feat(capacity): publish persistent tailnet-only dashboard service

[purple-phoenix]

Intent

Publish the fleet capacity dashboard as a persistent, always-reachable tailnet-only web service the captain can use to command firstmate, wearing the merged fm-capacity command-briefing redesign's look. Captain's hard requirements: (1) one-click dispatch of CAP-* actions delivered to the running firstmate through a safe durable inbound channel (state/dash-inbox records surfaced by the registered fm-dash watcher check), never executing anything in the web process; (2) a refresh-capacity button rerunning the generator server-side plus interval auto-render; (3) a persistent prod link on Tailscale surviving reboots via launchd, tailnet-only, never Funnel; (4) clickable work items with rich detail views (description, PR link, tailnet preview links, test plan from briefs, metadata, backlog, reports); (5) open decisions as rich options documents (data//decisions/.md, owner-qualified identity, wired into fm-decision-hold.sh filing) with per-option approve buttons and a bounded custom answer; (6) an Ideas section over data/ideas/idea-backlog.md with approve/deny/add-suggestions verdicts; (7) zero copy-prompt affordances on the served page - direct dispatch replaces copy everywhere; (8) every blocked row shows its plain-language blocker chain resolved recursively to the root cause plus an explicit What-you-can-do line; (9) a subscription usage panel from quota-axi --json for Claude, Codex, and Grok only with local-timezone resets; (10) prod-bug fixes from live use: the launchd agent must pin the installing shell's PATH so state readers resolve (states degraded silently to unknown under launchd's minimal env), a mostly-unknown render is marked RENDER DEGRADED loudly rather than presented as truth, and a keyless needs-decision status event must never be fabricated into a captain decision (keyed 'default' with a dead-end modal) - it renders honestly as a worker question firstmate handles in chat, with no decision identity and no Decide framing. Deliberate boundaries decided by the captain during review: the on-disk dashboard stays identity-opaque and privacy-bounded (no hold reasons, event summaries, or state details are copied into the artifact - concreteness comes from the authenticated service's refs-based de-anonymization and detail views); tailnet identity plus same-origin enforcement make dashboard input genuinely the captain; the only free text anywhere is the bounded captain-authored idea suggestion and decision custom answer, delivered as data, never interpreted; inbox delivery is at-least-once with idempotent handling (deliver-then-archive so a crash never loses a command); destructive or irreversible consequences still re-confirm in chat; secondmate-owned items keep a limited v1 note by accepted decision; the never-Funnel verification fails closed on unreadable tailscale status; installs are transactional, restore only observed prior mapping state, and refuse or skip ports whose mappings belong to other services. The final commit e7cbd85 on this branch applies exactly the item-10 prod fixes plus blocker chains and zero-copy replacement with regression tests; everything before it was validated by the prior run of this same intent through checks-passed.

What Changed

• Add a launchd-managed dashboard service and transactional Tailscale Serve installer that maintains a stable tailnet-only URL across reboots while protecting existing mappings and failing closed on Funnel exposure.
• Extend the capacity dashboard with authenticated refresh and auto-rendering, rich work/decision/idea views, subscription usage, and validated one-click dispatch through a durable Firstmate inbox.
• Harden dashboard accuracy with private identity refs, recursive blocker guidance, owner-qualified decisions, honest keyless worker questions, loud degraded-state reporting, documentation, and regression coverage.

Risk Assessment

✅ Low: Captain, the follow-up cleanly addresses sibling cycles, secondmate held-worker evidence, and multiple simultaneous decision roots without introducing a material new risk.

Testing

The already-passing full baseline was supplemented with the focused dashboard E2E suite and manual Chrome rendering of the authenticated served page; dispatch/inbox durability, refresh, decisions, ideas, quota filtering, blocker roots, degraded rendering, zero-copy controls, launchd PATH/persistence structure, and transactional Tailscale behavior all passed, with HTML, screenshot, and transcript evidence captured.

