instar 1.3.44 → 1.3.46

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-28T01:59:27.143Z",
-  "instarVersion": "1.3.44",
+  "generatedAt": "2026-05-28T02:19:53.690Z",
+  "instarVersion": "1.3.46",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -65,7 +65,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -74,7 +74,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -83,7 +83,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -101,7 +101,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -110,7 +110,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -128,7 +128,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1489,7 +1489,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "de0ac7e9acd815a17f3adf06b1154fcb0fd4a265f0e51e38509f811902e43c1e",
+      "contentHash": "002d9267e321809eb996c0e30bd35d7eeb67eb3e11b09dd8cfbf66e9bd215b49",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {
@@ -1521,7 +1521,7 @@
       "type": "subsystem",
       "domain": "communication",
       "sourcePath": "src/lifeline/TelegramLifeline.ts",
-      "contentHash": "6f5b9a817019b735b9afe3fded858ce713c8bc770b1d3bf018b65905eef25378",
+      "contentHash": "4a2f251ab4d091cf62d9826a1738729838775254ff00d6c743787193ca48dd8b",
       "since": "2025-01-01"
     },
     "subsystem:orphan-process-reaper": {

package/src/scaffold/templates.ts

@@ -443,6 +443,12 @@ This routes feedback to the Instar maintainers automatically. Valid types: \`bug
 
 **Use private views for sensitive content. Use Telegraph for public content.**
 
+**Agent Updates topic (self-broadcasts about ships, restarts, updates)** — When narrating a ship, an update I just applied, or a restart I just completed (e.g. "Just shipped X", "Back up and running on vN", "Bounced cleanly after the update"), route the message through the post-update channel so it lands in the dedicated Agent Updates topic — NOT the active session topic the user happened to be chatting in.
+- Post: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/telegram/post-update -H 'Content-Type: application/json' -d '{"text":"Your update narration here"}'\`
+- The endpoint resolves the Updates topic from state server-side; you cannot specify a topic and you should not try to.
+- If Updates is not configured, the endpoint returns 400 — do NOT fall back to sending in the active topic. Update-class messages belong in Updates or they don't go out at all.
+- **When to use** (PROACTIVE — this is the trigger): the moment I am about to author a conversational message whose subject is *me* shipping, updating, or restarting — including post-restart "I'm back" confirmations — I use this endpoint. Authoring such a message via the standard Telegram reply path puts release chatter into whatever conversation the user was last in, which is the bug this routing closes.
+
 **Secret Drop** — Securely collect secrets (API keys, passwords, tokens) from users without exposing them in chat history.
 - Request a secret: \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/secrets/request -H 'Content-Type: application/json' -d '{"label":"OpenAI API Key","description":"Needed for GPT integration","topicId":TOPIC_ID}'\`
 - The response includes a one-time URL (\`localUrl\` and \`tunnelUrl\`). Send this link to the user.

