agent-dag 3.0.0 → 3.2.0

package/README.md

@@ -68,6 +68,39 @@ What the deck does write, and the short list of what does leave the machine, is
 - Node.js ≥ 18 — macOS, Linux and Windows
 - Claude Code CLI or OpenAI Codex CLI (or both)
 - Optional: [claude-swap](https://pypi.org/project/claude-swap/) for the Accounts panel; the deck can install it for you
+- Nothing else. On Apple Silicon the deck fetches [`macmon`](https://github.com/vladkens/macmon) itself for the temperature rows; see below.
+
+### Temperature, per machine
+
+The machine panel shows a **Thermal** section only where the machine actually answers, and it never invents a reading — no sensor means no row.
+
+| | reads | needs |
+| --- | --- | --- |
+| Linux | `/sys/class/hwmon` | nothing |
+| Windows | the `Thermal Zone Information` performance counter | nothing — where the machine has an ACPI thermal zone. Many do not; see below |
+| macOS, Intel | `ioreg` for the GPU, `pmset -g therm` for throttling | nothing |
+| macOS, Apple Silicon | `macmon`, which the deck fetches for you | nothing |
+
+Apple Silicon is the one that needs a tool, and it is not an oversight. No command that ships with macOS prints a temperature on an M-series Mac: `powermetrics` needs root, `pmset -g therm` records nothing there, and the sensors sit behind a private API that only native code can call. [`macmon`](https://github.com/vladkens/macmon) reads them without `sudo` and covers M1 through M5.
+
+You do not have to install it. The deck downloads the published binary into `~/.agents-deck/tools/macmon` — the same place it already keeps `uv` — verifies it against the SHA-256 the GitHub release publishes, checks that it runs, and only then uses it. Not through Homebrew, because a machine without Homebrew would need Homebrew installed first, and that is a large thing to do to somebody who asked for a dashboard. It happens in the background, after the deck is already up, and never on the first run's critical path.
+
+It is skipped entirely on a machine that already answers — an Intel Mac never downloads anything — and on one where you have `macmon` yourself, which is found on either Homebrew prefix. `AGENTS_DECK_NO_DOWNLOAD=1` turns it off on its own; `AGENTS_DECK_NO_INSTALL=1` turns it off along with everything else.
+
+#### Windows, and why it is often blank
+
+Windows is the platform where this most often shows nothing, and that is not a defect in the deck. Measured on a physical Windows 11 laptop — a Lenovo IdeaPad L340, Intel i5-9300H, English install, checked both as an ordinary user and as an administrator:
+
+- its firmware declares **zero** ACPI thermal zones, so the performance counter above is registered but has no instances
+- `MSAcpi_ThermalZoneTemperature` answers `Not supported` **even to an administrator**
+- `Win32_TemperatureProbe` exists but every field reads `32768`, which is WMI's value for "unknown"
+- the sensors are real and actively managed — Intel Dynamic Tuning is running — but it publishes them in `root\WMI EsifDeviceInformation`, which is **Access denied** without administrator
+
+That is a class of machine, not a fault: modern Intel laptops moved thermal management into Intel DTT and stopped declaring the ACPI zones that Windows exposes to ordinary programs. There is no standard user-mode Windows API for CPU temperature — which is why HWiNFO, Core Temp and LibreHardwareMonitor all install a kernel driver, and why this deck does not.
+
+Where the counter does have instances — many desktop boards, servers, and older laptops — it is read without any privileges at all. Its path is currently English-only; see [#747](https://github.com/BarganConstantin/ccdeck/issues/747).
+
+One thing does work on the machines above, and it costs you nothing to have: if **LibreHardwareMonitor** happens to be running with its web server on, the deck reads its numbers over plain HTTP on localhost, which needs no privileges. That is a read, not a request — the deck does not install it, will not ask you to, and shows no section if it is not there. It is mentioned only so nobody is surprised to see degrees appear on a machine that had none.
 
