fix(newos4): empty-pipeline crash, stacks in reports, frame in digest + dashboard (v4.6.55)

Root cause: splitPipe() splits on every '|', so `help |`, `| wc -l`, `a || b` produced a stage with
no argv and executePipeChain() called parts[0].toLowerCase() on undefined — 989 occurrences, first
filed 2026-10-20, unfixable from the report because bug reports dropped the stack that named
executePipeChain:3955. Same unguarded read existed in _classify().

- terminal.js: _classify() returns an inert classification for empty argv; executePipeChain()
  parses each stage once, filters stages with no argv (so the last real stage stays final), warns
  only when the whole pipeline is empty. Last-stage test now compares against the filtered length.
- module-system.js: `bug` diagnostics include the stack (10 frames, 1200 chars); auto-filed reports
  carry it too — they are the majority of the inbox and were previously message-only.
- report.php: per-stack 2 KB cap; fingerprint pinned to message/source/count so adding `stack`
  cannot break dedupe against reports filed before today.
- ingest.php: first_frame() parsed once on ingest, stored as `frame` on each signature.
- newos4-triage.py: FRAME| line with the first application frame.
- dashboard.php: frame under each Top Errors row.
- modules/test/test-pipe-guard.js: ordering tripwire (guard must precede the parts[0] read).

Verified: test RED exit=1 -> GREEN exit=0; browser matrix on v4.6.55 (help |, | wc -l,
echo hi || echo bye, ls | | wc -l, |) -> 0 new error signatures, "|" warns;
auto-filed report now carries stack (RPT-...f3e31124, archived after the probe);
frame = modules/core/core-bundle.js:3955:42; maintain OK; skill audit 7/7.

1 files changed, 23 insertions, 1 deletions

diff --git a/api/debug/report.php b/api/debug/report.php
index 5d4fc95..5625ffe 100644
--- a/api/debug/report.php
+++ b/api/debug/report.php
@@ -29,6 +29,18 @@ $body = (string)($payload['body'] ?? '');
 if (mb_strlen($body) > 4000) $body = mb_substr($body, 0, 4000);
 $diag = (isset($payload['diagnostics']) && is_array($payload['diagnostics'])) ? $payload['diagnostics'] : [];
 
+// Bound every stack: 20 errors x 10 frames of long URLs can otherwise approach the 512 KB ceiling
+// and reject a legitimate report.
+if (!empty($diag['errors']) && is_array($diag['errors'])) {
+    foreach ($diag['errors'] as $k => $de) {
+        if (!is_array($de)) { unset($diag['errors'][$k]); continue; }
+        if (isset($de['stack'])) {
+            $diag['errors'][$k]['stack'] = mb_substr((string)$de['stack'], 0, 2000);
+        }
+    }
+    $diag['errors'] = array_values($diag['errors']);
+}
+
 // Maintenance thread: lets the in-app agent and the Hermes maintenance job hold a conversation.
 // `thread` is a client-generated id (thr-xxxxxxxx); `kind` distinguishes agent feedback from
 // operator bug reports so triage can weight them differently.
@@ -62,7 +74,17 @@ foreach ($rate as $k => $v) {
 save_json(RATE_FILE, $rate);
 
 // Dedupe: same title + error set + version within 24h collapses onto the existing report.
-$fingerprint = sha1($title . '|' . json_encode($diag['errors'] ?? []) . '|' . (string)($diag['version'] ?? ''));
+// Hash only the fields the pre-2026-10-23 payload had. Adding `stack` to json_encode($diag['errors'])
+// would change every fingerprint, so an identical error filed today would not dedupe against the
+// same error filed yesterday.
+$errKey = [];
+foreach (is_array($diag['errors'] ?? null) ? $diag['errors'] : [] as $de) {
+    if (!is_array($de)) continue;
+    $errKey[] = ['message' => (string)($de['message'] ?? ''),
+                 'source'  => (string)($de['source'] ?? ''),
+                 'count'   => (int)($de['count'] ?? 1)];
+}
+$fingerprint = sha1($title . '|' . json_encode($errKey) . '|' . (string)($diag['version'] ?? ''));
 $existing = glob(REPORTS_DIR . '/RPT-*.json') ?: [];
 foreach (array_slice(array_reverse($existing), 0, 100) as $f) {
     $d = json_decode(@file_get_contents($f), true);