instar 1.3.855 → 1.3.857

package/upgrades/1.3.856.md

@@ -0,0 +1,20 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Codex live-activity detection now recognizes the hour-scale working timer that the TUI renders as `Nh Nm Ns`, in addition to its existing seconds and minutes forms. The spinner-immune output hash also ignores that hour timer as it ticks.
+
+## What to Tell Your User
+
+Very long Codex turns no longer lose their “still working” signal after crossing one hour, so monitoring is less likely to mistake genuine long-running work for an idle or stuck session.
+
+## Summary of New Capabilities
+
+Codex activity monitoring handles real seconds, minutes, and hours TUI duration formats.
+
+## Evidence
+
+The hour fixture uses the real Codex rendering `Working (10h 19m 44s • esc to interrupt)`. TypeScript passes, and 36 focused activity and spinner-normalization assertions pass.

package/upgrades/1.3.857.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Standalone Playwright scripts can now voluntarily acquire and release the same
+machine-local operator-seat lease used by Playwright MCP calls. Ownership-checked
+release prevents late cleanup from clearing a successor's lease, while idempotent
+cleanup keeps `finally` blocks simple.
+
+## What to Tell Your User
+
+One-off Playwright scripts can coordinate with normal agent browser drives instead of
+quietly bypassing the shared browser-seat lock.
+
+## Summary of New Capabilities
+
+The `playwright-seat` command and authenticated seat-release route expose the existing
+host-wide lease to trusted standalone scripts.
+
+## Evidence
+
+TypeScript and the full lint chain pass. Thirty-nine focused unit/integration tests and
+a real temporary-home CLI smoke cover acquire, conflict, ownership-safe release,
+idempotent cleanup, and successor acquisition.

package/upgrades/eli16/codex-hour-activity.eli16.md

@@ -0,0 +1,7 @@
+# Codex hour-scale activity detection — plain-English overview
+
+Codex displays a live timer while it works. Monitoring already understood the timer in seconds and minutes, but after a turn crossed one hour Codex changed the timer to a form like `10h 19m 44s`. The detector no longer recognized it, so genuinely active long work could look idle.
+
+This change teaches the existing detector that exact hour format. It also prevents the ticking hour timer from looking like fresh model output by removing the duration before comparing successive terminal snapshots. Real new text still changes the comparison, so an unchanged, frozen working screen can still be recognized as stalled.
+
+Nothing is enabled, configured, or migrated. It is a small parsing correction backed by the real hour-scale Codex display and focused tests for both live detection and stalled-output hashing.

package/upgrades/eli16/playwright-standalone-seat-lease.eli16.md

@@ -0,0 +1,7 @@
+# Standalone Playwright seat lease — ELI16
+
+Playwright MCP already takes a numbered key before using the shared browser, but a
+one-off Playwright script entered through a side door and skipped the key desk. This
+adds an explicit check-out/check-in path for those scripts. Check-in only works for
+the holder that checked out the key, so an old script cannot accidentally erase a
+new script's reservation.

