Suppress hera rail (?) needs-input for sustained-active roles

[anutron]

Summary

Aaron's product ask: (?) should mean "genuinely stuck, no path forward without a human" — not "some flag is technically true regardless of current activity." False positives train the operator to dismiss (?) on sight, which degrades the signal for every other agent too.

Ground-truth investigation of a live false positive (hera role contrib-classifier, a nested sub-orchestrator coordinator dual-bound to the same argus task as its parent-orchestrator worker hat, per MaterializeHeraSubCoordinator) — genuinely active for 7+ minutes / 30k+ tokens streamed, still showing (?) — ruled out the working hypothesis (a stale self-reported blocked flag stuck on one hat, uncleared due to cross-hat scoping): both hats' hera_role_status read working, not blocked, and the existing autoClearBlockedHeraRoles auto-clear pass is already keyed by shared task ID, not per-role.

Live daemon.log/ux.log forensics instead found:

1. The task's in_review/ready_to_close status came from a separate daemon-bounce race: Daemon.SessionStatus transiently reported the supervisor-still-alive session as dead right after a daemon restart, firing RollHeraWorkerToReview on a task that never actually died. Documented as a known, unfixed follow-up in gotchas/daemon-rpc.md — out of scope here (bigger, higher-stakes daemon/supervisor reattach concern, not required by the (?) acceptance criteria).
2. The (?) glyph itself traces to the PTY-content needs-input scan (RoleView.NeedsInput) — agent.ResumeActivityTick's zero-grace-period consecutive-tick counter can never sustain 5 ticks for a session whose content classification is bursty (this role's narrated numbered-findings output periodically looked like a parked prompt), even during genuinely substantial activity. A new test (TestResumeActivityTick's "mostly-working... never converges either") proves this.

What changed

• RoleView.needsInputOwn() now checks a new SustainedActive signal first and returns false unconditionally when set — suppressing both the content-scan flag and a self-reported blocked ladder status.
• SustainedActive is computed once per argus task (not per role), threaded App → HeraPage.SetSustainedActive → BuildModel → buildRoleView → RoleView, exactly like NeedsInput/SessionIdle/SessionRunning already are. Because it's task-scoped, two roles sharing one live binding's task ID (a dual-bound sub-coordinator's worker hat + coordinator hat) automatically read the identical value — no per-hat lookup needed.
• New agent.SustainedActivityTick, a grace-tolerant sibling of agent.ResumeActivityTick (one-tick grace mirroring EscalateParkedSelection's BUG-060 pattern, reusing the same NeedsInputResumeTicks threshold — no new dial). ResumeActivityTick itself is unchanged and still exclusively backs BUG-065/BUG-066's stricter clear paths.
• A role that is merely IsActive (one tick) but not yet SustainedActive is unaffected — this is a narrowing, not a removal, of BUG-A's invariant.

Routed through OpenSpec (narrow-needs-input-sustained-active, archived in this PR per repo convention) with delta specs sharpening the hera-view capability's status-icon-precedence and needs-input requirements.

Test plan

• New unit tests: TestSustainedActivityTick (convergence on bursty patterns, grace semantics, still-refuses-genuinely-blocked patterns) and TestResumeActivityTick's new non-convergence proof.
• New internal/tui/hera tests: content-flag suppression, self-reported-blocked suppression, dual-bound cross-hat suppression, no-regression-on-unrelated-idle-blocked.
• All existing BuildModel/buildRoleView call sites updated for the new parameter; full existing hera/tui/agent suites pass unchanged.
• make build/vet/fmt-check/lint-pr/test-cover-gate all clean. make vuln fails only on pre-existing Go 1.26.3 stdlib CVEs (toolchain-only, CI continue-on-error, unrelated to this diff — confirmed none of the flagged code paths are touched by this change).

🤖 Generated with Claude Code

[github-actions]

Merging this branch changes the coverage (1 decrease, 2 increase)

Impacted Packages	Coverage Δ	🤖
github.com/drn/argus/internal/agent	89.67% (+0.05%)	👍
github.com/drn/argus/internal/tui	82.97% (+0.03%)	👍
github.com/drn/argus/internal/tui/hera	92.03% (-0.26%)	👎

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/drn/argus/internal/agent/needsinput.go	95.09% (+0.17%)	265 (+9)	252 (+9)	13	👍
github.com/drn/argus/internal/tui/app.go	77.83% (+0.14%)	2621 (+16)	2040 (+16)	581	👍
github.com/drn/argus/internal/tui/hera/model.go	96.68% (+0.03%)	361 (+3)	349 (+3)	12	👍
github.com/drn/argus/internal/tui/hera/page.go	86.27% (-1.73%)	357 (+7)	308	49 (+7)	👎

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/drn/argus/internal/agent/needsinput_test.go
• github.com/drn/argus/internal/tui/hera/bug024_test.go
• github.com/drn/argus/internal/tui/hera/bug028_repro_test.go
• github.com/drn/argus/internal/tui/hera/model_sustainedactive_test.go
• github.com/drn/argus/internal/tui/hera/model_test.go
• github.com/drn/argus/internal/tui/hera/pin_nonroot_test.go
• github.com/drn/argus/internal/tui/hera/plan_test.go