• Evidence: Rendered captain capacity dashboard (local file: /var/folders/g0/z_4x96f92cgfpm7940cqvtt00000gn/T/no-mistakes-evidence/01KYMYRBAQ8B9B19EGRG79V21K/capacity-dashboard.png)

Evidence: Authenticated dashboard response

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="color-scheme" content="dark light">
  <title>Firstmate capacity dashboard</title>
  <style>
    :root{color-scheme:dark;--bg:#0d0d0d;--ink:#ffffff;--ink2:#c3c2b7;--muted:#898781;--hair:#2c2c2a;--line:rgba(255,255,255,.10);--blue:#3987e5;--good:#0ca30c;--warn:#fab219;--serious:#ec835a;--crit:#d03b3b;--gray:#52514e;font-family:system-ui,-apple-system,"Segoe UI",sans-serif}
    @media(prefers-color-scheme: light){:root{color-scheme:light;--bg:#f9f9f7;--ink:#0b0b0b;--ink2:#52514e;--muted:#66645f;--hair:#e1e0d9;--line:rgba(11,11,11,.10);--blue:#1b5fae;--good:#087708;--warn:#8a6200;--serious:#a54824;--crit:#ae2525;--gray:#c3c2b7}}
    .sev-critical{--sev:var(--crit)}.sev-serious{--sev:var(--serious)}.sev-info{--sev:var(--blue)}.sev-neutral{--sev:var(--muted)}.sev-good{--sev:var(--good)}
    *{box-sizing:border-box}html{background:var(--bg)}
    body{margin:0;color:var(--ink);background:var(--bg);line-height:1.45;overflow-wrap:anywhere}
    a{color:var(--blue);text-underline-offset:.18em}button,a{outline-offset:3px}button:focus-visible,a:focus-visible{outline:3px solid var(--blue)}
    .skip{position:absolute;left:-9999px}.skip:focus{left:1rem;top:1rem;z-index:10;background:var(--ink);color:var(--bg);padding:.7rem 1rem}
    h1,h2,h3,p,ul{margin:0}ul{padding:0;list-style:none}
    .sevbar{height:.7rem;background:var(--sev)}
    .band{padding:clamp(1.5rem,4vw,3.25rem) clamp(1rem,6vw,5rem)}
    .wrap{max-width:70rem;margin-left:auto;margin-right:auto}
    .band-alarm{background:color-mix(in srgb,var(--sev) 13%,var(--bg));border-bottom:1px solid var(--line)}
    .kicker{display:flex;justify-content:space-between;align-items:baseline;gap:1rem;flex-wrap:wrap;color:var(--sev);font-weight:800;letter-spacing:.16em;text-transform:uppercase;font-size:.76rem}
    .kicker .stamp{color:var(--muted);letter-spacing:.02em;text-transform:none;font-weight:400;font-size:.76rem;text-align:right}
    .band .kicker{margin-bottom:.6rem}
    .headline{font-size:clamp(2.4rem,7vw,4.6rem);font-weight:800;letter-spacing:-.03em;line-height:.98}
    .headline::first-letter{text-transform:uppercase}
    .evidence{font-size:clamp(1.02rem,2vw,1.3rem);color:var(--ink2);max-width:75ch;margin-top:1rem}
    .action-id{border:1px solid var(--sev,var(--muted));color:var(--sev,var(--ink));padding:.1rem .55rem;font:700 .72rem ui-monospace,SFMono-Regular,Menlo,monospace;letter-spacing:.04em;vertical-align:middle;margin-left:.5rem}
    .rollcall{margin-top:2.25rem}
    .rollcall h2{font-size:.76rem;font-weight:800;letter-spacing:.16em;text-transform:uppercase;display:flex;align-items:baseline;gap:.6rem}
    .rollcall h2 .n{font-size:2.1rem;letter-spacing:0;line-height:1}
    .needs-you h2{color:var(--serious)}.blocked-items h2{color:var(--crit)}
    .rollcall ul{margin-top:.6rem}
    .rollcall li{display:grid;grid-template-columns:5.2rem minmax(0,.45fr) minmax(0,1fr);gap:.4rem 1.1rem;align-items:baseline;border-top:1px solid color-mix(in srgb,var(--sev) 30%,var(--hair));padding:.55rem 0;font-size:1.02rem;min-width:0}
    .rollcall li.empty{display:block}
    .verb{font-weight:800;text-transform:uppercase;letter-spacing:.08em;font-size:.72rem}
    .verb-approve{color:var(--blue)}.verb-decide{color:var(--serious)}.verb-blocked{color:var(--crit)}
    .who{font-weight:650;min-width:0}.who .item-id{margin-right:.35rem}
    .why{color:var(--ink2);font-size:.92rem;min-width:0}
    .chain{display:block;color:var(--muted);font-size:.8rem;margin-top:.25rem}
    .cando{display:block;color:var(--ink);font-size:.8rem;font-weight:650;margin-top:.15rem}
    .item-id{font:700 .82rem ui-monospace,SFMono-Regular,Menlo,monospace;color:var(--ink)}
    .next{margin-top:2rem;font-size:clamp(1.05rem,1.8vw,1.25rem)}
    .prompt{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:.7rem;align-items:center;margin-top:.9rem;border:1px solid var(--line);padding:.65rem .8rem;background:color-mix(in srgb,var(--bg) 55%,transparent)}
