instar 1.3.207 → 1.3.208

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-02T21:28:59.172Z",
-  "instarVersion": "1.3.207",
+  "generatedAt": "2026-06-02T21:56:02.195Z",
+  "instarVersion": "1.3.208",
   "entryCount": 195,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "797a5827842944d872077473dc0d87a1f99601f33d5f262e272748731d68250b",
+      "contentHash": "623bae8fdc8451b34fca0ac1d83fb255d3e8c449d8bf923b0997357b383a0173",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.208.md

@@ -0,0 +1,54 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`OutputActivityTracker` (the per-session change-detector that feeds
+`ActiveWorkSilenceSentinel`) now hashes a **spinner-immune** view of the captured
+pane. The host's "working" spinner (e.g. Claude's `✻ Sautéed for 26m 16s ·
+(esc to interrupt)`) ticks its elapsed-time counter every second, so the previous
+raw hash changed on every poll even when the turn had produced no real output for
+many minutes. That kept the session's `lastChangeAt` perpetually fresh and blinded
+the silence sentinel to a stalled-but-spinning turn — the cause of a ~26-minute
+unrecovered API-stall where a wedged session looked fully alive. A new
+`stripVolatileStatus` removes the volatile status region (the rotating glyph, the
+elapsed-time and token/context counters, and the `esc to interrupt` footer) before
+hashing, so only REAL scrollback changes refresh the activity timestamp. A
+stalled-but-spinning turn now correctly accrues idle time and becomes eligible for
+the sentinel's gentle nudge.
+
+This is safe: the silence sentinel's nudge is a non-destructive `Enter` keystroke,
+so a false-positive on a genuinely long turn is harmless. The only destructive
+recovery (Ctrl-C) lives in `SocketDisconnectSentinel`, which fires only on a
+positive connection-error marker — unchanged.
+
+## What to Tell Your User
+
+- **Better stuck-session detection**: "If one of my sessions ever freezes mid-task
+  while still showing a 'working' spinner, I can now actually notice it and try to
+  wake it, instead of being fooled into thinking it's busy because the spinner's
+  clock keeps ticking. It's a gentle nudge only — it never interrupts real work."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Spinner-immune stall detection | Automatic (ActiveWorkSilenceSentinel) |
+
+## Evidence
+
+- **Live before:** 2026-06-02, a session hung ~26 min on an Anthropic API socket
+  drop while showing `Sautéed for 26m 16s`; `ActiveWorkSilenceSentinel` never fired
+  (it flagged a *different* session idle at a static prompt in the same window), and
+  the turn only re-engaged when an inbound user message arrived. Confirmed in
+  `logs/server.log` + `logs/sentinel-events.jsonl`.
+- **After (code path):** `tests/unit/spinner-immune-liveness.test.ts` drives
+  `OutputActivityTracker` with ticking-spinner-only frames and asserts `lastOutputAt`
+  HOLDS across them (idle accrues) while genuine new output still advances it; plus
+  `stripVolatileStatus` unit cases for Claude/codex spinner shapes and a guard that
+  benign content (e.g. "completed in 5s") is not over-stripped.
+- **Cross-model reviewed** by the codex-based agent (task #63): confirmed the silence
+  nudge is `Enter`-only (non-destructive), which is why the spinner-immune hash alone
+  is sufficient and safe.

