instar 1.2.40 → 1.2.42

package/dist/monitoring/sentinelWiring.js

@@ -0,0 +1,154 @@
+/**
+ * sentinelWiring — constructs the runtime dependencies for the two
+ * "silently-stopped" sentinels (SocketDisconnectSentinel and
+ * ActiveWorkSilenceSentinel) from a SessionManager surface + config.
+ *
+ * Why this module exists: PR #334 merged both sentinels as standalone,
+ * unit-tested detectors but never instantiated them in the server. The
+ * release notes claimed "wired into server startup" — it wasn't true. This
+ * module is the missing wire-up, extracted from server.ts so the dependency
+ * construction is itself unit-testable (Testing Integrity Standard: every
+ * dependency-injected component needs wiring-integrity tests proving the deps
+ * are real functions that delegate to the underlying primitives, not nulls or
+ * silent no-ops).
+ *
+ * Signal-vs-authority: everything here is a detector or a bounded recovery
+ * primitive. `looksActivelyWorking` is a structural detector. All user-facing
+ * escalation routes through the existing MessagingToneGate via the `/attention`
+ * endpoint (category: degradation) — no new blocking authority is introduced.
+ *
+ * Spec: docs/specs/silently-stopped-trio.md
+ */
+import { getActivitySignal } from './frameworkActivitySignals.js';
+export function makeAttentionPoster(opts) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    return async (item) => {
+        try {
+            const resp = await doFetch(`http://localhost:${opts.port}/attention`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${opts.authToken}`,
+                },
+                body: JSON.stringify({ category: 'degradation', priority: 'HIGH', ...item }),
+            });
+            return resp.status === 201;
+        }
+        catch {
+            // Network/route failure — treat as not-delivered. The sentinel's notify
+            // wrapper swallows this; the bigger failure (silent stop) is still closed
+            // because recovery attempts are independent of the notice landing.
+            return false;
+        }
+    };
+}
+const SOCKET_CAPTURE_LINES = 40;
+const SILENCE_CAPTURE_LINES = 40;
+export function buildSocketDisconnectDeps(opts) {
+    return {
+        getRecentOutput: (sessionName) => opts.sessions.captureOutput(sessionName, SOCKET_CAPTURE_LINES) ?? '',
+        resumeFn: async (sessionName) => {
+            if (!opts.sessions.isSessionAlive(sessionName))
+                return false;
+            // A socket drop leaves Claude Code waiting at a retry state; a bare Enter
+            // re-engages without interrupting in-flight work (unlike Ctrl+C, which
+            // would cancel a tool call that may still be running).
+            return opts.sessions.sendKey(sessionName, 'Enter');
+        },
+        notifyFn: async (sessionName, text) => {
+            await opts.notify({
+                id: `socket-disconnect:${sessionName}`,
+                title: `${friendly(sessionName)} connection issue`,
+                summary: text,
+            });
+        },
+        listSessionNames: () => opts.sessions.listRunningSessions().map((s) => s.tmuxSession),
+    };
+}
+/**
+ * Detector: does this captured frame show the framework actively working
+ * (spinner, tool call, "esc to interrupt", "(running)") rather than sitting
+ * idle at its prompt? Used to filter the silence sentinel's candidate set so a
+ * session that is simply waiting for the user is never flagged as "stopped".
+ */
+export function looksActivelyWorking(output, framework) {
+    if (!output)
+        return false;
+    const sig = getActivitySignal(framework);
+    return (sig.toolCallOrSpinner.test(output) ||
+        sig.escapeToInterrupt.test(output) ||
+        sig.runningIndicator.test(output));
+}
+/**
+ * Tracks per-session output-change time so the silence sentinel can tell
+ * "frozen mid-task" from "still producing output". Only sessions whose most
+ * recent frame shows active-work signatures are surfaced as candidates; an
+ * idle-at-prompt session is marked `paused` so the sentinel skips it — it is
+ * not "actively working then stopped".
+ */
+export class OutputActivityTracker {
+    sessions;
+    now;
+    last = new Map();
+    constructor(sessions, now = Date.now) {
+        this.sessions = sessions;
+        this.now = now;
+    }
+    snapshot() {
+        const t = this.now();
+        const running = this.sessions.listRunningSessions();
+        const seen = new Set();
+        const out = [];
+        for (const s of running) {
+            seen.add(s.tmuxSession);
+            const output = this.sessions.captureOutput(s.tmuxSession, SILENCE_CAPTURE_LINES) ?? '';
+            const hash = cheapHash(output);
+            const prev = this.last.get(s.tmuxSession);
+            if (!prev || prev.hash !== hash) {
+                this.last.set(s.tmuxSession, { hash, at: t });
+            }
+            const lastOutputAt = this.last.get(s.tmuxSession).at;
+            const active = looksActivelyWorking(output, s.framework);
+            out.push({ sessionName: s.tmuxSession, lastOutputAt, paused: !active });
+        }
+        // Drop tracking for sessions that have ended so the map can't grow without bound.