    .prompt code{font-size:.78rem;white-space:normal;color:var(--ink2);font-family:ui-monospace,SFMono-Regular,Menlo,monospace}
    .prompt button{border:1px solid var(--ink);background:var(--ink);color:var(--bg);font-weight:700;padding:.5rem .9rem;cursor:pointer;font-size:.82rem}
    .fine{color:var(--muted);font-size:.76rem;margin-top:.8rem;max-width:100ch}
    .band-meter .kicker{color:var(--muted)}
    .split{display:flex;align-items:baseline;gap:1rem 2.75rem;flex-wrap:wrap;margin-top:.5rem}
    .split .pair{display:flex;align-items:baseline;gap:.75rem}
    .split .num{font-size:clamp(3rem,8vw,5.5rem);font-weight:850;line-height:1;letter-spacing:-.03em}
    .num-working{color:var(--good)}
    .split .lbl{font-size:1rem;color:var(--ink2);text-transform:uppercase;letter-spacing:.14em;font-weight:700}
    .split .of{color:var(--muted);font-size:.9rem}
    .meterbar{display:flex;gap:3px;height:2.9rem;margin-top:1.4rem}
    .m-working{background:var(--good)}.m-waiting{background:var(--gray)}
    .whys{margin-top:1.6rem}
    .whys h3{font-size:.76rem;font-weight:800;letter-spacing:.16em;text-transform:uppercase;color:var(--muted)}
    .whys ul{display:flex;flex-wrap:wrap;gap:1.1rem 2.75rem;margin-top:.8rem}
    .whys li{display:flex;align-items:baseline;gap:.65rem;min-width:0}
    .why-n{font-size:1.9rem;font-weight:800;line-height:1}
    .why-decide{color:var(--serious)}.why-blocked{color:var(--crit)}.why-gates{color:var(--warn)}.why-ready{color:var(--blue)}.why-queued{color:var(--muted)}
    .why-l{font-size:.92rem;color:var(--ink2)}.why-l small{display:block;color:var(--muted);font-size:.76rem}
    .band-quiet{border-top:1px solid var(--line);font-size:.88rem}
    .qhead{font-size:.76rem;font-weight:800;letter-spacing:.16em;text-transform:uppercase;color:var(--muted);border-bottom:1px solid var(--hair);padding-bottom:.45rem;margin-top:2.4rem}
    .band-quiet>.qhead:first-child{margin-top:0}
    .rec{border-bottom:1px solid var(--hair);padding:1rem 0;max-width:70rem}
    .rec-line strong{font-size:1rem}.rec-line strong::first-letter{text-transform:uppercase}
    .rec-line .action-id{margin-left:0;margin-right:.6rem;--sev:var(--muted)}
    .rec-evidence{color:var(--ink2);margin-top:.35rem;max-width:90ch}
    .rec-next{margin-top:.35rem;font-weight:650}
    .rec-fine{color:var(--muted);font-size:.76rem;margin-top:.4rem;max-width:100ch}
    .stage-group{margin-top:1.4rem}
    .stage-h{display:flex;align-items:baseline;gap:.6rem;font-size:.74rem;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:var(--muted)}
    .stage-n{font-size:1.35rem;letter-spacing:0;color:var(--ink)}
    .stage-n-alarm{color:var(--crit)}
    .mlist{margin-top:.4rem}
    .mrow{display:grid;grid-template-columns:minmax(11rem,.4fr) minmax(0,1fr) auto;gap:.3rem 1.25rem;border-top:1px solid var(--hair);padding:.45rem 0;align-items:baseline;min-width:0}
    .mid{min-width:0}.mowner{color:var(--muted);font-size:.78rem;margin-left:.5rem}
    .mreason{color:var(--ink2);min-width:0}
    .mmeta{color:var(--muted);font-size:.76rem;text-align:right}
    .lanes-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 3rem}
    .lanes-grid h3{font-size:.8rem;color:var(--ink2);margin-top:1.1rem;text-transform:uppercase;letter-spacing:.1em}
    .lane-row{display:flex;gap:.6rem;align-items:baseline;border-top:1px solid var(--hair);padding:.5rem 0;color:var(--ink2);min-width:0;margin-top:.4rem}
    .dot{flex:none;width:.6rem;height:.6rem;border-radius:50%;align-self:center}
    .dot-ok{background:var(--good)}.dot-bad{background:var(--crit)}.dot-warn{background:var(--warn)}
    .appendix{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:0 3rem}
    .appendix h3{font-size:.8rem;color:var(--ink2);margin-top:1.1rem;text-transform:uppercase;letter-spacing:.1em}
    .clean-list{margin-top:.4rem}
    .clean-list li{display:grid;grid-template-columns:minmax(8rem,.4fr) minmax(0,1fr);gap:.75rem;border-top:1px solid var(--hair);padding:.45rem 0;min-width:0}
    .clean-list li>*{min-width:0}.clean-list span{color:var(--ink2)}
    .artifact,.path{font:500 

