console review round 2: six must-fixes from the adversarial pass (one of its fixes corrected)

The 4-dimension review of 4736cba..820caf8 returned 14 surviving findings.  All
six must-fixes plus the four deferables are in; one of the review's own
prescriptions was wrong and is fixed differently (below).

THE REAPER, FINAL DOCTRINE (blocker + major).  Rev 2 -- "reap anything silent in
the staging window" -- was still wrong twice over: a pad sends exactly ONE
message in its life (the egg ACK, L4NET.CPP:1259) and is then silent FOREVER, so
any manual-launch hold >180s reaped every healthy ACKed pad and force-relaunched
their clients; and a REGISTERED game conn is quiet on TCP while loading, so with
BT_RELAY_TCP_ONLY=1 (or blocked UDP) the reaper _abort_round()ed the whole night
every ~3 minutes blaming a healthy player.  The rule is now: an app-level
deadline is valid only while a RESPONSE IS OWED.  Only egg-sent-never-ACKed pads
are reaped, with the debt clock starting at EGG SEND (a pad that sat through a
long held-egg wait gets its full window -- an edge neither review round caught);
game conns are never reaped at all.  Half-open ghosts are TCP keepalive's job
(~130s, faster than the deadline anyway).

RE-ARM GUARDED ON EVERY CHANNEL (major).  The launch_at guard lived only on the
LAUNCH-press path; the ctl `rearm` command, stdin, and the always-lit GUI button
reached _rearm_for_new_round unconditionally -- one press mid-mission zeroed the
counters, permanently killing the mission clock AND making End Mission print "no
mission is running": an unstoppable round, the exact class this feature exists
to eliminate.  Now refused (loudly) while a mission is running or a pair is in
flight, and the button greys while launched.  THE REVIEW'S OWN FIX WAS WRONG
here: it prescribed refusing on `launches_sent >= 2`, but that stays 2 after a
FINISHED round -- applying it verbatim resurrected the original dead-LAUNCH
wedge, caught immediately by the regression suite.  "Running" is
`launches_sent >= 2 AND not stop_sent`.

RE-ARM RE-KEYS SEATS (major).  It restored the template roster but left
seat_beacons/seat_prefs keyed by the trimmed round's positional ids, so round
2's trim minted a departed player's tag into the egg and trimmed a present
player's out, shifting every callsign/mech a slot.  The re-key block is factored
out of _maybe_reset_round (_rekey_seats_to_roster) and shared.

RESTART SESSION NO LONGER BAKES A WALK-UP'S NAME INTO THE EGG (major).
_stop_session and _start_session now restore the stashed configured
callsign/mech into the cells BEFORE _collect_egg can snapshot them
(_restore_seat_defaults); previously the departed name went into the egg (name=
plus rasterized bitmaps) and was then re-captured as the seat's permanent
"configured default".

LATE REMOTE OPERATOR GETS A ROSTER (major).  The only line the GUI can adopt
tags from was printed once at relay startup and aged out of the 400-line control
history in ~33 minutes of stats chatter -- AUTH now re-issues the live roster
line ahead of the replay, so a remote operator connecting at any point gets
pilot lights and a working LAUNCH button.

DEFERABLES, all four: _drop_game blames the tag stashed AT REGISTRATION (the
live-roster resolve named the wrong tag for a trimmed-round conn dying after a
re-arm restore -- and the tag-trusting GUI would clear the wrong seat); an
operator-BLANKED callsign cell now restores (empty string is a real configured
value; the falsy skip left the departed name up and re-captured it); a returning
player displaces their own half-open registered ghost (same IP, no mission
running) instead of eating ROSTER FULL until keepalive fires; udp_spoofed now
rides the [relay-stats] line when non-zero and the warn set is capped at 256.

VERIFIED: rearm suite grown to 25 checks (ACKed pad never reaped however silent;
never-ACKed pad reaped; game conns never reaped; the egg-send debt clock; re-arm
refused mid-mission, allowed after round end) -- plus net 17/17, roster 22/22,
checkctx CLEAN.  Live rig: mid-mission `rearm` refused with the message and the
mission survived; End Mission -> re-arm -> full re-seat -> second mission
launched.  One bounded artifact observed and documented: each waiting pod
bounces once (identity resync) after an explicit re-arm.

