Part A — tsc enum drift fix (4 errors → 0)
============================================

CC#1's KR-FEAT-HEARTBEAT ST2 (PR #118) added 4 fields to the
heartbeat surface; FE consumers in HeartbeatPanel.tsx +
DashboardPage.tsx didn't handle the additive shape, leaving
`tsc -b` with 4 errors on bare feature/phase2-upgrades.

Fixes:
  * HeartbeatStatus enum gained "unknown" (probe pending —
    cold-start / auth-missing / in-flight). Panel now renders
    it as a muted-outline pill with "probe pending" label +
    a CircleDashed icon. Distinct from "unhealthy" — pending
    is not failing.
  * HeartbeatService.last_check_at became nullable. Helper
    signatures formatTimestamp / formatRelative now accept
    `string | null`; null path renders "never checked"
    (matches the MCP-clients health-display convention from
    PR #117 to keep the operator's mental model consistent).
  * HeartbeatService.error: string | null surfaced in the
    expanded detail view as a destructive-toned <pre> block
    (mirrors MCP-clients last_error). Plain-text rendering;
    no dangerouslySetInnerHTML — probe output is untrusted.
  * HeartbeatServicesResponse.cache_warming: boolean. Panel
    renders "Probes warming up…" Hourglass banner above the
    services list. Dashboard card mutes the headline tone +
    appends "· warming" to suppress false-outage signal
    during daemon cold-start.

Also: dashboard counts.unknown bucketed separately from
healthy/degraded/unhealthy so the operator can distinguish
"scheduler not done yet" from "service down".

Part B — test_web_server_mcp_clients.py: investigation only
============================================================

Root cause is NOT stale assertions (Part B hypothesis was
incorrect). All 13 failures + 5 errors collapse on a single
`ModuleNotFoundError: No module named 'slowapi'` raised when
the test imports `kora_cli.web_server` → which transitively
imports `kora_cli.listeners.__init__` → `kora_cli.listeners.
webhooks` → `slowapi`. That import is unconditional at the
package __init__ level.

The `slowapi` package is declared in pyproject.toml's `web`
extra (`fastapi==0.133.1`, `uvicorn[standard]==0.41.0`,
`slowapi>=0.1.9`), but the test environment only installs
`--extra dev` — so slowapi is missing in CI/dev test runs.

Confirmed: running `uv sync --frozen --extra dev --extra web`
+ pytest passes 19/19 of the mcp_clients tests. No assertion
shape is stale.

This is the existing task NousResearch#265 (slowapi). Per the bucket
spec's "Genuine bug → STOP" rule, and §3 non-scope
("Investigating tasks NousResearch#265 (slowapi) — separate"), NOT
applying the fix here. Possible fixes for NousResearch#265:

  (a) Add `slowapi>=0.1.9` to the `dev` extra in pyproject.toml
      (1-line; tests then run from a single extra).
  (b) Add the `web` extra to CI test runs alongside `dev`.
  (c) Make slowapi imports lazy in kora_cli/listeners/webhooks.py
      so listeners/__init__.py doesn't fail at import time
      when only test/dev deps are installed.

(a) is simplest; recommend that path for the NousResearch#265 PR.

Tests
=====

  * tests/kora_cli/test_heartbeat_panel_drift_fixes.py — 11
    new source-pin tests: source files exist, "unknown" arm
    in STATUS_TONE / STATUS_LABEL / StatusIcon switch,
    dashboard counts include "unknown", formatTimestamp +
    formatRelative accept string|null with "never checked"
    null path, service.error rendered as JSX child (no
    dangerouslySetInnerHTML), cache_warming banner + dashboard
    headline tone suppression.
  * Full admin-panel regression: 260/260 across 22 suites
    (including the previously-failing mcp_clients suite,
    which passes once --extra web is installed).
  * `pnpm tsc -b` clean (was 4 errors → now 0).
  * `pnpm build` clean.

Refs: PRs #108 (KR-MCP-CLIENTS-FLIP) + #113 (KR-MCP-CONSUMPTION
ST2) + #118 (KR-FEAT-HEARTBEAT ST2); task NousResearch#269 (closed by
Part B investigation: dependency issue, not stale assertions);
task NousResearch#265 (slowapi dependency — open, recommended fix above).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>