instar 1.3.327 → 1.3.329

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T02:41:41.619Z",
-  "instarVersion": "1.3.327",
+  "generatedAt": "2026-06-06T03:08:49.643Z",
+  "instarVersion": "1.3.329",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -778,7 +778,7 @@
       "type": "cli-command",
       "domain": "setup",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:setup": {
@@ -786,7 +786,7 @@
       "type": "cli-command",
       "domain": "setup",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:add": {
@@ -794,7 +794,7 @@
       "type": "cli-command",
       "domain": "setup",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:backup": {
@@ -802,7 +802,7 @@
       "type": "cli-command",
       "domain": "operations",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:git": {
@@ -810,7 +810,7 @@
       "type": "cli-command",
       "domain": "coordination",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:memory": {
@@ -818,7 +818,7 @@
       "type": "cli-command",
       "domain": "memory",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:knowledge": {
@@ -826,7 +826,7 @@
       "type": "cli-command",
       "domain": "memory",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:semantic": {
@@ -834,7 +834,7 @@
       "type": "cli-command",
       "domain": "memory",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:intent": {
@@ -842,7 +842,7 @@
       "type": "cli-command",
       "domain": "intent",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:feedback": {
@@ -850,7 +850,7 @@
       "type": "cli-command",
       "domain": "feedback",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:server": {
@@ -858,7 +858,7 @@
       "type": "cli-command",
       "domain": "server",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:status": {
@@ -866,7 +866,7 @@
       "type": "cli-command",
       "domain": "monitoring",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:user": {
@@ -874,7 +874,7 @@
       "type": "cli-command",
       "domain": "users",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:relationship": {
@@ -882,7 +882,7 @@
       "type": "cli-command",
       "domain": "relationships",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:job": {
@@ -890,7 +890,7 @@
       "type": "cli-command",
       "domain": "scheduling",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:lifeline": {
@@ -898,7 +898,7 @@
       "type": "cli-command",
       "domain": "communication",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:list": {
@@ -906,7 +906,7 @@
       "type": "cli-command",
       "domain": "monitoring",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:autostart": {
@@ -914,7 +914,7 @@
       "type": "cli-command",
       "domain": "operations",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:migrate": {
@@ -922,7 +922,7 @@
       "type": "cli-command",
       "domain": "updates",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:machines": {
@@ -930,7 +930,7 @@
       "type": "cli-command",
       "domain": "coordination",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:whoami": {
@@ -938,7 +938,7 @@
       "type": "cli-command",
       "domain": "identity",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:pair": {
@@ -946,7 +946,7 @@
       "type": "cli-command",
       "domain": "coordination",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:join": {
@@ -954,7 +954,7 @@
       "type": "cli-command",
       "domain": "coordination",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:wakeup": {
@@ -962,7 +962,7 @@
       "type": "cli-command",
       "domain": "coordination",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:leave": {
@@ -970,7 +970,7 @@
       "type": "cli-command",
       "domain": "coordination",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:doctor": {
@@ -978,7 +978,7 @@
       "type": "cli-command",
       "domain": "monitoring",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:review": {
@@ -986,7 +986,7 @@
       "type": "cli-command",
       "domain": "monitoring",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:nuke": {
@@ -994,7 +994,7 @@
       "type": "cli-command",
       "domain": "operations",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:playbook": {
@@ -1002,7 +1002,7 @@
       "type": "cli-command",
       "domain": "context",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:dev-preflight": {
@@ -1010,7 +1010,7 @@
       "type": "cli-command",
       "domain": "development",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:dev-ci-failures": {
@@ -1018,7 +1018,7 @@
       "type": "cli-command",
       "domain": "development",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "cli:dev-profile-node": {
@@ -1026,7 +1026,7 @@
       "type": "cli-command",
       "domain": "development",
       "sourcePath": "src/cli.ts",
-      "contentHash": "e513a3a7f1cae3970a8a34bf51ae622ba47fa8026f85e6d2f3fed4581e9ec8e7",
+      "contentHash": "bfa434d670d4a07e78522422cffe333026479f9c3c4a8afea35d1a1203e4fe29",
       "since": "2025-01-01"
     },
     "template:build-stop-hook.sh": {
@@ -1570,7 +1570,7 @@
       "type": "subsystem",
       "domain": "communication",
       "sourcePath": "src/lifeline/TelegramLifeline.ts",
-      "contentHash": "3446974605736d653bf08f9c315c95b5cc42c0998867e4e1b60cb86144a3b975",
+      "contentHash": "524266bb64da7168ab8577b173a0126bf018bc5ffc8b7923dd2ea6b0f5df6b3e",
       "since": "2025-01-01"
     },
     "subsystem:orphan-process-reaper": {

