agent-tempo 1.7.0-beta.10 → 1.7.0-beta.12

package/README.md

@@ -148,7 +148,7 @@ agent-tempo                    # launch TUI (auto-provisions on first run)
 agent-tempo up [ensemble]      # provision infrastructure and launch conductor
 agent-tempo down [--destroy]   # tear down infrastructure (--destroy also terminates workflows)
 agent-tempo status [ensemble]  # list active sessions
-agent-tempo destroy <ensemble> # terminate all sessions in an ensemble
+agent-tempo destroy [ensemble] # terminate all sessions in an ensemble (defaults to "default")
 agent-tempo restore <ensemble> # restore orphaned sessions on this host
 agent-tempo hosts              # list daemons polling this Temporal namespace (--all/--json)
 agent-tempo recall <name>      # read a player's message history (--limit/--offset/--preview/--json)

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "1.7.0-beta.10",
+  "version": "1.7.0-beta.12",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/cli/commands.d.ts

@@ -51,6 +51,19 @@ interface UpOpts extends CliOverrides {
      */
     scenario?: string;
 }
+/**
+ * #832 — the operator-facing "ensemble ready" lines for `up` / `conduct`.
+ *
+ * Keyed on the RESOLVED ensemble name (what `command-center` / `status` take —
+ * `--ensemble` flag > positional > env > `default`), NOT the lineup's `name:`
+ * field. The two diverge whenever any of those overrides the lineup name, so the
+ * old `Ensemble <lineup-name> is ready` line named a thing the operator can't
+ * actually `connect` to. Surfaces the connect command so the next step is one
+ * copy-paste away. Pure + exported for unit testing (the surrounding `up` does
+ * I/O and isn't unit-testable). The shared markdown {@link ensembleReadyBanner}
+ * stays lineup-keyed for the conductor's seeded directive (a different surface).
+ */
+export declare function formatEnsembleReadyLines(ensemble: string, lineupName: string, playerCount: number): [readyLine: string, connectLine: string];
 export declare function up(opts: UpOpts): Promise<void>;
 /**
  * Format a `ScheduleEntry` recurrence for the `status` display.

package/dist/cli/commands.js

@@ -37,6 +37,7 @@ exports.status = status;
 exports.init = init;
 exports.initProject = initProject;
 exports.server = server;
+exports.formatEnsembleReadyLines = formatEnsembleReadyLines;
 exports.up = up;
 exports.formatScheduleRecurrence = formatScheduleRecurrence;
 exports.lineupScheduleToEntry = lineupScheduleToEntry;
@@ -710,7 +711,10 @@ async function start(opts) {
     out.log(`\nCheck status: ${out.dim('agent-tempo status ' + opts.ensemble)}`);
     if (startLineup && startInitialStartup) {
         console.log();
-        out.log(`  ${(0, constants_1.ensembleReadyBanner)(startLineup.name, startLineup.players.length)}`);
+        // #832 — name the RESOLVED ensemble (opts.ensemble), not the lineup's `name:`.
+        const [readyLine, connectLine] = formatEnsembleReadyLines(opts.ensemble, startLineup.name, startLineup.players.length);
+        out.success(readyLine);
+        out.log(`  ${out.dim(connectLine)}`);
     }
 }
 async function status(opts) {
@@ -1036,6 +1040,25 @@ async function server(opts) {
         out.success('Temporal ready');
     }
 }
+/**
+ * #832 — the operator-facing "ensemble ready" lines for `up` / `conduct`.
+ *
+ * Keyed on the RESOLVED ensemble name (what `command-center` / `status` take —
+ * `--ensemble` flag > positional > env > `default`), NOT the lineup's `name:`
+ * field. The two diverge whenever any of those overrides the lineup name, so the
+ * old `Ensemble <lineup-name> is ready` line named a thing the operator can't
+ * actually `connect` to. Surfaces the connect command so the next step is one
+ * copy-paste away. Pure + exported for unit testing (the surrounding `up` does
+ * I/O and isn't unit-testable). The shared markdown {@link ensembleReadyBanner}
+ * stays lineup-keyed for the conductor's seeded directive (a different surface).
+ */
+function formatEnsembleReadyLines(ensemble, lineupName, playerCount) {
+    const plural = playerCount === 1 ? '' : 's';
+    return [
+        `Ensemble "${ensemble}" is ready (from lineup ${lineupName}). ${playerCount} player${plural} on standby.`,
+        `Connect: agent-tempo command-center ${ensemble}`,
+    ];
+}
 async function up(opts) {
     const config = (0, config_1.getConfig)(opts);
     // #689 — best-effort sweep of stale 0600 secret env files (residual from a shell
@@ -1383,7 +1406,10 @@ async function up(opts) {
     // nothing is deferred — we only surface the banner on initial-startup paths.
     if (lineup && initialStartup) {
         console.log();
-        out.log(`  ${(0, constants_1.ensembleReadyBanner)(lineup.name, lineup.players.length)}`);
+        // #832 — name the RESOLVED ensemble (opts.ensemble), not the lineup's `name:`.
+        const [readyLine, connectLine] = formatEnsembleReadyLines(opts.ensemble, lineup.name, lineup.players.length);
+        out.success(readyLine);
+        out.log(`  ${out.dim(connectLine)}`);
     }
     console.log();
 }

package/dist/cli.js

@@ -544,10 +544,18 @@ async function main() {
             });
             break;
         case 'destroy': {
-            const target = args.positional[1] || args.ensemble || process.env[config_1.ENV.ENSEMBLE];
-            if (!target) {
-                out.error('Usage: agent-tempo destroy <ensemble> [-y]');
-                process.exit(1);
+            // #835 — use the SHARED resolver (flag > positional > env > default) so
+            // `destroy` matches every other verb. It previously hand-rolled INVERTED
+            // precedence (`positional || ensemble || env`), so `destroy foo --ensemble
+            // bar` destroyed `foo` — the lone outlier. `destroy` is gated by a typed
+            // confirmation (or `--yes`), so the resolver's `default` fallback is safe.
+            const target = (0, resolve_ensemble_1.resolveEnsemble)(args);
+            // #835 — surface a flag-over-positional override as a non-fatal note so the
+            // flag silently winning over a DIFFERENT positional isn't a silent mask
+            // (flag wins by design — this only warns, never errors).
+            const positional = args.positional[1];
+            if (args.ensemble && positional && args.ensemble !== positional) {
+                out.warn(`note: --ensemble "${args.ensemble}" overrides positional "${positional}"`);
             }
             await destroy({
                 ensemble: target,

package/dist/client/subscribe.d.ts

@@ -81,6 +81,16 @@ export interface SubscribeDeps {
      * present (Node 20), the wrapper falls back to fetch.
      */
     EventSourceImpl?: typeof EventSource;
+    /**
+     * #826 — force the fetch transport even when a native `EventSource` is
+     * available and no token is set. The fetch path is the only one that
+     * surfaces a permanent **401/404** as a thrown {@link SubscribeHttpError};
+     * native `EventSource` swallows those into its own silent reconnect cycle.
+     * The mission-control board needs that hard-error visibility (404 → `gone`,
+     * 401 → auth hint), so it sets this. TUI / dashboard leave it unset and keep
+     * the auto-selection (native `EventSource` on a tokenless loopback board).
+     */
+    forceFetch?: boolean;
     /**
      * Override sleep — used by tests to fast-forward backoff. Accepts an
      * `AbortSignal` so the wrapper can wake early on abort.

