@cohortapp/agent-sdk 2.11.0 → 2.11.1

package/lib/channels/inbox-item.mjs

@@ -182,6 +182,18 @@ export function eventToInboxItem(ev) {
   if (typeof ev.is_private === "boolean") item.is_private = ev.is_private;
   if (typeof ev.is_dm === "boolean") item.is_dm = ev.is_dm;
 
+  // THE CHANNEL KIND (DM / GROUP_DM / PUBLIC / PRIVATE / …). Cohort carries this
+  // on its org event feed (lib/org/messaging.toMessageEvent), and it is the ONLY
+  // reliable is_dm signal for Cohort, whose channel ids are cuids with no
+  // Slack-style "D…"/"dm/" prefix for the daemon's `enrichItem` to key off. The
+  // signal was being DROPPED here (and again by the YAML writer/reader), so a
+  // Cohort 1:1 DM arrived at the election gate looking like an ambient group
+  // message and was suppressed. Serialised only when present, so every non-Cohort
+  // producer keeps a byte-identical inbox item (see the byte-compat fixture).
+  if (typeof ev.channel_kind === "string" && ev.channel_kind) {
+    item.channel_kind = sanitizeYamlField(ev.channel_kind);
+  }
+
   // Only stamp `kind` when it's not the default. Existing message items must
   // remain byte-identical to what the Slack socket-mode writer produced before
   // this seam existed (it never wrote a `kind` field).

package/lib/channels/inbox-item.test.mjs

@@ -59,6 +59,39 @@ test("eventToInboxItem: channel_cc kind is stamped", () => {
   assert.equal(item.kind, "channel_cc");
 });
 
+test("eventToInboxItem: channel_kind is carried through when present, omitted when absent", () => {
+  // Present → serialised (Cohort's only reliable is_dm signal), and the poll-lane
+  // parser reads it back, so enrichItem actually receives it.
+  const withKind = eventToInboxItem({
+    channel: "cohort",
+    message_id: "m1",
+    channel_kind: "DM",
+    from: { id: "human-1", name: "Human" },
+    text: "hi",
+    timestamp: "2026-01-01T00:00:00.000Z",
+  });
+  assert.equal(withKind.channel_kind, "DM");
+
+  // Absent → omitted entirely, so a non-Cohort item stays byte-identical.
+  const withoutKind = eventToInboxItem({
+    channel: "slack",
+    message_id: "m2",
+    from: { id: "U1", name: "casey" },
+    text: "hi",
+    timestamp: "2026-01-01T00:00:00.000Z",
+  });
+  assert.equal("channel_kind" in withoutKind, false);
+});
+
+test("parseInboxItemYaml: channel_kind survives the YAML round-trip (present/absent)", () => {
+  const withKind = parseInboxItemYaml(
+    'id: "m1"\nservice: "cohort"\nchannel_id: "cuid_abc"\nchannel_kind: "GROUP_DM"\ncontent: |\n  hi\n',
+  );
+  assert.equal(withKind.channel_kind, "GROUP_DM");
+  const withoutKind = parseInboxItemYaml('id: "m2"\nservice: "slack"\ncontent: |\n  hi\n');
+  assert.equal("channel_kind" in withoutKind, false, "absent line → no channel_kind key");
+});
+
 // ---------------------------------------------------------------------------
 // round-trip event ↔ item
 // ---------------------------------------------------------------------------

package/lib/execution/disposition.mjs

@@ -392,8 +392,19 @@ export function decide(o = {}) {
   if (o.history && base.actor) {
     const hits = o.history.actorActivity(base.actor);
     if (hits >= floodLimit) {
-      why.push(`${base.actor} has woken me ${hits} time(s) in the flood window (limit ${floodLimit}) → batch the reply`);
-      return finish(base, "schedule", "actor_flood", why, o, { observeOnly, batched: true });
+      // A DIRECTED 1:1 DM is EXEMPT. The flood counter tallies ALL of an actor's
+      // activity in the window — including their own doc/board/decision events,
+      // which fire far more often than they message — so a person's genuine 1:1
+      // message would be downgraded to "batch the reply" merely because their
+      // unrelated document edits tripped the limit. A 1:1 DM is the one surface
+      // where the human is unambiguously talking TO the seat and watching for a
+      // reply, so it stays react-now; every other surface still batches.
+      if (base.surface === "dm") {
+        why.push(`${base.actor} is over the flood limit (${hits}/${floodLimit}), but this is a directed 1:1 DM → not batched`);
+      } else {
+        why.push(`${base.actor} has woken me ${hits} time(s) in the flood window (limit ${floodLimit}) → batch the reply`);
+        return finish(base, "schedule", "actor_flood", why, o, { observeOnly, batched: true });
+      }
     }
   }
 

package/lib/execution/disposition.test.mjs

@@ -256,15 +256,32 @@ test("IGNORE: a malformed event never crashes the ladder", () => {
 // ───────────────────────────────────────────────────────────────────────────
 