package/upgrades/1.3.329.md

@@ -0,0 +1,58 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The Instar CLI now rejects unknown top-level commands before the bare setup flow can run. A typo such as `instar dev:claim-checkk` prints a clear unknown-command error and exits with status 1 instead of falling into the interactive setup wizard.
+
+Bare `instar` remains unchanged: it still opens the setup flow for new or interrupted setup sessions. `instar help` now prints CLI help instead of entering setup.
+
+The ServerSupervisor's slow-retry mode (respawn a dead server every 2h, forever)
+is a sanctioned Eternal Sentinel under the new "No Unbounded Loops" standard —
+but it violated condition 4: it never told anyone. A multi-day crash-revive loop
+was indistinguishable from silence. Now a pure one-shot latch
+(`SlowRetrySentinelEscalation`, the AgeKillBackoff suppressor shape) fires
+exactly once per outage episode after a sustained-failure threshold (default
+12h ≈ 6 failed cycles): the supervisor emits `sentinelStalled` and the lifeline
+sends ONE operator message with the two useful levers (`/lifeline doctor`,
+`/lifeline reset`), then the sentinel keeps quietly retrying. The message goes
+directly to the Telegram Bot API from the lifeline process — no dependency on
+the (down) agent server. Recovery re-arms the latch via the single
+`resetCircuitBreaker()` funnel; retry/kill/spawn decisions are unchanged.
+
+## What to Tell Your User
+
+- **Clearer command typos**: "When I mistype an Instar command, I now fail fast with a clear message instead of opening setup and looking stuck."
+
+If your agent's server ever gets stuck in a crash loop, you'll now get one
+clear heads-up after ~12 hours — "still down, here's how to diagnose or force a
+retry, I'll keep trying" — instead of discovering the outage by noticing your
+agent went quiet for days. One message per outage, never a stream.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Unknown command rejection | Automatic for mistyped top-level Instar commands |
+| Bare setup preservation | Automatic when running Instar without a command |
+| Help command preservation | Automatic when asking Instar for help |
+
+- Slow-retry escalation: a sustained server outage (default 12h in slow-retry)
+  produces exactly one operator notification per episode; the never-give-up
+  revival behavior is unchanged. In-code default; no config required.
+
+## Evidence
+
+Reproduced the typo path locally with the built CLI. Before this change, a typoed command could enter the interactive setup path and hang an agent shell. After the change, `node dist/cli.js dev:claim-checkk` exits 1 with `error: unknown command 'dev:claim-checkk'` and the help hint. A separate `node dist/cli.js help` probe exits 0 and prints CLI help. A separate bare invocation probe, `timeout 3 node dist/cli.js`, still enters setup and times out at status 124, confirming the default setup behavior remains intact.
+
+Loop-safety audit finding (CMT-1109), verified at source: the slow-retry block
+in `src/lifeline/ServerSupervisor.ts` was annotated "never truly give up" with
+no operator signal. Fix is the first PR under constitution P19 ("No Unbounded
+Loops", incl. Justin's Eternal Sentinel caveat — this loop is its namesake
+case). Tests: 10 green in `tests/unit/SlowRetrySentinelEscalation.test.ts`
+including the P19 sustained-failure bound (week-long never-recovering episode →
+exactly 1 escalation) and source-shape wiring pins. Independent adversarial
+second-pass: CONCUR (all probes safe — per-tick reachability, no double-fire,
+server-independent delivery, emit-before-spawn ordering). tsc clean.