 ## How it works
 

package/bin/deck.js

@@ -11,11 +11,12 @@ import { dieOfSignal, dieWithParent } from "../src/server/supervisor.mjs";
 import { isPortValue, parseArgs } from "../src/server/args.mjs";
 import {
   CURSOR_HIDE, CURSOR_SHOW, colorProfile, fit, glyphs, labelColumn, link, motionOK, oneLine,
-  palette, pulseText, spinnerFrames, statusLine, supportsHyperlinks, termColumns, unicodeOK,
-  unregisteredDetail, wordmark,
+  palette, pulseDot, pulseText, spinnerFrames, statusLine, supportsHyperlinks, termColumns,
+  elapsedSuffix, unicodeOK, unregisteredDetail, visibleWidth, wordmark,
 } from "../src/server/term.mjs";
 import { PRODUCT } from "../src/server/brand.mjs";
 import { invokedName, renameNotice } from "../src/server/invoked-as.mjs";
+import { budget, bootDeadlineMs } from "../src/server/boot-deadline.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, "..");
@@ -245,6 +246,20 @@ const cols = () => termColumns(process.stdout);
 const sleep = ms => new Promise(r => setTimeout(r, ms));
 const fileLink = (path) => link(path, pathToFileURL(path).href, LINKS);
 
+/**
+ * What is still happening after the report ended, in three words or so.
+ *
+ * #742 left one job able to outlive the boot — an install of claude-swap that
+ * the report stopped waiting for — and the terminal said nothing about it once
+ * the rows were done. That is the wrong way round: the row that had finished
+ * was the one blinking, and the thing that really was working sat still. Now
+ * the pulse line carries the label while the job runs and drops it when the job
+ * settles, which is also what decides whether the line moves at all. Declared
+ * here rather than beside `registered` below, because reportStartup sets it and
+ * runs long before that line does.
+ */
+let pulseBusy = null;
+
 // ── the cursor ────────────────────────────────────────────────────────────────
 // Hidden for as long as anything of ours is moving — the reveal, the spinner,
 // the pulse — and put back on every way out of this process: the ordinary exit,
@@ -288,31 +303,72 @@ function row({ mark = " ", tone = P.ok, label = "", detail = "", detailTone = P.
 }
 
 // ── the wordmark ──────────────────────────────────────────────────────────────
+
+/**
+ * Hold anything else that wants to speak until the art is finished.
+ *
+ * #742, found while watching a first run through a pty: the startup jobs run
+ * UNDER the reveal on purpose, and one of them failing writes to console.error
+ * the moment it fails — which put
+ *
+ *     ccdeck ccusage: install failed: npm install ccusage failed: spawn npm ENOENT
+ *
+ * between the second and third rows of the logo. A wordmark with a stack of
+ * someone else's bad news through the middle of it is the first thing a new
+ * user sees, and it reads as a crash rather than as a note.
+ *
+ * The window is the reveal and nothing else — about 180ms — so at worst a
+ * message arrives a fifth of a second later than it would have, on the one
+ * stretch of the boot where there is nowhere for it to go. Restored in a
+ * `finally`, so a throw inside the reveal cannot leave the process mute.
+ */
+function holdConsole() {
+  const held = [];
+  const real = { warn: console.warn, error: console.error, log: console.log };
+  for (const k of Object.keys(real)) console[k] = (...args) => { held.push([k, args]); };
+  return () => {
+    Object.assign(console, real);
+    for (const [k, args] of held) real[k](...args);
+  };
+}
+
 async function printBanner() {
   const { lines } = wordmark({ columns: cols(), version: PKG_VERSION, profile: PROFILE, unicode: UNICODE, pal: P });
-  for (const line of lines) {
-    write(line + "\n");
-    // A reveal, not a wait. The once-per-session work is already running under
-    // it (see startupWork), so the art costs the boot nothing and the deck is
-    // ready about when the last row lands. What used to be here — 560ms of
-    // spinner at "loading…" before a single art line — was dead time in a tool
-    // whose documented entry point is `npx ccdeck`.
-    if (MOTION && line) await sleep(45);
+  const release = holdConsole();
+  try {
+    for (const line of lines) {
+      write(line + "\n");
+      // A reveal, not a wait. The once-per-session work is already running under
+      // it (see startupWork), so the art costs the boot nothing and the deck is
+      // ready about when the last row lands. What used to be here — 560ms of
+      // spinner at "loading…" before a single art line — was dead time in a tool
+      // whose documented entry point is `npx ccdeck`.
+      if (MOTION && line) await sleep(45);
+    }
+  } finally {
+    release();
   }
 }
 
