. What a serve remembers therefore starts when that
+// serve started, which is exactly what `since` says out loud.
+//
+// The ring is bounded before it is anything else: a serve is left open for days, and one
+// sample a minute for a day is a size, while "everything since Tuesday" is a leak with a
+// nicer name.
+import { stateOf } from './map.js';
+import { isWaiting } from './sessions.js';
+import { accountLimits } from './fleet.js';
+/** One sample a minute. Not a setting: see `HISTORY_SLOTS`. */
+export const HISTORY_CADENCE_MS = 60_000;
+/**
+ * 24 hours of them. One minute and one day are the product — a cadence knob would let a
+ * reader ask this process to spawn `claude agents --json` every second, and a retention knob
+ * would let them ask it to hold a week of fleets in RAM. A page that needs to say what it
+ * covers reads `since`.
+ */
+export const HISTORY_SLOTS = 1440;
+export function createHistory({ since, cadence }) {
+    const slots = [];
+    // Whether anything has aged out yet, which is the only thing that can move `since` off the
+    // moment the serve started. A ring that is exactly full has dropped nothing.
+    let dropped = false;
+    const push = (slot) => {
+        slots.push(slot);
+        // Trimmed on the way in and never on the way out: the array's own length is the
+        // guarantee, so no reader has to be told the ring is bounded for it to be true.
+        if (slots.length > HISTORY_SLOTS) {
+            slots.splice(0, slots.length - HISTORY_SLOTS);
+            dropped = true;
+        }
+    };
+    return {
+        record(fleet) {
+            const sample = sampleOf(fleet);
+            push({ t: sample.t, sample });
+        },
+        miss(t) {
+            push({ t, sample: null });
+        },
+        // Rebuilt per read, and never the ring itself: this is the only copy there is and no file
+        // to restore it from, so a reader that spliced what it was handed would edit the record.
+        read: () => {
+            const samples = slots.filter((s) => s.sample !== null).map((s) => s.sample);
+            return {
+                since: dropped ? slots[0].t : since,
+                cadence,
+                samples,
+                missed: slots.length - samples.length,
+            };
+        },
+    };
+}
+/**
+ * A fleet reading, reduced to what a replay reads back.
+ *
+ * The names are the omission that matters, and it is not an oversight to be commented — it is
+ * pinned by a test. `claude agents --json` names a background session after the PROMPT it was
+ * given, so a fleet's names are a record of what its agents were told to do. The live view may
+ * show that, because someone is looking at their own screen in the present tense; a day of
+ * them, retained by a process and served back on a route, is a different object. No name for
+ * anyone, so there is no rule about kinds to get wrong later.
+ */
+function sampleOf({ rows, health }) {
+    return {
+        t: health.generatedAt,
+        sessions: rows.map((r) => ({
+            sid: r.sessionId,
+            project: r.project,
+            kind: r.kind,
+            state: stateOf(r),
+            waitingFor: isWaiting(r) ? r.waitingFor : null,
+            ctxState: r.ctxState,
+            ctxPct: r.ctxPct,
+            costUsd: r.costUsd,
+        })),
+        // The reading, without its age: the ring keeps each reading and never how old it was.
+        rateLimits: accountLimits(rows)?.rateLimits ?? null,
+    };
+}

package/dist/limits.js

@@ -0,0 +1,62 @@
+// P3 — the account's two windows.
+//
+// Every session on the page spends from the same two allowances, so they belong to the page
+// and not to a node: five hours, and seven days. The statusline payload carries both, as a
+// used percentage and the epoch each one rolls over at.
+//
+// This module reads a shape someone else versions, which is why it reads it the way
+// `snapshots.ts` reads the context window: the PRESENCE of a key says whether a number was
+// ever taken, and the value says what it was. A key that is gone, or holding something that is
+// not a percentage, is a schema that moved — and neither one is 0%. There is exactly one thing
+// a dashboard must never do with an account's limits, and that is report a window it could not
+// read as a window with room to spare.
+//
+// The reset is turned into a stretch of time HERE, against the clock the reading was taken
+// with, so that no renderer has to go and find a clock of its own: the live page subtracts from
+// the moment it read the fleet, and a replay subtracts from the minute its sample was taken.
+// Both then have one rule about what a negative answer means.
+/**
+ * The two windows, in the order they are read. A table rather than two hand-written branches:
+ * the page script draws the same pair in the browser for a replayed minute, and it is handed
+ * this list rather than keeping a second copy of the vocabulary.
+ */
+export const LIMIT_WINDOWS = [
+    { key: 'five_hour', label: '5h', said: 'five-hour window' },
+    { key: 'seven_day', label: '7d', said: 'seven-day window' },
+];
+/**
+ * How far from the reading a reset may land and still be one.
+ *
+ * The same discipline the percentage gets, one field over: `used_percentage` outside 0-100 is
+ * refused rather than drawn, and a `resets_at` outside a plausible distance is refused for the
+ * same reason. The longest window here is seven days, so nothing this account resets at is more
+ * than eight away — while the two ways this field can move are both far outside that: the same
+ * number in milliseconds lands fifty thousand years out, and `0`, the sentinel an unset field so
+ * often is, lands in 1970. Both were rendered with a straight face ("resets in 19656250d").
+ */
+export const RESET_HORIZON_MS = 8 * 24 * 3600 * 1000;
+/** Both windows, always — a window that could not be read is a gauge that says so. */
+export function readLimits(rateLimits, now) {
+    // `rate_limits: []` and `rate_limits: "none"` are legal JSON and not a pair of windows.
+    // Neither may reach the lookup below as something to index.
+    const ok = rateLimits !== null && typeof rateLimits === 'object' && !Array.isArray(rateLimits);
+    return LIMIT_WINDOWS.map(({ key, label, said }) => {
+        const w = ok ? rateLimits[key] : undefined;
+        const has = w !== null && typeof w === 'object' && !Array.isArray(w) && 'used_percentage' in w;
+        const v = has ? w.used_percentage : undefined;
+        // Present and null: a window whose number has not been taken yet. Absent, or holding
+        // something that is not a percentage: the shape moved. The discriminant is the key.
+        const pct = has && typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 100 ? Math.floor(v) : null;
+        const why = pct !== null ? null : rateLimits == null || (has && v === null) ? 'absent' : 'drift';
+        const at = has && typeof w.resets_at === 'number' && Number.isFinite(w.resets_at) ? w.resets_at : null;
+        const resetsInMs = at === null ? null : at * 1000 - now;
+        return {
+            key,
+            label,
+            said,
+            pct,
+            why,
+            resetsInMs: resetsInMs === null || Math.abs(resetsInMs) > RESET_HORIZON_MS ? null : resetsInMs,
+        };
+    });
+}

package/dist/map.js

@@ -2,6 +2,7 @@
 //
 // A view over the fleet `buildFleet` already produced. It opens no second source: every
 // field below is derived from a row that is already on the page as a table line.
+import { isWaiting } from './sessions.js';
 /**
  * How recently a snapshot must have landed for its node to pulse. Two of the page's poll
  * intervals (5s): a session whose terminal keeps drawing frames keeps its heartbeat across
@@ -107,4 +108,12 @@ function readingOf(r) {
         return 'undated';
     return r.stale ? 'stale' : 'live';
 }
-export const stateOf = (r) => (r.busy === true ? 'busy' : r.busy === false ? 'idle' : 'unknown');
+/**
+ * The four words a node can be, out of a boolean that only has three answers.
+ *
+ * `waiting` is asked BEFORE the boolean's `null`, and that order is the point: a session
+ * halted until a human answers carries `busy: null` — "is it working" has no honest answer —
+ * which is the same null an unrecognised word gets. Left to the boolean alone, the one
+ * session that is blocked on YOU drew as the amber "tarmac does not know this word".
+ */
+export const stateOf = (r) => r.busy === true ? 'busy' : isWaiting(r) ? 'waiting' : r.busy === false ? 'idle' : 'unknown';