package/upgrades/side-effects/cli-unknown-command-trap.md

@@ -0,0 +1,31 @@
+# Side-Effects Review - CLI unknown-command trap
+
+**Version / slug:** `cli-unknown-command-trap`
+**Date:** `2026-06-06`
+**Author:** `instar-codey`
+
+## Summary
+
+This change adds a top-level command guard before Commander parses the CLI. Unknown first-position command tokens now print a clear error and exit 1. The existing no-argument setup path is preserved, and Commander’s implicit `help` command remains allowed.
+
+## Decision Points
+
+- Add `rejectUnknownTopLevelCommand` in `src/cli.ts`.
+- Call it after all commands are registered and before `program.parse()`.
+- Add e2e regression tests for `dist/cli.js dev:claim-checkk` and `dist/cli.js help`.
+
+## Over-Block
+
+Risk: rejecting a legitimate command before Commander sees it. Mitigation: the guard builds its allowlist from `program.commands` and command aliases after registration, and explicitly handles Commander’s implicit `help` command because Commander does not list it in `program.commands` and otherwise sends it into the default setup action. Options and the no-argument path bypass the guard.
+
+## Under-Block
+
+Nested unknown subcommands remain Commander-owned. This fix targets the incident class: unknown top-level command tokens falling into the default setup action.
+
+## Interactions
+
+No server routes, persistent state, messaging, or external APIs change. The behavior changes are limited to process exit behavior for unknown top-level CLI commands and restoring the intended `instar help` help output.
+
+## Rollback
+
+Rollback is a normal revert of the helper, call site, test, and notes. No data migration is involved.