 // ── a step, with a spinner only if it is slow enough to need one ──────────────
 // The interval's first frame is 80ms away, so anything already settled when we
 // get here paints nothing at all and the row below is the only trace of it.
+
 async function step(label, work) {
   if (!MOTION) return work;
   const frames = spinnerFrames(UNICODE);
   // Kept inside the terminal: a label that wraps is a label the \r below can
   // only half erase, and what is left of it stays under the row that follows.
-  const text = fit(label, cols() - 6, G.ellipsis);
+  // Six columns for the indent and the spinner, four more so the elapsed
+  // seconds have somewhere to go without pushing the label off the edge.
+  const text = fit(label, cols() - 10, G.ellipsis);
+  const started = Date.now();
   let i = 0;
+  let widest = 0;
   const iv = setInterval(() => {
-    write(`\r  ${P.accent}${frames[i++ % frames.length]}${P.reset}  ${P.muted}${text}${P.reset}`);
+    const line = `  ${P.accent}${frames[i++ % frames.length]}${P.reset}  ${P.muted}${text}${elapsedSuffix(Date.now() - started)}${P.reset}`;
+    widest = Math.max(widest, visibleWidth(line));
+    write(`\r${line}`);
   }, 80);
   try {
     return await work;
@@ -320,8 +376,10 @@ async function step(label, work) {
     clearInterval(iv);
     // Cleared rather than overwritten: the row that follows is a different
     // length, and relying on it to be the longer of the two is how a spinner
-    // leaves its own tail on screen. Nothing to clear if it never painted.
-    if (i) write("\r" + " ".repeat(text.length + 5) + "\r");
+    // leaves its own tail on screen. Measured rather than computed, because the
+    // line grows when the elapsed seconds appear and again when they reach two
+    // digits. Nothing to clear if it never painted.
+    if (i) write("\r" + " ".repeat(widest) + "\r");
   }
 }
 
@@ -357,10 +415,20 @@ function startupWork() {
   // panel useless even when the tool is there — so the account already signed
   // in is registered once. Bounded inside seedFirstAccount: empty store only,
   // once ever, never with NO_INSTALL set.
+  //
+  // `cswapInstalling` is the other half, and it is what keeps a first run from
+  // spending the boot's whole deadline on a question that has already been
+  // answered: ensureCswap resolves it the moment it commits to an install, so
+  // the report can stop waiting then rather than eight seconds later. It never
+  // settles on the machines where there is nothing to install, which is every
+  // machine after the first run.
+  let sayInstalling;
+  const cswapInstalling = new Promise(r => { sayInstalling = r; });
+
   const cswap = (async () => {
     if (!wantClaude) return null;
     const { ensureCswap } = await import(pathToFileURL(join(PKG_ROOT, "src/server/cswap-install.mjs")).href);
-    const cs = await ensureCswap();
+    const cs = await ensureCswap({ onInstalling: () => sayInstalling() });
     const usable = cs.state === "present" || cs.state === "installed" || cs.state === "upgrading";
     if (!usable) return { cs, seed: null };
     const { seedFirstAccount } = await import(pathToFileURL(join(PKG_ROOT, "src/server/claude-accounts.mjs")).href);
@@ -390,12 +458,17 @@ function startupWork() {
     new Promise(r => setTimeout(() => r(null), 1200)),
   ]);
 
-  return { hooks, cswap, ccusage, update };
+  return { hooks, cswap, cswapInstalling, ccusage, update };
 }
 