package/dist/render.js

@@ -9,6 +9,8 @@
 import { formatDuration } from './config.js';
 import { buildMap, INTERACTIVE, stateOf } from './map.js';
 import { schemaNotice } from './schema.js';
+import { LIMIT_WINDOWS, RESET_HORIZON_MS, readLimits } from './limits.js';
+import { accountLimits } from './fleet.js';
 /**
  * The other thing this module renders: the plan a user consents to before install or
  * uninstall touches their settings.json. Everything the decision rests on has to be here —
@@ -147,7 +149,7 @@ export function renderTable({ rows, health }) {
     const head = ['PROJECT', 'STATE', 'CTX', 'AS OF', 'MODEL', 'EFFORT', 'COST', 'UP'];
     const body = rows.map((r) => [
         r.project ?? '—',
-        r.busy === true ? 'busy' : r.busy === false ? 'idle' : `?${r.status ?? ''}`,
+        stateCell(r),
         r.ctxPct === null ? `— ${r.ctxState}` : `${r.ctxPct}%`,
         // The age of the reading, never implied to be "now".
         r.snapshotAgeMs === null ? '—' : ahead(r) ? '— ahead' : `${age(r.snapshotAgeMs)}${r.stale ? ' !' : ''}`,
@@ -200,6 +202,21 @@ export function renderTable({ rows, health }) {
         (warns.length ? '\n' + warns.join('\n') + '\n' : '') +
         `\n${health.sessions} sessions · ${health.busy} busy · ${total}\n`);
 }
+/**
+ * The STATE column, out of the same verdict the page draws from.
+ *
+ * `?` is this column's word for "a status tarmac does not recognise", so it may not lead the
+ * one status tarmac knows by name and now has a state for. The reason follows the word, in
+ * the separator this renderer already uses for two facts on one line — and it is the only
+ * value here that can widen a column: it does so on a fleet that has a session blocked on a
+ * human, which is the fleet you wanted it on.
+ */
+function stateCell(r) {
+    const state = stateOf(r);
+    if (state === 'unknown')
+        return `?${r.status ?? ''}`;
+    return state === 'waiting' && r.waitingFor ? `waiting · ${r.waitingFor}` : state;
+}
 /**
  * A snapshot dated AFTER the clock we are reading it with — a mount whose time runs ahead, an
  * NTP correction between the write and the read. Its age is not a small number, it is not a
@@ -287,10 +304,86 @@ export function renderLive(fleet) {
       <tbody>${rows.map(renderRow).join('')}</tbody>
     </table></div></div>
 <div class="view view-map">${renderMap(fleet)}</div>`;
-    return `<div class="meta">${health.sessions} session${health.sessions === 1 ? '' : 's'} · ${health.busy} busy · ${cost(health)} · ${esc(new Date(health.generatedAt).toISOString())}</div>
+    return `<div id="limits-src" hidden>${renderLimits(fleet)}</div>
+<div class="meta">${health.sessions} session${health.sessions === 1 ? '' : 's'} · ${health.busy} busy · ${cost(health)} · ${esc(new Date(health.generatedAt).toISOString())}</div>
 ${warnings.map((w) => `<div class="warn">${esc(w)}</div>`).join('')}
 ${body}`;
 }
+/**
+ * The account's two windows, for the page's header.
+ *
+ * They are the one pair of numbers here that is not about a session: every session on the page
+ * spends from the same five-hour and seven-day allowance, so the gauges sit at the top of the
+ * page rather than on a node — and the fleet's own rule decides whose reading counts when the
+ * sessions carry the same number at different ages.
+ *
+ * Rendered into the FRAGMENT as well as into the shell, in a slot the script copies up on every
+ * swap. The header is the shell's — it has to survive a poll, the tabs and a replay — but the
+ * numbers are the fleet's, and the fleet is what the fragment carries. A gauge left in the shell
+ * alone would be as old as the tab.
+ */
+export function renderLimits({ rows, health }) {
+    const account = accountLimits(rows);
+    const gauges = readLimits(account === null ? null : account.rateLimits, health.generatedAt)
+        .map(gauge)
+        .join('');
+    // Dated when the snapshot behind it is past the threshold, exactly as the table dates a stale
+    // context. It matters more here than anywhere else on the page: the percentage is as old as
+    // that snapshot, while the countdown beside it is recomputed on every five-second re-render —
+    // so an undated pair puts a frozen number next to a visibly moving one and lets the reader
+    // assume both are now.
+    //
+    // Once for the two, not once each: both windows come out of the SAME snapshot, and the same
+    // fact said twice is noise. The replay has no equivalent — the ring keeps each reading and
+    // never how old it was, which is why nothing replayed on this page is dated.
+    const stale = account !== null && account.ageMs > health.staleAfterMs;
+    return gauges + (stale ? `<span class="stale">! ${esc(asOfAge(account.ageMs))} ago</span>` : '');
+}
+/**
+ * One window. Four things in a line: which window it is, a bar for the glance, the number that
+ * is authoritative, and how long is left. The bar is `aria-hidden` because it says nothing the
+ * number does not, and the abbreviation is replaced rather than doubled for a reader who hears
+ * the page — "5h" is a label on a screen and a syllable in an ear.
+ */
+function gauge(g) {
+    // No fill, ever, for a window nobody read: an empty bar is what an account at 0% wears, and
+    // "I could not look" must not be able to wear it. The same dotted emptiness as an unmeasured
+    // dial, in the shape a bar has.
+    const rail = g.pct === null
+        ? `<span class="rail unmeasured" aria-hidden="true"></span>`
+        : `<span class="rail" aria-hidden="true"><i style="width:${g.pct}%"></i></span>`;
+    return (`<div class="gauge"><span class="lbl" aria-hidden="true">${g.label}</span><span class="sr">${g.said}</span>` +
+        `${rail}<span class="num">${g.pct === null ? dash() : `${g.pct}%`}</span>` +
+        `<span class="reset">${g.pct === null ? LIMIT_WHY[g.why] : resetWords(g.resetsInMs)}</span></div>`);
+}
+/** Which kind of missing a missing window is, in the two words both surfaces use. */
+const LIMIT_WHY = { absent: 'no reading', drift: 'schema drift' };
+/**
+ * The reset, as a stretch of time rather than as the epoch the payload carries.
+ *
+ * A negative one is not a countdown to be printed with a minus sign: the window rolled over
+ * after the reading that reported it, so the percentage beside these words belongs to a window
+ * that no longer exists. Saying that is the whole point of showing a reset at all.
+ */
+const resetWords = (ms) => ms === null ? `reset ${dash()}` : ms > 0 ? `resets in ${left(ms)}` : `reset was due ${left(-ms)} ago`;
+/**
+ * How long, in the two units that matter at each scale. Deliberately finer than `duration()`
+ * next door, which floors a session's uptime to whole hours: five hours is a window someone
+ * plans the next hour around, and "resets in 2h" said anywhere between 2h00 and 2h59 is the
+ * kind of rounding that makes a reader stop believing the number.
+ */
+function left(ms) {
+    const m = Math.floor(ms / 60000);
+    if (m < 1)
+        return '<1m';
+    if (m < 60)
+        return `${m}m`;
+    const h = Math.floor(m / 60);
+    if (h < 24)
+        return m % 60 === 0 ? `${h}h` : `${h}h ${m % 60}m`;
+    const d = Math.floor(h / 24);
+    return h % 24 === 0 ? `${d}d` : `${d}d ${h % 24}h`;
+}
 /**
  * What to say instead of a fleet. Discovery returning entries we could not identify is not
  * an empty fleet, and saying "none found" would hide a schema change behind a calm, wrong
@@ -346,14 +439,20 @@ function ago(ms) {
     return m < 60 ? `${m}m` : `${Math.round(m / 60)}h`;
 }
 export function renderPage(fleet, view = 'table') {
+    // The header's copy. `renderLive` below renders its own, out of this same fleet and through
+    // this same function — two calls of one pure renderer over one reading, which is what keeps
+    // the pair the reader sees and the pair the script will copy up from being two accounts.
+    const gauges = renderLimits(fleet);
     return `<!doctype html>
 <html lang="en"><head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>tarmac — fleet</title>
 <style>
-  :root { color-scheme: light dark; --fg:#111; --dim:#6b7280; --line:#e5e7eb; --bg:#fff; --warn:#b45309; --warnbg:#fffbeb; --busy:#047857; }
-  @media (prefers-color-scheme: dark) { :root { --fg:#e5e7eb; --dim:#9ca3af; --line:#374151; --bg:#0b0f14; --warn:#fbbf24; --warnbg:#231a06; --busy:#34d399; } }
+  /* --wait is a fourth hue rather than the warning one: a session blocked on a human is not
+     a fault, and painting it amber puts it in the same column as "tarmac cannot read this". */
+  :root { color-scheme: light dark; --fg:#111; --dim:#6b7280; --line:#e5e7eb; --bg:#fff; --warn:#b45309; --warnbg:#fffbeb; --busy:#047857; --wait:#1d4ed8; }
+  @media (prefers-color-scheme: dark) { :root { --fg:#e5e7eb; --dim:#9ca3af; --line:#374151; --bg:#0b0f14; --warn:#fbbf24; --warnbg:#231a06; --busy:#34d399; --wait:#93c5fd; } }
   body { margin:0; padding:2rem 1.25rem; background:var(--bg); color:var(--fg);
          font:14px/1.5 ui-sans-serif,-apple-system,"Segoe UI",sans-serif; }
   header { display:flex; align-items:baseline; gap:1rem; flex-wrap:wrap; margin-bottom:1rem; }
@@ -377,11 +476,13 @@ export function renderPage(fleet, view = 'table') {
   .pill { display:inline-block; font-size:.8rem; font-weight:600; padding:.05rem .5rem;
           border:1px solid currentColor; border-radius:99px; white-space:nowrap; }
   .pill.busy { color:var(--busy); }
+  .pill.waiting { color:var(--wait); }
   .pill.unknown { color:var(--warn); }
   .pill.idle { color:var(--dim); font-weight:400; }
   /* The weight the sort deserves: busy rows carry an accent and a bold name. */
   td:first-child { border-left:3px solid transparent; }
   tr[data-state="busy"] td:first-child { border-left-color:var(--busy); }
+  tr[data-state="waiting"] td:first-child { border-left-color:var(--wait); }
   tr[data-state="unknown"] td:first-child { border-left-color:var(--warn); }
   tr[data-state="busy"] .project { font-weight:700; }
   /* The bar reads a magnitude at a glance; the number beside it is what is authoritative.
@@ -405,6 +506,72 @@ export function renderPage(fleet, view = 'table') {
   body[data-view="table"] .view-map { display:none; }
   body[data-view="map"] .view-table { display:none; }
 