package/dist/client/subscribe.js

@@ -216,6 +216,8 @@ function makeIterator(args) {
  * for `Authorization: Bearer …` and is the only option in Node 20.
  */
 function canUseEventSource(deps) {
+    if (deps.forceFetch)
+        return false; // #826 — caller needs throw-on-permanent
     if (deps.token)
         return false;
     return resolveEventSource(deps) !== undefined;

package/dist/http/writes.js

@@ -276,6 +276,17 @@ function mapWriteError(res, action, ensemble, err) {
     if (/no session found|no maestro|workflow not found/i.test(message)) {
         return (0, responses_1.errorResponse)(res, 404, { error: 'session-not-found', action, ensemble, detail: message });
     }
+    // #834 — a cue/ask to a player whose workflow is ABSENT (destroyed / never
+    // existed) throws `Player "<to>" not found in ensemble "<ens>"` from
+    // `sendAsMaestro` (core.ts). That's a 404, not a 500 — the operator typo'd a
+    // name or the player was destroyed. NOTE: a detached/gone-but-Running player
+    // never reaches here — its workflow still matches the `ExecutionStatus =
+    // "Running"` query, so `sendAsMaestro` signals it and the soft-fail 202/queued
+    // path (checkDeliverability) handles it (no throw). So this 404 cannot
+    // regress the #822/#827 warn-but-queue contract.
+    if (/player ".*" not found in ensemble/i.test(message)) {
+        return (0, responses_1.errorResponse)(res, 404, { error: 'player-not-found', action, ensemble, detail: message });
+    }
     if (/Unknown agent type/i.test(message)) {
         return (0, responses_1.errorResponse)(res, 400, { error: 'unknown-agent-type', action, ensemble, detail: message });
     }

package/dist/pi/mission-control/actions.js

@@ -63,6 +63,28 @@ class MissionControlActions {
      * the daemon's own body detail (it already returns good 403/503 hints).
      */
     httpError(status, detail) {
+        // #834 — the daemon returns a structured `player-not-found` 404 (a cue/ask to
+        // a destroyed / never-existed player). Surface a clean operator string rather
+        // than leaking the raw JSON blob the user saw. The `⚠ cue <name> — ` prefix
+        // is the extension footer formatter's job; actions.ts just stops leaking JSON.
+        let parsedError;
+        let parsedDetail;
+        try {
+            const j = JSON.parse(detail);
+            if (typeof j.error === 'string')
+                parsedError = j.error;
+            if (typeof j.detail === 'string')
+                parsedDetail = j.detail;
+        }
+        catch {
+            /* not JSON (or truncated past the 200-char slice) — fall back to raw match */
+        }
+        if (parsedError === 'player-not-found' || /"player-not-found"/.test(detail)) {
+            // Handles both the unescaped parsed detail (`Player "bob" ...`) and the raw
+            // JSON body where the quotes are escaped (`Player \"bob\" ...`).
+            const who = /Player \\?"([^"\\]+)\\?"/.exec(parsedDetail ?? detail)?.[1];
+            return who ? `no such player "${who}"` : 'no such player';
+        }
         if (!this.adminToken && (status === 401 || status === 403 || status === 503)) {
             return (`HTTP ${status}: operator actions need ${exports.ADMIN_TOKEN_ENV} for a remote / 0.0.0.0 daemon ` +
                 `(a local loopback daemon needs none)${detail ? ` — ${detail}` : ''}`);

package/dist/pi/mission-control/board.d.ts

@@ -41,14 +41,15 @@ export declare const DEFAULT_TAIL_LIMIT = 200;
  *
  * - `'connecting'` — initial / post-rebind, before the first coarse event lands.
  * - `'live'` — at least one coarse event has arrived on the current connection.
- * - `'reconnecting'` — the coarse stream ENDED (a non-404 error, a 401, or a
- *   defensive normal-end) and the loop has exited. Rows are KEPT (rendered stale,
- *   not cleared). NOTE (#827 review): this is terminal-until-rebind today — the
- *   stream does NOT auto-resubscribe (genuine transient blips are swallowed
- *   INSIDE `createSubscribe`, so the board stays `'live'` through them). The
- *   renderer therefore labels it "STREAM ENDED … reopens on re-bind", not
- *   "reconnecting". Auto-re-arm with backoff is tracked in #828; restore the
- *   reconnecting wording if/when the loop re-subscribes on this transition.
+ * - `'reconnecting'` — the coarse stream ended OR went silent past the watchdog
+ *   threshold (#826), and the board is RE-ARMING. Rows are KEPT (rendered stale,
+ *   not cleared). #828: the extension now auto-re-subscribes with bounded
+ *   equal-jitter backoff (genuine transient blips are still swallowed INSIDE
+ *   `createSubscribe`, so the board only reaches here on a real stream-death).
+ *   The variant is carried on `connectionDetail` (no new enum value): an arming
+ *   detail → `[RECONNECTING]`, a settled detail (re-arm capped at 30s) →
+ *   `[STREAM DOWN]`, and the 401-auth path (which does NOT auto-re-arm — a
+ *   re-sub would just 401 again) keeps the `[STREAM ENDED]` + set-token hint.
  * - `'gone'` — a hard 404 on the per-ensemble stream: the ensemble's maestro is
  *   gone. {@link setConnection} CLEARS the player list on this transition and the
  *   extension STOPS the stream; the renderer shows "ENSEMBLE DESTROYED".