 /** The same work, said out loud, in a fixed order — a boot whose rows arrive in
  *  whatever order the network settled is a boot nobody can scan twice. */
 async function reportStartup(jobs) {
+  // What the whole report may spend waiting, shared by every job under it
+  // rather than granted to each — four jobs at eight seconds each is a
+  // thirty-two second boot that no individual deadline would object to.
+  const left = budget(bootDeadlineMs());
+
   write(row({
     mark: G.ok, label: "workspace",
     detail: workspace === "" ? "(all)" : workspace,
@@ -435,22 +508,96 @@ async function reportStartup(jobs) {
     write(row({ label: "Codex sessions", detail: `skipped ${G.dash} no ~/.codex/, or --no-codex` }));
   }
 
-  const swap = await step(`checking claude-swap${G.ellipsis}`, jobs.cswap);
+  // Bounded, because this is the job that made a first boot look hung: on a
+  // machine with neither claude-swap nor a Python toolchain it fetches a uv
+  // binary and then builds an environment with it, and the report used to wait
+  // out both. See src/server/boot-deadline.mjs. Nothing is cancelled — the
+  // install carries on and says how it went when it knows.
+  const swapWait = await step(`checking claude-swap${G.ellipsis}`, Promise.race([
+    left.within(jobs.cswap),
+    // The install announcing itself. Not a timeout — a decision, arriving in
+    // about a second on the boot that would otherwise have paid the full
+    // deadline for news it already had.
+    jobs.cswapInstalling.then(() => ({ done: false, installing: true })),
+  ]));
+  if (swapWait.done) writeSwapRows(swapWait.value);
+  else {
+    write(row({
+      label: "claude-swap",
+      // Both halves earn their place, and both have to survive an 80-column
+      // terminal: what the job is doing, and that waiting for it is not the
+      // user's problem. The row that only said the first is the row this
+      // replaces — a spinner at "checking claude-swap…" says that much.
+      detail: swapWait.installing
+        ? `installing in the background ${G.dash} the deck is ready`
+        : `still setting up ${G.dash} the deck is ready`,
+    }));
+    // Handed to the pulse line, which is the only thing still on screen once
+    // the rows are done — and taken back the moment the job settles, whichever
+    // way it settled.
+    pulseBusy = swapWait.installing ? "installing claude-swap" : "setting up claude-swap";
+    jobs.cswap.then(
+      late => { pulseBusy = null; writeSwapRows(late, { late: true }); },
+      () => { pulseBusy = null; },
+    );
+  }
+
+  const cu = await left.within(jobs.ccusage);
+  writeCcusageRow(cu.done ? cu.value : null);
+
+  const upgrade = await jobs.update;
+  if (upgrade) {
+    write(row({
+      mark: G.up, tone: P.warn, label: "update",
+      detail: `v${upgrade.notice.to} available ${G.dash} ${upgrade.command}`,
+    }));
+  }
+
+  // Which name this deck was started under, when that is knowable — a notice,
+  // never a refusal. 95% of installs are on the two old names and the update
+  // path runs through this very process, so a build that declined to boot under
+  // one of them would kill the deck on the machine where the deck is what would
+  // have explained why. Nothing at all is printed wherever the typed name
+  // cannot be proven (a Windows global install, a git checkout): telling
+  // somebody who already types `ccdeck` to type `ccdeck` is the one failure
+  // that would make this row worth ignoring. See src/server/invoked-as.mjs.