package/upgrades/1.3.45.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+UX refinement of the Process Health dashboard tab shipped in v1.3.27. Eight rounds of user-driven copy + structure iteration landed on the design that became the **Dashboard Standard** — the bar all future dashboard features now start from. Pure dashboard-only change (`dashboard/process-health.js` + `dashboard/index.html` + tests); no `src/` / `scripts/` / `.husky/` / `skills/` changes.
+
+What the page looks like now: a one-sentence intro grounds the subject so "it" later in the page has a referent; each section title carries a one-line subtitle that distinguishes it from the others (with explicit cross-references — "When the same kind keeps repeating, it shows up as a pattern above"); each captured problem and pattern card is a `<details>` element with a status color dot on the left (amber/blue/green/gray — never alarm reds) and a chevron on the right; the expanded body is a labeled fact-sheet using a fixed vocabulary (Status / Where / Times seen / First noticed / Cause) used identically across both lists. All action-implying language ("Suggested next step", "verify before acting", "Fix worked") is gone — the page informs, it doesn't direct. Internal codenames (`capture-only`, `failure-learning-loop`, `config-parse`) never reach the DOM; they pass through renderer-owned plain-English maps.
+
+The reference implementation now backs a durable agent memory (`feedback_dashboard_copy_eli16.md`) that codifies the seven rules + eight default substitutions + four status-color tokens so future dashboard work starts from this bar.
+
+## What to Tell Your User
+
+- The Process Health tab on your dashboard reads a lot more clearly now: a calm intro tells you what the page is showing in one sentence, every problem and pattern collapses to one plain line with a small color dot (amber = still being looked into, blue = cause known, green = worked out, gray = closed), and tapping any row opens up the same set of labeled details — Status, Where, Times seen, First noticed, Cause — every time. The bar this set for "what a calm, informative dashboard reads like" is now the standard for everything I build next.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Process Health tab — ELI16 + structure pass | Open the Process Health tab in your dashboard (no action needed; it’s just clearer now) |
+| Dashboard Standard (durable, applies to future dashboard work) | Reference: `feedback_dashboard_copy_eli16.md` (in agent memory) — 7 rules + 8 substitutions + 4 status-color tokens |
+
+## Evidence
+
+- 46 tests green: 30 unit + 12 integration + 4 e2e — includes structural assertions for the unified label order, status-dot CSS classes, and that the dropped framing line is genuinely absent.
+- Safety contract unchanged: XSS negative fixture still fires zero live elements + no canary; `detail.full` redaction is verified end-to-end.
+- Show-don't-tell iteration: eight rounds, each rendered to a real browser and screenshotted for user thumbs-up before committing — no merge-and-iterate churn. The harness pattern is captured in the standard.

package/upgrades/1.3.46.md

@@ -0,0 +1,46 @@
+# Instar Upgrade Guide — NEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+Update-class messages now consistently land in the dedicated **Agent Updates** topic instead of leaking into random conversations. Three separate emitters were each picking a topic differently and two picked the wrong one:
+
+1. The lifeline's HTTP-426 version-skew alert ("Heads up: my server auto-updated to vN but my lifeline is still on vM…") was being sent to whichever topic the user happened to be typing in when the forward came back. Now it resolves `agent-updates-topic` from server state and routes there, falling back to the Lifeline topic if Updates is unset — never the inbound topic.
+2. The `ForegroundRestartWatcher` "Applying update to vN — restarting now" heads-up was routing through the central `notify()` helper without an explicit topic, which silently defaulted to the **Attention** topic. The caller now reads `agent-updates-topic` and passes it explicitly, falling through to the prior Attention default only when Updates is unconfigured.