package/dist/pi/mission-control/extension.d.ts

@@ -1,4 +1,5 @@
 import { type PiRole } from '../../config';
+import { createSubscribe } from '../../client/subscribe';
 import { type BoardModel, type CommandLevel } from './board';
 import { MissionControlActions, type ActionResult } from './actions';
 import { type InfraProgress } from '../../cli/ensure-infra';
@@ -32,6 +33,14 @@ export interface MissionControlDeps {
      * `'player'` and `'none'` both keep it dormant.
      */
     role?: PiRole;
+    /**
+     * #826/#828 — override the coarse-stream subscribe factory (test seam).
+     * Defaults to {@link createSubscribe}. Lets a fake-timer test inject a mock
+     * `subscribe` generator to drive the watchdog + re-arm loop deterministically
+     * and assert the single-loop invariant (subscribe called exactly N times, not
+     * N+1). Production never sets it.
+     */
+    createSubscribeImpl?: typeof createSubscribe;
 }
 /**
  * Infra-bootstrap seam (#700 P1). Defaults to the real {@link ensureInfra}; the
@@ -93,6 +102,61 @@ export declare function classifyCoarseStreamEnd(err: unknown, aborted: boolean):
     connection: 'gone' | 'reconnecting';
     detail?: string;
 } | null;
+/** #826 — watchdog poll cadence (how often we compare now − lastCoarseEventAt). */
+export declare const WATCHDOG_TICK_MS = 5000;
+/**
+ * #826 — board-level staleness threshold. The daemon emits a `heartbeat` SSE
+ * event every ≤10s on a live `/v1/events` stream, so >35s of TOTAL silence
+ * (3.5× heartbeat) means the stream is wedged/dead — a half-open socket from a
+ * hard `agent-tempo down` (ECONNREFUSED / dead TCP), which neither a 404 nor
+ * force-fetch's INTERNAL retry surfaces (that loop reconnects forever, never
+ * throws). Sits ABOVE the fetch loop's 30s internal backoff cap, so a healthy
+ * cycling loop still receiving heartbeats never trips it — this gap IS the
+ * no-double-retry boundary (watchdog = safety net ABOVE the transport).
+ */
+export declare const COARSE_STALE_MS = 35000;
+/**
+ * #828 — after this many consecutive failed re-arms the board stops claiming
+ * it's actively "reconnecting" and settles to the honest "[STREAM DOWN] —
+ * retrying every 30s" wording. Re-arm itself NEVER stops (a permanently silent
+ * wedge is the #752 silent-wedge class); only the label changes. ~5 steps takes
+ * the backoff ramp to its 30s cap.
+ */
+export declare const REARM_SETTLE_THRESHOLD = 5;
+/**
+ * #828 — equal-jitter backoff for the Nth re-arm attempt: `b/2 + rand(0, b/2)`
+ * where `b = min(1s·2^attempt, 30s)`. `Math.random()` is fine here — this is
+ * client code, not workflow code (the determinism rule does not apply). Jitter
+ * spreads re-arms so a fleet of boards doesn't thundering-herd a recovering
+ * daemon. `randomFn` is injectable for deterministic tests.
+ */
+export declare function rearmDelayMs(attempt: number, randomFn?: () => number): number;
+/**
+ * #828 — the reconnecting sub-variant wording for the Nth re-arm attempt: still
+ * ramping (< {@link REARM_SETTLE_THRESHOLD}) → "attempting to reconnect…";
+ * settled (≥) → "retrying every 30s". Carried on the model's `connectionDetail`
+ * (NO new BoardConnection enum value) and read by the renderer to pick the
+ * marker. Pure + exported for unit testing.
+ */
+export declare function reconnectDetailForAttempt(attempt: number): string;
+/**
+ * #828 — should a coarse stream-END auto-re-arm? Gate (architect ruling):
+ * - `null` (aborted teardown/rebind) → no
+ * - `gone` (404 — maestro torn down; a re-sub just 404s) → no (terminal by design)
+ * - `reconnecting` WITH a detail (the 401 auth path — tight-looping a
+ *   guaranteed-fail) → no; keep the set-token hint
+ * - `reconnecting` WITHOUT a detail (generic stream-drop / normal-end) → yes
+ * Pure + exported for unit testing.
+ */
+export declare function shouldRearmOnStreamEnd(end: {
+    connection: 'gone' | 'reconnecting';
+    detail?: string;
+} | null): boolean;
+/**
+ * #826 — is the coarse stream stale (silent past {@link COARSE_STALE_MS})?
+ * `lastEventAt === 0` means "not connected yet" → never stale. Pure.
+ */
+export declare function isCoarseStale(lastEventAt: number, now: number): boolean;
 /**
  * The operator-command + board controller. Holds the model + the action client;
  * command methods are independently unit-testable with a fake actions + ctx.
@@ -177,8 +241,11 @@ export declare class Controller {
      * operator who just wants to un-suspend the ensemble has a single action,
      * without overloading `/play`'s sources-only meaning (the two axes stay
      * distinct at the primitive/daemon level).
+     *
+     * #833 — exposed as `/unpause` (NOT `/resume` — that collides with a Pi
+     * built-in interactive command and gets skipped from autocomplete).
      */
-    cmdResume(_args: string, ctx: McExtensionContext): Promise<void>;
+    cmdUnpause(_args: string, ctx: McExtensionContext): Promise<void>;
     cmdRestart(args: string, ctx: McExtensionContext): Promise<void>;
     cmdDestroy(args: string, ctx: McExtensionContext): Promise<void>;
     cmdReset(args: string, ctx: McExtensionContext): Promise<void>;