+  /* ── the account's two windows ───────────────────────────────────────────────────────
+     In the header, because a rate limit is the account's and not a node's. Slim on purpose:
+     the fleet is what the page is about, and these two numbers are the weather it flies in.
+     Laid out with flex behind the same :not([hidden]) guard the replay containers carry —
+     the replayed pair ships hidden, and a display in a stylesheet beats the attribute. */
+  .limits:not([hidden]) { display:flex; gap:1rem; flex-wrap:wrap; align-items:center; }
+  .gauge { display:flex; align-items:baseline; gap:.35rem; font-size:.8rem; }
+  /* Not upper-cased, alone among the small labels on this page: "5H" is not an hour, and a
+     unit that has been shouted reads as a different unit. */
+  .gauge .lbl { color:var(--dim); font-weight:600; letter-spacing:.04em; }
+  .gauge .num { font-variant-numeric:tabular-nums; font-weight:650; }
+  .gauge .reset { color:var(--dim); }
+  /* Same bargain as the row bars: a glance at a magnitude, in the quiet ink of a secondary
+     fact, beside the number that is the authority. Its own class rather than .bar — that one
+     is dropped below 46rem, where a card layout gives every value the name of its column, and
+     these two have no column to be named by. */
+  .gauge .rail { display:inline-block; width:3.5rem; height:.3rem; border-radius:99px;
+          background:var(--line); align-self:center; }
+  .gauge .rail > i { display:block; height:100%; border-radius:99px; background:var(--dim); }
+  /* Nothing was measured — the dotted track of an unmeasured dial, in the shape of a bar. An
+     empty rail is what an account at 0% wears, and the two must not match. */
+  .gauge .rail.unmeasured { background:repeating-linear-gradient(90deg,var(--line) 0 2px,transparent 2px 8px); }
+  /* The live pair goes down with the live fragment: they are about now, and left up they would
+     be the one present-tense number standing over a fleet three hours old. */
+  body.replaying #limits { display:none; }
+  /* The replayed pair leads the past fleet rather than sitting on top of its totals. */
+  #replay-limits { margin-bottom:.2rem; }
+
+  /* ── the scrubber ────────────────────────────────────────────────────────────────────
+     Under the map, and only under the map: the record holds what the MAP draws, so a
+     scrubber over the table would offer a drag onto rows it cannot fill.
+     Everything here lives in the shell for the same reason the tabs do: the /live fragment is
+     swapped into innerHTML every five seconds, and a handle inside it would be dragged back
+     to the present by a poll nobody asked for. */
+  body[data-view="table"] #replay, body[data-view="table"] #replay-view { display:none; }
+  /* One fleet at a time, and the whole fragment rather than only its map: the fragment's
+     header is the LIVE count, cost and timestamp, and hiding the map alone left it sitting
+     directly above the replayed one — two totals of two different moments, the pair dated
+     with the present. The warnings above them are about the present too. The failure banner
+     is in the shell, so a refresh that breaks mid-replay still says so. */
+  body.replaying #live { display:none; }
+  /* Both of these are laid out with flex, and both are hidden by the attribute until a script
+     raises them — so the display is refused to a hidden one explicitly. The hidden attribute
+     is only a UA rule of display:none, and any display a stylesheet gives the same element
+     beats it: unguarded, this page came up announcing a replay nobody had asked for. */
+  .replay:not([hidden]) { display:flex; align-items:center; gap:.6rem; flex-wrap:wrap; margin-top:1rem;
+            padding-top:.7rem; border-top:1px solid var(--line); }
+  .replay button { font:inherit; font-size:.8rem; color:var(--fg); background:transparent;
+            border:1px solid var(--line); border-radius:99px; padding:.15rem .8rem; cursor:pointer; }
+  .replay input[type="range"] { flex:1; min-width:10rem; accent-color:var(--dim); }
+  .replay input[type="range"]:disabled { opacity:.4; }
+  /* The two things the reader has to be able to read while dragging: the minute under the
+     handle, and what the whole range covers. Tabular, so neither jitters as it counts. */
+  #replay-at { font-variant-numeric:tabular-nums; font-weight:600; }
+  .replay .covers { flex-basis:100%; color:var(--dim); font-size:.75rem; }
+  /* The banner wears the warning style on purpose: a page showing a past minute as though it were the
+     fleet is the worst thing this dashboard could do, so it wears the loudest thing it has. */
+  /* Sticky, because the handle is at the bottom of a map that can be taller than the
+     viewport: a reader dragging with the "this is the past" banner scrolled off the top is
+     a reader the banner is not warning. */
+  .replaying-note:not([hidden]) { display:flex; align-items:baseline; gap:.6rem; flex-wrap:wrap;
+            position:sticky; top:0; z-index:1; }
+  .replaying-note button { font:inherit; font-size:.75rem; font-weight:600; color:inherit;
+            background:transparent; border:1px solid currentColor; border-radius:99px;
+            padding:.05rem .7rem; cursor:pointer; }
+
   /* ── the map ─────────────────────────────────────────────────────────────────────────
      One node per session. The arc is the context, its weight is how much that reading may
      be believed, and the halo — the only thing on this page that moves — says a frame
@@ -413,6 +580,7 @@ export function renderPage(fleet, view = 'table') {
   .node { border:1px solid var(--line); border-radius:10px; padding:.8rem .85rem .7rem;
           display:flex; flex-direction:column; align-items:center; text-align:center; }
   .node[data-state="busy"] { border-color:color-mix(in srgb, var(--busy) 45%, var(--line)); }
+  .node[data-state="waiting"] { border-color:color-mix(in srgb, var(--wait) 45%, var(--line)); }
   /* An agent is a smaller body in the same system, next to the session it shares a directory
      with — never inside it. Tinted rather than outlined, and hooked, so it reads as the
      session's dependent without a line claiming a parentage the source never published. */
@@ -439,6 +607,11 @@ export function renderPage(fleet, view = 'table') {
      stroke-dasharray, which is what carries the percentage. */
   .node[data-reading="stale"] .arc, .node[data-reading="undated"] .arc {
           stroke:var(--warn); stroke-width:2.5; opacity:.7; }
+  /* A replayed reading. Its EXTENT is what the record vouches for; its age is the one thing
+     the ring never kept, so it may not wear the solid arc that means "as current as a reading
+     gets" — nor the warning hue of a stale one, which would claim the opposite. Between the
+     two: full colour, a shade lighter, and no date underneath it. */
+  .node[data-reading="undatable"] .arc { stroke-width:4; opacity:.85; }
   /* Nothing was measured. Keyed on the measurement and never on the age of the file: a
      solid empty ring is what a session measured at 0% wears, and the two must not match. */
   .track.unmeasured { stroke-dasharray:2 6; stroke-linecap:round; }
@@ -465,8 +638,12 @@ export function renderPage(fleet, view = 'table') {
   .node[data-state="busy"] .who .project { font-weight:700; }
   .shape { font-size:.7rem; color:var(--dim); }
   .node[data-state="busy"] .shape { color:var(--busy); }
+  .node[data-state="waiting"] .shape { color:var(--wait); }
   .node[data-state="unknown"] .shape { color:var(--warn); }