+3. Agent-authored ship/restart narration ("Quick heads-up: shipped X", "Back up and running on vN") had no template guidance steering it through the post-update channel — it landed in whatever topic the session was bound to. A new CLAUDE.md section + idempotent migration teaches every existing agent to route those self-broadcasts through `POST /telegram/post-update`.
+
+## What to Tell Your User
+
+- My update notifications, restart heads-ups, and post-restart "I'm back" messages will now show up in the Agent Updates topic where they belong, instead of leaking into whatever conversation you happened to be in when an update fired. If you don't see them in random topics any more — that's the fix working.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Lifeline version-skew alert resolves Updates topic | Automatic — no agent action required. The lifeline reads `agent-updates-topic` state on every 426 episode and routes the alert there; falls back to the Lifeline topic if Updates is unset. |
+| `ForegroundRestartWatcher` "applying update" routes to Updates | Automatic — no agent action required. The pre-restart heads-up now consults `agent-updates-topic` and falls through to the prior Attention default only when unset. |
+| Agent self-broadcast guidance (CLAUDE.md template + migration) | Existing agents pick up the new section via `PostUpdateMigrator.migrateClaudeMd()` on next update. New agents get it via `init`. Trigger: any conversational message whose subject is "I shipped / I updated / I restarted" → `curl -X POST .../telegram/post-update` instead of authoring in the active topic. |
+
+## Evidence
+
+- Bug report: Justin, 2026-05-27 (topic 14668), with screenshot of two update-narration messages landing in a Case Study topic instead of the Agent Updates topic.
+- Diagnosis: three independent emitter paths each picking a topic differently — two wired wrong.
+- Spec: `docs/specs/UPDATE-MESSAGE-TOPIC-ROUTING-SPEC.md` (Fix 1 lifeline / Fix 2 watcher / Fix 3 template + migration).
+- ELI16 summary: `docs/specs/UPDATE-MESSAGE-TOPIC-ROUTING-ELI16.md`.
+- Tests added (3 files, 20 new tests, all green):
+  - `tests/unit/lifeline/version-skew-alert-routing.test.ts` — source-level assertions that `handleVersionSkew` resolves Updates via the new `resolveUpdatesAlertTopic()` helper, never the inbound topic; preserves 24h dedupe; drops cleanly when both Updates and Lifeline topics are unset.
+  - `tests/unit/foreground-restart-watcher-notify-routing.test.ts` — source-level assertions that the `onRestartDetected` callback reads `agent-updates-topic` and passes it explicitly to `notify()`; uses `|| undefined` so the unset case falls through to the prior central-notify default.
+  - `tests/unit/PostUpdateMigrator-updateTopicSelfBroadcast.test.ts` — full migration test: idempotency on second run, preserves existing CLAUDE.md content, graceful skip when CLAUDE.md is missing, parity with the source template.
+- Smoke suite: 2941/2941 passed.
+- Migration parity: the two code fixes ride the normal dist refresh on update; the CLAUDE.md template change has a dedicated migration in `PostUpdateMigrator` so existing agents pick it up, not just newly-initialized ones.
+
+## Risk + Rollback
+
+- Risk: **low**. Each fix is a pure routing change with a documented fallback. No contract change, no schema migration, no rolling restart needed beyond the standard post-update flow.
+- Rollback: revert the PR. The lifeline 426 path returns to sending the alert to the inbound topic; the foreground watcher path returns to the central-notify Attention default; the CLAUDE.md section remains in already-migrated agents but does no harm (it's awareness, not enforcement).
+
+## Follow-Ups (tracked, not in this PR)
+
+- Structural enforcement of Fix 3 via a PreToolUse hook that detects agent-authored ship/update narration and redirects to `/telegram/post-update` — the Structure-over-Willpower version of the template guidance.
+- Audit of remaining `notify('IMMEDIATE', 'system', …)` callsites in `commands/server.ts` for any other update-class messages that should route to Updates rather than Attention.

