agent-tempo 1.7.0-beta.11 → 1.7.0-beta.12

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "1.7.0-beta.11",
+  "version": "1.7.0-beta.12",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/client/subscribe.d.ts

@@ -81,6 +81,16 @@ export interface SubscribeDeps {
      * present (Node 20), the wrapper falls back to fetch.
      */
     EventSourceImpl?: typeof EventSource;
+    /**
+     * #826 — force the fetch transport even when a native `EventSource` is
+     * available and no token is set. The fetch path is the only one that
+     * surfaces a permanent **401/404** as a thrown {@link SubscribeHttpError};
+     * native `EventSource` swallows those into its own silent reconnect cycle.
+     * The mission-control board needs that hard-error visibility (404 → `gone`,
+     * 401 → auth hint), so it sets this. TUI / dashboard leave it unset and keep
+     * the auto-selection (native `EventSource` on a tokenless loopback board).
+     */
+    forceFetch?: boolean;
     /**
      * Override sleep — used by tests to fast-forward backoff. Accepts an
      * `AbortSignal` so the wrapper can wake early on abort.

package/dist/client/subscribe.js

@@ -216,6 +216,8 @@ function makeIterator(args) {
  * for `Authorization: Bearer …` and is the only option in Node 20.
  */
 function canUseEventSource(deps) {
+    if (deps.forceFetch)
+        return false; // #826 — caller needs throw-on-permanent
     if (deps.token)
         return false;
     return resolveEventSource(deps) !== undefined;

package/dist/pi/mission-control/board.d.ts

@@ -41,14 +41,15 @@ export declare const DEFAULT_TAIL_LIMIT = 200;
  *
  * - `'connecting'` — initial / post-rebind, before the first coarse event lands.
  * - `'live'` — at least one coarse event has arrived on the current connection.
- * - `'reconnecting'` — the coarse stream ENDED (a non-404 error, a 401, or a
- *   defensive normal-end) and the loop has exited. Rows are KEPT (rendered stale,
- *   not cleared). NOTE (#827 review): this is terminal-until-rebind today — the
- *   stream does NOT auto-resubscribe (genuine transient blips are swallowed
- *   INSIDE `createSubscribe`, so the board stays `'live'` through them). The
- *   renderer therefore labels it "STREAM ENDED … reopens on re-bind", not
- *   "reconnecting". Auto-re-arm with backoff is tracked in #828; restore the
- *   reconnecting wording if/when the loop re-subscribes on this transition.
+ * - `'reconnecting'` — the coarse stream ended OR went silent past the watchdog
+ *   threshold (#826), and the board is RE-ARMING. Rows are KEPT (rendered stale,
+ *   not cleared). #828: the extension now auto-re-subscribes with bounded
+ *   equal-jitter backoff (genuine transient blips are still swallowed INSIDE
+ *   `createSubscribe`, so the board only reaches here on a real stream-death).
+ *   The variant is carried on `connectionDetail` (no new enum value): an arming
+ *   detail → `[RECONNECTING]`, a settled detail (re-arm capped at 30s) →
+ *   `[STREAM DOWN]`, and the 401-auth path (which does NOT auto-re-arm — a
+ *   re-sub would just 401 again) keeps the `[STREAM ENDED]` + set-token hint.
  * - `'gone'` — a hard 404 on the per-ensemble stream: the ensemble's maestro is
  *   gone. {@link setConnection} CLEARS the player list on this transition and the
  *   extension STOPS the stream; the renderer shows "ENSEMBLE DESTROYED".

package/dist/pi/mission-control/extension.d.ts

@@ -1,4 +1,5 @@
 import { type PiRole } from '../../config';
+import { createSubscribe } from '../../client/subscribe';
 import { type BoardModel, type CommandLevel } from './board';
 import { MissionControlActions, type ActionResult } from './actions';
 import { type InfraProgress } from '../../cli/ensure-infra';
@@ -32,6 +33,14 @@ export interface MissionControlDeps {
      * `'player'` and `'none'` both keep it dormant.
      */
     role?: PiRole;
+    /**
+     * #826/#828 — override the coarse-stream subscribe factory (test seam).