   .sub { color:var(--dim); font-size:.76rem; max-width:100%; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+  /* The one caption that is not a footnote: it is why this node is not working, and it sits
+     directly under the name in the state's own hue rather than in the grey of the rest. */
+  .sub.waiting-for { color:var(--wait); font-weight:600; }
   .asof { font-size:.72rem; color:var(--dim); font-variant-numeric:tabular-nums; margin-top:.15rem; }
   .asof.stale { color:var(--warn); font-weight:600; }
   @media (max-width: 30rem) { .map { grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr)); gap:.6rem; } }
@@ -483,6 +660,7 @@ export function renderPage(fleet, view = 'table') {
     tr { border:1px solid var(--line); border-left-width:3px; border-radius:8px;
          padding:.35rem .7rem; margin-bottom:.6rem; }
     tr[data-state="busy"] { border-left-color:var(--busy); }
+    tr[data-state="waiting"] { border-left-color:var(--wait); }
     tr[data-state="unknown"] { border-left-color:var(--warn); }
     td, td:first-child { border:0; padding:.2rem 0; white-space:normal;
          display:flex; justify-content:space-between; align-items:baseline; gap:1rem; }
@@ -503,6 +681,11 @@ export function renderPage(fleet, view = 'table') {
     <a href="/"${view === 'table' ? ' aria-current="page"' : ''}>Table</a>
     <a href="/map"${view === 'map' ? ' aria-current="page"' : ''}>Map</a>
   </nav>
+  <!-- The account's two windows, page-level because that is what they are: a limit belongs to
+       the account every session below is spending from, not to any one of them. Their VALUES
+       come up from the fragment on every poll (the script's limits-src copy), so the header
+       structure can be the shell's without the numbers being as old as the tab. -->
+  <div class="limits" id="limits" role="group" aria-label="account rate limits">${gauges}</div>
   <!-- Not "updated just now". If the script never runs — a policy-injected CSP without
        'unsafe-inline', a script error — that text would stand as a permanent lie, and
        <noscript> would not fire to correct it because JavaScript is enabled. The page's one
@@ -510,12 +693,42 @@ export function renderPage(fleet, view = 'table') {
   <span class="freshness"><span class="pulse" aria-hidden="true"></span><span id="age">updated &mdash;</span></span>
 </header>
 <div class="warn offline" id="offline" hidden>
-  <strong>&#9888; refresh failing</strong> — nothing below has moved since the time in the header.
+  <strong>&#9888; refresh failing</strong> — nothing on this page has moved since the time in the header.
   <span id="why"></span>
 </div>
+<!-- The one claim on this page that could be a lie, so it is the loudest element on it and it
+     carries the minute it is showing. Hidden until a script raises it: with no script there
+     is no replay, and a banner about one would be a warning about nothing. -->
+<!-- role="status" because it appears without a reload and without focus moving: drawn only,
+     it is the page's loudest claim and its most invisible one. -->
+<div class="warn replaying-note" id="replaying" role="status" hidden>
+  <strong>&#9209; replaying <span id="replay-at"></span></strong>
+  <span>&mdash; a reading from the past, not the fleet now.</span>
+  <button type="button" id="to-live">Back to live</button>
+</div>
 <noscript><div class="warn">JavaScript is off, so this page will not refresh itself. Reload it to see the fleet now.</div></noscript>
 <div id="live">${renderLive(fleet)}</div>
-<script>${SCRIPT}</script>
+<!-- Where the past is drawn: the shell's own map, in the place the live one occupies, so
+     that swapping the fragment underneath cannot repaint what the reader is scrubbing. -->
+<div id="replay-view" hidden>
+  <!-- The same pair, for the minute under the reader's hand — and here rather than in the
+       header, where the live pair sits. The banner that says "this is the past" is below the
+       header: an account drawn above it would be the one past number on the page with nothing
+       over it saying so, and the first thing a screen reader reaches, long before the warning.
+       Hidden until a script raises it: with no script there is no replay, and an empty gauge
+       would be a claim about nothing. -->
+  <div class="limits" id="replay-limits" role="group" aria-label="account rate limits, at the minute being replayed" hidden></div>
+  <div class="meta" id="replay-meta"></div>
+  <div class="map" id="replay-map"></div>
+</div>
+<!-- A dead handle is worse than no handle: this is revealed once the record is in hand, and
+     what it says it covers is whatever the record answered with. -->
+<div class="replay" id="replay" hidden>
+  <button type="button" id="play">Play</button>
+  <input type="range" id="scrub" min="0" max="0" step="1" value="0" disabled aria-label="Replay position">
+  <div class="covers" id="covers"></div>
+</div>
+<script>${pageScript(view)}</script>
 </body></html>
 `;
 }
@@ -531,9 +744,15 @@ export function renderPage(fleet, view = 'table') {
  * polled for a reader who is not there. A poll is the only one of the three where the client
  * decides — so a hidden tab simply stops asking, and a waking one asks at once.
  *
- * The page therefore owns exactly two facts: when it last heard from the server, and whether
- * the last attempt failed. Everything a reader interprets is rendered by `renderLive` on the
- * server, where the suite can reach it.
+ * The page therefore owns exactly two facts about the present: when it last heard from the
+ * server, and whether the last attempt failed. Everything a reader interprets about NOW is
+ * rendered by `renderLive` on the server, where the suite can reach it.
+ *
+ * The replay below is the one exception, and it is one the issue asks for: scrubbing a day
+ * has to be a lookup in samples the page already holds, or every pixel of a drag would be a
+ * request and a `claude agents --json` behind it. So a second, smaller renderer lives in the
+ * browser — fed the same three words, the same three glyphs and the same dial geometry as the
+ * server's, by interpolation rather than by copy, and executed by `test/replay-script`.
  */
 export const REFRESH_MS = 5000;
 /**
@@ -542,10 +761,30 @@ export const REFRESH_MS = 5000;
  * on the server side first and arrives with a real reason instead of this generic one.
  */
 const STALL_MS = 20000;
-const SCRIPT = `
+/**
+ * How fast play walks the record — one reading per step, so a serve that has seen ten minutes
+ * plays for a second and a full day for two and a half minutes. It is a step interval and not
+ * a total duration on purpose: the samples are not evenly spaced (a minute the collector
+ * missed is a minute nobody recorded), so a fixed run time would silently speed up over the
+ * gaps and make the day look busier than it was.
+ */
+const PLAY_STEP_MS = 100;
+/**
+ * The same walk for a reader who asked their system for less motion. Play is the one thing
+ * here that moves, and the honest answer to that preference is not to take the feature away —
+ * it is to stop flickering ten frames a second at someone who said that hurts.
+ */
+const PLAY_STEP_CALM_MS = 1000;
+/**
+ * A function, not a constant: it reads the vocabulary and the geometry declared below it, and
+ * it takes the view because only one of the two has a scrubber to feed.
+ */
+function pageScript(view) {
+    return `
 (function () {
   var live = document.getElementById('live'), age = document.getElementById('age');
   var off = document.getElementById('offline'), why = document.getElementById('why');
+  var limits = document.getElementById('limits');
   var last = Date.now(), failing = false, inFlight = false, since = 0, gen = 0;
 
