fix: stop reporting claude panes done while their subagents run

[matthias-scale]

Herdr reported Claude panes on ub1 as done while the subagents they launched were still working. done is AgentState::Idle plus unseen, so an idle screen is all a pane has once its subagent evidence is lost. Three independent faults were dropping that evidence.

Vim mode hid the live-turn rule

Claude prefixes its status row with the vim mode indicator when vim mode is on, so -- INSERT -- ⏵⏵ bypass permissions on · esc to interrupt never matched live_turn_working, which anchors the row on ^\s*[⏸⏵]. Every Claude pane on ub1 renders that prefix, so a pane mid-turn could read idle. The rule now allows the indicator and stays anchored otherwise.

A cached remote manifest shadowed the bundled rules

ub1 loaded remote:~/.local/state/herdr/agent-detection/remote/claude.toml at version 2026.09.11.1, the same version string as the bundled manifest, and read_remote_manifest only prefers bundled when the remote version is strictly older. The updater reported current and never refetched, so bundled rules the remote copy lacked never ran. The manifest version moves to 2026.09.23.1.

A closing-block subagent claim died on its authority

current_direct_closing_report_subagents() re-checked at read time that the reporting hook authority was still live, but the claim is already validated when the report is applied. Starting another turn retires that authority without clearing the claim, so a parent that reported closing_agents = 1 silently read idle from the next turn onward. Pane w9:p15 was the confirmed case: it carried the token, declared one running agent in its own closing block, and reported done, while a sibling pane with the identical token reported working.

The read-time gate is gone. Because the watchdog was the only thing ageing a claim out and it also bailed on a retired authority, it now arms off that authority's later lifecycle boundary and issues a terminal zero report, so a claim can never outlive its expiry. A report that cannot be bound to the current agent session is still retired whole, count included.

New rule: detect subagents from the /tasks hint

Claude puts · /tasks to see subagents · on the status row only while subagent tasks are running and drops it when the last finishes, which makes it the one control that survives the parent returning to an idle prompt. Confirmed on ub1: fourteen panes with no running subagent never rendered the segment, and a pane holding a live subagent did.

Not changed: background shells

background_shell_working has never matched anything — its regex is broken by the vim prefix, by a comma delimiter, and by end-of-line. Repairing it would be wrong. Claude's counter includes every background shell the session registered, not the ones still running: one ub1 pane reports 74 while the whole host runs 238 bash processes across 19 agents. Matching it would pin nearly every pane to working for good, which is why upstream removed the rule in 987b070. It stays as it was.

Verification

cargo nextest run -E 'test(/detect::manifest|terminal::state/)' — 274 passed. claude_kimi_real_screen_fixtures_classify_idle_and_blocked still passes, so the new rule adds no false positive on the captured ub1 idle screens.

just check-parallel did not complete locally. Two runs stopped on different real-server integration tests, agent_start_stops_retrying_when_the_pane_shell_stays_busy and two_servers_share_groups_route_concurrent_mutations_and_recover_stale_catalogs, both with cleanup watchdog errors and both passing in isolation, on a host at load average 74. Leaving that to CI on a clean runner.