+     * Defaults to {@link createSubscribe}. Lets a fake-timer test inject a mock
+     * `subscribe` generator to drive the watchdog + re-arm loop deterministically
+     * and assert the single-loop invariant (subscribe called exactly N times, not
+     * N+1). Production never sets it.
+     */
+    createSubscribeImpl?: typeof createSubscribe;
 }
 /**
  * Infra-bootstrap seam (#700 P1). Defaults to the real {@link ensureInfra}; the
@@ -93,6 +102,61 @@ export declare function classifyCoarseStreamEnd(err: unknown, aborted: boolean):
     connection: 'gone' | 'reconnecting';
     detail?: string;
 } | null;
+/** #826 — watchdog poll cadence (how often we compare now − lastCoarseEventAt). */
+export declare const WATCHDOG_TICK_MS = 5000;
+/**
+ * #826 — board-level staleness threshold. The daemon emits a `heartbeat` SSE
+ * event every ≤10s on a live `/v1/events` stream, so >35s of TOTAL silence
+ * (3.5× heartbeat) means the stream is wedged/dead — a half-open socket from a
+ * hard `agent-tempo down` (ECONNREFUSED / dead TCP), which neither a 404 nor
+ * force-fetch's INTERNAL retry surfaces (that loop reconnects forever, never
+ * throws). Sits ABOVE the fetch loop's 30s internal backoff cap, so a healthy
+ * cycling loop still receiving heartbeats never trips it — this gap IS the
+ * no-double-retry boundary (watchdog = safety net ABOVE the transport).
+ */
+export declare const COARSE_STALE_MS = 35000;
+/**
+ * #828 — after this many consecutive failed re-arms the board stops claiming
+ * it's actively "reconnecting" and settles to the honest "[STREAM DOWN] —
+ * retrying every 30s" wording. Re-arm itself NEVER stops (a permanently silent
+ * wedge is the #752 silent-wedge class); only the label changes. ~5 steps takes
+ * the backoff ramp to its 30s cap.
+ */
+export declare const REARM_SETTLE_THRESHOLD = 5;
+/**
+ * #828 — equal-jitter backoff for the Nth re-arm attempt: `b/2 + rand(0, b/2)`
+ * where `b = min(1s·2^attempt, 30s)`. `Math.random()` is fine here — this is
+ * client code, not workflow code (the determinism rule does not apply). Jitter
+ * spreads re-arms so a fleet of boards doesn't thundering-herd a recovering
+ * daemon. `randomFn` is injectable for deterministic tests.
+ */
+export declare function rearmDelayMs(attempt: number, randomFn?: () => number): number;
+/**
+ * #828 — the reconnecting sub-variant wording for the Nth re-arm attempt: still
+ * ramping (< {@link REARM_SETTLE_THRESHOLD}) → "attempting to reconnect…";
+ * settled (≥) → "retrying every 30s". Carried on the model's `connectionDetail`
+ * (NO new BoardConnection enum value) and read by the renderer to pick the
+ * marker. Pure + exported for unit testing.
+ */
+export declare function reconnectDetailForAttempt(attempt: number): string;
+/**
+ * #828 — should a coarse stream-END auto-re-arm? Gate (architect ruling):
+ * - `null` (aborted teardown/rebind) → no
+ * - `gone` (404 — maestro torn down; a re-sub just 404s) → no (terminal by design)
+ * - `reconnecting` WITH a detail (the 401 auth path — tight-looping a
+ *   guaranteed-fail) → no; keep the set-token hint
+ * - `reconnecting` WITHOUT a detail (generic stream-drop / normal-end) → yes
+ * Pure + exported for unit testing.
+ */
+export declare function shouldRearmOnStreamEnd(end: {
+    connection: 'gone' | 'reconnecting';
+    detail?: string;
+} | null): boolean;
+/**
+ * #826 — is the coarse stream stale (silent past {@link COARSE_STALE_MS})?
+ * `lastEventAt === 0` means "not connected yet" → never stale. Pure.
+ */
+export declare function isCoarseStale(lastEventAt: number, now: number): boolean;
 /**
  * The operator-command + board controller. Holds the model + the action client;
  * command methods are independently unit-testable with a fake actions + ctx.

