Each open session self-reports every ~10 seconds. Ticking figures are extrapolated from that session's measured pace; they re-anchor to truth on each refresh.

What this page is

The whole project on one URL, kept current by machinery rather than by anyone remembering to run anything: a local server rebuilds this page every 60 seconds from disk truth — session state files, task lists, transcripts, git, and the project's own docs — and an open tab swaps its numbers in place when a newer build lands. No slash command and no model is involved anywhere in the loop. The /watchtower command still exists, but only as a manual health check.

How fresh is each number

• Page data — rebuilt every 60s by the live server; the open tab polls a ~15-byte probe every 30s and re-renders in place (scroll and tab survive). The snapshot chip in the header names the age; click it to force a full reload.
• Session cards — each open session writes its state every ~10s via the statusline collector.
• Allowances — the official usage endpoint, polled on a 5-minute floor with backoff; a reading served from cache says so on its face.
• Art credits — the PixelLab balance, polled on a 10-minute floor. The key never enters this page; only the number travels.
• Repo panels — re-read from disk every build; the expensive counts are cached on HEAD, so they move the moment a commit lands.

Reading the numbers

• Which weekly meter this account has decides what the cards mean. Some logins report an all-model week beside a per-model week (both): there the Fable card is the foreman's own tank and workers do not drain it. Others report a model-scoped week as the only weekly meter (scoped-only): that one meter counts every model on the account, so an idle foreman still empties it while its implementers run. The page reads the shape off the endpoint and words each card accordingly — and under scoped-only it refuses to split the week per model, because one opaque meter cannot be apportioned.
• Every ETA is conditioned on how long the thing has already been running, and says which of three readings it gives. Inside the sample: median minus elapsed. Past the typical run: re-estimated from only those past runs that lasted longer — something already late is evidence of a long run, so the figure jumps outward as work drags. Past everything measured: no date at all, and the box says so. A floor is not an estimate; this page once shipped one and the step ETA read a constant 59 minutes for as long as it was wrong.
• Medians, not means, and never a blend. Where two independent measures exist — pace now vs average, flat rung pace vs gate-leg sizing — both are printed and neither is averaged into the other. Two rough numbers that agree tell you something; one number blended out of both tells you nothing.
• Estimates are installer-style on purpose: rough, always visible, wrong in honest ways, re-anchored every build. An ETA lengthening mid-operation is data, not a bug.
• Spend today / this week fold every session on the account — workers, closed windows and the watchtower's own machinery included. Today resets at local midnight, the week with the weekly limit; the figures tick forward at the live sessions' measured pace between refreshes (the … marks extrapolation).
• Burn attribution splits by the models that actually ran (subagent transcripts included) over the last 12 hours. Sessions hidden from the fleet list by rule still burn real money; their share is named on its own row, never silently reassigned. The %-of-a-tank figures assume weighted tokens track allowance, which this page cannot verify, and are withheld with a reason where the account's only weekly meter is model-scoped.
• The rung panel and the ladder are read straight off the repo: GOALS names each rung's gate legs, docs/evidence/ captures say which legs came back green, HANDOFF-META names the open rung. Two datings are shown side by side — flat commit pace and size-weighted hours-per-leg calibrated close-to-close on rungs that actually closed — and the gap between them is the information.
• The evidence stream lists only captures that state a verdict line (NAME: PASS|FAIL|BLOCKED). Exit codes are not evidence and neither is a file's existence; an instrument log with no verdict stays out.
• The backlog panel is pattern extraction, not adjudication: it counts and quotes what the register literally marks ☐ and what PARKED.md holds. The /ledger command reasons about obligations; this panel only reads the marks, and shows each row's own text so a false positive is visible for what it is.
• Commit trailers are not model attribution (D-043): the trailer records the harness's configured string, not the model that ran. A trailer naming Sonnet is strong evidence — nothing writes it by accident — while the majority string proves nothing. HANDOFF-META: model= is the attribution record.
• Everything below a dashed rule is judgment — a foreman's filed estimate, in its own colour, scored against the real close once it lands. File one with node ~/.claude/watchtower/watchtower-forecast.mjs --rung m7.8 --phase 2/5 --done +8h --note "…". No entries filed = no overlay; the measured facts stand alone.

If it stops updating

• The snapshot chip going amber then red means no fresh build is landing. The server and tunnel run as the scheduled tasks "Crimson Watchtower Server" and "Crimson Watchtower Tunnel" on the PC — Start-ScheduledTask either, then re-check after 40 seconds, not 12.
• Error 1033 on the public URL = the tunnel has no connector (server or tunnel not running on the PC). 502 = tunnel up, local server down.
• /healthz on the same host prints the last build verdict and the last fallback deploy.
• The *.pages.dev fallback is auto-deployed every 10 minutes and serves the last snapshot even with the PC off.

Phone ready

• This page — same URL; it re-checks on wake, focus and reconnect, so a tab left open stays honest.
• Remote Control — /rc in a session, scan the QR with the Claude app: live streaming + steering, push notifications when a session needs input.
• Happy — npm i -g happy, then happy claude: full E2E-encrypted session mirroring on the phone. Third-party relay — a deliberate trust decision.

Deeper instruments optional