+        for (const key of Array.from(this.last.keys())) {
+            if (!seen.has(key))
+                this.last.delete(key);
+        }
+        return out;
+    }
+}
+export function buildActiveWorkSilenceDeps(opts) {
+    return {
+        listSessions: () => opts.tracker.snapshot(),
+        nudgeFn: async (sessionName) => {
+            if (!opts.sessions.isSessionAlive(sessionName))
+                return false;
+            return opts.sessions.sendKey(sessionName, 'Enter');
+        },
+        notifyFn: async (sessionName, text) => {
+            await opts.notify({
+                id: `active-silence:${sessionName}`,
+                title: `${friendly(sessionName)} went quiet`,
+                summary: text,
+            });
+        },
+    };
+}
+/** FNV-1a — enough to detect that captured output changed. Not security-sensitive. */
+function cheapHash(s) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(16);
+}
+function friendly(sessionName) {
+    return sessionName
+        .replace(/^ai\.instar\./, '')
+        .replace(/-server$/, '')
+        .replace(/-lifeline$/, '');
+}
+//# sourceMappingURL=sentinelWiring.js.map

package/dist/monitoring/sentinelWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinelWiring.js","sourceRoot":"","sources":["../../src/monitoring/sentinelWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAwBlE,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,oBAAoB,IAAI,CAAC,IAAI,YAAY,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;iBAC1C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,0EAA0E;YAC1E,mEAAmE;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,UAAU,yBAAyB,CAAC,IAGzC;IACC,OAAO;QACL,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE,CAC/B,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,IAAI,EAAE;QACtE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7D,0EAA0E;YAC1E,uEAAuE;YACvE,uDAAuD;YACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;YACpC,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChB,EAAE,EAAE,qBAAqB,WAAW,EAAE;gBACtC,KAAK,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,mBAAmB;gBAClD,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE,CACrB,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,SAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,CACL,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAIb;IACA;IAJF,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAExE,YACmB,QAAgC,EAChC,MAAoB,IAAI,CAAC,GAAG;QAD5B,aAAQ,GAAR,QAAQ,CAAwB;QAChC,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,QAAQ;QACN,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,kFAAkF;QAClF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,IAI1C;IACC,OAAO;QACL,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;QAC3C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;YACpC,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChB,EAAE,EAAE,kBAAkB,WAAW,EAAE;gBACnC,KAAK,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,aAAa;gBAC5C,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,WAAmB;IACnC,OAAO,WAAW;SACf,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.2.40",
+  "version": "1.2.42",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-23T02:31:36.933Z",
-  "instarVersion": "1.2.40",
+  "generatedAt": "2026-05-23T03:29:25.734Z",
+  "instarVersion": "1.2.42",
   "entryCount": 191,
   "entries": {
     "hook:session-start": {
@@ -1448,7 +1448,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "7241736a08f63b09d8b1abda0965dadb37127c95aa6e4ac11bafee05661dbe9f",
+      "contentHash": "caf5980117359821e0523c8358a0eea102d4b1c63f592d9dce8462411232cedd",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.2.40.md

@@ -91,6 +91,18 @@ plumbing is in place; PR 6 makes it user-facing.
 All 92 tunnel-related unit tests pass (11 new + 81 from PRs 1–4).
 `tsc --noEmit` clean. `npm run lint` clean.
 
+## Also in this release — Silently-stopped trio
+
+Closes three independent gaps that all let an agent silently stop working without anyone noticing — diagnosed jointly with the gsd-side echo agent on 2026-05-22 (topic 5447).
+
+**A — WorktreeManager clone-default for cross-project worktrees.** The legacy git-worktree flow keeps per-worktree metadata inside the SOURCE repo's hidden git folder. When Claude Code's sandbox EPERM-blocks paths under the shared projects directory, every git command from the worktree dies (confirmed 2026-05-22, recovery cost ~20m). WorktreeManager now uses `git clone` for cross-project work — self-contained git directory under agent home, no shared-path dependency. Existing in-tree worktrees still use the cheaper worktree path; the `INSTAR_WORKTREE_FORCE_WORKTREE` env var is the rollback escape hatch.