package/dist/pi/mission-control/extension.js

@@ -33,13 +33,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Controller = void 0;
+exports.Controller = exports.REARM_SETTLE_THRESHOLD = exports.COARSE_STALE_MS = exports.WATCHDOG_TICK_MS = void 0;
 exports.buildAnswerWake = buildAnswerWake;
 exports.parseEnsembleUpArgs = parseEnsembleUpArgs;
 exports.parseRecruitArgs = parseRecruitArgs;
 exports.parseReleaseArg = parseReleaseArg;
 exports.formatOutcome = formatOutcome;
 exports.classifyCoarseStreamEnd = classifyCoarseStreamEnd;
+exports.rearmDelayMs = rearmDelayMs;
+exports.reconnectDetailForAttempt = reconnectDetailForAttempt;
+exports.shouldRearmOnStreamEnd = shouldRearmOnStreamEnd;
+exports.isCoarseStale = isCoarseStale;
 exports.registerPlannerTools = registerPlannerTools;
 exports.createMissionControlExtension = createMissionControlExtension;
 /**
@@ -217,6 +221,73 @@ function classifyCoarseStreamEnd(err, aborted) {
     }
     return { connection: 'reconnecting' };
 }
+// ── #826/#828 — coarse-stream watchdog + auto-re-arm ───────────────────────
+/** #826 — watchdog poll cadence (how often we compare now − lastCoarseEventAt). */
+exports.WATCHDOG_TICK_MS = 5_000;
+/**
+ * #826 — board-level staleness threshold. The daemon emits a `heartbeat` SSE
+ * event every ≤10s on a live `/v1/events` stream, so >35s of TOTAL silence
+ * (3.5× heartbeat) means the stream is wedged/dead — a half-open socket from a
+ * hard `agent-tempo down` (ECONNREFUSED / dead TCP), which neither a 404 nor
+ * force-fetch's INTERNAL retry surfaces (that loop reconnects forever, never
+ * throws). Sits ABOVE the fetch loop's 30s internal backoff cap, so a healthy
+ * cycling loop still receiving heartbeats never trips it — this gap IS the
+ * no-double-retry boundary (watchdog = safety net ABOVE the transport).
+ */
+exports.COARSE_STALE_MS = 35_000;
+/** #828 re-arm backoff: base 1s, ×2, cap 30s. */
+const REARM_BASE_MS = 1_000;
+const REARM_MAX_MS = 30_000;
+/**
+ * #828 — after this many consecutive failed re-arms the board stops claiming
+ * it's actively "reconnecting" and settles to the honest "[STREAM DOWN] —
+ * retrying every 30s" wording. Re-arm itself NEVER stops (a permanently silent
+ * wedge is the #752 silent-wedge class); only the label changes. ~5 steps takes
+ * the backoff ramp to its 30s cap.
+ */
+exports.REARM_SETTLE_THRESHOLD = 5;
+/**
+ * #828 — equal-jitter backoff for the Nth re-arm attempt: `b/2 + rand(0, b/2)`
+ * where `b = min(1s·2^attempt, 30s)`. `Math.random()` is fine here — this is
+ * client code, not workflow code (the determinism rule does not apply). Jitter
+ * spreads re-arms so a fleet of boards doesn't thundering-herd a recovering
+ * daemon. `randomFn` is injectable for deterministic tests.
+ */
+function rearmDelayMs(attempt, randomFn = Math.random) {
+    const b = Math.min(REARM_BASE_MS * 2 ** Math.max(0, attempt), REARM_MAX_MS);
+    return b / 2 + randomFn() * (b / 2);
+}
+/**
+ * #828 — the reconnecting sub-variant wording for the Nth re-arm attempt: still
+ * ramping (< {@link REARM_SETTLE_THRESHOLD}) → "attempting to reconnect…";
+ * settled (≥) → "retrying every 30s". Carried on the model's `connectionDetail`
+ * (NO new BoardConnection enum value) and read by the renderer to pick the
+ * marker. Pure + exported for unit testing.