   function ago(ms) {
@@ -607,6 +846,15 @@ const SCRIPT = `
         if (body.trim() === '') throw new Error('The server answered with an empty page.');
         if (!mineStill()) return;
         live.innerHTML = body;
+        // The account's gauges, lifted out of the fragment and into the header where they
+        // belong. Here rather than in the fragment's own place on the page because a limit is
+        // the account's and not a session's; here rather than in the shell alone because the
+        // NUMBERS arrive with the fleet, and a five-hour window that stopped counting down
+        // would be the one thing on this page still claiming to be about now.
+        // Inside the accepted-answer branch on purpose: a body that was refused is a body
+        // nothing is read out of, the account's numbers included.
+        var src = document.getElementById('limits-src');
+        if (src) limits.innerHTML = src.innerHTML;
         last = Date.now();
         failing = false;
       });
@@ -625,11 +873,340 @@ const SCRIPT = `
     });
   }
 
+  // ── the day behind the present ──────────────────────────────────────────────────────
+  //
+  // The record is asked for once, and every drag after that is a lookup in it. The state of
+  // the replay lives here rather than in the fragment for the same reason the tabs do: /live
+  // is swapped wholesale every five seconds, and the reader's hand is not the server's to move.
+
+  var replay = document.getElementById('replay'), scrub = document.getElementById('scrub');
+  var playBtn = document.getElementById('play'), covers = document.getElementById('covers');
+  var rview = document.getElementById('replay-view'), rmap = document.getElementById('replay-map');
+  var rmeta = document.getElementById('replay-meta'), note = document.getElementById('replaying');
+  var rlimits = document.getElementById('replay-limits');
+  var atEl = document.getElementById('replay-at'), toLive = document.getElementById('to-live');
+  var record = null, recordAt = 0, at = -1, replaying = false, playing = null, hgen = 0;
+
+  // The vocabulary and the geometry, handed over rather than written twice: three words for
+  // the three kinds of missing, three glyphs for the three states, one dial radius.
+  var WHY = ${JSON.stringify(CTX_WHY)}, SHAPE = ${JSON.stringify(SHAPE)};
+  var INTERACTIVE = ${JSON.stringify(INTERACTIVE)};
+  var ENT = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+  var R = ${DIAL_R}, C = 2 * Math.PI * R;
+  var STEP = typeof matchMedia === 'function' && matchMedia('(prefers-reduced-motion: reduce)').matches
+    ? ${PLAY_STEP_CALM_MS} : ${PLAY_STEP_MS};
+
+  function esc(v) {
+    if (v === null || v === undefined || v === '') return '<span class="dim">—</span>';
+    return String(v).replace(/[&<>"']/g, function (c) { return ENT[c]; });
+  }
+
+  /** A lookup that cannot be answered by Object.prototype. */
+  function own(table, key) {
+    return Object.prototype.hasOwnProperty.call(table, key);
+  }
+
+  function two(n) { return (n < 10 ? '0' : '') + n; }
+  function hhmm(t) { var d = new Date(t); return two(d.getHours()) + ':' + two(d.getMinutes()); }
+
+  // A day-long ring can straddle one midnight, and "09:14 – 08:59" reads as a span running
+  // backwards until the older edge says which day it is.
+  function edge(t, ref) {
+    return hhmm(t) + (new Date(t).getDate() === new Date(ref).getDate() ? '' : ' yesterday');
+  }
+
+  // What the range covers, in the record's own terms. Never "a day": that is the size of the
+  // ring, and a serve ten minutes old has seen ten minutes.
+  function coversText() {
+    var n = record.samples.length;
+    if (n === 0) {
+      // A record empty because every reading FAILED is not a record that has just started, and
+      // this was the one branch that threw that away: ten hours of a collector that could not
+      // run read exactly like a serve thirty seconds old.
+      return record.missed
+        ? 'Nothing recorded — this serve started at ' + hhmm(record.since) + ' and '
+          + record.missed + ' minute' + (record.missed === 1 ? '' : 's') + ' were due and never read.'
+        : 'Nothing recorded yet — this serve started at ' + hhmm(record.since)
+          + ' and takes a reading every ' + Math.round(record.cadence / 1000) + 's.';
+    }
+    var last = record.samples[n - 1].t;
+    return 'Covering ' + edge(record.since, last) + ' – ' + hhmm(last)
+      // Not "when the page loaded": the record is asked for again when a tab that has been
+      // away comes back, so the sentence names the last time this page asked rather than a
+      // moment it may be hours past.
+      + ', as this page last had it — ' + n + ' reading' + (n === 1 ? '' : 's')
+      // A gap that says it is a gap is not a gap. The handle steps through readings, not
+      // through minutes, and a record with holes in it is not a smooth walk.
+      + (record.missed ? ', ' + record.missed + ' minute' + (record.missed === 1 ? '' : 's') + ' with no reading' : '')
+      + '. The record keeps each reading, not how old that reading was, so nothing replayed here is dated.';
+  }
+
+  function ready() {
+    var n = record.samples.length;
+    replay.hidden = false;
+    covers.textContent = coversText();
+    scrub.max = String(n === 0 ? 0 : n - 1);
+    scrub.disabled = n === 0;
+    playBtn.disabled = n === 0;
+  }
+
+  // Revealed, not hidden, when the record cannot be had: a scrubber that silently never
+  // appears is indistinguishable from one this build does not have.
+  function noRecord(said) {
+    replay.hidden = false;
+    scrub.disabled = true;
+    playBtn.disabled = true;
+    covers.textContent = said;
+  }
+
+  function load() {
+    // The same generation guard the fleet poll carries, for the same reason and one more.
+    // The replaying flag is read when the tab regains focus; the answer lands later, and
+    // a reader's hand can arrive in between — so the question is asked AGAIN at the moment of
+    // the swap. Without it the record was replaced under a live scrub: the handle pointing at
+    // one minute, the map drawing another, out of a record that no longer existed.
+    var mine = ++hgen;
+    return fetch('/api/history', { cache: 'no-store' }).then(function (res) {
+      // The same refusal the fragment makes, for the same reason: what comes back is parsed
+      // and drawn into this page, and loopback proves where bytes came from, not who wrote them.
+      if (!res.headers.get('X-Tarmac')) throw new Error('The answer on this port did not come from tarmac.');
+      return res.text().then(function (body) {
+        if (!res.ok) throw new Error(body.split('\\n').filter(Boolean).join(' ').slice(0, 200));
+        var got = JSON.parse(body);
+        if (!got || !got.samples) throw new Error('the record came back in a shape this page does not know');
+        if (mine !== hgen || replaying) return;
+        record = got;
+        recordAt = Date.now();
+        ready();
+      });
+    }).catch(function (e) {
+      if (mine !== hgen) return;
+      // A refresh is not a first load. Failing one is no reason to take away a record the page
+      // is already holding — and saying "the record could not be read" over one the reader is
+      // scrubbing would be false. The fleet poll's own banner already says the server is quiet.
+      if (record !== null) return;
+      noRecord('The record could not be read — ' + String((e && e.message) || e).slice(0, 200));
+    });
+  }
+
+  // One node, out of what the ring holds and nothing more. No name, for any kind of session:
+  // a background session is named after the prompt it was given, and the ring stores none.
+  function nodeOf(x, anchored) {
+    // The map's own rule, in the map's own words: an absent kind is not evidence of an agent,