... [32116 bytes truncated] ...

ueue
    // captain messages for firstmate.
    if (cfg.ideas.length) {
      const ideasSection = document.createElement("section");
      ideasSection.className = "band band-quiet";
      ideasSection.setAttribute("aria-label", "Ideas");
      const wrap = document.createElement("div");
      wrap.className = "wrap";
      const heading = document.createElement("h2");
      heading.className = "qhead";
      heading.textContent = "Ideas · awaiting your verdict";
      wrap.appendChild(heading);
      const list = document.createElement("ul");
      list.className = "mlist";
      cfg.ideas.forEach((idea) => {
        const row = document.createElement("li");
        row.className = "mrow";
        const chip = document.createElement("span");
        chip.className = "item-id fmdash-click";
        chip.textContent = idea.id;
        chip.setAttribute("role", "button");
        chip.setAttribute("tabindex", "0");
        chip.setAttribute("aria-label", "Open pitch for " + idea.id);
        const title = document.createElement("span");
        title.className = "mreason";
        title.textContent = idea.title;
        const open = () => openIdea(idea);
        chip.addEventListener("click", (event) => { event.stopPropagation(); open(); });
        chip.addEventListener("keydown", (event) => { if (event.key === "Enter" || event.key === " ") { event.preventDefault(); open(); } });
        row.addEventListener("click", open);
        row.style.cursor = "pointer";
        row.appendChild(chip);
        row.appendChild(title);
        list.appendChild(row);
      });
      wrap.appendChild(list);
      ideasSection.appendChild(wrap);
      const footer = document.querySelector("footer");
      const main = document.querySelector("main");
      if (main) main.appendChild(ideasSection);
      else if (footer) footer.before(ideasSection);
    }
    async function sendIdeaVerdict(id, verdict, suggestion, button) {
      button.disabled = true;
      const original = button.textContent;
      button.textContent = "Sending…";
      try {
        const res = await postJson({ idea: id, verdict, suggestion });
        const out = await res.json();
        if (out.status === "queued" || out.status === "replaced" || out.status === "already-queued") {
          button.textContent = verdict === "suggest" ? "Suggestions sent" : (verdict === "approve" ? "Approved · queued" : "Denied · queued");
          showPending(out.pending);
          return true;
        }
        button.textContent = "Refused";
        button.disabled = false;
      } catch { button.textContent = original; button.disabled = false; }
      return false;
    }
    async function openIdea(idea) {
      const overlay = document.createElement("div");
      overlay.className = "fmdash-overlay";
      const panel = document.createElement("div");
      panel.className = "fmdash-panel";
      panel.setAttribute("role", "dialog");
      panel.setAttribute("aria-modal", "true");
      panel.setAttribute("aria-label", idea.id + " pitch");
      overlay.appendChild(panel);
      const close = () => { overlay.remove(); document.removeEventListener("keydown", onKey); };
      const onKey = (event) => { if (event.key === "Escape") close(); };
      overlay.addEventListener("click", (event) => { if (event.target === overlay) close(); });
      document.addEventListener("keydown", onKey);
      const kicker = document.createElement("div");
      kicker.className = "fmdash-kicker";
      kicker.textContent = "Idea pitch";
      const closeButton = document.createElement("button");
      closeButton.type = "button";
      closeButton.className = "fmdash-close";
      closeButton.textContent = "Close";
      closeButton.addEventListener("click", close);
      kicker.appendChild(closeButton);
      panel.appendChild(kicker);
      panel.appendChild(textBlock("h2", idea.id + " — " + idea.title));
      panel.appendChild(textBlock("p", "Loading pitch…"));
      document.body.appendChild(overlay);
      closeButton.focus();
      let detail = null;
      try {