Docs rewritten to the final doctrine (context/operator-console.md reaper +
re-arm + roster-replay + udp_spoofed sections; OPERATOR_GUIDE + tooltip now say
re-arm is between-rounds-only and warn about the one-bounce resync).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scratchpad/test_relay_rearm.py

@@ -127,20 +127,66 @@ check("RunMission actually reached the pods",
       all(c.sock.sent for c in r.console_conns),
       "%d pkt(s) to pod 1" % len(r.console_conns[0].sock.sent))
 
-print("\n=== 5. REAPER: reaps a silent peer DURING STAGING only ===")
+print("\n=== 5. REAPER: only a pad that OWES an ACK is ever reaped ===")
+# Doctrine (2nd review, 2026-07-26): silence is abnormal ONLY while a response
+# is owed.  An ACKed pad's silence is protocol-normal FOREVER (the ACK is its
+# only message ever) -- the earlier cut reaped every healthy pad 180s into any
+# manual-launch staging hold.  Half-open ACKed ghosts are TCP keepalive's job.
 r = new_relay()
 r.launches_sent = 0
-r.eggs_released = True          # staging: the egg is out, pods should be talking
-dead = FakeConn(acked=True)
-dead.last_seen = btconsole.time.time() - (btconsole.DEAD_PEER_SECONDS + 30)
-live = FakeConn(acked=True)
-r.console_conns = [dead, live]
+r.eggs_released = True
+owes = FakeConn(acked=False)                    # egg sent, never ACKed: dead
+owes.egg_sent_at = btconsole.time.time() - (btconsole.DEAD_PEER_SECONDS + 30)
+owes.last_seen = owes.egg_sent_at
+acked_quiet = FakeConn(acked=True)              # healthy: silent since its ACK
+acked_quiet.last_seen = btconsole.time.time() - 9999
+r.console_conns = [owes, acked_quiet]
 r.game_conns = []
 dropped = []
 r._drop_console = lambda c: (dropped.append(c), r.console_conns.remove(c))
 r._reap_dead_peers()
-check("the silent conn was reaped", dead in dropped)
-check("the live conn was kept", live in r.console_conns and live not in dropped)
+check("the never-ACKed pad was reaped", owes in dropped)
+check("an ACKed pad is NEVER reaped however silent", acked_quiet not in dropped)
+
+print("\n=== 5d. REAPER never touches game conns (loading pods are quiet) ===")
+r = new_relay()
+r.launches_sent = 0
+r.eggs_released = True
+class FakeGame:                                  # registered, TCP-only, loading
+    addr = ("10.0.0.7", 700); host_id = 2
+    last_seen = btconsole.time.time() - 9999
+r.console_conns = []
+r.game_conns = [FakeGame()]
+r._drop_game = lambda c, why: fails.append("game conn reaped: " + why)
+r._reap_dead_peers()
+check("a silent REGISTERED game conn is never reaped",
+      not any("game conn reaped" in f for f in fails))
+
+print("\n=== 5e. the ACK-debt clock starts at EGG SEND, not connect ===")
+r = new_relay()
+r.launches_sent = 0
+r.eggs_released = True
+early = FakeConn(acked=False)                   # connected long ago (held egg)
+early.last_seen = btconsole.time.time() - 9999  # ...but the egg JUST went out
+early.egg_sent_at = btconsole.time.time() - 5
+r.console_conns = [early]
+r.game_conns = []
+reaped = []
+r._drop_console = lambda c: reaped.append(c)
+r._reap_dead_peers()
+check("a pad whose egg just went out is given its full window", not reaped)
+
+print("\n=== 5f. RE-ARM refusals: running mission / in-flight pair ===")
+r = new_relay()
+r.launches_sent = 2
+r.stop_sent = False                              # mission genuinely RUNNING
+r.eggs_released = True
+r.console_conns = []
+r._rearm_for_new_round("test")
+check("re-arm REFUSED while a mission is running", r.launches_sent == 2)
+r.stop_sent = True                               # round has ENDED
+r._rearm_for_new_round("test")
+check("re-arm allowed once the round has ended", r.launches_sent == 0)
 
 print("\n=== 5b. REAPER MUST NOT TOUCH A WAITING POD BETWEEN ROUNDS ===")
 # The regression this guards: a pod waiting for the next mission is byte-silent