+    // and a fleet where nothing calls itself interactive is a fleet whose source moved.
+    var role = !anchored || x.kind === null || x.kind === undefined || x.kind === INTERACTIVE ? 'session' : 'agent';
+    // Own keys only. A bare read inherits from Object.prototype, so "constructor" and
+    // "toString" passed this guard and reached the markup below — into an attribute
+    // unescaped, and into the glyph slot as a function body.
+    var state = own(SHAPE, x.state) ? x.state : 'unknown';
+    var pct = typeof x.ctxPct === 'number' ? x.ctxPct : null;
+    // The ring keeps each reading and never how old that reading was, so the arc weight that
+    // says how much a reading may be believed cannot be earned here. It is not the live
+    // default either: this third value is de-weighted in the stylesheet, and never the warning
+    // hue, which would claim the opposite — that the reading is known to be old.
+    return '<article class="node" data-role="' + role + '" data-state="' + state + '" data-reading="undatable">'
+      // No halo, ever. It means a frame landed moments ago, which is never true of a sample.
+      + '<div class="dial"><svg viewBox="0 0 80 80" aria-hidden="true">'
+      + '<circle class="track' + (pct === null ? ' unmeasured' : '') + '" cx="40" cy="40" r="' + R + '"/>'
+      + (pct === null ? '' : arcOf(pct))
+      + '</svg><div class="val">'
+      + (pct === null
+        ? '<span class="why"><b>—</b>' + esc(own(WHY, x.ctxState) ? WHY[x.ctxState] : 'no reading') + '</span>'
+        : '<span class="pct">' + pct + '<i>%</i></span>')
+      + '</div></div>'
+      + '<div class="who"><span class="shape" aria-hidden="true">' + SHAPE[state] + '</span>'
+      + '<span class="sr">' + state + '</span>'
+      + '<span class="project">' + esc(x.project) + '</span></div>'
+      // The one caption the ring can fill. Guarded on the state as well as on the field: a
+      // reason left over beside another state is not a session waiting for anything, and esc()
+      // answers an absent field with a dash, which would caption a node "waiting for —".
+      + (state === 'waiting' && x.waitingFor ? '<div class="sub waiting-for">' + esc(x.waitingFor) + '</div>' : '')
+      + (x.kind === null || x.kind === undefined || x.kind === INTERACTIVE ? '' : '<div class="sub">' + esc(x.kind) + '</div>')
+      + (typeof x.costUsd === 'number' ? '<div class="sub">$' + x.costUsd.toFixed(2) + '</div>' : '')
+      + '</article>';
+  }
+
+  // The server's own arithmetic, off the server's own radius: a fraction of the real
+  // circumference, never pathLength, so a browser that ignores it cannot close every ring
+  // into a full context window.
+  function arcOf(pct) {
+    var filled = (Math.min(100, Math.max(0, pct)) / 100) * C;
+    var r2 = function (n) { return Math.round(n * 100) / 100; };
+    return '<circle class="arc" cx="40" cy="40" r="' + R + '" transform="rotate(-90 40 40)"'
+      + ' stroke-dasharray="' + r2(filled) + ' ' + r2(C - filled) + '"/>';
+  }
+
+  // ── the account, as it stood that minute ────────────────────────────────────────────
+  //
+  // The second thing this page interprets twice, and for the same reason as the dials: a
+  // replay is a lookup in samples the page already holds, and the ring holds the payload's own
+  // rate_limits rather than anything rendered. The vocabulary, the dash and the two windows are
+  // handed over below rather than written again; what is mirrored is the arithmetic, and a
+  // test compares this output with the server's character for character.
+  //
+  // What it counts the reset against is the SAMPLE's own clock, never Date.now(). A reset is a
+  // moment, and "how long is left" is a question about the minute being replayed: at 09:14 the
+  // five-hour window had two hours to run, and it had two hours to run whatever time it is now.
+  // Counted against the present, every reset in the record would read as long overdue the
+  // moment it aged past — a page announcing an account over its limit for a day that ended.
+  var LIMITS = ${JSON.stringify(LIMIT_WINDOWS)}, LIMIT_WHY = ${JSON.stringify(LIMIT_WHY)};
+  var DASH = ${JSON.stringify(dash())};
+
+  function left(ms) {
+    var m = Math.floor(ms / 60000);
+    if (m < 1) return '<1m';
+    if (m < 60) return m + 'm';
+    var h = Math.floor(m / 60);
+    if (h < 24) return m % 60 === 0 ? h + 'h' : h + 'h ' + (m % 60) + 'm';
+    var d = Math.floor(h / 24);
+    return h % 24 === 0 ? d + 'd' : d + 'd ' + (h % 24) + 'h';
+  }
+
+  function gaugesOf(rl, now) {
+    // Anything can be in a sample: rate_limits is a shape someone else versions, and the ring
+    // stored whatever the payload had. None of it may throw in the header of a dashboard.
+    var ok = rl !== null && rl !== undefined && typeof rl === 'object' && !Array.isArray(rl);
+    var html = '';
+    for (var i = 0; i < LIMITS.length; i++) {
+      var w = ok ? rl[LIMITS[i].key] : undefined;
+      var has = w !== null && w !== undefined && typeof w === 'object' && !Array.isArray(w) && 'used_percentage' in w;
+      var v = has ? w.used_percentage : undefined;
+      var pct = has && typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 100 ? Math.floor(v) : null;
+      var at = has && typeof w.resets_at === 'number' && Number.isFinite(w.resets_at) ? w.resets_at : null;
+      var ms = at === null ? null : at * 1000 - now;
+      // The server's horizon, off the server's own number: a reset further from the reading than
+      // the longest window can be is not this account's reset, whatever it says.
+      if (ms !== null && Math.abs(ms) > ${RESET_HORIZON_MS}) ms = null;
+      // Presence, never value: a window that is there and null is a number not taken yet, and
+      // one that is gone is a schema that moved. Same discriminant as everywhere else here.
+      // Read off rl and NOT off ok: rate_limits carrying something that is not a pair of
+      // windows — an array, which the snapshot reader lets through — is a schema that moved,
+      // not an account nobody measured. Written as !ok, this said the opposite of the server
+      // about the very same minute.
+      var why = pct !== null ? null : (rl === null || rl === undefined || (has && v === null)) ? 'absent' : 'drift';
+      html += '<div class="gauge"><span class="lbl" aria-hidden="true">' + LIMITS[i].label + '</span>'
+        + '<span class="sr">' + LIMITS[i].said + '</span>'
+        + (pct === null
+          ? '<span class="rail unmeasured" aria-hidden="true"></span>'
+          : '<span class="rail" aria-hidden="true"><i style="width:' + pct + '%"></i></span>')
+        + '<span class="num">' + (pct === null ? DASH : pct + '%') + '</span>'
+        + '<span class="reset">'
+        + (pct === null
+          ? LIMIT_WHY[why]
+          : ms === null
+            ? 'reset ' + DASH
+            : ms > 0 ? 'resets in ' + left(ms) : 'reset was due ' + left(-ms) + ' ago')
+        + '</span></div>';
+    }
+    return html;
+  }
+
+  function nodesOf(s) {
+    var anchored = false, html = '', i;
+    for (i = 0; i < s.sessions.length; i++) if (s.sessions[i].kind === INTERACTIVE) anchored = true;
+    // In the order the sample carries. The live map places an agent beside the session it
+    // shares a directory with; the ring holds no directory, so the past is drawn in the order
+    // the fleet was sorted in rather than in a grouping this page would have to invent.
+    for (i = 0; i < s.sessions.length; i++) html += nodeOf(s.sessions[i], anchored);
+    return html;
+  }
+
+  // The fleet of that minute, counted from that minute. A partial sum is never presented as
+  // the total, the same rule the live header follows.
+  function metaOf(s) {
+    var n = s.sessions.length, busy = 0, cost = 0, reporting = 0;
+    for (var i = 0; i < n; i++) {
