The 0-byte / <200-byte run-log heuristic in stale_active_run_evaluation
fires for both genuine stalls (ORA-284 / ORA-275 / ORA-276 class) and
brand-new runs that have not yet produced output (class-1 false positives).
Most firings were class-1, so operators could not trust the alert.
- Add ACTIVE_RUN_OUTPUT_MIN_AGE_MS = 30s: runs younger than this are
skipped regardless of log size, eliminating the class-1 noise.
- Add ACTIVE_RUN_OUTPUT_LIKELY_ZOMBIE_THRESHOLD_MS = 5min with a
near-empty log (<200 bytes) AND no spawn PID / no in-memory process
handle, so genuine stalls fire at the operator's SLA instead of
waiting for the 60-minute general suspicion threshold.
- General 60-min suspicion and 4-h critical thresholds are unchanged.
- Extract the rule into a pure decideStaleRunEvaluation() helper and
thread the resulting decision into the issue body so wallClockSec and
elapsedMs are visible on every new evaluation, with a 'Threshold
applied' line explaining which branch fired.
- Add unit tests covering: missing silence anchor, too-young, zombie,
stall, near-empty boundary, both-process-anchors-present, general
suspicion, critical escalation, and wallClockSec/elapsedMs reporting.
Paperclip CEO
d86062b321