[mottihoresh]

The last PR of fix-track chunk 3. Two behaviours change on purpose (decided 2026-10-16); nothing else does.

1. X2 / R5 / S10 — one "on the bus" rule

	Before	After
Fresh PDU telemetry	Made a board visible but not online. A registry PDU seen by its pages alone (no roster row, or a complete roster that left it out) was a "new but offline" board: not counted, not news, never adoptable (S10).	Fresh PDU pages are evidence in the one availability rule (node-model.ts nodeAvailability → { availability, evidence: 'roster' | 'telemetry' | 'none' }). Order: roster present → online (roster); fresh PDU pages newer than the roster's last "absent" reading → online (telemetry); roster absent / complete roster without it → offline (roster); else unknown (none). availabilityOf (node-model.ts) is the one place that weighs them.
Hide / Forget	canHide / canForget treated any fresh pages as live, separately from the availability, so the panel could read OFFLINE beside the "Online — can't be removed" footer.	The gate reads only the one availability. NodeHub's offlineSignals computes it with availabilityOf over the same signals; the footer reads the model's. OfflineSignals.pduTelemetry and offline-actions.ts pduTelemetryLive are gone.
Every "on the bus" surface	While the Gateway was unplugged, the Cockpit's "New on the bus · N / Adopt…", Settings › About's On the bus column ("yes" / "offline") and Connected nodes all read the stale roster as live.	One onBusNow(entry, live) (node-model.ts) = link up and online. isReportableNew(e, live) is built on it. Every surface reads it: the Cockpit CTA (newCount), the strays (strayNew), the Overview's new-devices notice (newDevices), Connected nodes (nodesSummary: COCKPIT_IDLE.nodesCard while down) and About's registry rows (registryOnBus: — while down; a hidden row still reads hidden). They all go quiet while unplugged and come back when the link does.
Adopt evidence	An online board with no status row read "not reporting right now".	A PDU online by its pages reads telemetry: 12 V … or telemetry: board status.

X2 variants deleted (the co-located answers from the rewrite):

• cockpit-snapshot/index.ts: the live ? strays : [] gate is now strayNew(..., live). The X2 rows are gone from both variant lists in the header.
• attention.ts: "New on the bus counts whatever the last model said" is gone. newCount(model, live) replaces it.
• summaries.ts: "Connected nodes reads the last model whatever the link" is gone. nodesSummary(..., live) replaces it, and newDevices' own if (!live) is folded into isReportableNew.
• registry-rows.ts: "a CAN row reads the last model whatever the link" is gone.
• node-model.ts: the two "visible vs online" copies of the telemetry rule are gone. sending and availability both read node-telem.ts pduPagesLive, which offline-actions.ts pduTelemetryLive reads too.

Newest evidence wins (follow-up commit, from review)

The first commit let fresh pages win whatever the roster said. A PDU that lost power then read online until its last page went stale (10 s) instead of when the roster's heartbeat timeout reported it absent (3 s), so its outage formed about 7 s late.

Now node-telem.ts pduPagesLive(t, now, absentAt), still the one freshness helper, with newestPduPageAt next to it, counts pages only while the newest one arrived after the roster's last "absent" reading for that board (seen.offlineAt, while its row is absent):

• The roster says absent after the last page: the PDU is offline at once and folds into its outage on the roster's timing.
• Pages arrive after that "absent": the PDU is online again.
• No absent reading at all: pages count. That covers no row, or a complete roster that left it out, which is the S10 case.
• A tie goes to the roster.

NodeModelInput gains now (when the telemetry snapshot was taken) so page ages can be compared with the roster's times.

2. A lost line inside a reply

• END count semantics (confirmed in the firmware). PanelBridge.cpp emitAllNodes at the pinned commit a78dd90 and on OpenSkyhawk main:

  • it sends emitSelf(), then one row per alive node, then _NODE_STATUS_END <count>;
  • count is decimal and starts at 1, so it includes the node-0 row: 1 means bridge only;
  • every row in a reply has present = 1;
  • the bridge writes the burst synchronously, so no delta can interleave with it.

  One caveat: the A-4 worktree named in the brief is on feat/pdu-telemetry-216, which still has the pre-#344 v2 version (no node-0 row, count from 0). The client is pinned to the v3 one.

• Before. One _NODE_STATUS line lost inside a reply made that board offline for one poll. That is a false offline row, an extra save and possibly a false PDU outage, all against the #290 "no false offline" gate.

• After. NodeRoster compares the END count with the distinct NODE_IDs the reply brought.

  • A reply starts at its node-0 row. From there its rows are the reply: not the deltas before it, and not what an earlier reply with a lost END brought.
  • On a mismatch, absences are not reconciled. The roster does not count as complete (so remembered boards stay unknown, not offline), and the next whole reply decides.
  • NodeHub logs one debug line (roster reply incomplete: 2 of 3 rows; absences not reconciled), with no event row.
  • An END with no count completes as before: there is nothing to check it against, and no v3 bridge sends one.