+  const rename = renameNotice({ invoked: INVOKED_AS, pkgRoot: PKG_ROOT, dash: G.dash });
+  if (rename) {
+    write(row({ mark: G.warn, tone: P.warn, label: "name", detail: rename.said }));
+    // The line that carries the value: for a global install there is nothing to
+    // install and nothing to download, only six different characters to type.
+    write(row({ label: "", detail: rename.fix }));
+  }
+}
+
+/**
+ * The claude-swap rows, wherever in the boot they end up being printed.
+ *
+ * `late` is the one difference, and it is not cosmetic: by the time a late row
+ * arrives the pulse indicator owns the last line and repaints it with `\r`, so
+ * a row written without a newline first would be drawn over on the next beat.
+ * Every other thing that speaks after boot — reportUnregistered,
+ * reportReregistered — opens with the same newline for the same reason.
+ */
+function writeSwapRows(swap, { late = false } = {}) {
   const cs = swap?.cs;
+  // Collected rather than written one at a time, because a late report opens
+  // with a newline and there is exactly one of those however many rows follow.
+  let out = "";
   if (!wantClaude) {
     // claude-swap is a Python tool that switches Claude Code accounts, and the
     // deck used to fetch a uv binary to install it on machines with no Claude
     // Code at all. Saying so is the point of the row: it is the one place a
     // user can learn that the accounts panel is missing on purpose.
-    write(row({ label: "claude-swap", detail: `skipped ${G.dash} accounts are Claude-only` }));
+    out += row({ label: "claude-swap", detail: `skipped ${G.dash} accounts are Claude-only` });
   } else if (cs?.state === "present") {
-    write(row({ mark: G.ok, label: "claude-swap", detail: `v${cs.version} (accounts panel enabled)` }));
+    out += row({ mark: G.ok, label: "claude-swap", detail: `v${cs.version} (accounts panel enabled)` });
   } else if (cs?.state === "installed") {
-    write(row({ mark: G.ok, label: "claude-swap", detail: `installed v${cs.version} via ${cs.via}` }));
+    out += row({ mark: G.ok, label: "claude-swap", detail: `installed v${cs.version} via ${cs.via}` });
   } else if (cs?.state === "upgrading") {
-    write(row({ mark: G.ok, label: "claude-swap", detail: `v${cs.version}, upgrading to v${cs.latest} in background` }));
+    out += row({ mark: G.ok, label: "claude-swap", detail: `v${cs.version}, upgrading to v${cs.latest} in background` });
   } else if (cs?.state === "skipped") {
-    write(row({ mark: G.ok, label: "claude-swap", detail: "not installed (AGENTS_DECK_NO_INSTALL=1)" }));
+    out += row({ mark: G.ok, label: "claude-swap", detail: "not installed (AGENTS_DECK_NO_INSTALL=1)" });
   } else {
     const how = cs?.reason === "no_installer"
       ? `not installed ${G.dash} the accounts panel needs it`
@@ -459,19 +606,32 @@ async function reportStartup(jobs) {
             process.platform === "win32" ? "%USERPROFILE%\\.local\\bin" : "~/.local/bin"
           }`
         : `install failed${cs?.via ? ` via ${cs.via}` : ""}`;
-    write(row({ mark: G.fail, tone: P.warn, label: "claude-swap", detail: how }));
+    out += row({ mark: G.fail, tone: P.warn, label: "claude-swap", detail: how });
     // A URL is not an answer when someone just wants the panel to work. Print
     // the command for THIS machine, picked from what is already on it.
-    if (cs?.hint) write(row({ label: "", detail: cs.hint }));
+    if (cs?.hint) out += row({ label: "", detail: cs.hint });
   }
 