        const res = await fetch("/api/detail?idea=" + encodeURIComponent(idea.id));
        if (res.ok) detail = await res.json();
      } catch { /* handled below */ }
      panel.replaceChildren(kicker);
      panel.appendChild(textBlock("h2", idea.id + " — " + idea.title));
      const pitchText = detail && (detail.pitch || detail.description);
      panel.appendChild(textBlock("pre", pitchText || "No pitch or concept summary is on file for this idea."));
      if (cfg.readOnly) return;
      const controls = document.createElement("div");
      controls.className = "fmdash-option";
      const buttons = document.createElement("div");
      const approve = document.createElement("button");
      approve.type = "button";
      approve.className = "fmdash-send";
      approve.textContent = "Approve";
      approve.addEventListener("click", () => sendIdeaVerdict(idea.id, "approve", null, approve));
      const deny = document.createElement("button");
      deny.type = "button";
      deny.className = "fmdash-send";
      deny.textContent = "Deny";
      deny.style.marginLeft = ".6rem";
      deny.addEventListener("click", () => sendIdeaVerdict(idea.id, "deny", null, deny));
      const suggest = document.createElement("button");
      suggest.type = "button";
      suggest.className = "fmdash-send";
      suggest.textContent = "Add suggestions";
      suggest.style.marginLeft = ".6rem";
      buttons.appendChild(approve);
      buttons.appendChild(deny);
      buttons.appendChild(suggest);
      controls.appendChild(buttons);
      panel.appendChild(controls);
      panel.appendChild(textBlock("p", "Approving asks firstmate to create the work item(s) through the normal backlog lifecycle; nothing runs from this page."));
      suggest.addEventListener("click", () => {
        if (panel.querySelector("textarea")) return;
        const box = document.createElement("textarea");
        box.rows = 4;
        box.style.width = "100%";
        box.style.marginTop = ".6rem";
        box.setAttribute("aria-label", "Suggestions for " + idea.id);
        box.placeholder = "Your suggestions for this idea…";
        const send = document.createElement("button");
        send.type = "button";
        send.className = "fmdash-send";
        send.style.marginTop = ".5rem";
        send.textContent = "Send suggestions";
        send.addEventListener("click", async () => {
          if (!box.value.trim()) return;
          const ok = await sendIdeaVerdict(idea.id, "suggest", box.value.trim(), send);
          if (ok) box.disabled = true;
        });
        panel.appendChild(box);
        panel.appendChild(send);
        box.focus();
      });
    }
    if (cfg.readOnly) {
      copyButtons.forEach((copyButton) => copyButton.remove());
      return;
    }
    copyButtons.forEach((copyButton) => {
      const id = ((copyButton.dataset.copy || "").match(/CAP-\d{2}/) || [])[0];
      if (!id) { copyButton.remove(); return; }
      if (!cfg.dispatchable.includes(id)) {
        const note = document.createElement("span");
        note.className = "fmdash-chat";
        note.textContent = "Raise in captain chat";
        copyButton.replaceWith(note);
        return;
      }
      const send = document.createElement("button");
      send.type = "button";
      send.className = "fmdash-send";
      send.textContent = "Approve & send";
      send.setAttribute("aria-label", "Approve " + id + " and queue it for firstmate");
      send.addEventListener("click", async () => {
        send.disabled = true;
        send.textContent = "Sending…";
        try {
          const res = await postJson({ id });
          const out = await res.json();
          if (out.status === "queued" || out.status === "already-queued") {
            send.textContent = "Approved · queued";
            showPending(out.pending);
            return;
          }
          send.textContent = "Refused";
          send.disabled = false;
        } catch { send.textContent = "Failed"; send.disabled = false; }
      });
      copyButton.replaceWith(send);
    });
  })();
  </script></body>
</html>