+ */
+function reconnectDetailForAttempt(attempt) {
+    return attempt >= exports.REARM_SETTLE_THRESHOLD ? render_1.STREAM_DOWN_DETAIL : render_1.RECONNECT_ARMING_DETAIL;
+}
+/**
+ * #828 — should a coarse stream-END auto-re-arm? Gate (architect ruling):
+ * - `null` (aborted teardown/rebind) → no
+ * - `gone` (404 — maestro torn down; a re-sub just 404s) → no (terminal by design)
+ * - `reconnecting` WITH a detail (the 401 auth path — tight-looping a
+ *   guaranteed-fail) → no; keep the set-token hint
+ * - `reconnecting` WITHOUT a detail (generic stream-drop / normal-end) → yes
+ * Pure + exported for unit testing.
+ */
+function shouldRearmOnStreamEnd(end) {
+    return end !== null && end.connection === 'reconnecting' && end.detail === undefined;
+}
+/**
+ * #826 — is the coarse stream stale (silent past {@link COARSE_STALE_MS})?
+ * `lastEventAt === 0` means "not connected yet" → never stale. Pure.
+ */
+function isCoarseStale(lastEventAt, now) {
+    if (lastEventAt === 0)
+        return false;
+    return now - lastEventAt > exports.COARSE_STALE_MS;
+}
 /**
  * The operator-command + board controller. Holds the model + the action client;
  * command methods are independently unit-testable with a fake actions + ctx.
@@ -783,6 +854,15 @@ function createMissionControlExtension(deps = {}) {
         let renderTimer = null;
         let lastRenderedRevision = -1;
         let activeCtx = null;
+        // #826/#828 — coarse-stream liveness + auto-re-arm state.
+        // `lastCoarseEventAt` is stamped on EVERY received coarse event (incl. the
+        // daemon's ≤10s `heartbeat`), so the watchdog measures true silence. `0` =
+        // not connected yet. `rearmAttempt` drives the #828 backoff + settle wording;
+        // `rearmTimer` is the single pending re-arm (one at a time — no stacking).
+        let watchdogTimer = null;
+        let rearmTimer = null;
+        let rearmAttempt = 0;
+        let lastCoarseEventAt = 0;
         // #790 — the CURRENT ensemble binding lives on `ctrl.model.ensemble`
         // (re-keyed by Controller.rebind BEFORE onRebind fires), so the SSE
         // closures below read it at (re)open time instead of capturing the
@@ -795,7 +875,58 @@ function createMissionControlExtension(deps = {}) {
             lastRenderedRevision = ctrl.model.revision;
             activeCtx.ui.setWidget(WIDGET_KEY, (0, render_1.renderBoard)(ctrl.model, ctrl.localHost), { placement: 'aboveEditor' });
         };
+        // #823 — flip the board's connection state + render the banner immediately
+        // (don't wait for the throttle tick when the stream's liveness changes).
+        const markConnection = (state, detail) => {
+            (0, board_1.setConnection)(ctrl.model, state, detail);
+            renderNow();
+        };
+        // #828 — cancel the single pending re-arm timer (idempotent).
+        const cancelRearm = () => {
+            if (rearmTimer) {
+                clearTimeout(rearmTimer);
+                rearmTimer = null;
+            }
+        };
+        // #828 — schedule the next coarse re-arm with bounded equal-jitter backoff.
+        // At most ONE pending at a time (the `rearmTimer` guard stops the watchdog and
+        // a stream-end both stacking re-arms). Reflects the arming/settled wording on
+        // the banner immediately, then re-opens the stream after the delay. NEVER
+        // gives up — the delay caps at 30s and `rearmAttempt` keeps the cadence there.
+        const scheduleRearm = () => {
+            if (rearmTimer)
+                return;
+            markConnection('reconnecting', reconnectDetailForAttempt(rearmAttempt));
+            const delay = rearmDelayMs(rearmAttempt);
+            rearmAttempt++;
+            rearmTimer = setTimeout(() => {
+                rearmTimer = null;
+                startCoarse(); // aborts the old/wedged loop at its top, opens a fresh one
+            }, delay);
+            if (typeof rearmTimer.unref === 'function')
+                rearmTimer.unref();
+        };
+        // #828 — apply a classified coarse stream-END to the board. A generic
+        // stream-drop re-arms (backoff); `gone` (404) is terminal (clear roster +
+        // cancel any pending re-arm); a 401 keeps the auth hint WITHOUT auto-re-arm
+        // (tight-looping a guaranteed-fail). `null` = aborted teardown/rebind/re-arm.
