feat(session-manager): per-window last-activity time on the wire (#{window_activity})

[ZacxDev]

Producer half of clawgate task 516. The consumer half is ZacxDev/homelab-infra (containers/clawgate) — merge this one first; the consumer decode is permissive, so the two can land in either order without breaking a page, but the field only becomes observable once this ships.

What and why

clawgate's tmux page renders a card per window. Its "4m ago" came from Snapshot.ReceivedAt — how long ago clawgate last heard from the host — so all 45 cards under one host showed the same number and none of them said anything about its own window. The renderer was never the missing piece; the per-window datum was.

tmux already exposes #{window_activity} (epoch seconds, updated when the window's active pane produces output), and list-windows already runs once per host, so this costs no extra tmux invocation and no fifth ssh round trip — the same argument #{pid}/#{start_time} ride on.

• WINDOW_FORMAT gains #{window_activity} before #{session_name} (session name must stay last or the bounded maxsplit stops absorbing pipes in a session name).
• split_window_line returns it; parse_windows and parse_tmux_server_id are unchanged in contract.
• New parse_window_activity → {window_id: epoch_seconds}. Absent, never zero: an empty, non-numeric or non-positive value is omitted, because epoch 0 renders as "56 years ago" — a fabricated measurement in the costume of a real one.
• fold_windows writes window_activity only when it has a value. It is the one optional row key and is documented apart from the row ledger in the module docstring.

Measured on the real fleet — not a fixture

scripts/session-manager --json from this branch, 2026-09-07, both hosts:

host	rows	carrying window_activity	distinct times	zero/negative
workbench	54	54	36	0
laptop	32	32	18	0
total	86	86	—	0

Distinct-times > 1 per host is the assertion that matters: windows on one host genuinely disagree, which is what the consumer needs.

Known limit, measured rather than assumed

12 of the laptop's 32 windows report 2021-01-01 — the same frozen pre-NTP RTC value that host's tmux #{start_time} carries (already documented above WINDOW_FORMAT). They are windows that have produced no output since their tmux server started, so tmux stamped them at the server's start instant, recorded under a clock that was wrong and does not move when NTP later corrects it. They render as ~49,000h.

Deliberately not clamped: the relative claim ("nothing has happened here since the server came up") is true, only the magnitude is wrong, and suppressing it would swap a visibly absurd number for a silent absence — the substitution this whole file refuses. A consumer wanting a ceiling has to choose one deliberately; there is no honest one to pick here. Recorded in the code at WINDOW_FORMAT and mirrored in the consumer's renderer comment.

RED → GREEN matrix

This commit's test file applied to a clean worktree of origin/main (969f0581) with the unchanged session-manager:

18 failed, 804 passed

At HEAD of this branch:

823 passed

The 18 red-at-base: the two format-contract tests, the eight parse_window_activity cases, five fold_windows cases, the end-to-end seam test, and the two ledger/golden guards that had to learn the new key.

Wider sweep, unchanged by this PR: test_agent_ledger, test_bar_status, test_claude_sessions, test_clawgate_predicate_single_source, test_session_manager_skill_size, test_standup_local_health, test_tmux_snapshot_push, test_skill_descriptions, test_drift_check — 1237 passed.

Mutation battery

Restore verified by sha256sum before/after; D0 unmutated control green first.

#	mutation	result
D1	parse_window_activity accepts a non-positive epoch	KILLED — drops_a_value_it_cannot_trust[0], [-1]
D2	fold_windows writes the key even when unmeasured	KILLED — carries_NO_KEY_not_a_zero
D3	move #{window_activity} after #{session_name}	KILLED — fields_come_BEFORE_session_name
D4	never wire the parsed map into fold_windows	KILLED — reaches_the_REPORT_per_window_end_to_end
D5	int(float(x)) instead of int(x)	KILLED — drops_a_value_it_cannot_trust[17.5], [1e9]
D6	drop the windows_measured gate on the activity parse	SURVIVED — by design

Each kill was checked to fail with that test's own node id, not a neighbour's.

D6 is reported, not hidden. The same windows_measured flag already gates slot_ids two lines up, so on a failed list-windows every row's window_id is None and fold_windows looks nothing up regardless — the conditional is depth, not a defence anyone has watched work. That is now stated at the parse site rather than implied away, and the outcome is pinned by test_a_PARTIAL_list_windows_read_publishes_no_activity, which fails the call while still returning parseable rows so the refusal is a real decision rather than an empty-string artefact.

Not verified

• No live clawgate page was driven from this branch's collector; the cross-repo seam was verified by feeding this branch's real --json capture through the consumer's real ingest + view code (86/86 windows decoded, 18/36 distinct times per host), not by watching the deployed pusher.
• --lean (LEAN_ROW_FIELDS) deliberately does not carry the new key; that view is a separate, trimmed contract and widening it was out of scope.