Evidence: Dashboard end-to-end test transcript

ok - every route except healthz requires the configured captain identity
ok - authenticated browser posts require a matching same origin
ok - served page is the producer dashboard wearing the injected interactive layer
ok - subscription usage is bounded to Claude, Codex, and Grok
ok - operational data cannot break out of the inline configuration script
ok - clickable work items serve rich detail from briefs, metadata, and previews
ok - decision documents validate option picks and bounded custom answers
ok - equal decision keys remain distinct across origins and homes
ok - refs are usable only for their matching dashboard generation
ok - ideas render their pitches and verdicts flow through the durable inbox
ok - a click becomes exactly one durable captain command record
ok - dispatch refuses free text, non-allowlisted actions, and stale actions
ok - refresh reruns the capacity producer server-side and replaces the dashboard
ok - inbox claim delivers before archive and safely permits replay
ok - read-only mode serves the page and refuses every mutation
ok - watcher registration follows writable mode without deleting pending commands
ok - the launchd agent survives reboots and the installer is structurally funnel-free
ok - custom serve ports persist and old mappings are removed
ok - launchd env is pinned and a mostly-unknown render is loudly marked degraded
ok - every copy-prompt affordance on the served page is replaced by direct dispatch
ok - the service is documented and wired into the operating contract
fm-dash tests passed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 4 issues found → auto-fixed (4) ✅

• 🚨 bin/fm-capacity.mjs:813 - Criterion 10 requires that a keyless needs-decision event never become a captain decision. This guard skips key: "default" only when decision.id is also absent, but secondmate summaries attach the worker ID, so it fabricates an owner-qualified decision from that ID. Skip every missing/default key regardless of id, matching the main-home path.
• 🚨 bin/fm-capacity.mjs:880 - Criterion 8 requires every blocked row to show its recursive blocker chain and an explicit What-you-can-do line. Secondmate blocked records are pushed as plain cards without waits_on or what_you_can_do (the captain-hold, structured-wait, and time-gate branches have the same omission), so blockedContext() renders nothing for them.
• 🚨 bin/fm-capacity.mjs:702 - Criterion 8 also requires recursive resolution to the root cause. blocked_by can contain tasks-axi's comma-separated dependency list, but this code treats the entire value as one task ID; a,b therefore cannot match either backlog record and is reported as unavailable instead of resolving both roots.
• 🚨 bin/fm-dash-serve.mjs:1169 - Criterion 10 requires a mostly-unknown worker-state render to be marked RENDER DEGRADED. The denominator counts every manifest row, including queued, ready, landed, and blocked backlog cards that have no worker-state reading. A dashboard where all active workers are unknown can therefore escape the warning when enough non-worker rows exist; compare unknown states against authoritative worker-state rows instead.