+        const handleStreamEnd = (end) => {
+            if (!end)
+                return;
+            if (shouldRearmOnStreamEnd(end)) {
+                scheduleRearm();
+                return;
+            }
+            if (end.connection === 'gone')
+                cancelRearm();
+            markConnection(end.connection, end.detail);
+        };
         const startCoarse = () => {
+            // #828 — guarantee EXACTLY ONE coarse loop alive: abort any prior stream (a
+            // wedged one being re-armed, or one that just ended) before opening a fresh
+            // one. The aborted prior loop exits via classifyCoarseStreamEnd(_, true)→null
+            // (no state change). session_start's first call has none (abort is a no-op).
+            coarseAbort?.abort();
             // #54 — accurate posture: a tokenless board is FULLY functional against a
             // local (loopback) daemon, which grants full trust. Only a REMOTE / 0.0.0.0
             // daemon requires the admin token (it 401s tokenless reads + actions).
@@ -807,25 +938,33 @@ function createMissionControlExtension(deps = {}) {
             // expected teardown abort log a spurious "coarse SSE ended: AbortError".
             const ac = new AbortController();
             coarseAbort = ac;
-            // H5: omit baseUrl → createSubscribe re-resolves the daemon port per
-            // (re)connect, so a daemon restart on a new port self-heals.
-            const subscribe = (0, subscribe_1.createSubscribe)({
+            // #826 — FORCE the fetch transport: only it throws on a permanent 401/404
+            // (native EventSource swallows those into a silent reconnect cycle), and the
+            // board needs that to flip to `gone` / surface the auth hint. H5: omit baseUrl
+            // → createSubscribe re-resolves the daemon port per (re)connect, so a daemon
+            // restart on a new port self-heals.
+            const subscribe = (deps.createSubscribeImpl ?? subscribe_1.createSubscribe)({
+                forceFetch: true,
                 ...(deps.baseUrl ? { baseUrl: deps.baseUrl } : {}),
                 ...(adminToken ? { token: adminToken } : {}),
             });
-            // #823 — flip the board's connection state + render the banner immediately
-            // (don't wait for the throttle tick when the stream's liveness changes).
-            const markConnection = (state, detail) => {
-                (0, board_1.setConnection)(ctrl.model, state, detail);
-                renderNow();
-            };
+            // #826 — fresh connect: reset the staleness clock so the watchdog measures
+            // silence on THIS attempt, not the gap accrued since the last dead stream.
+            lastCoarseEventAt = Date.now();
             void (async () => {
                 try {
                     for await (const ev of subscribe(ctrl.model.ensemble, { signal: ac.signal })) {
-                        // #823 — the first event on this connection proves the stream is
-                        // live (clears a prior reconnecting/connecting banner).
-                        if (ctrl.model.connection !== 'live')
+                        // #826 — stamp liveness on EVERY received event (incl. the no-op
+                        // `heartbeat` the daemon emits ≤10s) so the watchdog sees the pulse.
+                        lastCoarseEventAt = Date.now();
+                        // #823/#828 — the first event on this connection proves the stream is
+                        // live: clear a prior reconnecting banner AND reset the re-arm backoff
+                        // (a recovered stream starts the next failure's ramp from scratch).
+                        if (ctrl.model.connection !== 'live') {
                             markConnection('live');
+                            rearmAttempt = 0;
+                            cancelRearm();
+                        }
                         // #700 P2 — an `answer` event isn't a board event; it WAKES the
                         // planner (its only inbound channel is this SSE stream). Inject via
                         // pi.sendMessage(triggerTurn) — feature-detected (a fake/older Pi
@@ -839,24 +978,41 @@ function createMissionControlExtension(deps = {}) {
                         }
                         (0, board_1.applyTempoEvent)(ctrl.model, ev);
                     }
-                    // #823 — the stream ENDED without throwing. In production `createSubscribe`
-                    // only ends normally on abort (it auto-retries transient drops), so a
-                    // non-aborted normal end is a defensive transient path → reconnecting.