+      if (s.sessions[i].state === 'busy') busy++;
+      if (typeof s.sessions[i].costUsd === 'number') { cost += s.sessions[i].costUsd; reporting++; }
+    }
+    return n + ' session' + (n === 1 ? '' : 's') + ' · ' + busy + ' busy · '
+      + (reporting === 0 ? 'cost —'
+        : '$' + cost.toFixed(2) + (reporting < n ? ' (' + reporting + '/' + n + ' reporting cost)' : ''));
+  }
+
+  function draw(i) {
+    var s = record && record.samples[i];
+    if (!s) return;
+    at = i;
+    replaying = true;
+    scrub.value = String(i);
+    // The handle's own value is an index, so a reader who cannot see the banner would be read
+    // "3" while the fleet on screen is three hours old. The minute travels with the handle.
+    scrub.setAttribute('aria-valuetext', hhmm(s.t));
+    atEl.textContent = hhmm(s.t);
+    rmeta.textContent = metaOf(s);
+    rmap.innerHTML = nodesOf(s);
+    // The account of that minute, in the place the live pair occupies — which the body class
+    // has just taken down. One allowance on screen at a time, and it is the one belonging to
+    // the fleet being shown.
+    rlimits.innerHTML = gaugesOf(s.rateLimits, s.t);
+    rlimits.hidden = false;
+    note.hidden = false;
+    rview.hidden = false;
+    document.body.classList.toggle('replaying', true);
+  }
+
+  function stopPlay() {
+    if (playing) { clearInterval(playing); playing = null; }
+    playBtn.textContent = 'Play';
+  }
+
+  // Back to now, in one gesture, with nothing of the past left behind a hidden attribute.
+  // The position is NOT reset: the handle stays where the reader let go of it, so what it
+  // shows and where play would pick up are the same place.
+  function present() {
+    stopPlay();
+    replaying = false;
+    note.hidden = true;
+    rview.hidden = true;
+    rlimits.hidden = true;
+    rlimits.innerHTML = '';
+    rmap.innerHTML = '';
+    scrub.removeAttribute('aria-valuetext');
+    document.body.classList.toggle('replaying', false);
+  }
+
+  function play() {
+    if (playing) { stopPlay(); return; }
+    if (!record || record.samples.length === 0) return;
+    // From the top when there is nothing to resume: a play button that ends where it started
+    // has played nothing.
+    draw(at < 0 || at >= record.samples.length - 1 ? 0 : at);
+    playBtn.textContent = 'Pause';
+    playing = setInterval(function () {
+      // It stops at the end rather than looping back: a day that restarts on its own is a
+      // day whose beginning and end are impossible to tell apart.
+      if (at >= record.samples.length - 1) { stopPlay(); return; }
+      draw(at + 1);
+    }, STEP);
+  }
+
+  scrub.addEventListener('input', function () { stopPlay(); draw(Number(scrub.value)); });
+  playBtn.addEventListener('click', play);
+  toLive.addEventListener('click', present);
+
   setInterval(tick, 1000);
   setInterval(function () { if (!document.hidden) poll(); }, ${REFRESH_MS});
-  document.addEventListener('visibilitychange', function () { if (!document.hidden) poll(); });
+  document.addEventListener('visibilitychange', function () {
+    if (document.hidden) return;
+    poll();
+    // The record was answered once, at load. A tab left alone all afternoon holds a record
+    // that stops where the reader's attention did — so it is asked again on the way back in.
+    // Never while a reader is scrubbing (the record under their hand is not ours to swap, and
+    // the load asks that question again when the answer lands), and never for one younger than
+    // a single slot. A record that could never be read at all is not retried here: it stays
+    // null, the guard holds, and the reader has a sentence saying so rather than a page
+    // quietly trying again forever.
+    if (!replaying && record !== null && Date.now() - recordAt >= record.cadence) load();
+  });
+  // Only where there is a scrubber to feed. The table view hides these controls in CSS, and a
+  // full ring is megabytes of session ids, projects and costs: fetching and parsing it to
+  // write a sentence into an element with display:none is a cost paid on every load of the
+  // page most people open first, for a control they cannot see.
+  if (${view === 'map'}) load();
 })();
 `;
+}
 /**
  * The sort puts busy first, unknown next, idle last. This is where that order is given its
  * weight — an accent down the row and a bold name for the ones that are working, a quiet row
@@ -641,7 +1218,7 @@ const SCRIPT = `
  */
 function renderRow(r) {
     const state = stateOf(r);
-    const word = stateWord(state, r);
+    const word = stateLabel(state, r);
     // `data-label` is not decoration: below ~46rem the columns stack, the header row is gone,
     // and a value whose column has no name is a bare "—" that could mean anything.
     // Every cell holds exactly ONE element. Stacked on a phone the label sits left and the
@@ -658,7 +1235,7 @@ function renderRow(r) {
     <td data-label="Uptime" class="num dim"><span class="v">${r.uptimeMs === null ? dash() : esc(duration(r.uptimeMs))}</span></td>
   </tr>`;
 }
-const SHAPE = { busy: '●', unknown: '▲', idle: '○' };
+const SHAPE = { busy: '●', waiting: '◐', unknown: '▲', idle: '○' };
 /**
  * The state in words, for both surfaces — derived from the state the MODEL decided, never
  * from the row a second time. Two expressions for one fact on one element is how a node ends
@@ -668,6 +1245,13 @@ const SHAPE = { busy: '●', unknown: '▲', idle: '○' };
  * of keeping it is that someone reading the page can go and find out what `compacting` means.
  */
 const stateWord = (state, r) => state === 'unknown' ? (r.status ?? 'unknown') : state;
+/**
+ * The same word with the reason attached, for the table — which has one cell per session and
+ * no room for a caption of its own. The map keeps them apart instead: the word is what a
+ * screen reader is handed in place of the glyph, and repeating the reason there would read it
+ * twice, once hidden and once out of the caption below it.
+ */
+const stateLabel = (state, r) => state === 'waiting' && r.waitingFor ? `${stateWord(state, r)} · ${r.waitingFor}` : stateWord(state, r);
 /**
  * Which kind of missing a missing percentage is. One lookup for both surfaces: the table
  * says it beside a dash, the map says it inside an empty dial, and a second copy of these
@@ -697,6 +1281,10 @@ export function renderMap(fleet) {
  * dial is no reading at all, the shape beside the name is the session's state, and the halo
  * says one landed moments ago. The words under them are the same ones the table uses for the
  * same conditions — including the halo's, which would otherwise live only in a drawing.
+ *
+ * One state brings a caption with it. A waiting session is the only one where the shape
+ * leaves a question the source can answer — which human answer it is halted on — and it is
+ * printed directly under the name, not hidden in a title attribute nobody hovers on a phone.
  */
 function renderNode({ row: r, role, state, reading, measured, pulse }) {
     // The model owns "is there a number"; this reads its verdict rather than asking the row a
@@ -722,6 +1310,7 @@ function renderNode({ row: r, role, state, reading, measured, pulse }) {
         ${pulse ? `<span class="sr">a reading just landed</span>` : ''}
       </div>
       <div class="who"><span class="shape" aria-hidden="true">${SHAPE[state]}</span><span class="sr">${esc(stateWord(state, r))}</span><span class="project">${esc(r.project)}</span></div>
+      ${state === 'waiting' && r.waitingFor ? `<div class="sub waiting-for">${esc(r.waitingFor)}</div>` : ''}
       <div class="sub">${esc(r.name)}</div>
       ${r.kind === null || r.kind === INTERACTIVE ? '' : `<div class="sub">${esc(r.kind)}</div>`}
       <div class="sub">${esc(r.model)}${r.effort === null ? '' : ` · ${esc(r.effort)}`}</div>