package/upgrades/side-effects/supervisor-sentinel-escalation.md

@@ -0,0 +1,61 @@
+# Side-Effects Review — Slow-Retry Sentinel Escalation
+
+**Version / slug:** `supervisor-sentinel-escalation`
+**Date:** `2026-06-05`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `independent adversarial reviewer subagent — CONCUR (all four probes safe; no blocking defects; non-blocking notes recorded below)`
+
+## Summary of the change
+
+The ServerSupervisor's slow-retry mode (2h respawn cadence, deliberately forever) gains the Eternal Sentinel's condition-4 observability: a pure one-shot latch (`src/lifeline/SlowRetrySentinelEscalation.ts`) fires once per outage episode after `escalateAfterMs` (default 12h), the supervisor emits `'sentinelStalled'`, and `TelegramLifeline.notifySentinelStalled` delivers ONE operator message (doctor/reset levers), after which the sentinel keeps retrying unchanged. `resetCircuitBreaker()` — the single episode-ending funnel — re-arms the latch in lockstep with zeroing `slowRetryStartedAt`. Files: `SlowRetrySentinelEscalation.ts` (new, pure), `ServerSupervisor.ts` (declaration comment + per-tick check + emit + reset hook + one constructor option), `TelegramLifeline.ts` (listener + notify method), one test file.
+
+## Decision-point inventory
+
+- `ServerSupervisor` slow-retry block — **modify (additive)** — gains a read-only latch check + event emit; the retry decision, cadence, kill, and spawn are untouched.
+- `SlowRetrySentinelEscalation` — **add** — a pure signal producer with no authority of any kind.
+- `TelegramLifeline` event wiring — **add** — delivery only; mirrors the existing `circuitBroken` handler shape (fire-and-forget, catch-swallowed).
+
+## 1. Over-block
+
+Nothing is blocked — this change cannot suppress, delay, or alter any retry or recovery action. The only "cost" added is one Telegram message per ≥12h outage episode.
+
+## 2. Under-block
+
+(a) A lifeline PROCESS restart zeroes the in-memory latch with all breaker state; after ~13.5h of freshly rebuilt sustained failure it would notify again. Reviewer-assessed as correct-by-design ("still broken after a bounce" is a legitimate re-notification), and persisting the latch was explicitly rejected — a stale on-disk latch could suppress a legitimate notification, the worse failure. (b) The threshold is time-based, not attempt-based: a machine asleep for 12h would escalate on wake even though few attempts ran — acceptable; the operator-facing claim ("down ~N hours") remains true. (c) Other eternal-sentinel-shaped loops (lease pull) are NOT covered here — next audit PR <!-- tracked: CMT-1109 -->.
+
+## 3. Level-of-abstraction fit
+
+Yes. The latch lives beside the loop it observes (lifeline package), as a pure helper in the established suppressor shape (`AgeKillBackoff`: injectable clock, bounded state, unit-testable). Delivery rides the existing supervisor→lifeline event channel (`circuitBroken` precedent) rather than inventing a new notification path — and deliberately does NOT use the agent server's attention queue, which is definitionally down when this fires.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** `docs/signal-vs-authority.md`
+
+- [x] No — pure signal. The latch can only cause one message; it holds no authority over retries, kills, spawns, or the circuit breaker. The healer's behavior is byte-identical with the latch removed.
+
+## 5. Interactions
+
+- **Double-fire:** impossible within a process — the episode key (`slowRetryStartedAt`) is written only at episode start (when 0) and zeroed only inside `resetCircuitBreaker()`, which re-arms the latch in the same method; key and latch cannot desync (reviewer traced every write).
+- **Starvation:** the slow-retry block runs every 10s health-check tick while broken (the branch returns without resetting `consecutiveFailures`), so the latch check cannot be starved (reviewer traced `evaluateUnhealthyServer` → `handleUnhealthy` reachability).
+- **Ordering:** the emit's listener is fire-and-forget and catch-swallowed; it cannot block or throw into the same tick's kill/spawn (mirrors `circuitBroken`).
+- **Feedback loops:** none — a message cannot change health-check outcomes.
+
+## 6. External surfaces
+
+- **User-visible:** one new Telegram message class, bounded at one per episode (Bounded Notification Surface-compatible: no topic creation — it posts to the existing lifeline topic).
+- **Delivery independence:** `sendToTopic` → Telegram Bot API directly over HTTPS from the lifeline process; zero dependency on the down agent server (reviewer-verified at `apiCall`).
+- **Persistent state / config / schema:** none. In-code default; `slowRetryEscalateAfterMs` is a constructor option for tests only. No migration (Migration Parity: nothing installed changes).
+
+## 7. Rollback cost
+
+Revert the commit. No state to clean, no config to unwind. The only observable regression of rollback is the silence returning.
+
+## Conclusion
+
+Signal-only observability for the constitution's namesake Eternal Sentinel: persistence preserved, silence eliminated, volume bounded at one message per episode and proven by the P19 sustained-failure test (week-long never-recovering episode → exactly 1). Second-pass reviewer CONCUR with zero blocking findings; both non-blocking notes (restart re-fire window, no Tier-2/3 for a route-less signal change) are recorded in §2/§6 with their rationale.
+
+---
+
+## Phase 5 — Second-pass review (server-lifecycle-adjacent → performed)
+
+An independent adversarial reviewer audited the diff and final files at line level against four probes: (1) any >1-fire-per-outage path — traced every `slowRetryStartedAt`/`circuitBroken` write; none desync the episode key from the latch; lifeline-restart re-fire requires ~13.5h of rebuilt failure and is a correct re-notification; (2) any never-fire path — the slow-retry branch is reached every 10s tick while broken (per-tick reachability traced through `evaluateUnhealthyServer`/`handleUnhealthy`); (3) delivery dependence on the down server — none: the lifeline posts straight to the Telegram Bot API; (4) emit-vs-spawn ordering — fire-and-forget listener, cannot block or throw into the spawn. Ran the 10-test suite (green) and `tsc --noEmit` (clean). **Verdict: CONCUR.**