-                    const end = classifyCoarseStreamEnd(undefined, ac.signal.aborted);
-                    if (end)
-                        markConnection(end.connection, end.detail);
+                    // Stream ended without throwing — classify + (maybe) re-arm.
+                    handleStreamEnd(classifyCoarseStreamEnd(undefined, ac.signal.aborted));
                 }
                 catch (err) {
-                    // #823 — map the (permanent) stream error to a board connection state.
-                    // Aborted teardown/rebind → null (no change, no spurious log).
+                    // Map the (permanent) stream error to a board transition.
+                    // Aborted teardown/rebind/re-arm → null (no change, no spurious log).
                     const end = classifyCoarseStreamEnd(err, ac.signal.aborted);
                     if (!end)
                         return;
                     log(end.connection === 'gone' ? 'coarse SSE — ensemble gone:' : 'coarse SSE ended:', err instanceof Error ? err.message : err);
-                    markConnection(end.connection, end.detail);
+                    handleStreamEnd(end);
                 }
             })();
         };
+        // #826 — watchdog: a wedged/dead socket (half-open from a hard `agent-tempo
+        // down`) never throws and never ends the loop, so neither the 404 path nor
+        // force-fetch's internal retry catches it. Detect it by TOTAL silence past
+        // COARSE_STALE_MS (no heartbeat) and re-arm. Skips when already `gone`
+        // (terminal), in the 401 auth-ended state (no auto-re-arm by design — its
+        // connectionDetail is the auth hint, not an arming/settled marker), or when a
+        // re-arm is already pending (no stacking with the stream-end path).
+        const checkStale = () => {
+            if (ctrl.model.connection === 'gone')
+                return;
+            if (ctrl.model.connection === 'reconnecting' &&
+                ctrl.model.connectionDetail !== render_1.RECONNECT_ARMING_DETAIL &&
+                ctrl.model.connectionDetail !== render_1.STREAM_DOWN_DETAIL)
+                return;
+            if (rearmTimer)
+                return;
+            if (!isCoarseStale(lastCoarseEventAt, Date.now()))
+                return;
+            log(`coarse stream stale — no daemon heartbeat for >${exports.COARSE_STALE_MS / 1000}s; re-arming`);
+            scheduleRearm();
+        };
         const openTail = (playerId) => {
             tailAbort?.abort();
             tailAbort = null;
@@ -889,6 +1045,8 @@ function createMissionControlExtension(deps = {}) {
             coarseAbort = null;
             tailAbort?.abort();
             tailAbort = null;
+            cancelRearm();
+            rearmAttempt = 0; // #828 — fresh ensemble: drop any pending re-arm + reset the backoff ramp
             startCoarse(); // reads the already-re-keyed ctrl.model.ensemble
             renderNow(); // show the re-keyed (empty) board immediately, not at the next throttle tick
         };
@@ -897,6 +1055,11 @@ function createMissionControlExtension(deps = {}) {
             coarseAbort = null;
             tailAbort?.abort();
             tailAbort = null;
+            cancelRearm(); // #828 — drop any pending re-arm
+            if (watchdogTimer) {
+                clearInterval(watchdogTimer);
+                watchdogTimer = null;
+            } // #826
             if (renderTimer) {
                 clearInterval(renderTimer);
                 renderTimer = null;
@@ -908,10 +1071,16 @@ function createMissionControlExtension(deps = {}) {
         pi.on('session_start', (_event, ctx) => {
             activeCtx = ctx;
             lastRenderedRevision = -1;
+            rearmAttempt = 0; // #828 — fresh session
             startCoarse();
             renderTimer = setInterval(renderNow, throttleMs);
             if (typeof renderTimer.unref === 'function')
                 renderTimer.unref();
+            // #826 — coarse-stream staleness watchdog (catches a wedged/dead socket
+            // that never throws). `.unref()` so it can't keep the process alive.