package/dist/schema.js

@@ -30,7 +30,7 @@
  */
 export const CHECKED_VERSIONS = {
     statusline: ['2.1.220', '2.1.226'],
-    agents: ['2.1.226'],
+    agents: ['2.1.226', '2.1.232'],
 };
 const SURFACE_LABEL = {
     statusline: 'statusline payload',

package/dist/server.js

@@ -5,6 +5,7 @@
 import http from 'node:http';
 import { reason, renderLive, renderPage } from './render.js';
 import { SOURCE_PHRASE } from './config.js';
+import { createHistory, HISTORY_CADENCE_MS } from './history.js';
 /**
  * On every answer, including the refusals and the 500s. The page swaps what this port returns
  * into `innerHTML`, and loopback proves where an answer came from, never who wrote it: a
@@ -19,8 +20,36 @@ const PAGES = new Map([
     ['/', 'table'],
     ['/map', 'map'],
 ]);
-export function createFleetServer({ collect }) {
-    return http.createServer(async (req, res) => {
+export function createFleetServer({ collect, sampleEveryMs = HISTORY_CADENCE_MS }) {
+    // What this serve has already read, kept for a day and never written down. `since` is the
+    // moment this server was made, not the first sample that landed: the span it covers is how
+    // long the process has been up, and an hour of it with nothing in it is a fact worth
+    // showing rather than an empty record pretending to be a young one.
+    const history = createHistory({ since: Date.now(), cadence: sampleEveryMs });
+    // One at a time. `claude agents --json` has a 15s deadline of its own, and a fleet slower
+    // than a slot would otherwise be answered with a queue of processes instead of one missed
+    // minute — the tick that finds a read still running counts the slot and stands down.
+    let reading = false;
+    const sample = async () => {
+        if (reading) {
+            history.miss(Date.now());
+            return;
+        }
+        reading = true;
+        try {
+            history.record(await collect());
+        }
+        catch {
+            // A collector that throws is the normal weather here: `claude` missing, a laptop that
+            // was asleep. It costs a slot and nothing else — a throw out of this timer would be an
+            // unhandled rejection, and `serve` runs unattended for hours.
+            history.miss(Date.now());
+        }
+        finally {
+            reading = false;
+        }
+    };
+    const server = http.createServer(async (req, res) => {
         // Loopback binding alone does not stop a DNS-rebinding page in the user's own browser
         // from reading /api/fleet — which carries cwd paths, session ids and costs.
         if (!isLoopbackHost(req.headers.host)) {
@@ -48,11 +77,30 @@ export function createFleetServer({ collect }) {
         // the tabs are plain links, so the view has to be somewhere a reload and a bookmark can
         // both find it. There is no second fragment — one `/live` carries both views, which is
         // what keeps them from ever showing readings of different ages.
-        if (!PAGES.has(url.pathname) && url.pathname !== '/live' && url.pathname !== '/api/fleet') {
+        if (!PAGES.has(url.pathname) &&
+            url.pathname !== '/live' &&
+            url.pathname !== '/api/fleet' &&
+            url.pathname !== '/api/history') {
             res.writeHead(404, { ...IDENTITY, 'content-type': 'text/plain; charset=utf-8' });
             res.end('not found\n');
             return;
         }
+        // Served out of the ring, above the collect below and never through it: this route is
+        // what the serve has ALREADY read, and one that collected would let a scrubber spawn
+        // `claude agents --json` on every drag of its handle.
+        if (url.pathname === '/api/history') {
+            res.writeHead(200, {
+                ...IDENTITY,
+                'content-type': 'application/json; charset=utf-8',
+                'cache-control': 'no-store',
+            });
+            // Not indented, alone among the JSON answers here. `/api/fleet` pretty-prints ONE
+            // reading, which a person reads in a terminal; this is up to 1440 of them, where the
+            // indentation is 40% of a body no human will ever open — megabytes of whitespace on
+            // every poll of the replay.
+            res.end(JSON.stringify(history.read()));
+            return;
+        }
         // Read AND render inside the guard, and send nothing until there is something to send.
         // Writing the 200 first and rendering after made the collector's failure a 500 and the
         // renderer's failure a dead daemon: the headers were already on the wire, the throw
@@ -82,6 +130,29 @@ export function createFleetServer({ collect }) {
         res.writeHead(200, { ...IDENTITY, 'content-type': type, 'cache-control': 'no-store' });
         res.end(body);
     });
+    // The sampler lives exactly as long as the serving does. Started at construction it kept
+    // reading the fleet for a server whose `listen` had refused — a port named on the command
+    // line and taken — into a ring no request could ever reach; and never cleared, it did the
+    // same for every server a suite had closed behind it.
+    //
+    // `close` is the only shutdown this module has. `tarmac serve` itself has no graceful one:
+    // Ctrl-C ends the process, which takes the timer with it. Unref'ing is the belt to that
+    // braces — it keeps the sampler from being a reason `node --test`, or anything else that
+    // embeds this server, stays alive — and it is deliberately not the thing relied on.
+    let sampler = null;
+    server.on('listening', () => {
+        if (sampler !== null)
+            return;
+        sampler = setInterval(() => void sample(), sampleEveryMs);
+        sampler.unref();
+    });
+    server.on('close', () => {
+        if (sampler === null)
+            return;
+        clearInterval(sampler);
+        sampler = null;
+    });
+    return server;
 }
 /**
  * How far past a port NOBODY CHOSE `serve` may walk. A corridor, not a search: wide enough

package/dist/sessions.js

@@ -27,6 +27,15 @@ const KNOWN_STATUS = new Map([
     ['working', true],
     ['done', false],
 ]);
+/**
+ * The word for a session halted until a human answers, and the only one with a field saying
+ * which answer. It stays out of the map above — the boolean it would have to fill still has
+ * no honest value — but it is no longer counted as a word we failed to recognise: it has a
+ * state of its own on both surfaces, and a reason to print beside it.
+ */
+const WAITING = 'waiting';
+/** Whether this reading is halted on a human. The one status the renderers treat as a state. */
+export const isWaiting = (s) => s.status === WAITING;
 /** @param text raw stdout of `claude agents --json` */
 export function parseAgents(text) {
     let raw;
@@ -54,7 +63,11 @@ export function parseAgents(text) {
         // is what the dispatcher believes about an agent whose process may not be on this machine.
         const status = typeof entry.status === 'string' ? entry.status : typeof entry.state === 'string' ? entry.state : null;
         const busy = KNOWN_STATUS.has(status) ? KNOWN_STATUS.get(status) : null;
-        if (busy === null)
+        // Two different questions, and only the second one is a blind spot: `busy` is null here
+        // for a word we cannot answer the boolean with, and `waiting` is one of those — while
+        // being a word this tool knows by name. Counting it would put "reports a status tarmac
+        // does not know" on the banner over a session tarmac is drawing, captioned, as waiting.
+        if (busy === null && status !== WAITING)
             health.unknownStatus += 1;
         sessions.push({
             sessionId,
@@ -64,6 +77,7 @@ export function parseAgents(text) {
             kind: typeof entry.kind === 'string' ? entry.kind : null,
             startedAt: typeof entry.startedAt === 'number' ? entry.startedAt : null,
             status,
+            waitingFor: typeof entry.waitingFor === 'string' ? entry.waitingFor : null,
             busy,
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrrr/tarmac",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Fleet observability for Claude Code — reads documented surfaces only, never an internal format",
   "keywords": [
     "claude",
@@ -36,7 +36,7 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "npm run clean && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json",
-    "test": "npm run typecheck && node --test \"test/*.test.ts\"",
+    "test": "npm run typecheck && node --test --test-timeout=120000 --test-force-exit \"test/*.test.ts\"",
     "fixtures:capture": "node scripts/capture-fixtures.ts",
     "prepack": "npm run build",
     "prepublishOnly": "npm run build && TARMAC_REQUIRE_DASH=1 npm test && node dist/cli.js --help > /dev/null"