package/upgrades/side-effects/codex-hour-activity.md

@@ -0,0 +1,45 @@
+# Side-Effects Review — Codex hour-scale activity detection
+
+**Date:** 2026-07-16  
+**Author:** instar-codey
+
+## Summary
+
+Extends the existing Codex TUI duration grammar from `Ns` / `Nm Ns` to the real `Nh Nm Ns` hour rendering. The same hour token is removed from the spinner-immune hash so a ticking clock does not masquerade as new model output.
+
+## Decision-point inventory
+
+- `CODEX_CLI_SIGNAL.toolCallOrSpinner` and `.liveActivity`: identify a current Codex working-status line.
+- `stripVolatileStatus`: removes only the exact hour/minute/second duration token before change hashing.
+
+## Seven dimensions
+
+1. **Over-block:** the pattern still requires the literal `Working (` prefix and a complete duration ending in seconds, so ordinary prose containing hours does not become a live signal.
+2. **Under-block:** seconds, minutes, and the observed hour form are pinned. Unknown future formats remain unchanged rather than guessed.
+3. **Abstraction:** duration recognition remains in the shared framework signal; volatile clock normalization remains in its existing hashing boundary.
+4. **Signal vs authority:** the status line is a liveness signal, not proof of semantic progress. Existing unchanged-pane logic can still classify a frozen spinner as stalled.
+5. **Interactions:** idle model-name/composer text and scrollback-persistent action bullets retain their existing behavior.
+6. **External surfaces:** none. No messages, APIs, persistent state, or credentials change.
+7. **Rollback:** code-only revert with no migration or cleanup.
+
+## Judgment-point check
+
+No new semantic judgment is introduced. This is an exact finite grammar extension grounded in an observed Codex TUI rendering.
+
+## Operator-surface quality
+
+No operator surface changes. Monitoring becomes more truthful without asking the user to configure or operate anything.
+
+## Multi-machine posture
+
+Framework pane parsing is machine-local on every host. The same deterministic grammar ships to each machine; no replicated state or cross-machine authority is involved.
+
+## Rollback cost
+
+One code revert. There is no state to repair.
+
+## Evidence pointers
+
+- Real hour form: `Working (10h 19m 44s • esc to interrupt)`.
+- 36 focused unit assertions pass across framework signals, activity classification, and spinner-immune hashing.
+- Full TypeScript check passes.

package/upgrades/side-effects/playwright-standalone-seat-lease.md

@@ -0,0 +1,66 @@
+# Side-Effects Review — standalone Playwright seat lease
+
+**Version / slug:** `playwright-standalone-seat-lease`
+**Date:** `2026-07-16`
+**Tier:** 2
+**Second-pass reviewer:** independent Codex collaboration reviewer — concur
+
+## Summary
+
+Adds an ownership-checked release operation to `PlaywrightSeatLease`, an authenticated
+release route, and a `playwright-seat` CLI acquire/release path so trusted standalone
+Playwright scripts can participate in the existing host-wide lease.
+
+## Decision-point inventory
+
+- `PlaywrightSeatLease.release` — **add** — removes the record only for the current holder.
+- release route — **add** — returns conflict for a different live holder.
+- CLI acquire/release — **add** — exposes the same store to standalone local scripts.
+
+## Over-block / under-block
+
+The existing default-seat lease still conservatively serializes all users of that
+physical seat. Standalone scripts remain voluntary participants: a script that ignores
+this interface can still contend. This change does not pretend to sandbox hostile or
+uncooperative local processes.
+
+## Abstraction and authority
+
+Release belongs in the existing lease store and uses its existing filesystem lock;
+the CLI and route are adapters, not second authorities. Ownership is an exact invariant,
+not an inferred signal. A mismatched holder cannot release, and an absent record is an
+idempotent success for cleanup. Callers must choose a unique ID per active drive
+invocation and reuse it only for that invocation's matching release; intentional ID
+reuse is intentional same-owner renewal semantics.
+
+## Interactions and races
+
+Acquire and release serialize on the same lock. The ownership check and unlink happen
+inside that critical section, preventing a late cleanup from deleting a successor's
+lease. No scheduler, retry loop, notification, or external operation is added.
+
+## External surfaces and cross-machine posture
+
+The new route is authenticated and the CLI is local. Both expose holder labels and
+expiry already present in the acquire surface; no browser credentials or page data are
+read. The state remains **machine-local by design** because the guarded browser profile
+is a physical resource on that machine.
+
+## Rollback
+
+Revert the adapters and release method. Existing lease records remain compatible and
+expire normally; no migration or repair is required.
+
+## Verification
+
+- TypeScript typecheck
+- 39 focused unit/integration tests covering ownership mismatch, successful release,
+  idempotent cleanup, successor acquisition, route behavior, and registry classification
+
+## Second-pass review
+
+**Verdict:** concur. The reviewer confirmed that release ownership checking and unlink
+are atomic under the same host-wide lock as acquire; route authentication/write
+classification, CLI conflict behavior, and machine-local posture are sound. The review's
+nonblocking precision note — explicitly require a unique holder ID per invocation — is
+incorporated in CLI help, docs, and this artifact.