Check pi liveness per tmux pane and add "Seen" marks to the control board (#1503)

First step-3 refinement from Jason's daily use. Liveness now lists the
panes of the agent's tmux session and counts it alive only if a pane runs
pi, so killed pi sessions whose tmux session still exists show offline
instead of waiting. A "Seen" button on waiting and error rows stores the
row's lastActivity in <dataRoot>/board/seen.json (clicks only, never
rewritten by a scan, fail closed if corrupt) and drops the row from
"Waiting on you" until the agent writes anything newer; "Unsee" reverses
it. New POST /api/seen route: JSON only, 4 KB limit, 400 on bad input.

Tests: control-board 63/63 (30 new), registry 69/69. Review APPROVED;
receipt docs/plans/reviews/2026-09-12_control-board-step3-seen-marks.md.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

packages/control-board/src/serve.mjs

@@ -3,8 +3,14 @@
 //
 //   GET /            the page (src/page.html)
 //   GET /api/board   re-runs the scanner and returns index.json as JSON
+//   POST /api/seen   {project, agent, lastActivity, seen?} marks a row as seen
+//                    (or clears the mark with seen:false), rescans, returns index
 //   GET /healthz     {"ok":true}
 //
+// POST requires Content-Type: application/json. A plain form post from another
+// site in the browser cannot set that header without a CORS preflight, and this
+// server answers no preflight, so a stray page cannot flip marks.
+//
 // Every /api/board request rescans, so the page is never staler than its
 // refresh timer. The scan rewrites the derived board files as a side effect.
 
@@ -12,7 +18,42 @@ import { createServer as createHttpServer } from "node:http";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { isIP } from "node:net";
-import { scan, ConfigError } from "./scan.mjs";
+import { scan, markSeen, ConfigError } from "./scan.mjs";
+
+const MAX_BODY = 4096;
+
+function sendJson(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+  res.end(JSON.stringify(body) + "\n");
+}
+
+function readJsonBody(req) {
+  return new Promise((resolvePromise, reject) => {
+    const type = String(req.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+    if (type !== "application/json") return reject(new Error("Content-Type must be application/json"));
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > MAX_BODY) {
+        req.destroy();
+        reject(new Error(`body larger than ${MAX_BODY} bytes`));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("body must be a JSON object");
+        resolvePromise(parsed);
+      } catch (err) {
+        reject(new Error(`invalid JSON body: ${err.message}`));
+      }
+    });
+    req.on("error", reject);
+  });
+}
 
 const LOOPBACK = new Set(["127.0.0.1", "::1", "localhost"]);
 
@@ -29,6 +70,22 @@ export function loadPage(path = join(import.meta.dirname, "page.html")) {
 export function createServer({ specs, boardDir, isAlive, now, page = loadPage() }) {
   return createHttpServer((req, res) => {
     const url = new URL(req.url, "http://localhost");
+    if (req.method === "POST" && url.pathname === "/api/seen") {
+      return readJsonBody(req)
+        .then((body) => {
+          try {
+            markSeen(boardDir, { project: body.project, agent: body.agent, lastActivity: body.lastActivity, seen: body.seen ?? true });
+          } catch (err) {
+            return sendJson(res, 400, { error: err.message });
+          }
+          try {
+            sendJson(res, 200, scan(specs, { boardDir, isAlive, now }));
+          } catch (err) {
+            sendJson(res, 500, { error: err.message });
+          }
+        })
+        .catch((err) => sendJson(res, 400, { error: err.message }));
+    }
     if (req.method !== "GET" && req.method !== "HEAD") {
       res.writeHead(405, { "content-type": "text/plain" });
       return res.end("method not allowed\n");