package/upgrades/side-effects/process-health-tab-eli16-pass.md

@@ -0,0 +1,49 @@
+# Side-Effects Review — Process Health tab ELI16 + structure pass
+
+**Version / slug:** `process-health-tab-eli16-pass`
+**Date:** 2026-05-27
+**Author:** echo
+**Spec:** `docs/specs/PROCESS-HEALTH-DASHBOARD-TAB-SPEC.md` (v4, the original feature spec; this PR is a UX-refinement follow-up that does NOT change the spec's behavioral surface)
+
+## Summary of the change
+
+Eight rounds of user-driven copy + UX iteration on the Process Health dashboard tab (originally shipped in v1.3.27 via PR #435). Pure dashboard-only refinement — no `src/` / `scripts/` / `.husky/` / `skills/` changes — so this PR is outside the instar-dev gate's in-scope set. The reference implementation now backs a durable agent memory (`feedback_dashboard_copy_eli16.md`) that codifies the **Dashboard Standard** for future dashboard features.
+
+**Files changed (UI):**
+- `dashboard/process-health.js` (renderers): rewritten `CATEGORY_WORDS`, `ATTRIBUTION_LABELS`, `STAGES`, `INSIGHT_STATUS_WORDS`; new `TYPE_WORDS`, `STATUS_WORDS`, `CAUSE_CONFIDENCE_WORDS`, `statusDotClass`, `statusDot`, `labeledRow`. Restructured `renderCaptured` and `renderPatterns` around the fixed label vocabulary + `<details>` expandability + status color dots. `renderMaturation` reshaped per-stage as expandable `<details>` with plain-English descriptions. Dropped the redundant per-card framing line in v7.
+- `dashboard/index.html`: added page-intro paragraph + per-section subtitles that distinguish each section and cross-reference adjacent ones; new CSS for `.ph-intro`, `.ph-h-sub`, `.ph-item`, `.ph-item-summary`, `.ph-item-text`, `.ph-item-body`, `.ph-item-row`, `.ph-label`, `.ph-value`, `.ph-status-dot` (+ 5 status-color variants), `.ph-stage-summary`, `.ph-stage-body`; chevron disclosure indicator on every `<details>` (opacity 0.8).
+
+**Files changed (tests):**
+- `tests/unit/process-health-render.test.ts`: assertions rewritten for new label vocabulary + new status copy + new framing absence + structural assertions on `<details>` + status-dot CSS classes (3 new structural tests added).
+- `tests/integration/process-health-tab.test.ts`: assertions updated for new copy; new framing-absence check.
+- `tests/e2e/process-health-tab-lifecycle.test.ts`: assertions updated for new copy.
+
+**Files changed (release):**
+- `upgrades/NEXT.md` (NEW for this PR, `bump: patch`).
+
+## Decision-point inventory
+
+- **Pure UX refinement vs. functional change?** Pure UX. No new endpoints, no new data fields, no new auth surfaces, no behavioral changes to the polling controller, no changes to the route layer, no changes to migration parity. Only the rendered text + DOM structure changes.
+- **Drop the recommendation field entirely vs. keep + relabel?** Dropped. Justin explicitly directed "avoid language that implies user needs to act unless ABSOLUTELY essential". The recommendation field is upstream prose that is action-implying by content; relabeling chrome around it doesn't change that. Actionable insight delivery is the deferred §10 surface anyway; v1 of the tab is the calm informational surface.
+- **Drop the per-card framing line vs. keep + rephrase?** Dropped in v7. Once "verify before acting" was rephrased to "Same kind of problem has come up more than once" in v5, it became the third echo of the section title + section subtitle. The no-action-authority signal that the framing was originally carrying is now structural (the rendered card has nothing actionable on it), not chrome.
+- **Add status color dots vs. status text only?** Dots. Lets the user scan the collapsed list and read state at a glance without expanding each item. Colors are calm (amber/blue/green/gray) — never alarm reds, per the existing visual rules.
+
+## Side-effects analysis
+
+- **Behavioral:** None. The polling controller, route layer, and migration paths are unchanged. Only the rendered DOM differs.
+- **Architectural:** None. Same file structure; the renderer module is the same self-contained ESM as before. No new build step, no new runtime dependency.
+- **Security:** The safety contract (`sanitizeForDisplay`, textContent-only DOM writes, element ban, safeUrl) is unchanged. New label spans (`.ph-label`, `.ph-value`) use textContent only. The XSS negative fixture continues to fire zero live elements + no canary. The `detail.full` redaction is unchanged.
+- **Migration parity:** Not applicable — no agent-installed-file changes (`templates.ts` / `PostUpdateMigrator` / shadow markers untouched).
+- **Performance:** Marginal increase in DOM nodes per item (each captured item now has 4–5 `<div>`s of body content instead of 0–4 flat children). Diff-aware rendering still works (signature mechanism is structure-agnostic). No new fetches.
+- **Reversibility:** Fully reversible — revert the commit and the previous render returns.
+
+## Standard captured (the durable artifact this PR exists to back)
+
+The 8-round iteration converged on a design that's now codified as the **Dashboard Standard** in `feedback_dashboard_copy_eli16.md` (agent memory): 7 rules (ELI16 copy + codename maps + grounding intro + self-contained section titles with subtitles + expandable items + fixed label vocabulary + no action-implying language), 8 default substitutions, 4 calm status-color tokens, and the show-don't-tell iteration pattern. The Process Health tab is now the reference implementation.
+
+## Evidence pointers
+
+- All 46 tests green: 30 unit + 12 integration + 4 e2e — includes structural assertions for the unified label order, status-dot CSS classes, and that the dropped framing line is genuinely absent.
+- Safety verified end-to-end: XSS negative fixture still fires zero live elements + no canary; `detail.full` redaction unchanged.
+- Typecheck: `tsc --noEmit` clean.
+- Live-rendered both views (collapsed + expanded) to Chrome headless across 8 iterations and sent screenshots to the user for thumbs-up before each commit. Justin approved v8 with "this is good enough, let's go with it; save this as the standard for future dashboard features".