package/upgrades/side-effects/spinner-immune-liveness.md

@@ -0,0 +1,122 @@
+# Side-Effects Review — spinner-immune liveness signal
+
+**Version / slug:** `spinner-immune-liveness`
+**Date:** `2026-06-02`
+**Author:** `echo`
+**Second-pass reviewer:** `instar-codey (codex) — cross-model review completed; verdict incorporated`
+
+## Summary of the change
+
+`src/monitoring/sentinelWiring.ts`: `OutputActivityTracker.snapshot()` now hashes
+`stripVolatileStatus(output, framework)` instead of the raw pane. `stripVolatileStatus`
+strips the host's animated working-status region (Braille spinner glyphs, the
+`Nm Ns` / `(Ns` elapsed timers, token/context counters, and the `esc to interrupt`
+footer line) so only real scrollback changes refresh `lastChangeAt`. Fixes the
+silence sentinel being permanently blinded by the spinner's ticking clock.
+
+## Decision-point inventory
+
+- `OutputActivityTracker: did this frame change?` (sentinelWiring.ts:~215) — **modify**
+  — the hashed input is now spinner-normalized. The downstream "observed-change
+  requirement" + `looksActivelyWorking` + silence-threshold logic are unchanged.
+
+---
+
+## 1. Over-block
+
+**No block/allow surface — over-block not applicable.** The change cannot reject or
+block anything. The only effect is that the silence sentinel correctly recognizes a
+stalled-but-spinning turn as idle (rather than perpetually "active") and may issue
+its existing non-destructive `Enter` nudge.
+
+---
+
+## 2. Under-block
+
+**What does it still miss?** It strips a conservative, anchored set of volatile
+tokens; an exotic future spinner format could still leak a changing token into the
+hash (degrading gracefully back to the old "always active" behavior for that host —
+no worse than today). It does not change the silence THRESHOLD; a true stall is
+detected at the existing ~16-min mark.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct layer — a normalization at the change-detector's input boundary, reusing the
+existing per-framework `getActivitySignal` patterns rather than inventing new ones.
+It feeds the existing smart silence sentinel; it does not add a parallel detector or
+hold any authority.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change produces a signal (a fresher/stale activity timestamp)
+  consumed by the existing `ActiveWorkSilenceSentinel`, which owns the (non-destructive)
+  recovery decision.
+
+The cross-model review (Codey) specifically affirmed the signal-vs-authority shape:
+absence-of-activity must NOT authorize destructive recovery; here it only authorizes a
+non-destructive `Enter` nudge, and the destructive Ctrl-C path (SocketDisconnectSentinel)
+remains gated on a POSITIVE error-string marker. No change weakens that.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** none — same single hash site; downstream logic unchanged.
+- **Double-fire:** none — `SocketDisconnectSentinel` (error-string → Ctrl-C) and
+  `ActiveWorkSilenceSentinel` (silence → Enter) remain independent; this only un-blinds
+  the latter.
+- **Races:** none — pure synchronous string transform inside the existing snapshot tick.
+- **Feedback loops:** the Enter nudge could, on a genuinely-long generation, submit a
+  stray blank line; the pane is mid-turn (spinner present) so it is queued/ignored, not
+  destructive. Verified the nudge is `sendKey(session, 'Enter')` (sentinelWiring.ts:255),
+  not Ctrl-C.
+
+---
+
+## 6. External surfaces
+
+- Persistent state: none.
+- External systems: none.
+- Behavior visible to operators: a stalled-but-spinning session now appears in
+  `logs/sentinel-events.jsonl` as detected/nudged where before it was invisible. The
+  Telegram escalation default (off) is unchanged.
+- Runtime: one extra string transform per session per silence tick — negligible.
+
+---
+
+## 7. Rollback cost
+
+Pure code change — revert `stripVolatileStatus` + restore `cheapHash(output)`, ship a
+patch. No persistent state, no migration, no user-visible regression (it would simply
+return to the prior "spinner fools the detector" behavior).
+
+---
+
+## Conclusion
+
+The cross-model review materially improved this change: it began as a multi-state
+process-activity gate to protect long generations from a *destructive* Ctrl-C, but the
+reviewer's grounded catch — the silence nudge is `Enter`-only, not Ctrl-C — collapsed it
+to a single safe normalization, with the destructive path already correctly gated on a
+positive error marker elsewhere. Clear to ship as a Tier-1 monitoring reliability fix.
+
+## Second-pass review (if required)
+
+**Reviewer:** instar-codey (codex)
+**Independent read: concur (after the implementation correction).** The reviewer's
+verdict drove the final design: do not let absence-of-activity authorize destructive
+recovery (already satisfied — the silence path is non-destructive `Enter`; Ctrl-C stays
+behind the SocketDisconnectSentinel error marker). No residual concern on the shipped
+shape.
+
+## Evidence pointers
+
+- `tests/unit/spinner-immune-liveness.test.ts` — 7 tests (normalizer + tracker behavior).
+- `src/monitoring/sentinelWiring.ts:255` — nudge is `sendKey(session, 'Enter')`.
+- Origin incident: `logs/server.log` + `logs/sentinel-events.jsonl`, 2026-06-02 26-min stall.