   if (swap?.seed?.state === "added") {
-    write(row({ mark: G.ok, label: "accounts", detail: "registered the signed-in account (cswap add)" }));
+    out += row({ mark: G.ok, label: "accounts", detail: "registered the signed-in account (cswap add)" });
   } else if (swap?.seed?.state === "failed" || swap?.seed?.state === "nothing-to-add") {
-    write(row({ label: "accounts", detail: `panel empty ${G.dash} sign in to Claude Code, then run cswap add` }));
+    out += row({ label: "accounts", detail: `panel empty ${G.dash} sign in to Claude Code, then run cswap add` });
   }
 
-  const cu = await jobs.ccusage;
+  write(late ? "\n" + out : out);
+}
+
+/**
+ * The ccusage row.
+ *
+ * `null` covers both of the ways there is nothing to say — the job was not
+ * attempted, and the job had not answered by the time the boot's deadline ran
+ * out. Neither deserves a row: unlike claude-swap there is no install to wait
+ * for here, because primeCcusage starts one and returns without it, so a
+ * ccusage that is slow to answer is slow at resolving a path and will be
+ * resolved again the first time the usage modal is opened.
+ */
+function writeCcusageRow(cu) {
   if (cu?.state === "present") write(row({ mark: G.ok, label: "ccusage", detail: `v${cu.version}` }));
   else if (cu?.state === "updating") write(row({ mark: G.ok, label: "ccusage", detail: `v${cu.version}, checking for update` }));
   // A ccusage the user provided, named rather than versioned — reading a
@@ -481,30 +641,6 @@ async function reportStartup(jobs) {
   // with a managed install AND a PATH copy could not answer before #433.
   else if (cu?.state === "user") write(row({ mark: G.ok, label: "ccusage", detail: `your own copy ${G.dash} ${cu.bin}` }));
   else if (cu?.state === "installing") write(row({ mark: G.ok, label: "ccusage", detail: "installing in background" }));
-
-  const upgrade = await jobs.update;
-  if (upgrade) {
-    write(row({
-      mark: G.up, tone: P.warn, label: "update",
-      detail: `v${upgrade.notice.to} available ${G.dash} ${upgrade.command}`,
-    }));
-  }
-
-  // Which name this deck was started under, when that is knowable — a notice,
-  // never a refusal. 95% of installs are on the two old names and the update
-  // path runs through this very process, so a build that declined to boot under
-  // one of them would kill the deck on the machine where the deck is what would
-  // have explained why. Nothing at all is printed wherever the typed name
-  // cannot be proven (a Windows global install, a git checkout): telling
-  // somebody who already types `ccdeck` to type `ccdeck` is the one failure
-  // that would make this row worth ignoring. See src/server/invoked-as.mjs.
-  const rename = renameNotice({ invoked: INVOKED_AS, pkgRoot: PKG_ROOT, dash: G.dash });
-  if (rename) {
-    write(row({ mark: G.warn, tone: P.warn, label: "name", detail: rename.said }));
-    // The line that carries the value: for a global install there is nothing to
-    // install and nothing to download, only six different characters to type.
-    write(row({ label: "", detail: rename.fix }));
-  }
 }
 
 // Asking the supervisor to bring us back. It is the only party that can, and
@@ -533,11 +669,13 @@ let upgradeTimer = null;
 // So an ask that arrives too early is held rather than run: the user asked for
 // something this deck can genuinely give a moment later, and refusing outright
 // would put back the same silence in a politer form. BOOT_RESTART_MS is the
-// outer bound, for the reason UPGRADE_ANSWER_MS above is one — and since #483
-// moved the listen in front of the report, it is a bound that gets used: a boot
-// waiting out a real `uv tool install` is minutes long, and the restart is the
-// right answer to it rather than a casualty of it. Ten seconds in, the ask is
-// run; the respawn skips the report entirely and is up in about a second.
+// outer bound, for the reason UPGRADE_ANSWER_MS above is one. It used to be a
+// bound that got used — before #742 the report waited out a real `uv tool
+// install`, so the window it covers was minutes wide. It is now the boot
+// deadline plus the browser spawn, comfortably inside ten seconds, and this
+// stays as the thing that makes that a fact rather than a belief. Ten seconds
+// in, the ask is run; the respawn skips the report entirely and is up in about
+// a second.
 let booted = false;
 let heldRestart = null;
 let bootTimer = null;
@@ -831,9 +969,14 @@ await discovery.check();
 // Never on a respawn: the tab that asked for the restart is still open and
 // reconnecting on its own. A second one would be the deck talking over itself.
 if (openBrowser && !RESPAWN) {
+  // Not awaited, and not a dependency any more. `open@10` was this package's
+  // only runtime dependency and brought nine more with it, all of them fetched
+  // on a cold `npx ccdeck` before the deck's own tarball is unpacked — and the
+  // await under it held the boot behind a launcher that has nothing to report.
+  // See src/server/open-url.mjs.
   try {
-    const { default: open } = await import("open");
-    await open(url);
+    const { openUrl } = await import(pathToFileURL(join(PKG_ROOT, "src/server/open-url.mjs")).href);
+    openUrl(url);
   } catch {}
 }
 