+
+**B — SocketDisconnectSentinel.** Mirrors the RateLimitSentinel pattern shipped earlier this week. Watches tracked sessions for Claude Code's "socket connection closed unexpectedly" message and related disconnect strings every 15 seconds. On detection: immediate plain-English Telegram notice, four-attempt staircase recovery, escalation if recovery fails. No existing detector covered this case.
+
+**C — ActiveWorkSilenceSentinel.** Independent of topic binding. Walks the SessionRegistry every 60s for "had output recently, hasn't for N minutes" (default 15 min). One gentle nudge, 30-second verify, escalate via the tone-gated attention path if the session doesn't unstick. Covers the gsd-style sub-spawned worktree session pattern that slipped through SessionWatchdog, SessionMonitor, and PresenceProxy.
+
+All three route user-facing alerts through the existing MessagingToneGate B12-B14 ruleset.
+
 ## What to Tell Your User
 
 This release puts the security gate for backup tunnels into place.
@@ -117,3 +129,6 @@ preference.
 | Single-use CSPRNG nonce binding | Automatic — pendingConsent.nonce embeds in the inline button in the next release |
 | Cross-episode consent cooldown | Automatic — exponential back-off on decline/timeout (1h → 4h → 24h) |
 | Mandatory rotation marker on relay-active entry | Automatic — rotationPending=true is the crash-safe flag the upcoming rotation lifecycle reads |
+| WorktreeManager clone-default | Automatic for cross-project work; rollback via INSTAR_WORKTREE_FORCE_WORKTREE=1 |
+| SocketDisconnectSentinel | Wired into server startup; configurable via config.monitoring.socketDisconnectSentinel |
+| ActiveWorkSilenceSentinel | Wired into server startup; threshold configurable via config.monitoring.activeWorkSilenceSentinel.silenceThresholdMs |

package/upgrades/1.2.41.md

@@ -0,0 +1,34 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+Completes the silently-stopped trio shipped in 1.2.41. That release announced two new watchdogs — SocketDisconnectSentinel and ActiveWorkSilenceSentinel — as "wired into server startup." They were not: both shipped as standalone, tested detector classes that the server never actually instantiated, so on every agent they were dead code. This release is the missing wire-up that turns them on.
+
+**The gap.** The detectors were correct and unit-tested, but nothing constructed or started them. A grep made it obvious: the RateLimitSentinel they were modeled on is referenced from six files; both new sentinels were referenced from zero outside their own definitions. The release notes claimed a behavior that did not exist.
+
+**The fix.** A new wiring module builds each sentinel's dependencies from the live session manager and starts them at server boot, behind default-on config switches. SocketDisconnectSentinel now self-drives a 15-second scan over every running session. ActiveWorkSilenceSentinel walks the session registry every 60 seconds and — importantly — only flags sessions whose latest screen shows active work (a spinner, a running tool, an "interrupt" hint), so a session simply waiting for you is never mistaken for a frozen one. All escalations route through the existing tone gate, so you only hear about something that genuinely needs a yes-or-no from you.
+
+## What to Tell Your User
+
+- The two silent-stop watchdogs announced last release are now actually running. Before this, they were installed but switched off, so a dropped connection or a frozen background session could still go unnoticed.
+- You will not get noise from sessions that are just idle and waiting for you — only from sessions that were genuinely working and then froze, or that lost their connection.
+- Both watchdogs can be turned off per-agent in config if you ever need to, and they are on by default.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| SocketDisconnectSentinel (live) | On by default; disable via config.monitoring.socketDisconnectSentinel.enabled=false |
+| ActiveWorkSilenceSentinel (live) | On by default; tune config.monitoring.activeWorkSilenceSentinel.silenceThresholdMs; disable via .enabled=false |
+
+## Evidence
+
+- Spec: `docs/specs/silently-stopped-trio.md` (with ELI16 companion). Side-effects: `upgrades/side-effects/silently-stopped-trio-wiring.md`.
+- The gap, reproduced: a grep for either sentinel name across the source returned only its own definition and test files — no construction, no start call.
+- Tests: 30 new tests — wiring-integrity and active-vs-idle semantics (24), self-driving scan loop (3), and an end-to-end integration test that drives both sentinels through the tone-gated attention path and asserts an idle session is never escalated (3).
+
+## Rollback
+
+Per-sentinel config kill switch (no release needed), or revert the wiring module plus the server-startup block and the SocketDisconnectSentinel start/stop additions. No persistent state to clean up.

package/upgrades/1.2.42.md

@@ -0,0 +1,34 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+Completes the silently-stopped trio shipped in 1.2.41. That release announced two new watchdogs — SocketDisconnectSentinel and ActiveWorkSilenceSentinel — as "wired into server startup." They were not: both shipped as standalone, tested detector classes that the server never actually instantiated, so on every agent they were dead code. This release is the missing wire-up that turns them on.