+            watchdogTimer = setInterval(checkStale, exports.WATCHDOG_TICK_MS);
+            if (typeof watchdogTimer.unref === 'function')
+                watchdogTimer.unref();
             renderNow();
         });
         pi.on('session_shutdown', () => teardown());

package/dist/pi/mission-control/render.d.ts

@@ -1,4 +1,16 @@
 import { type BoardModel } from './board';
+/**
+ * #828 — `connectionDetail` sentinels that select the `reconnecting` sub-marker
+ * (the variant is carried on the model's `connectionDetail`, so NO new
+ * `BoardConnection` enum value is needed). The extension sets one of these while
+ * the coarse stream auto-re-arms:
+ * - {@link RECONNECT_ARMING_DETAIL} — still ramping (< settle threshold) → `[RECONNECTING]`
+ * - {@link STREAM_DOWN_DETAIL} — settled (re-arm capped at 30s, daemon still dead) → `[STREAM DOWN]`
+ * Any OTHER reconnecting detail (e.g. the 401 auth hint) renders as `[STREAM
+ * ENDED]` — that path does NOT auto-re-arm.
+ */
+export declare const RECONNECT_ARMING_DETAIL = "attempting to reconnect\u2026";
+export declare const STREAM_DOWN_DETAIL = "retrying every 30s \u2014 /ensemble to rebind";
 /**
  * #836 — Pi's `InteractiveMode` hard-caps a widget at this many lines and, beyond
  * it, naively slices the top N and appends its own dev-speak `... (widget

package/dist/pi/mission-control/render.js

@@ -1,10 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_WIDGET_LINES = void 0;
+exports.MAX_WIDGET_LINES = exports.STREAM_DOWN_DETAIL = exports.RECONNECT_ARMING_DETAIL = void 0;
 exports.renderBoard = renderBoard;
 const board_1 = require("./board");
 /** How many recent fine-tail frames to show under the selected player. */
 const TAIL_RENDER_LINES = 12;
+/**
+ * #828 — `connectionDetail` sentinels that select the `reconnecting` sub-marker
+ * (the variant is carried on the model's `connectionDetail`, so NO new
+ * `BoardConnection` enum value is needed). The extension sets one of these while
+ * the coarse stream auto-re-arms:
+ * - {@link RECONNECT_ARMING_DETAIL} — still ramping (< settle threshold) → `[RECONNECTING]`
+ * - {@link STREAM_DOWN_DETAIL} — settled (re-arm capped at 30s, daemon still dead) → `[STREAM DOWN]`
+ * Any OTHER reconnecting detail (e.g. the 401 auth hint) renders as `[STREAM
+ * ENDED]` — that path does NOT auto-re-arm.
+ */
+exports.RECONNECT_ARMING_DETAIL = 'attempting to reconnect…';
+exports.STREAM_DOWN_DETAIL = 'retrying every 30s — /ensemble to rebind';
 /**
  * #836 — Pi's `InteractiveMode` hard-caps a widget at this many lines and, beyond
  * it, naively slices the top N and appends its own dev-speak `... (widget
@@ -137,23 +149,36 @@ function renderBoard(model, localHost) {
     // A dropped stream outranks PAUSED/HELD: the suspension flags below are then
     // last-known-only and the operator needs to know the view itself may be stale.
     //
-    // HONEST LABEL (#827 review): the `'reconnecting'` connection state does NOT
-    // auto-reconnect today — `createSubscribe` swallows genuine transient blips
-    // internally (the board stays `live` through them), so this state is only
-    // reached when the coarse stream has actually ended and the loop has exited.
-    // It reopens on an `/ensemble` re-bind, not on its own. We therefore label it
-    // "STREAM ENDED … reopens on re-bind" rather than the misleading "RECONNECTING"
-    // (shipping a reconnecting badge that doesn't reconnect is the exact
-    // misleading-feedback class this PR fixes). Auto-re-arm is tracked in #828;
-    // if/when the loop re-subscribes with backoff, restore the reconnecting wording.