@@ -844,17 +987,79 @@ if (openBrowser && !RESPAWN) {
 // would leave the message behind and pulse into empty space. Sized to the real
 // terminal, because at 40 columns the old fixed 61-character line wrapped, and
 // from then on \r only ever reached its second row.
+//
+// AND IT STOPS MOVING (#742). The dot alternated green and grey every 800ms for
+// as long as the deck ran, and a blinking indicator beside a status line is the
+// vocabulary of "working on it" — so a boot that finished in a second read as
+// one that never finished, which is what people reported. Motion is now spent
+// on the two states where something really is outstanding, and the frame is
+// compared against what is already on screen so a deck at rest paints once and
+// then leaves the terminal alone. See pulseMoves.
 if (MOTION) {
   let pi = 0;
+  let painted = null;
+  // The line is on screen and is the last thing written to this terminal.
+  let ours = false;
+  // We are the one writing right now, so the guard below leaves us alone.
+  let writing = false;
+
+  // The pulse line's tenancy, enforced rather than agreed.
+  //
+  // The convention was that anything with something to say writes a newline
+  // first, so the pulse's `\r` never lands on somebody else's text. bin/deck.js
+  // keeps it everywhere. src/server/quota.mjs does not — it calls console.error
+  // directly — and a Windows user with no Claude Code sent a screenshot of the
+  // result: `listening — Ctrl+C to stop        ccdeck quota: claude CLI failed`
+  // on one row, three times over, the pulse and the complaint interleaved.
+  //
+  // An invariant every writer has to remember is one a writer will forget, and
+  // the writers here are server modules that know nothing about a terminal. So
+  // it is enforced at the stream instead: while our line is the last thing on
+  // screen, anything else that speaks gets a newline first, and the memo is
+  // dropped so the next beat repaints the line under whatever was said.
+  //
+  // Both streams, because console.error goes to stderr and lands on the same
+  // screen. Only when MOTION is on — with no pulse there is no line to defend,
+  // and a piped deck must not have its output rewritten.
+  for (const stream of [process.stdout, process.stderr]) {
+    const real = stream.write.bind(stream);
+    stream.write = (chunk, ...rest) => {
+      if (!writing && ours) {
+        ours = false;
+        // Dropped, not kept: the line is no longer where we left it, so the
+        // next beat has to draw it again even though the frame is unchanged.
+        painted = null;
+        // Unless the speaker already did it. Every late message in this file
+        // opens with one, and two blank lines is its own kind of mess.
+        if (!String(chunk).startsWith("\n")) real("\n");
+      }
+      return real(chunk, ...rest);
+    };
+  }
+
   setInterval(() => {
     // The colour follows the words. A Codex-only deck keeps saying "listening"
     // when it is unregistered — see pulseText — and painting that sentence in
     // the warning tone would restore the alarm the sentence just retired.
     const alarm = !registered && wantClaude;
-    const text = pulseText({ registered, claude: wantClaude, columns: cols(), unicode: UNICODE });
-    const dot = pi++ % 2 === 0 ? (alarm ? P.warn : P.ok) : P.muted;
+    const state = { registered, claude: wantClaude, busy: pulseBusy };
+    const text = pulseText({ ...state, columns: cols(), unicode: UNICODE });
+    // At rest every beat is lit, which is what makes the line still: the frame
+    // is then identical to the one already on screen and the write below is
+    // skipped. See pulseDot.
+    const dot = pulseDot(pi++, state) === "on" ? (alarm ? P.warn : P.ok) : P.muted;
     const tone = alarm ? P.warn : P.muted;
-    write(`\r  ${dot}${G.pulse}${P.reset}  ${tone}${text}${P.reset}`);
+    const frame = `\r  ${dot}${G.pulse}${P.reset}  ${tone}${text}${P.reset}`;
+    // Unchanged frames are not written at all. That is what makes "at rest"
+    // visible: one paint, and then a still line for as long as nothing happens.
+    // `painted` is dropped by the guard above whenever somebody else writes, so
+    // this can only skip a beat while the line is genuinely still where we left
+    // it.
+    if (frame === painted) return;
+    painted = frame;
+    writing = true;
+    try { write(frame); } finally { writing = false; }
+    ours = true;
   }, 800).unref();
 }