+
+**The gap.** The detectors were correct and unit-tested, but nothing constructed or started them. A grep made it obvious: the RateLimitSentinel they were modeled on is referenced from six files; both new sentinels were referenced from zero outside their own definitions. The release notes claimed a behavior that did not exist.
+
+**The fix.** A new wiring module builds each sentinel's dependencies from the live session manager and starts them at server boot, behind default-on config switches. SocketDisconnectSentinel now self-drives a 15-second scan over every running session. ActiveWorkSilenceSentinel walks the session registry every 60 seconds and — importantly — only flags sessions whose latest screen shows active work (a spinner, a running tool, an "interrupt" hint), so a session simply waiting for you is never mistaken for a frozen one. All escalations route through the existing tone gate, so you only hear about something that genuinely needs a yes-or-no from you.
+
+## What to Tell Your User
+
+- The two silent-stop watchdogs announced last release are now actually running. Before this, they were installed but switched off, so a dropped connection or a frozen background session could still go unnoticed.
+- You will not get noise from sessions that are just idle and waiting for you — only from sessions that were genuinely working and then froze, or that lost their connection.
+- Both watchdogs can be turned off per-agent in config if you ever need to, and they are on by default.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| SocketDisconnectSentinel (live) | On by default; disable via config.monitoring.socketDisconnectSentinel.enabled=false |
+| ActiveWorkSilenceSentinel (live) | On by default; tune config.monitoring.activeWorkSilenceSentinel.silenceThresholdMs; disable via .enabled=false |
+
+## Evidence
+
+- Spec: `docs/specs/silently-stopped-trio.md` (with ELI16 companion). Side-effects: `upgrades/side-effects/silently-stopped-trio-wiring.md`.
+- The gap, reproduced: a grep for either sentinel name across the source returned only its own definition and test files — no construction, no start call.
+- Tests: 30 new tests — wiring-integrity and active-vs-idle semantics (24), self-driving scan loop (3), and an end-to-end integration test that drives both sentinels through the tone-gated attention path and asserts an idle session is never escalated (3).
+
+## Rollback
+
+Per-sentinel config kill switch (no release needed), or revert the wiring module plus the server-startup block and the SocketDisconnectSentinel start/stop additions. No persistent state to clean up.

package/upgrades/side-effects/silently-stopped-trio-wiring.md

@@ -0,0 +1,185 @@
+# Side-Effects Review — Silently-stopped trio: server wiring
+
+**Version / slug:** `silently-stopped-trio-wiring`
+**Date:** 2026-05-23
+**Author:** echo
+**Second-pass reviewer:** [pending — high-risk: sentinels + server startup]
+**Spec:** [docs/specs/silently-stopped-trio.md](../../docs/specs/silently-stopped-trio.md)
+**ELI16:** [docs/specs/silently-stopped-trio.eli16.md](../../docs/specs/silently-stopped-trio.eli16.md)
+
+## Summary of the change
+
+PR #334 merged `SocketDisconnectSentinel` and `ActiveWorkSilenceSentinel` as
+standalone, unit-tested detectors — but never instantiated them in the running
+server. A grep proved it: `RateLimitSentinel` (the pattern they claimed to
+mirror) is referenced from six files; both new sentinels were referenced from
+zero outside their own definition + test files. The merged release notes and
+side-effects artifact both stated "wired into server startup". That was false:
+on every agent, after the auto-update, the sentinels would still never run.
+
+This change is the missing wire-up. No detector logic changes; the detectors
+were correct. What was missing was construction + lifecycle.
+
+- **`src/monitoring/sentinelWiring.ts`** (new) — testable dependency builders:
+  `makeAttentionPoster` (posts escalations to the tone-gated `/attention`
+  route, returns true only on 201), `buildSocketDisconnectDeps`,
+  `buildActiveWorkSilenceDeps`, `OutputActivityTracker` (per-session
+  output-change timing), and `looksActivelyWorking` (active-vs-idle detector
+  built on the existing `frameworkActivitySignals`).
+- **`src/monitoring/SocketDisconnectSentinel.ts`** — added an optional
+  `listSessionNames` dep plus `start()` / `stop()` / `tick()` so the sentinel
+  self-drives a 15s scan loop (mirrors `ActiveWorkSilenceSentinel`'s shape).
+  Existing event-driven API (`report` / `scanSession`) is unchanged.