package/dist/pi/mission-control/extension.js

@@ -33,13 +33,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Controller = void 0;
+exports.Controller = exports.REARM_SETTLE_THRESHOLD = exports.COARSE_STALE_MS = exports.WATCHDOG_TICK_MS = void 0;
 exports.buildAnswerWake = buildAnswerWake;
 exports.parseEnsembleUpArgs = parseEnsembleUpArgs;
 exports.parseRecruitArgs = parseRecruitArgs;
 exports.parseReleaseArg = parseReleaseArg;
 exports.formatOutcome = formatOutcome;
 exports.classifyCoarseStreamEnd = classifyCoarseStreamEnd;
+exports.rearmDelayMs = rearmDelayMs;
+exports.reconnectDetailForAttempt = reconnectDetailForAttempt;
+exports.shouldRearmOnStreamEnd = shouldRearmOnStreamEnd;
+exports.isCoarseStale = isCoarseStale;
 exports.registerPlannerTools = registerPlannerTools;
 exports.createMissionControlExtension = createMissionControlExtension;
 /**
@@ -217,6 +221,73 @@ function classifyCoarseStreamEnd(err, aborted) {
     }
     return { connection: 'reconnecting' };
 }
+// ── #826/#828 — coarse-stream watchdog + auto-re-arm ───────────────────────
+/** #826 — watchdog poll cadence (how often we compare now − lastCoarseEventAt). */
+exports.WATCHDOG_TICK_MS = 5_000;
+/**
+ * #826 — board-level staleness threshold. The daemon emits a `heartbeat` SSE
+ * event every ≤10s on a live `/v1/events` stream, so >35s of TOTAL silence
+ * (3.5× heartbeat) means the stream is wedged/dead — a half-open socket from a
+ * hard `agent-tempo down` (ECONNREFUSED / dead TCP), which neither a 404 nor
+ * force-fetch's INTERNAL retry surfaces (that loop reconnects forever, never
+ * throws). Sits ABOVE the fetch loop's 30s internal backoff cap, so a healthy
+ * cycling loop still receiving heartbeats never trips it — this gap IS the
+ * no-double-retry boundary (watchdog = safety net ABOVE the transport).
+ */
+exports.COARSE_STALE_MS = 35_000;
+/** #828 re-arm backoff: base 1s, ×2, cap 30s. */
+const REARM_BASE_MS = 1_000;
+const REARM_MAX_MS = 30_000;
+/**
+ * #828 — after this many consecutive failed re-arms the board stops claiming
+ * it's actively "reconnecting" and settles to the honest "[STREAM DOWN] —
+ * retrying every 30s" wording. Re-arm itself NEVER stops (a permanently silent
+ * wedge is the #752 silent-wedge class); only the label changes. ~5 steps takes
+ * the backoff ramp to its 30s cap.
+ */
+exports.REARM_SETTLE_THRESHOLD = 5;
+/**
+ * #828 — equal-jitter backoff for the Nth re-arm attempt: `b/2 + rand(0, b/2)`
+ * where `b = min(1s·2^attempt, 30s)`. `Math.random()` is fine here — this is
+ * client code, not workflow code (the determinism rule does not apply). Jitter
+ * spreads re-arms so a fleet of boards doesn't thundering-herd a recovering
+ * daemon. `randomFn` is injectable for deterministic tests.
+ */
+function rearmDelayMs(attempt, randomFn = Math.random) {
+    const b = Math.min(REARM_BASE_MS * 2 ** Math.max(0, attempt), REARM_MAX_MS);
+    return b / 2 + randomFn() * (b / 2);
+}
+/**
+ * #828 — the reconnecting sub-variant wording for the Nth re-arm attempt: still
+ * ramping (< {@link REARM_SETTLE_THRESHOLD}) → "attempting to reconnect…";
+ * settled (≥) → "retrying every 30s". Carried on the model's `connectionDetail`
+ * (NO new BoardConnection enum value) and read by the renderer to pick the
+ * marker. Pure + exported for unit testing.
+ */
+function reconnectDetailForAttempt(attempt) {
+    return attempt >= exports.REARM_SETTLE_THRESHOLD ? render_1.STREAM_DOWN_DETAIL : render_1.RECONNECT_ARMING_DETAIL;
+}
+/**
+ * #828 — should a coarse stream-END auto-re-arm? Gate (architect ruling):
+ * - `null` (aborted teardown/rebind) → no
+ * - `gone` (404 — maestro torn down; a re-sub just 404s) → no (terminal by design)
+ * - `reconnecting` WITH a detail (the 401 auth path — tight-looping a
+ *   guaranteed-fail) → no; keep the set-token hint
+ * - `reconnecting` WITHOUT a detail (generic stream-drop / normal-end) → yes
+ * Pure + exported for unit testing.
+ */
+function shouldRearmOnStreamEnd(end) {
+    return end !== null && end.connection === 'reconnecting' && end.detail === undefined;
+}
+/**
+ * #826 — is the coarse stream stale (silent past {@link COARSE_STALE_MS})?
+ * `lastEventAt === 0` means "not connected yet" → never stale. Pure.
+ */
+function isCoarseStale(lastEventAt, now) {
+    if (lastEventAt === 0)
+        return false;
+    return now - lastEventAt > exports.COARSE_STALE_MS;
+}
 /**
  * The operator-command + board controller. Holds the model + the action client;
  * command methods are independently unit-testable with a fake actions + ctx.
@@ -406,9 +477,9 @@ class Controller {
         const r = await this.actions.play(release);
         // #821 — the two-axis wart: a sources-only `/play` that leaves players HELD
         // reads as "nothing happened" (the real #821). Name the residual axis so the
-        // operator knows to clear it — `/resume` does both in one shot.
+        // operator knows to clear it — `/unpause` does both in one shot.
         const extra = r.ok && !release && this.model.held
-            ? 'ensemble resumed, but players are still HELD — use /resume (or /play release) to free them'
+            ? 'ensemble resumed, but players are still HELD — use /unpause (or /play release) to free them'
             : undefined;
         this.report(ctx, 'play', r, extra);
     }
@@ -418,9 +489,12 @@ class Controller {
      * operator who just wants to un-suspend the ensemble has a single action,
      * without overloading `/play`'s sources-only meaning (the two axes stay
      * distinct at the primitive/daemon level).
+     *
+     * #833 — exposed as `/unpause` (NOT `/resume` — that collides with a Pi
+     * built-in interactive command and gets skipped from autocomplete).
      */
-    async cmdResume(_args, ctx) {
-        this.report(ctx, 'resume', await this.actions.play(true));
+    async cmdUnpause(_args, ctx) {
+        this.report(ctx, 'unpause', await this.actions.play(true));
     }
     async cmdRestart(args, ctx) {
         const [p, reason] = Controller.splitFirst(args);
@@ -780,6 +854,15 @@ function createMissionControlExtension(deps = {}) {
         let renderTimer = null;
         let lastRenderedRevision = -1;
         let activeCtx = null;
+        // #826/#828 — coarse-stream liveness + auto-re-arm state.
+        // `lastCoarseEventAt` is stamped on EVERY received coarse event (incl. the
+        // daemon's ≤10s `heartbeat`), so the watchdog measures true silence. `0` =
+        // not connected yet. `rearmAttempt` drives the #828 backoff + settle wording;
+        // `rearmTimer` is the single pending re-arm (one at a time — no stacking).
+        let watchdogTimer = null;
+        let rearmTimer = null;
+        let rearmAttempt = 0;
+        let lastCoarseEventAt = 0;
         // #790 — the CURRENT ensemble binding lives on `ctrl.model.ensemble`
         // (re-keyed by Controller.rebind BEFORE onRebind fires), so the SSE
         // closures below read it at (re)open time instead of capturing the
@@ -792,7 +875,58 @@ function createMissionControlExtension(deps = {}) {
             lastRenderedRevision = ctrl.model.revision;
             activeCtx.ui.setWidget(WIDGET_KEY, (0, render_1.renderBoard)(ctrl.model, ctrl.localHost), { placement: 'aboveEditor' });
         };
+        // #823 — flip the board's connection state + render the banner immediately
+        // (don't wait for the throttle tick when the stream's liveness changes).
+        const markConnection = (state, detail) => {
+            (0, board_1.setConnection)(ctrl.model, state, detail);
+            renderNow();
+        };
+        // #828 — cancel the single pending re-arm timer (idempotent).
+        const cancelRearm = () => {
+            if (rearmTimer) {
+                clearTimeout(rearmTimer);
+                rearmTimer = null;
+            }
+        };
+        // #828 — schedule the next coarse re-arm with bounded equal-jitter backoff.
+        // At most ONE pending at a time (the `rearmTimer` guard stops the watchdog and
+        // a stream-end both stacking re-arms). Reflects the arming/settled wording on
+        // the banner immediately, then re-opens the stream after the delay. NEVER
+        // gives up — the delay caps at 30s and `rearmAttempt` keeps the cadence there.
+        const scheduleRearm = () => {
+            if (rearmTimer)
+                return;
+            markConnection('reconnecting', reconnectDetailForAttempt(rearmAttempt));
+            const delay = rearmDelayMs(rearmAttempt);
+            rearmAttempt++;
+            rearmTimer = setTimeout(() => {
+                rearmTimer = null;
+                startCoarse(); // aborts the old/wedged loop at its top, opens a fresh one
+            }, delay);
+            if (typeof rearmTimer.unref === 'function')
+                rearmTimer.unref();
+        };
+        // #828 — apply a classified coarse stream-END to the board. A generic
+        // stream-drop re-arms (backoff); `gone` (404) is terminal (clear roster +
+        // cancel any pending re-arm); a 401 keeps the auth hint WITHOUT auto-re-arm
+        // (tight-looping a guaranteed-fail). `null` = aborted teardown/rebind/re-arm.
+        const handleStreamEnd = (end) => {
+            if (!end)
+                return;
+            if (shouldRearmOnStreamEnd(end)) {
+                scheduleRearm();
+                return;
+            }
+            if (end.connection === 'gone')
+                cancelRearm();
+            markConnection(end.connection, end.detail);
+        };
         const startCoarse = () => {
+            // #828 — guarantee EXACTLY ONE coarse loop alive: abort any prior stream (a
+            // wedged one being re-armed, or one that just ended) before opening a fresh