🔧 Fix: Fix captain decision, blocker, and degraded-state handling
3 errors still open:

• 🚨 bin/fm-capacity.mjs:676 - Criterion 8 requires “every blocked row” to resolve every root. The new comma split assumes blocked_by already aggregates all dependencies, but the real snapshot parser captures only the last repeated blocked-by: marker from tasks-axi markdown. Multi-blocker production rows therefore still lose all but one root before reaching this code; preserve every edge in fm-fleet-snapshot.sh and pass the complete list here.
• 🚨 bin/fm-capacity.mjs:682 - Criterion 8 requires chains to be “resolved recursively to the root cause,” but this new depth limit stops after five blockers even when a valid deeper root exists. Cycle detection already bounds cyclic paths, so traverse the bounded snapshot until a root, cycle, or missing record is reached.
• 🚨 bin/fm-dash-serve.mjs:1170 - Criterion 10 and the ordered fix require that “all-workers-unknown always trips the banner.” Although the denominator is now correct, unknownStates >= 3 suppresses RENDER DEGRADED when a fleet has only one or two workers and every state is unknown. Remove the minimum-count gate or explicitly handle the all-unknown case.

🔧 Fix: Preserve captain blocker roots and tiny-fleet degradation
3 issues (2 errors, 1 warning) still open:

• 🚨 bin/fm-capacity.mjs:681 - Criterion 8 requires every blocked row’s chain to be “resolved recursively to the root cause.” currentById retains only a worker’s state, so a dependency on a blocked worker with a keyed decision or keyless chat question ends at “currently blocked” instead of identifying that actual root. Preserve the task evidence and apply the same keyed/keyless/paused resolution used for the worker’s own card.
• 🚨 bin/fm-capacity.mjs:694 - Criterion 8 also requires a truthful plain-language root. A blocker already in done is described here as “queued and not started,” while done or failed current states fall through to “unblocks itself when … finishes.” Treat terminal blockers as stale dependency edges requiring reconciliation.
• ⚠️ bin/fm-capacity.mjs:707 - The unbounded recursive flatMap enumerates every dependency path without memoization. Because the main backlog is not capped, a long chain can overflow the call stack and a branching DAG can produce exponential output. Use iterative or memoized traversal and emit unique root chains.

🔧 Fix: Resolve captain blocker roots with bounded traversal
3 errors still open:

• 🚨 bin/fm-capacity.mjs:741 - Criterion 8 requires every blocked row to show its resolved root and explicit action. The global scheduled guard can hide cycles crossing sibling branches: with initial blockers A and B where A→B and B→A, both targets are already scheduled, neither appears as an ancestor, and no root is emitted—leaving waits_on and what_you_can_do empty. Detect cycles independently of the chosen parent tree.
• 🚨 bin/fm-capacity.mjs:920 - Criteria 8 and 10 require truthful roots, including keyless worker questions. mateTaskEvidence includes only active_children, but secondmate parked/paused/blocked workers are projected under holds; their state and decision hints are therefore unavailable. Their own rows remain generic structured waits, and dependents describe them as queued rather than resolving paused, keyed-decision, or chat-question roots. Preserve and resolve child-state hold evidence too.
• 🚨 bin/fm-capacity.mjs:593 - Criterion 8 requires every root to be described, but .find() retains only the first keyed decision and the keyless-question branch takes precedence over all keyed decisions. A worker with multiple open decisions—or both a keyless question and a keyed decision—therefore produces an incomplete blocker chain even though all decisions are surfaced elsewhere. Return and combine every applicable root context.

🔧 Fix: Complete captain blocker roots across cycles and holds
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Pre-supplied baseline: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Focused E2E: bash tests/fm-dash.test.sh | tee /var/folders/g0/z_4x96f92cgfpm7940cqvtt00000gn/T/no-mistakes-evidence/01KYMYRBAQ8B9B19EGRG79V21K/fm-dash-e2e.log
• Captured the authenticated running-service GET / response using the dashboard fixture as capacity-dashboard-served.html
• Rendered the captured service response in Chrome at 1440×1100, inspected its visible layout, and saved capacity-dashboard.png
• Verified the rendered surface visibly contains tailnet-live status, refresh, direct Approve & send, recursive blocker explanations with What you can do guidance, and subscription usage
• Verified git status --short is clean after removing transient capture helpers and browser-profile data

🔧 **Document** - 1 issue found → auto-fixed ✅

• ⚠️ bin/fm-dash-inbox.sh:117 - Captain, the claim summary still tells Firstmate to treat every record as an action-ID approval, which is wrong for decision and idea records; correcting this runtime output is outside the documentation-only scope.

🔧 Fix: Correct dashboard claim handling reminder
✅ Re-checked - no issues remain.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.