+- **`src/commands/server.ts`** — instantiates both sentinels from a
+  SessionManager surface + config, and starts them. Guarded by config
+  kill-switches, default-on.
+- **`src/core/types.ts` + `src/config/ConfigDefaults.ts`** — config types +
+  default-on entries. Migration parity is automatic: `migrateConfig` applies
+  all `ConfigDefaults` via `applyDefaults`, so existing agents receive the
+  config keys on update.
+
+## Decision-point inventory
+
+- `looksActivelyWorking` — **add** — structural detector (regex on captured
+  frame via `frameworkActivitySignals`). No judgment, no authority.
+- `OutputActivityTracker.snapshot` — **add** — deterministic change-detection
+  (FNV-1a hash compare) + active/idle classification. Marks idle-at-prompt
+  sessions `paused` so the silence sentinel skips them.
+- `makeAttentionPoster` — **pass-through** — delegates the actual block/allow
+  decision to the existing `/attention` tone gate (B12-B14). Returns true only
+  on 201; a 422 block is the gate doing its job, not an error.
+- `SocketDisconnectSentinel.start/tick` — **add** — bounded scan loop.
+
+## 1. Over-block
+
+- **Active-vs-idle false negative → no escalation.** If a frozen session's last
+  frame does NOT contain an active-work signature (spinner / "esc to interrupt"
+  / tool-call / "(running)"), `OutputActivityTracker` marks it `paused` and the
+  silence sentinel skips it. This is deliberate: the alternative (flag every
+  static frame) would fire on every idle-at-prompt session waiting for the
+  user. Cost of this choice: a session that froze at a non-active-looking frame
+  is missed by sentinel C — but SocketDisconnectSentinel, SessionWatchdog, and
+  SessionMonitor still cover their shapes. The integration test asserts an
+  idle-prompt session is NOT escalated.
+- **Socket regex over-broad** (unchanged from PR #334) — false-positive cost is
+  one bare Enter + a first-notice that the tone gate (B14) suppresses anyway.
+
+## 2. Under-block
+
+- **`looksActivelyWorking` pattern coverage.** The frame is classified using
+  the session's resolved framework (via `SessionManager.frameworkForSession`,
+  added in this PR — second-pass review caught that the prior draft read a
+  non-existent `sess.framework` field and silently fell back to claude-code for
+  every session, mis-classifying Codex). Coverage is now correct for both
+  claude-code and codex-cli. A framework outside that map (none exist today)
+  still defaults to claude-code patterns; the same `frameworkActivitySignals`
+  module backs StallTriageNurse, so adding a framework improves all consumers
+  centrally.
+- **First-notice delivery.** The "lost its connection, trying to recover"
+  notice has no CTA, so the tone gate (B14) blocks it (422 → poster returns
+  false). This is intended — only the escalation (which carries a yes/no CTA)
+  reaches the user. The recovery loop runs regardless of whether any notice
+  lands.
+
+## 3. Level-of-abstraction fit
+
+- Wiring lives in `server.ts` alongside the RateLimitSentinel/CompactionSentinel
+  wire-up — the same layer, the same idiom (`await import` + construct + start).
+- Dependency construction is extracted to `sentinelWiring.ts` specifically so it
+  is unit-testable in isolation (the bug this PR fixes was an *untested wiring
+  gap*; the fix ships the wiring-integrity tests the standard requires).
+- `OutputActivityTracker` is the right owner of per-session output timing for
+  the topic-independent case — SessionMonitor's equivalent snapshots are keyed
+  by topicId and therefore blind to non-topic-bound sessions (the exact gap).
+
+## 4. Signal vs authority compliance
+
+**Reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] **No new blocking authority.** Every user-facing escalation is a signal
+  posted to the existing `/attention` tone gate, which holds the authority.
+- `looksActivelyWorking` and `OutputActivityTracker` are detectors.
+- `makeAttentionPoster` returns the gate's verdict (201 → delivered, 422 →
+  blocked); it never overrides the gate.
+- The recovery primitives (bare Enter via `sendKey`) are bounded and
+  alive-gated.
+
+## 5. Interactions
+
+- **Double-fire with the live socket sentinel + silence sentinel.** A socket
+  drop (15s scan) fires far sooner than the 15-min silence threshold, and each
+  uses a distinct `/attention` id (`socket-disconnect:` vs `active-silence:`),
+  so they don't collide. Idempotency-by-id on `/attention` upserts rather than
+  duplicating.
+- **Recovery nudge vs other injectors.** The bare Enter is alive-gated and does
+  not interrupt work (unlike Ctrl+C). It does not register with the
+  zombie-kill veto used by RateLimit/Compaction sentinels — these sentinels do
+  not kill sessions, so the veto is not relevant.