+            // one. The aborted prior loop exits via classifyCoarseStreamEnd(_, true)→null
+            // (no state change). session_start's first call has none (abort is a no-op).
+            coarseAbort?.abort();
             // #54 — accurate posture: a tokenless board is FULLY functional against a
             // local (loopback) daemon, which grants full trust. Only a REMOTE / 0.0.0.0
             // daemon requires the admin token (it 401s tokenless reads + actions).
@@ -804,25 +938,33 @@ function createMissionControlExtension(deps = {}) {
             // expected teardown abort log a spurious "coarse SSE ended: AbortError".
             const ac = new AbortController();
             coarseAbort = ac;
-            // H5: omit baseUrl → createSubscribe re-resolves the daemon port per
-            // (re)connect, so a daemon restart on a new port self-heals.
-            const subscribe = (0, subscribe_1.createSubscribe)({
+            // #826 — FORCE the fetch transport: only it throws on a permanent 401/404
+            // (native EventSource swallows those into a silent reconnect cycle), and the
+            // board needs that to flip to `gone` / surface the auth hint. H5: omit baseUrl
+            // → createSubscribe re-resolves the daemon port per (re)connect, so a daemon
+            // restart on a new port self-heals.
+            const subscribe = (deps.createSubscribeImpl ?? subscribe_1.createSubscribe)({
+                forceFetch: true,
                 ...(deps.baseUrl ? { baseUrl: deps.baseUrl } : {}),
                 ...(adminToken ? { token: adminToken } : {}),
             });
-            // #823 — flip the board's connection state + render the banner immediately
-            // (don't wait for the throttle tick when the stream's liveness changes).
-            const markConnection = (state, detail) => {
-                (0, board_1.setConnection)(ctrl.model, state, detail);
-                renderNow();
-            };
+            // #826 — fresh connect: reset the staleness clock so the watchdog measures
+            // silence on THIS attempt, not the gap accrued since the last dead stream.
+            lastCoarseEventAt = Date.now();
             void (async () => {
                 try {
                     for await (const ev of subscribe(ctrl.model.ensemble, { signal: ac.signal })) {
-                        // #823 — the first event on this connection proves the stream is
-                        // live (clears a prior reconnecting/connecting banner).
-                        if (ctrl.model.connection !== 'live')
+                        // #826 — stamp liveness on EVERY received event (incl. the no-op
+                        // `heartbeat` the daemon emits ≤10s) so the watchdog sees the pulse.
+                        lastCoarseEventAt = Date.now();
+                        // #823/#828 — the first event on this connection proves the stream is
+                        // live: clear a prior reconnecting banner AND reset the re-arm backoff
+                        // (a recovered stream starts the next failure's ramp from scratch).
+                        if (ctrl.model.connection !== 'live') {
                             markConnection('live');
+                            rearmAttempt = 0;
+                            cancelRearm();
+                        }
                         // #700 P2 — an `answer` event isn't a board event; it WAKES the
                         // planner (its only inbound channel is this SSE stream). Inject via
                         // pi.sendMessage(triggerTurn) — feature-detected (a fake/older Pi
@@ -836,24 +978,41 @@ function createMissionControlExtension(deps = {}) {
                         }
                         (0, board_1.applyTempoEvent)(ctrl.model, ev);
                     }
-                    // #823 — the stream ENDED without throwing. In production `createSubscribe`
-                    // only ends normally on abort (it auto-retries transient drops), so a
-                    // non-aborted normal end is a defensive transient path → reconnecting.
-                    const end = classifyCoarseStreamEnd(undefined, ac.signal.aborted);
-                    if (end)
-                        markConnection(end.connection, end.detail);
+                    // Stream ended without throwing — classify + (maybe) re-arm.
+                    handleStreamEnd(classifyCoarseStreamEnd(undefined, ac.signal.aborted));
                 }
                 catch (err) {
-                    // #823 — map the (permanent) stream error to a board connection state.
-                    // Aborted teardown/rebind → null (no change, no spurious log).
+                    // Map the (permanent) stream error to a board transition.
+                    // Aborted teardown/rebind/re-arm → null (no change, no spurious log).
                     const end = classifyCoarseStreamEnd(err, ac.signal.aborted);
                     if (!end)
                         return;
                     log(end.connection === 'gone' ? 'coarse SSE — ensemble gone:' : 'coarse SSE ended:', err instanceof Error ? err.message : err);
-                    markConnection(end.connection, end.detail);
+                    handleStreamEnd(end);
                 }
             })();
         };
+        // #826 — watchdog: a wedged/dead socket (half-open from a hard `agent-tempo
+        // down`) never throws and never ends the loop, so neither the 404 path nor
+        // force-fetch's internal retry catches it. Detect it by TOTAL silence past
+        // COARSE_STALE_MS (no heartbeat) and re-arm. Skips when already `gone`
+        // (terminal), in the 401 auth-ended state (no auto-re-arm by design — its
+        // connectionDetail is the auth hint, not an arming/settled marker), or when a
+        // re-arm is already pending (no stacking with the stream-end path).
+        const checkStale = () => {
+            if (ctrl.model.connection === 'gone')
+                return;
+            if (ctrl.model.connection === 'reconnecting' &&
+                ctrl.model.connectionDetail !== render_1.RECONNECT_ARMING_DETAIL &&
+                ctrl.model.connectionDetail !== render_1.STREAM_DOWN_DETAIL)
+                return;
+            if (rearmTimer)
+                return;
+            if (!isCoarseStale(lastCoarseEventAt, Date.now()))
+                return;
+            log(`coarse stream stale — no daemon heartbeat for >${exports.COARSE_STALE_MS / 1000}s; re-arming`);
+            scheduleRearm();
+        };
         const openTail = (playerId) => {
             tailAbort?.abort();
             tailAbort = null;
@@ -886,6 +1045,8 @@ function createMissionControlExtension(deps = {}) {
             coarseAbort = null;
             tailAbort?.abort();
             tailAbort = null;
+            cancelRearm();
+            rearmAttempt = 0; // #828 — fresh ensemble: drop any pending re-arm + reset the backoff ramp
             startCoarse(); // reads the already-re-keyed ctrl.model.ensemble
             renderNow(); // show the re-keyed (empty) board immediately, not at the next throttle tick
         };
@@ -894,6 +1055,11 @@ function createMissionControlExtension(deps = {}) {
             coarseAbort = null;
             tailAbort?.abort();
             tailAbort = null;
+            cancelRearm(); // #828 — drop any pending re-arm
+            if (watchdogTimer) {
+                clearInterval(watchdogTimer);
+                watchdogTimer = null;
+            } // #826
             if (renderTimer) {
                 clearInterval(renderTimer);
                 renderTimer = null;
@@ -905,10 +1071,16 @@ function createMissionControlExtension(deps = {}) {
         pi.on('session_start', (_event, ctx) => {
             activeCtx = ctx;
             lastRenderedRevision = -1;
+            rearmAttempt = 0; // #828 — fresh session
             startCoarse();
             renderTimer = setInterval(renderNow, throttleMs);
             if (typeof renderTimer.unref === 'function')
                 renderTimer.unref();
+            // #826 — coarse-stream staleness watchdog (catches a wedged/dead socket
+            // that never throws). `.unref()` so it can't keep the process alive.
+            watchdogTimer = setInterval(checkStale, exports.WATCHDOG_TICK_MS);
+            if (typeof watchdogTimer.unref === 'function')
+                watchdogTimer.unref();
             renderNow();
         });
         pi.on('session_shutdown', () => teardown());
@@ -922,7 +1094,8 @@ function createMissionControlExtension(deps = {}) {
         pi.registerCommand('pause', { description: 'Pause the ensemble', handler: (a, ctx) => ctrl.cmdPause(a, ctx) });
         pi.registerCommand('play', { description: 'Clear the PAUSE axis (/play [release] also frees held players)', handler: (a, ctx) => ctrl.cmdPlay(a, ctx) });
         // #821 — the one obvious "resume everything" (clears PAUSE + HELD).
-        pi.registerCommand('resume', { description: 'Resume everything — clears PAUSE + frees HELD players', handler: (a, ctx) => ctrl.cmdResume(a, ctx) });
+        // #833 — registered as `/unpause`, NOT `/resume` (collides with a Pi built-in).
+        pi.registerCommand('unpause', { description: 'Resume everything — clears PAUSE + frees HELD players', handler: (a, ctx) => ctrl.cmdUnpause(a, ctx) });
         pi.registerCommand('restart', { description: 'Restart a player (/restart <player> [reason])', handler: (a, ctx) => ctrl.cmdRestart(a, ctx) });
         pi.registerCommand('destroy', { description: 'Destroy a player (/destroy <player> [reason])', handler: (a, ctx) => ctrl.cmdDestroy(a, ctx) });
         pi.registerCommand('reset', { description: 'Clean-wipe a player (/reset <player> [reason])', handler: (a, ctx) => ctrl.cmdReset(a, ctx) });

