fix(hook): give the macOS tap's capability probes their own watchdog budget

[hyspacex]

Summary

When the Mac goes to sleep, the agent force-exits and launchd restarts it. Two distinct things go wrong at the sleep transition, and this PR has one commit for each. Refs #952.

1. The between-slice capability probe (AXIsProcessTrusted, the throwaway CGEventTapCreate, CGEventTapIsEnabled, CGEventTapEnable) is a WindowServer/TCC round trip that takes seconds while the system is going down, and it was charged to the 1.5 s stall budget. 43 of 43 exits on one machine sit at a sleep transition with elapsed_ms in 1555–1809: the watchdog fired on time, the tap thread was slow, not wedged.
2. The lifecycle watchdog thread itself stops running for a while around the transition. On a second machine two of three exits fired at elapsed_ms=2515 and 6325 — 1.0 s and 4.8 s past the budget, which a thread evaluating every 100 ms cannot do — and the tap thread it judges was not running either. Charging that gap to the tap thread force-exited a healthy agent.

Changes

• openlogi-hook: new TapPhase::Probing, published by the tap thread around the post-slice probe and judged against a separate TAP_PROBE_BUDGET (10 s) for both exit reasons; the progress mark is refreshed before Armed is re-published.
• openlogi-hook: each lifecycle evaluation credits at most OBSERVATION_GAP (5 polls, 500 ms) for the time since the previous one, and a stall is judged by the time the watchdog was awake to see. A starved-but-running watchdog still accumulates. LifecycleDecision::Exit carries watched and stalled, and the exit log prints both — a wide gap between them is the process-frozen signature.
• openlogi-hook: a budget change is a new stall, so a stop that waited out a slow probe gets the short budget afresh for the teardown instead of being exited the moment the probe returns.
• crates/openlogi-hook/AGENTS.md: the invariants above.

Testing

Run on macOS 26 (arm64) with RUSTFLAGS="-D warnings", rebased onto master 5cca3f5: cargo fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace, the non-GUI rustdoc job, cargo xtask ci clippy-windows. Watchdog decision tests drive the pure LifecycleWatchdog at the real 100 ms poll cadence; mutation checks confirm the freeze tests fail without the gap credit and the teardown test fails without the budget in the stall identity.

Not run: tests (linux), msrv, cargo-deny. Not runtime-tested through a lid-close cycle on the combined branch; the agent log lines to look for after one are HID CGEventTap lifecycle did not make progress (should be gone) and, in any that remain, stalled_ms vs watched_ms.

[greptile-apps]

Confidence Score: 5/5

[High risk] Watchdog timing logic for the macOS input tap.

The PR appears safe to merge based on the reviewed watchdog changes.

Summary

The PR gives macOS tap capability probes a separate watchdog budget and discounts lifecycle-watchdog scheduling gaps that span a kernel sleep or wake. It also refreshes progress before returning to the short-budget tap phase and adds decision tests for probes, teardown, and sleep transitions.

• The latest changes restrict gap discounting to observed power transitions, so ordinary delayed polls count in full.
• No new actionable issue was established.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Lifecycle poll] --> B{Sleep or wake epoch changed?}
  B -->|No| C[Charge full poll gap]
  B -->|Yes| D[Charge at most 500 ms]
  C --> E{Tap phase}
  D --> E
  E -->|Probing| F[10 s probe budget]
  E -->|Other watched stall| G[1.5 s budget]

Loading

_{Reviews (3) · Last reviewed commit: "fix(hook): discount only the watchdog ga..."}

[AprilNEA]

Pushed two changes on top of your commit, rebased onto master:

• your Armed re-publish now refreshes the progress mark first (the Greptile P1) — the watchdog reads the phase before the mark, so a probe that had already returned could still be judged against the pre-probe mark;
• a second commit for the other half we see on my machine. Two of my three [Bug]:OpenLogi crashes/exits after macOS machine sleeps #952 exits fired at elapsed_ms=2515 and 6325, i.e. 1.0 s and 4.8 s past the budget, which a thread evaluating every 100 ms cannot do: the watchdog thread itself was not running around the sleep transition, and neither was the tap thread it judges. Your exits (1555–1809 ms) fired on time and are the slow-probe case your commit fixes; my 1561 ms one is that case too. Each evaluation now credits at most 500 ms for the time since the previous one, and the exit log prints stalled_ms next to watched_ms so the two cases can be told apart from logs. It also gives the teardown a fresh short budget after a stop waited out a slow probe — with the probe budget alone, a probe over 1.5 s meant an exit the moment it returned.

Details in the second commit's message. If you can run a lid-close cycle on the clamshell setup, that is the test neither of us has done on the combined branch.