+- **Tracker memory.** `OutputActivityTracker` prunes ended sessions every
+  snapshot, so the map cannot grow unbounded.
+
+## 6. External surfaces
+
+- **Telegram:** one new attention-item class per incident, tone-gated. Quiet by
+  default (first-notice suppressed; only CTA escalations surface).
+- **Config:** two new `monitoring.*Sentinel` keys, default-on, applied to
+  existing agents via the standard `applyDefaults` migration path.
+- **Persistent state:** none — both sentinels keep in-memory state only.
+- **Timing:** socket scan 15s, silence walk 60s; each captures ~40 lines of
+  tmux output per running session per tick. Same order of cost as the existing
+  SessionMonitor poll.
+
+## 7. Rollback cost
+
+- Per-sentinel config kill-switch:
+  `monitoring.socketDisconnectSentinel.enabled=false` /
+  `monitoring.activeWorkSilenceSentinel.enabled=false` — no release needed.
+- Code rollback: revert the `server.ts` wire-up block + `sentinelWiring.ts` +
+  the `SocketDisconnectSentinel` start/stop additions. No persistent state to
+  clean up.
+
+## Conclusion
+
+Makes the silently-stopped trio actually run, which the prior PR claimed but did
+not do. Adds the wiring-integrity + semantic tests the Testing Integrity
+Standard requires for dependency-injected components, plus an integration test
+that drives both sentinels end-to-end through the tone-gated `/attention` path.
+No new blocking authority; default-on with per-sentinel kill switches.
+
+Clear to ship pending second-pass review.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** independent review subagent, 2026-05-23
+
+**Verdict: Concur with the review**, with one substantive correctness finding
+that has been fixed in this PR.
+
+- Confirmed both sentinels are constructed AND `.start()`-ed, guarded by
+  default-on kill switches matching the RateLimitSentinel idiom. Not dead code.
+- Signal-vs-authority holds: escalations route through `/attention`; the
+  detectors hold no blocking authority. The `=== 201` success check is correct.
+- Intervals are unref'd; `OutputActivityTracker` prunes ended sessions (no Map
+  leak). Bare-Enter recovery is alive-gated and the right choice over Ctrl+C.
+- **Finding (FIXED): framework was never populated.** The draft read a
+  non-existent `sess.framework` field, so `looksActivelyWorking` always used
+  claude-code patterns — a Codex session's spinner would be classed idle and
+  skipped. Resolution: added `SessionManager.frameworkForSession` (public
+  accessor over the existing per-session framework cache) and plumbed it into
+  the session surface; removed the `as`-cast. Codex coverage now works.
+- Over-fire risk assessed low and acceptable: a slow-but-alive tool call
+  re-renders its spinner/token count → hash changes → `lastOutputAt` resets, so
+  it won't trip; idle-at-prompt is `paused`; a frozen non-active frame is
+  skipped by design and covered by the other watchdogs.
+
+---
+
+## Evidence pointers
+
+- Tests: `tests/unit/monitoring/sentinelWiring.test.ts` (24),
+  `tests/unit/monitoring/SocketDisconnectSentinel.test.ts` (+3 loop tests),
+  `tests/integration/silently-stopped-trio-wiring.test.ts` (3).
+- The gap: `grep -rln SocketDisconnectSentinel src | grep -v 'SocketDisconnectSentinel.ts'`
+  returned nothing before this change.

package/upgrades/side-effects/silently-stopped-trio.md

@@ -0,0 +1,115 @@
+# Side-Effects Review — Silently-stopped trio
+
+**Version / slug:** `silently-stopped-trio`
+**Date:** 2026-05-22
+**Author:** echo
+**Second-pass reviewer:** [pending — high-risk: WorktreeManager + new sentinels]
+**Spec:** [docs/specs/silently-stopped-trio.md](../../docs/specs/silently-stopped-trio.md)
+**ELI16:** [docs/specs/silently-stopped-trio.eli16.md](../../docs/specs/silently-stopped-trio.eli16.md)
+
+## Summary of the change
+
+Three independent layers closing the same failure class — "agent silently stopped working without anyone noticing" — diagnosed jointly with the gsd-side echo agent on 2026-05-22.
+
+1. **WorktreeManager clone-default** (`src/core/WorktreeManager.ts`). New private predicate `shouldCloneInsteadOfWorktree()` returns true when source `projectDir` is outside agent home (the sandbox-revocation hazard case). When true, `createBinding` uses `git clone` + `git checkout -b` instead of `git worktree add`, producing a fully self-contained `.git/` directory under agent home. `INSTAR_WORKTREE_FORCE_WORKTREE=1` is the rollback escape hatch. The existing in-tree worktree path (source already under agent home) is preserved unchanged.