package/dist/pi/mission-control/render.d.ts

@@ -1,4 +1,29 @@
 import { type BoardModel } from './board';
+/**
+ * #828 — `connectionDetail` sentinels that select the `reconnecting` sub-marker
+ * (the variant is carried on the model's `connectionDetail`, so NO new
+ * `BoardConnection` enum value is needed). The extension sets one of these while
+ * the coarse stream auto-re-arms:
+ * - {@link RECONNECT_ARMING_DETAIL} — still ramping (< settle threshold) → `[RECONNECTING]`
+ * - {@link STREAM_DOWN_DETAIL} — settled (re-arm capped at 30s, daemon still dead) → `[STREAM DOWN]`
+ * Any OTHER reconnecting detail (e.g. the 401 auth hint) renders as `[STREAM
+ * ENDED]` — that path does NOT auto-re-arm.
+ */
+export declare const RECONNECT_ARMING_DETAIL = "attempting to reconnect\u2026";
+export declare const STREAM_DOWN_DETAIL = "retrying every 30s \u2014 /ensemble to rebind";
+/**
+ * #836 — Pi's `InteractiveMode` hard-caps a widget at this many lines and, beyond
+ * it, naively slices the top N and appends its own dev-speak `... (widget
+ * truncated)` (mirrors `InteractiveMode.MAX_WIDGET_LINES`, verified 0.78.0). That
+ * is doubly bad for us: (1) operators see internal "widget truncated" copy, and
+ * (2) the slice keeps the TOP and drops the BOTTOM — which is exactly the
+ * command-log acks (#821) the operator most needs to see. So we clamp to this
+ * budget OURSELVES with {@link assembleWidget}, keeping the header/banner (top)
+ * AND the command-log footer (bottom) and trimming the expendable middle
+ * (roster/tail) under an operator-friendly `⋯ N … hidden` marker. If Pi ever
+ * raises its cap this only clamps a touch early — it can never over-run it.
+ */
+export declare const MAX_WIDGET_LINES = 10;
 /**
  * Render the full board. Header + player rows (conductor first), then — when a
  * player is selected — a fine inner-loop tail (last {@link TAIL_RENDER_LINES}).