• No firmware change.

Changed assertions (each on purpose)

Test	Was	Now	Why
T9 stays from the last model while the link is down (R5 today) → goes quiet while the link is down, and returns when it is back (R5, #132)	CTA "New on the bus · 1" and Adopt… enabled with the link down	CTA and Adopt… absent while down, back on reconnect	Contract R5 / F12 (X2 final): onBusNow(live)
T32 unplugged: … CAN nodes still read "yes" (R5 today) → … no CAN row says it is on the bus (R5, #132)	#1 … yes while unplugged	Every CAN row — (hidden stays hidden), back to yes on reconnect	Contract X7 / R5: on the bus means now
T32 opened while unplugged: the same	#1 … yes	#1 … —	Same
registry-rows.test lists each registry row … before and after the model (built with link down)	rows 1/2 yes / offline	— / —	The X2 variant's own unit pin; S10 / R5
offline-actions.test allowed only offline with no fresh PDU pages → allowed only offline	gate({ availability: 'offline' | 'unknown', pduTelemetry: true }) refused	The gate reads only { availability }; that loop is removed	Newest-evidence rule: pages are weighed inside the availability (availabilityOf), so a separate "pages win" signal would contradict it. The footer and main agreement is still pinned by node-hub.test "one rule for the footer and main", unchanged.
offline-actions.test PDU pages count only while fresh, and only for that NODE_ID	pduTelemetryLive	Removed with the helper	Replaced by node-telem.test "pduPagesLive: the newest evidence wins"
main phase0-probes M3: a v2 bridge — END completes the roster, added boards read offline, Forget allowed → M3 / #132 (fixed): a reply whose rows were dropped completes nothing	END 2 with its only (malformed, 22-hex) row dropped completed the roster: board offline, Forget allowed	Incomplete reply: board unknown, Forget refused	The new count check. That row was never a real v2 row (v2 is 26 hex, already handled by M3)

Every other assertion is unchanged. Some call sites changed without changing what they assert: isReportableNew, strayNew, newCount and nodesSummary gained the explicit live argument (true in the old cases), boardActions lost its pduTelemetry argument, and buildNodeModel inputs gained now. The soak's seeded PRNG now also draws for line drops, so its random sequence shifted, but its assertions are the same.

New tests, each shown able to fail

Each was run against a temporarily broken source, then restored:

Test	Broken source	Result
Telemetry-only PDU counts online: node-model.test "the one availability rule" (rule, PDU in your cockpit roster-or-not, stale pages not); node-hub.test (online, and Hide / Forget refused)	Drop the telemetry branch	5 fail
No unadoptable new-but-offline board: node-model.test (a pages-only registry PDU is online, reportable and an Adopt row with kind: pdu and telemetry evidence; every new board in the model is online)	Drop the telemetry branch	Covered by the 5 above
Every on-the-bus surface goes quiet with the link down and returns when it is up: cockpit-snapshot/on-the-bus.test.ts (CTA, strays incl. band, Overview notice, Connected nodes, About), through the snapshot builder and through CockpitSnapshotHost unplug → replug with no new model; plus T9 / T32 above	Make onBusNow ignore live and remove the two !live guards	12 fail
Incomplete reply never marks a board offline; a whole reply still does: node-status-wire.test "a reply missing a line reconciles nothing" (lost row, lost node-0 row, lost END, a short first reply leaves the roster incomplete, deltas before node 0 not counted, END without a count); node-hub.test (one debug line, no event row, a later whole reply still logs offline)	Disable the count check	5 fail (incl. the soak)
Same, the node-0 framing	Disable the node-0 reset	"deltas before node 0" fails
Newest evidence wins: node-hub.test "a PDU's pages against the roster". A PDU that loses power is offline at 13.2 s (absent at 13 s, last page at 10 s, still fresh) and folds into its outage (at: 13000), shown as one Attention item, with the footer and main both allowing Hide. Pages after the absent bring it back (outage gone; footer, Forget and Hide all refuse). Also node-model.test (absent before vs after the newest page) and node-telem.test (pduPagesLive / newestPduPageAt)	Ignore absentAt in pduPagesLive	3 fail
Same: every surface and the gate agree	Make NodeHub.offlineSignals drop the pages	4 fail (footer-vs-main matrix, M1/C3 probe, both new hub cases)
#150's 30-minute soak: one in five replies now loses a single random line (a board row, node 0 or END). It asserts no false offline, no extra saves, no node event rows and no "not responding" flash, and that over 50 lines were dropped	Disable the count check	Fails: a false offline

Checks

• npm test: 1394 passed (baseline 1372, +22)
• npm run lint: 0 / 0
• npm run lint:deps: clean
• npm run typecheck (3 projects): clean

The renderer only displays: no renderer source changed.

Part of #132