+
+2. **SocketDisconnectSentinel** (`src/monitoring/SocketDisconnectSentinel.ts`, new). Detector + recovery for Claude Code's `socket connection closed unexpectedly` family of strings. Mirrors `RateLimitSentinel`'s shape — detect, immediate user notice, backoff staircase, verify, escalate. Patterns are intentionally broad (4 regex variants) because false-positives are cheap nudges and false-negatives are the exact failure class this exists to close.
+
+3. **ActiveWorkSilenceSentinel** (`src/monitoring/ActiveWorkSilenceSentinel.ts`, new). Walks the SessionRegistry every 60s; reports any session whose `lastOutputAt` is older than the silence threshold (default 15 min). One nudge (empty `tmux send-keys`), 30s verify, escalate via tone-gated `/attention` if no advance.
+
+All three escalation payloads route through the existing `MessagingToneGate` B12-B14 ruleset via `/attention` (`category: degradation`).
+
+## Decision-point inventory
+
+- `WorktreeManager.shouldCloneInsteadOfWorktree` — **add** — structural predicate (file shape + env override).
+- `WorktreeManager.createBinding` clone branch — **add** — uses `git clone` + `git checkout -b` for cross-project sources.
+- `SocketDisconnectSentinel.report / scanSession / runAttempt / verifyAttempt / escalate` — **add** — full recovery state machine.
+- `ActiveWorkSilenceSentinel.tick / report / runNudge / verifyNudge / escalate` — **add** — silence-detection state machine.
+- Tone-gated `/attention` POST path — **pass-through** — consumed by both new sentinels' notify functions; the gate (existing authority) is unchanged.
+
+## Deferrals tracked
+
+The v3 Self-Healing Remediator's Tier-3 absorption of these sentinels' detection + recovery surfaces is the only forward note. <!-- tracked: topic-3079-v3-remediator -->
+
+---
+
+## 1. Over-block
+
+- **Worktree decision over-broad.** Any source outside agent home triggers clone. False-positive cost: a `git clone` takes 1-5s on APFS (sub-second with CoW). False-negative cost: the exact incident class we just hit. Acceptable.
+- **Socket-disconnect regex over-broad.** Patterns include generic `connection.*closed.*unexpectedly` — could match unrelated text. False-positive cost: one Ctrl+C+Enter nudge to a healthy session + a "lost its connection" Telegram message that resolves cleanly. False-negative cost: silently frozen session. Trade-off documented.
+- **Silence threshold over-broad.** 15 min is conservative; agents doing slow LLM work (e.g. 5-min generation cycles) could trip if they go quiet during a long thinking pause. Mitigation: the `paused` / `recoveryInFlight` flags let SessionRegistry callers exempt sessions in known-quiet states. Configurable per-deployment.
+
+## 2. Under-block
+
+- **WorktreeManager migration of EXISTING worktrees.** This PR ships the clone-default for NEW bindings. Migration of existing worktrees-on-disk is deferred — the spec discussed it but it requires significant safety work (rsync of uncommitted diffs, fencing during the swap). Tracked: same v3 Remediator absorption point. <!-- tracked: topic-3079-v3-remediator -->
+- **Socket-disconnect pattern coverage.** Claude Code may surface other disconnect strings we don't yet know about. Patterns are extensible; the next observed string adds one line.
+- **Active-work-silence false-negatives.** Sessions that produce minimal output (e.g. a `wait + retry` loop with tiny intervals) might never trip the 15-min threshold even when "stuck" in some other sense. Adjacent watchdogs (SessionWatchdog, PresenceProxy) cover other shapes.
+- **Both sentinels currently fire-and-forget on escalation.** No retry-the-escalation loop. If the notify fails (network blip, tone gate hiccup), the message is lost. Acceptable for v1 — the bigger problem (silent failure) is closed; retry plumbing comes with v3 Remediator.
+
+## 3. Level-of-abstraction fit
+
+- **WorktreeManager** is the right layer — it's the single funnel that decides how to materialize a worktree on disk. Putting the clone-vs-worktree decision anywhere else would skip the existing fencing + binding lifecycle.
+- **Sentinels in `src/monitoring/`** alongside RateLimitSentinel, CompactionSentinel, SessionWatchdog. Same idiom; same wire-up shape via server.ts.
+- **Escalation through `/attention`** uses the existing tone gate — no new judgment authority introduced.