package/dist/pi/mission-control/render.js

@@ -1,9 +1,53 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_WIDGET_LINES = exports.STREAM_DOWN_DETAIL = exports.RECONNECT_ARMING_DETAIL = void 0;
 exports.renderBoard = renderBoard;
 const board_1 = require("./board");
 /** How many recent fine-tail frames to show under the selected player. */
 const TAIL_RENDER_LINES = 12;
+/**
+ * #828 — `connectionDetail` sentinels that select the `reconnecting` sub-marker
+ * (the variant is carried on the model's `connectionDetail`, so NO new
+ * `BoardConnection` enum value is needed). The extension sets one of these while
+ * the coarse stream auto-re-arms:
+ * - {@link RECONNECT_ARMING_DETAIL} — still ramping (< settle threshold) → `[RECONNECTING]`
+ * - {@link STREAM_DOWN_DETAIL} — settled (re-arm capped at 30s, daemon still dead) → `[STREAM DOWN]`
+ * Any OTHER reconnecting detail (e.g. the 401 auth hint) renders as `[STREAM
+ * ENDED]` — that path does NOT auto-re-arm.
+ */
+exports.RECONNECT_ARMING_DETAIL = 'attempting to reconnect…';
+exports.STREAM_DOWN_DETAIL = 'retrying every 30s — /ensemble to rebind';
+/**
+ * #836 — Pi's `InteractiveMode` hard-caps a widget at this many lines and, beyond
+ * it, naively slices the top N and appends its own dev-speak `... (widget
+ * truncated)` (mirrors `InteractiveMode.MAX_WIDGET_LINES`, verified 0.78.0). That
+ * is doubly bad for us: (1) operators see internal "widget truncated" copy, and
+ * (2) the slice keeps the TOP and drops the BOTTOM — which is exactly the
+ * command-log acks (#821) the operator most needs to see. So we clamp to this
+ * budget OURSELVES with {@link assembleWidget}, keeping the header/banner (top)
+ * AND the command-log footer (bottom) and trimming the expendable middle
+ * (roster/tail) under an operator-friendly `⋯ N … hidden` marker. If Pi ever
+ * raises its cap this only clamps a touch early — it can never over-run it.
+ */
+exports.MAX_WIDGET_LINES = 10;
+/**
+ * #836 — assemble `[head, body, foot]` into a widget that fits {@link
+ * MAX_WIDGET_LINES}. `head` (header + suspension/connection banner) and `foot`
+ * (the #821 command-log acks) are always kept; only the middle `body` (roster +
+ * inner tail) is trimmed, with one line spent on a friendly hidden-count marker
+ * that replaces Pi's `... (widget truncated)` dev-speak. Pure + total — never
+ * returns more than `MAX_WIDGET_LINES` lines (head+foot is ≤ 7 by construction).
+ */
+function assembleWidget(head, body, foot) {
+    const budget = exports.MAX_WIDGET_LINES - head.length - foot.length;
+    if (body.length <= budget)
+        return [...head, ...body, ...foot];
+    // Spend one line on the marker; keep as much of the body top as fits.
+    const keep = Math.max(budget - 1, 0);
+    const hidden = body.length - keep;
+    const marker = hidden > 0 ? `  ⋯ ${hidden} more line${hidden === 1 ? '' : 's'} hidden` : '  ⋯ (older entries hidden)';
+    return [...head, ...body.slice(0, keep), marker, ...foot];
+}
 /**
  * #821 — render the persistent command-log footer (recent acks/⚠/failures). Folds
  * write-command results into the widget so feedback doesn't vanish like the old
@@ -81,7 +125,11 @@ function oneLine(s, max) {
  */
 function renderBoard(model, localHost) {
     const ids = (0, board_1.sortedPlayerIds)(model);
-    const lines = [];
+    // #836 — three bands so the widget clamp keeps the high-value top (header +
+    // banner) and bottom (command-log acks) and only trims the expendable middle.
+    const head = [];
+    const body = [];
+    const foot = renderCommandLog(model);
     // #823 — a GONE ensemble (hard 404 — the maestro is torn down) is the most
     // urgent signal and makes the player list + suspension flags meaningless:
     // render the loud teardown banner and stop, so a destructive
@@ -89,36 +137,48 @@ function renderBoard(model, localHost) {
     // staring at the stale pre-destroy roster (the reported symptom). Players are
     // already cleared by `setConnection('gone')`.
     if (model.connection === 'gone') {
-        lines.push(`MISSION CONTROL · ${model.ensemble} · ENSEMBLE GONE`);
-        lines.push('!! ENSEMBLE DESTROYED — no active players. ' +
+        head.push(`MISSION CONTROL · ${model.ensemble} · ENSEMBLE GONE`);
+        head.push('!! ENSEMBLE DESTROYED — no active players. ' +
             '/ensemble <name> to observe another, or /ensemble-up to re-create.');
         // #821 — keep the command log visible so the `ensemble-down --destroy ✓`
         // ack that produced this state is still on screen (the #823 scenario).
-        lines.push(...renderCommandLog(model));
-        return lines;
+        return assembleWidget(head, body, foot);
     }
     // #752/#823 — the header marker rides one loud line so a paused/held/
     // stream-ended ensemble can't sit unnoticed (the 5h silent-wedge incident).
     // A dropped stream outranks PAUSED/HELD: the suspension flags below are then
     // last-known-only and the operator needs to know the view itself may be stale.
     //
-    // HONEST LABEL (#827 review): the `'reconnecting'` connection state does NOT
-    // auto-reconnect today — `createSubscribe` swallows genuine transient blips
-    // internally (the board stays `live` through them), so this state is only
-    // reached when the coarse stream has actually ended and the loop has exited.
-    // It reopens on an `/ensemble` re-bind, not on its own. We therefore label it
-    // "STREAM ENDED … reopens on re-bind" rather than the misleading "RECONNECTING"
-    // (shipping a reconnecting badge that doesn't reconnect is the exact
-    // misleading-feedback class this PR fixes). Auto-re-arm is tracked in #828;
-    // if/when the loop re-subscribes with backoff, restore the reconnecting wording.
+    // #828 — the coarse stream now AUTO-RE-ARMS (bounded-backoff re-subscribe), so
+    // the `reconnecting` state has three honest variants, discriminated by
+    // `connectionDetail` (no new `BoardConnection` enum value):
+    //   - arming  (re-arm in flight, < settle) → `[RECONNECTING]` "attempting to reconnect…"
+    //   - settled (re-arm capped at 30s, still dead) → `[STREAM DOWN]` "retrying every 30s"
+    //   - other detail (the 401 auth path — does NOT auto-re-arm) → `[STREAM ENDED]` + hint