+    // #828 — the coarse stream now AUTO-RE-ARMS (bounded-backoff re-subscribe), so
+    // the `reconnecting` state has three honest variants, discriminated by
+    // `connectionDetail` (no new `BoardConnection` enum value):
+    //   - arming  (re-arm in flight, < settle) → `[RECONNECTING]` "attempting to reconnect…"
+    //   - settled (re-arm capped at 30s, still dead) → `[STREAM DOWN]` "retrying every 30s"
+    //   - other detail (the 401 auth path — does NOT auto-re-arm) → `[STREAM ENDED]` + hint
+    // The #827 "STREAM ENDED, reopens on re-bind" honest-label note is now reversed
+    // for the arming/settled variants because re-arm is real (#828); only the 401
+    // path keeps the stream-ended wording (it genuinely needs a manual re-bind /
+    // new token).
     let marker = '';
     let what = '';
     if (model.connection === 'reconnecting') {
-        marker = ' · [STREAM ENDED]';
-        const tail = 'last-known state, reopens on /ensemble re-bind';
-        what = model.connectionDetail
-            ? `STREAM ENDED — ${model.connectionDetail}; ${tail}`
-            : `STREAM ENDED — coarse stream dropped; ${tail}`;
+        if (model.connectionDetail === exports.RECONNECT_ARMING_DETAIL) {
+            marker = ' · [RECONNECTING]';
+            what = `RECONNECTING — ${exports.RECONNECT_ARMING_DETAIL}`;
+        }
+        else if (model.connectionDetail === exports.STREAM_DOWN_DETAIL) {
+            marker = ' · [STREAM DOWN]';
+            what = `STREAM DOWN — ${exports.STREAM_DOWN_DETAIL}`;
+        }
+        else {
+            // 401 auth (or any non-re-arming reconnecting): the stream ended and only a
+            // manual re-bind / new token recovers it — keep the honest stream-ended copy.
+            marker = ' · [STREAM ENDED]';
+            const tail = 'last-known state, reopens on /ensemble re-bind';
+            what = model.connectionDetail
+                ? `STREAM ENDED — ${model.connectionDetail}; ${tail}`
+                : `STREAM ENDED — coarse stream dropped; ${tail}`;
+        }
     }
     else if (model.paused) {
         marker = ' · [PAUSED]';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-tempo",
-  "version": "1.7.0-beta.11",
+  "version": "1.7.0-beta.12",
   "description": "Many agents, one tempo. Durable coordination for multi-agent work via Temporal.",
   "keywords": [
     "mcp",
@@ -82,13 +82,14 @@
     "test": "mocha && vitest run",
     "lint:surface-drift": "node scripts/check-surface-drift.js",
     "lint:no-stale-scaffold": "node scripts/check-no-stale-scaffold.js",
+    "lint:no-stray-src-js": "node scripts/check-no-stray-src-js.js",
     "lint:test-ensemble-literals": "bash scripts/check-test-ensemble-literals.sh",
     "lint:skip-reasons": "node scripts/lint-skip-reasons.js",
     "lint:lockstep-version": "node -e \"const r=require('./package.json').version,d=require('./dashboard/package.json').version;if(r!==d){console.error('Version drift: root='+r+' dashboard='+d+'. Bump dashboard/package.json#version to match root.');process.exit(1);}console.log('Lockstep OK: '+r);\"",
     "lint:lockfile-canonical": "bash scripts/check-lockfile-canonical.sh",
     "lint:dashboard-css-sync": "npm run build:scripts && node dist/scripts/check-components-css-sync.js",
     "lint:pi-drift": "node scripts/check-pi-drift.js",
-    "check:all": "npm run lint:test-ensemble-literals && npm run lint:skip-reasons && npm run lint:lockstep-version && npm run lint:lockfile-canonical && npm run lint:surface-drift && npm run lint:no-stale-scaffold && npm run build && npm run lint:pi-drift && npm run lint:dashboard-css-sync && npm test && npm --prefix dashboard run lint && npm --prefix dashboard run test && npm run size-limit && npm run verify-tarball"
+    "check:all": "npm run lint:test-ensemble-literals && npm run lint:skip-reasons && npm run lint:lockstep-version && npm run lint:lockfile-canonical && npm run lint:surface-drift && npm run lint:no-stale-scaffold && npm run lint:no-stray-src-js && npm run build && npm run lint:pi-drift && npm run lint:dashboard-css-sync && npm test && npm --prefix dashboard run lint && npm --prefix dashboard run test && npm run size-limit && npm run verify-tarball"
   },
   "optionalDependencies": {
     "@anthropic-ai/sdk": "~0.91.1",