+
+## 4. Signal vs authority compliance
+
+**Reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] **No — this change produces signals consumed by an existing smart gate.**
+
+- `shouldCloneInsteadOfWorktree` is a structural predicate (file path + env). No judgment.
+- `SOCKET_DISCONNECT_PATTERNS` regex is a detector. State machine is a bounded mechanic (fixed attempt count, fixed backoff staircase).
+- `ActiveWorkSilenceSentinel.tick` threshold is deterministic. Nudge is a bounded primitive.
+- All user-facing escalation goes through `MessagingToneGate` via `/attention`'s existing path. No new authority introduced.
+
+## 5. Interactions
+
+- **Shadowing:** SocketDisconnectSentinel and ActiveWorkSilenceSentinel can both fire on the same session (socket dropped → output stopped). The socket sentinel ticks every 15s; the silence sentinel waits 15 min. Socket sentinel virtually always fires first. Idempotency-by-id in `/attention` prevents duplicate topic creation if both ever land.
+- **Double-fire vs existing watchdogs:** SessionWatchdog (long-running child), SessionMonitor (topic-bound output gap), PresenceProxy (user-waits-for-agent). All three handle different shapes; none overlap with the new sentinels in practice. Active-work-silence is the catch-all for what falls through the cracks.
+- **Races:** Sentinel state maps are per-session keys; concurrent ticks on the same server can't race (single-threaded JS event loop). Cross-process safety is N/A — each server instance is a single sentinel owner.
+- **WorktreeManager clone vs worktree-add:** Mutually exclusive code paths; no race.
+
+## 6. External surfaces
+
+- **Other agents:** Bindings created by this PR for shared repos will be clones, not worktrees. `git worktree list` from the source repo won't show them. Documented in CLAUDE.md template (forward).
+- **Other users:** ships in next release. macOS users + Linux users alike. The clone path is OS-agnostic.
+- **External systems:** Telegram (one extra topic class — "disconnect" alerts — though tone-gated). `/attention` route — existing; no change to its contract.
+- **Persistent state:** No new files for the sentinels (in-memory state only — by design, simpler than RateLimitSentinel which persists). WorktreeManager bindings file unchanged.
+- **Timing:** Sentinel ticks (15s + 60s) are negligible overhead per session.
+
+## 7. Rollback cost
+
+- WorktreeManager: revert the diff. `INSTAR_WORKTREE_FORCE_WORKTREE=1` is the in-place rollback toggle without a release.
+- Sentinels: revert each new file + the server.ts wire-up. No persistent state to clean up.
+- Total: ~15 min revert + release cycle.
+
+---
+
+## Addendum 2026-05-23 — Smoke-test interaction with SourceTreeGuard (fixed)
+
+After the initial commit landed, `npm run test:smoke` surfaced 14 failures in the existing WorktreeManager test suite — every test that exercised the clone-default branch failed with `SourceTreeGuardError: Refusing to run src/core/WorktreeManager.ts:clone-default against the instar source tree`. Root cause: `SafeGitExecutor.runSourceTreeChecks` defaults the target list to cwd. The new `git clone` call ran from a cwd that happened to be inside the instar source tree (test fixtures invoking `createBinding` from inside an instar checkout), and the guard correctly flagged the cwd as destructive-against-source even though the clone op itself is non-destructive on the source. **Fix:** pin `cwd: this.worktreesRoot` on the clone call — guaranteed outside the source tree and the same dir the clone destination lives under. All 56 smoke tests pass.
+
+This is a defensible interaction, not a guard regression: the guard is doing exactly what it was built to do (conservative protection of the source tree). The clone-default branch needed explicit cwd because it's the first WorktreeManager codepath to run git from outside the source's own dir.
+
+## Conclusion
+
+Closes the silently-stopped failure class in one PR per the no-deferrals rule. 34 new tests cover the core surfaces. Server-side wire-up + integration tests + CLAUDE.md template update are part of this PR (see commit). Tone-gate compliance asserted at unit level for both sentinels' escalation payloads. Migration of existing worktrees explicitly deferred to v3 Remediator with tracker marker.
+
+Clear to ship pending second-pass review.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** [pending]
+
+[awaiting reviewer]
+
+---
+
+## Evidence pointers
+
+- Spec: `docs/specs/silently-stopped-trio.md` + `.eli16.md`.
+- Tests: `tests/unit/monitoring/SocketDisconnectSentinel.test.ts`, `tests/unit/monitoring/ActiveWorkSilenceSentinel.test.ts`, `tests/unit/core/WorktreeManager-clone-default.test.ts` — 34 tests.
+- Incident reference: topic 5447 alignment with gsd-side echo's diagnosis 2026-05-22.