fix: repair hook authority fallback and visible blockers

[matthias-scale]

Summary

• Expire true full-lifecycle hook authority after a configurable local-receipt timeout and after sustained output inconsistent with the latest lifecycle event.
• Keep fresh lifecycle hooks authoritative over ordinary screen states, while newer structurally anchored native Claude Code blockers override them.
• Stop closing-block reports from claiming full-lifecycle authority; retain explicit blocked fleet gates until their defined retirement conditions.
• Force unchanged-screen rescans without resetting pane/runtime state, and make agent explain report the arbitration actually applied.
• Publish fork-local Claude and Kimi manifest updates with real captured Claude and Kimi-through-Claude evidence.

Acceptance criteria

• S3a1: A configurable bounded timeout measured from local hook receipt expires true full-lifecycle authority through scheduled TUI and headless deadlines, including a static pane with no later output, then recomputes cached manifest evidence and emits the pane update. just test-one stale_full_lifecycle_hook_authority_falls_back_to_screen passed 6 tests.
• S3a2: The sustained-output observer retires true hook authority before timeout for output inconsistent with the latest Idle, Blocked, or Unknown report; every accepted eligible report rebaselines it, while Working output, one late write, turn-end repaint, and resize retain authority. just test-one unmatched_output_retires_hook_authority passed 3 tests.
• S3a3: Fresh same-agent full-lifecycle hook state remains authoritative over Idle, Working, and Done screen rules absent a newer high-priority visible blocker, and a later accepted report clears retirement. just test-one fresh_hook_state_wins_over_non_blocker_screen passed 2 tests, including the complete hook/screen precedence matrix.
• S3a4: Native Claude permission/tool approval, trust-folder, AskUserQuestion, and login/OAuth panels classify Blocked through visible_blocker rules above concurrent Working evidence under fresh authority; stale or quoted blocker text remains non-blocking, and agent explain reports the applied screen/hook/foreground owner. just test-one visible_blocker_overrides_fresh_hook_authority passed 4 tests; focused terminal and API explain suites also passed.
• S3a5: Real captured Claude and Kimi-through-Claude fixtures classify empty prompts as Idle and native blockers as Blocked without fleet tokens. Captures cover 50, 48, 40, 34, and 24 columns, with provenance outside terminal bytes. just test-one claude_kimi_real_screen_fixtures_classify_idle_and_blocked passed.
• S3a6: Bundled and website Claude manifests preserve deployed 2026.08.21.1 working rules, include the bounded wrap separator from upstream PR fix: detect claude selection dialogs in narrow panes herdrdev/herdr#3165 exact head cb512903cfb5febfe7b4be5d23f91fe77f260e8b, and use fork-local version 2026.08.25.1001; Kimi is bumped above 2026.06.10.1. python3 scripts/agent_detection_manifest_check.py --require-website passed with bundled/website parity and version-floor checks.
• S3a7: Closing-block reports never claim full-lifecycle authority. Non-Blocked closing reports yield to newer screen evidence; an explicit Blocked fleet gate remains authoritative until a later report, process exit, or sustained new-turn output. just test-one closing_block_authority_is_limited_to_live_blocked_gates passed 3 tests.

Runtime and regression evidence

• Real capture fixtures include the ub1 wM:pJ empty Claude prompt, ub1 wM:pK Kimi-through-Claude empty prompt, local native Bash permission, trust-folder, AskUserQuestion, and login-method panels. The ub1 fixtures were previously collected read-only; this slice performed no ub1/ub2 mutation.
• Width-specific disposable captures preserve actual 50/48/40/34/24-column buffers and layout metadata. The upstream fix: detect claude selection dialogs in narrow panes herdrdev/herdr#3165 separator is used exactly: (?:[ \t]+|[ \t]*\n[ \t]*); blank-line, NBSP, and no-whitespace neighbours are rejected.
• Threat-model negatives cover quoted blocker text at a live prompt, an old panel above the live prompt, model picker/transcript/mode-line/overlay/streaming neighbours, blocker plus stale busy OSC evidence, and fleet-token absence.
• Real detector-loop tests force unchanged-buffer evaluation after timeout and quiet closing reports. Cached Blocked/Working and manifest Idle outcomes arrive through normal StateChanged handling without synthetic Idle/Done or hidden-pane Done flicker.
• API regressions prove that diagnostics may expose a matched panel before it is newer than the hook, while effective state remains the applied runtime state; after a real newer screen event, explain/list/effective agree, and panel removal restores the correct owner.

Configuration and validation

• Adds advanced agent_detection.full_lifecycle_hook_authority_timeout_seconds, default 600, valid range 30..=3600; invalid reload preserves the prior live value. Default config, parser/reload, reference JSON, changelog, and staged English/Japanese/Chinese docs are updated.
• Windows test enumeration initially exposed an incomplete cfg boundary around the Unix live-detector test helper. The repair gates the helper, wrapper, and two consumers with four #[cfg(unix)] attributes. A pinned MSVC test build compiles the full Herdr test binary through Rust code generation on macOS; only the unavailable Windows SDK link remains host-limited.
• Serialized isolated-XDG just check-parallel passed lint, Rust, Windows, maintenance, integrations, and marketplace checks with Zig 0.15.2 at head 172ccc508d3b4e4a07438fddd04482bfb8e5d04e.
• The product head received an exact-head adversarial PASS with no P0-P3 findings. Focused exact-head review of the four-line Windows cfg repair also passed with no findings and left S3a1-S3a7 unchanged.

Deployment boundary

S3 did not install or deploy any Herdr binary or agent-detection manifest on the Mac, ub1, or ub2, and did not act on any server/session. Mac manifest deployment belongs to the separately authorized final Mac rollout; ub1/ub2 remain untouched pending Matthias's later authorization.