+    // The #827 "STREAM ENDED, reopens on re-bind" honest-label note is now reversed
+    // for the arming/settled variants because re-arm is real (#828); only the 401
+    // path keeps the stream-ended wording (it genuinely needs a manual re-bind /
+    // new token).
     let marker = '';
     let what = '';
     if (model.connection === 'reconnecting') {
-        marker = ' · [STREAM ENDED]';
-        const tail = 'last-known state, reopens on /ensemble re-bind';
-        what = model.connectionDetail
-            ? `STREAM ENDED — ${model.connectionDetail}; ${tail}`
-            : `STREAM ENDED — coarse stream dropped; ${tail}`;
+        if (model.connectionDetail === exports.RECONNECT_ARMING_DETAIL) {
+            marker = ' · [RECONNECTING]';
+            what = `RECONNECTING — ${exports.RECONNECT_ARMING_DETAIL}`;
+        }
+        else if (model.connectionDetail === exports.STREAM_DOWN_DETAIL) {
+            marker = ' · [STREAM DOWN]';
+            what = `STREAM DOWN — ${exports.STREAM_DOWN_DETAIL}`;
+        }
+        else {
+            // 401 auth (or any non-re-arming reconnecting): the stream ended and only a
+            // manual re-bind / new token recovers it — keep the honest stream-ended copy.
+            marker = ' · [STREAM ENDED]';
+            const tail = 'last-known state, reopens on /ensemble re-bind';
+            what = model.connectionDetail
+                ? `STREAM ENDED — ${model.connectionDetail}; ${tail}`
+                : `STREAM ENDED — coarse stream dropped; ${tail}`;
+        }
     }
     else if (model.paused) {
         marker = ' · [PAUSED]';
@@ -128,39 +188,40 @@ function renderBoard(model, localHost) {
         marker = ' · [HELD]';
         what = 'HELD players';
     }
-    lines.push(`MISSION CONTROL · ${model.ensemble} · ${ids.length} player${ids.length === 1 ? '' : 's'}${marker}`);
+    head.push(`MISSION CONTROL · ${model.ensemble} · ${ids.length} player${ids.length === 1 ? '' : 's'}${marker}`);
     if (what) {
         if (model.connection === 'reconnecting') {
             // Informational — no resume hint (the issue is the stream, not a suspend).
-            lines.push(`!! ${what}`);
+            head.push(`!! ${what}`);
         }
         else {
-            // #821 — the one obvious resume is `/resume` (clears PAUSE + HELD); `/play`
+            // #821 — the one obvious resume is `/unpause` (clears PAUSE + HELD); `/play`
             // (sources only) and `/play release` remain for the two-axis primitive.
-            lines.push(`!! ${what} — cues queue silently; resume: /resume (or /play release)`);
+            // #833 — `/unpause`, NOT `/resume` (the latter collides with a Pi built-in).
+            head.push(`!! ${what} — cues queue silently; resume: /unpause (or /play release)`);
         }
     }
     if (ids.length === 0) {
-        lines.push('  (no players — waiting for the ensemble…)');
+        body.push('  (no players — waiting for the ensemble…)');
     }
     else {
         for (const id of ids) {
             const row = model.players.get(id);
-            lines.push(renderRow(row, id === model.selected, localHost));
+            body.push(renderRow(row, id === model.selected, localHost));
         }
     }
     if (model.selected) {
-        lines.push(`── tail: ${model.selected} ──`);
+        body.push(`── tail: ${model.selected} ──`);
         const recent = model.innerTail.slice(-TAIL_RENDER_LINES);
         if (recent.length === 0) {
-            lines.push('  (no inner-loop activity yet)');
+            body.push('  (no inner-loop activity yet)');
         }
         else {
             for (const f of recent)
-                lines.push(renderInnerFrame(f));
+                body.push(renderInnerFrame(f));
         }
     }
-    // #821 — persistent command-result footer (recent acks/⚠/failures).
-    lines.push(...renderCommandLog(model));
-    return lines;
+    // #821 — persistent command-result footer (recent acks/⚠/failures) lives in
+    // `foot` (already computed) so the #836 clamp keeps it visible.
+    return assembleWidget(head, body, foot);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-tempo",
-  "version": "1.7.0-beta.10",
+  "version": "1.7.0-beta.12",
   "description": "Many agents, one tempo. Durable coordination for multi-agent work via Temporal.",
   "keywords": [
     "mcp",
@@ -82,13 +82,14 @@
     "test": "mocha && vitest run",
     "lint:surface-drift": "node scripts/check-surface-drift.js",
     "lint:no-stale-scaffold": "node scripts/check-no-stale-scaffold.js",
+    "lint:no-stray-src-js": "node scripts/check-no-stray-src-js.js",
     "lint:test-ensemble-literals": "bash scripts/check-test-ensemble-literals.sh",
     "lint:skip-reasons": "node scripts/lint-skip-reasons.js",
     "lint:lockstep-version": "node -e \"const r=require('./package.json').version,d=require('./dashboard/package.json').version;if(r!==d){console.error('Version drift: root='+r+' dashboard='+d+'. Bump dashboard/package.json#version to match root.');process.exit(1);}console.log('Lockstep OK: '+r);\"",
     "lint:lockfile-canonical": "bash scripts/check-lockfile-canonical.sh",
     "lint:dashboard-css-sync": "npm run build:scripts && node dist/scripts/check-components-css-sync.js",
     "lint:pi-drift": "node scripts/check-pi-drift.js",
-    "check:all": "npm run lint:test-ensemble-literals && npm run lint:skip-reasons && npm run lint:lockstep-version && npm run lint:lockfile-canonical && npm run lint:surface-drift && npm run lint:no-stale-scaffold && npm run build && npm run lint:pi-drift && npm run lint:dashboard-css-sync && npm test && npm --prefix dashboard run lint && npm --prefix dashboard run test && npm run size-limit && npm run verify-tarball"
+    "check:all": "npm run lint:test-ensemble-literals && npm run lint:skip-reasons && npm run lint:lockstep-version && npm run lint:lockfile-canonical && npm run lint:surface-drift && npm run lint:no-stale-scaffold && npm run lint:no-stray-src-js && npm run build && npm run lint:pi-drift && npm run lint:dashboard-css-sync && npm test && npm --prefix dashboard run lint && npm --prefix dashboard run test && npm run size-limit && npm run verify-tarball"
   },
   "optionalDependencies": {
     "@anthropic-ai/sdk": "~0.91.1",