 test("DOWNGRADE not silence: a flooding actor gets batched, not muted", () => {
-  const d = run({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT }) });
+  // Assert on a NON-DM surface (an @mention): a directed 1:1 DM is now EXEMPT
+  // from actor-flood (see the next test), so it can no longer stand in for the
+  // general batching behaviour.
+  const floodMention = (over) => run({
+    verdict: yes("mention", "mention"),
+    candidate: { family: "messaging", kind: "send", surfaces: ["mention"] },
+    ...over,
+  });
+  const d = floodMention({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT }) });
   assert.equal(d.disposition, "schedule");
   assert.equal(d.reason, "actor_flood");
   assert.equal(d.batched, true);
   // one under the limit still answers turn-by-turn
-  const under = run({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT - 1 }) });
+  const under = floodMention({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT - 1 }) });
   assert.equal(under.disposition, "react_now");
 });
 
+test("a directed 1:1 DM is EXEMPT from actor-flood batching", () => {
+  // The flood counter tallies ALL of an actor's activity (their doc/board edits
+  // included), so a genuine 1:1 message must not be batched just because the same
+  // person tripped the limit elsewhere. Even far over the limit, a DM reacts now.
+  const d = run({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT * 5 }) });
+  assert.equal(d.disposition, "react_now");
+  assert.equal(d.reason, "directed_now");
+});
+
 test("DOWNGRADE not silence: an exhausted budget queues the reply", () => {
   for (const runtime of [{ dailyCapExhausted: true }, { remainingCents: 0 }]) {
     const d = run({ runtime });

package/lib/execution/pipeline.test.mjs

@@ -157,7 +157,10 @@ test("a burst from one actor is batched rather than answered turn-by-turn", asyn
     const fx = fakeEffects();
     const items = [];
     for (let i = 0; i < 6; i += 1) {
-      items.push(dm({ id: `cohort-msg_${i}`, raw_ref: `cohort:dm:msg_${i}:${100 + i}`, thread_id: `t_${i}`, channel_id: `c_${i}` }));
+      // A burst of @mentions (NOT DMs): a directed 1:1 DM is now exempt from
+      // actor-flood, so flood batching is exercised on a channel surface where
+      // it still applies. `is_dm:false` + mentions_agent → surface "mention".
+      items.push(dm({ id: `cohort-msg_${i}`, raw_ref: `cohort:mention:msg_${i}:${100 + i}`, thread_id: `t_${i}`, channel_id: `c_${i}`, is_dm: false }));
     }
     const { results } = await run(items, { agentRoot: root, effects: fx, actorFloodLimit: 3 });
     const dispositions = results.map((r) => r.decision.disposition);

package/lib/org/messaging.mjs

@@ -859,6 +859,11 @@ export function toMessageEvent(ev, me) {
     kind: isCall ? "call" : "message",
     subject: isCall ? "Cohort call invite" : "Cohort message",
     channel_id: channelId,
+    // The org event feed carries channelKind (DM/GROUP_DM/PUBLIC/…); surface it
+    // so the daemon's is_dm detection works for Cohort (whose channel ids are
+    // cuids, not Slack-style "D…"/"dm/…" prefixes). Without this a Cohort DM was
+    // misread as a group message and wrongly routed through the election gate.
+    channel_kind: String(p.channelKind || p.channel_kind || "").toUpperCase(),
     channel_label: String(p.channelName || channelId || "cohort"),
     sender: String(p.fromName || fromId),
     priority_signals: {

package/lib/org/messaging.test.mjs

@@ -248,6 +248,13 @@ test("toMessageEvent: projects a messaging event onto the MessageEvent contract"
   assert.equal(ev.ingest_source, "cohort");
 });
 
+test("toMessageEvent: projects channelKind so the daemon can tell a DM from a GROUP_DM", () => {
+  const dm = toMessageEvent({ family: "messaging", seq: 8, payload: { id: "m1", channel: "dm-x", channelKind: "DM", from: "human-1", body: "hi" } }, "me");
+  assert.equal(dm.channel_kind, "DM", "a 1:1 DM carries channel_kind DM (→ is_dm true downstream)");
+  const group = toMessageEvent({ family: "messaging", seq: 9, payload: { id: "m2", channel: "gdm-x", channelKind: "group_dm", from: "human-1", body: "hi all" } }, "me");
+  assert.equal(group.channel_kind, "GROUP_DM", "a GROUP_DM is upper-cased and NOT a 1:1 DM downstream");
+});
+
 test("pullInbound: filters to directed events and advances the cursor to max seq", async () => {
   const f = fakeFetch(() => ({
     body: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {

package/scripts/daemon/agent-daemon.mjs

@@ -69,6 +69,7 @@ import {
   sweepObligations,
   openObligations,
   escalate,
+  closeObligation,
 } from "./assurance.mjs";
 import { recordPoll, recordClassification, recordSession, writeHealthDashboard } from "./health.mjs";
 import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
@@ -326,7 +327,29 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
 export function enrichItem(item, service) {
   const channelStr = (item.channel || "").toLowerCase();
   const channelId = item.channel_id || "";
-  const isDm = channelStr.startsWith("dm/") || channelId.startsWith("D");
+  // Cohort carries the channel kind explicitly (DM/GROUP_DM/…); its channel ids
+  // are cuids, so the Slack-style "dm/"/"D…" prefix heuristics never fire. When
+  // the kind is known it is AUTHORITATIVE:
+  //   - DM        → a 1:1 DM: is_dm true, so it skips the group election gate.
+  //   - GROUP_DM  → a multi-participant channel: is_dm FALSE, so an UNDIRECTED
+  //                 message goes through the election exactly like any other
+  //                 channel (only ONE seat should answer an ambient group DM).
+  //   - any other explicit kind (PUBLIC/PRIVATE/…) → not a 1:1 DM.
+  // When the kind is ABSENT we do NOT immediately reach for the prefix
+  // heuristics: the DEFAULT (wide) inbound reader — `lib/org/inbound/project.mjs`
+  // toMessageEvent — projects a Cohort 1:1 DM with `is_dm:true`/`channel_type:'dm'`
+  // but does NOT emit `channel_kind`. That boolean survives the whole
+  // eventToInboxItem → writeInboxItem → parseInboxItemYaml chain, so HONOR it
+  // before falling back. Overwriting it with the cuid-blind prefix heuristics
+  // (which never match a Cohort id) is exactly what sent a genuine 1:1 DM through
+  // the group election gate and suppressed it. Precedence: explicit kind →
+  // pre-existing boolean is_dm → Slack-style id/label prefix heuristics.
+  const channelKind = String(item.channel_kind || "").toUpperCase();
+  const isDm = channelKind
+    ? channelKind === "DM"
+    : typeof item.is_dm === "boolean"
+      ? item.is_dm
+      : channelStr.startsWith("dm/") || channelId.startsWith("D");
   const myFirstName = loadAgent().firstName || "Agent";
   const agentThreadRegex = new RegExp(`^${myFirstName}:`, "m");
   const agentInThread = !!(item.thread_context && agentThreadRegex.test(item.thread_context));
@@ -697,7 +720,44 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
         });
         return { ok: true, path: "quick_reply", reason: classResult.model };
       }
-      // If quick reply failed to send or was blocked by validation, fall through to dispatch a full session
+      // PERMANENT SEND FAILURE — NEVER FALL THROUGH. A permanent failure
+      // (FORBIDDEN_SCOPE from the send-gate, NOT_FOUND/BAD_REQUEST from hq) means
+      // retrying changes nothing AND that a spawned session would fail to post the
+      // very same way. Worse, that session runs AUTONOMOUSLY: denied its intended
+      // reply, it improvises and posts UNRELATED work into a channel this seat was
+      // just told it may not write to. So we stop here — open the durable debt so
+      // the ask is not lost, write a needs-attention escalation an operator can
+      // sweep, close the obligation as failed so the assurance sweep does not loop
+      // on an impossible send, and retire the item so the poll lane stops
+      // re-delivering it. The requester is not told (the only channel we had was
+      // the forbidden one); the escalation is the trace that a human must act.
+      if (result.permanent) {
+        const cause = result.code || result.error || "permanent send failure";
+        console.error(`[daemon] Quick reply PERMANENTLY failed for ${item.sender} (${cause}) — NOT spawning a session; opening obligation + escalating`);
+        let obligationKey = itemId;
+        try {
+          const opened = await openAndAcknowledge({
+            item, classResult, service, traceId: trace_id, ack: false,
+          });
+          if (opened && opened.key) obligationKey = opened.key;
+        } catch (err) {
+          console.error(`[daemon] openAndAcknowledge threw for ${itemId} on permanent send failure: ${err.message}`);
+        }
+        escalate(
+          { key: obligationKey, sender: item.sender, service,
+            channel: item.channel_id || item.channel || null,
+            summary: classResult && classResult.summary, openedAt: Date.now(),
+            attempts: 1, sessionId: null, traceId: trace_id, lastError: cause,
+            item: { content: item.content } },
+          { failure: { label: cause }, told: false },
+        );
+        try { closeObligation(obligationKey, { outcome: "failed", note: cause }); } catch { /* best-effort */ }
+        counters.bump("send.permanent_failure", { service, code: result.code || "unknown" });
+        emitEvent({ type: EVENT_TYPES.ERROR, trace_id, attrs: { item_id: itemId, service, stage: "quick_reply_permanent", error: cause } });
+        markProcessed(item, service);
+        return { ok: true, path: "quick_reply_permanent", reason: cause };
+      }
+      // If quick reply failed transiently or was blocked by validation, fall through to dispatch a full session
       const reason = result.blocked ? `validation blocked: ${result.issues?.map(i => i.rule).join(", ")}` : "send failed";
       console.warn(`[daemon] Quick reply not sent (${reason}), falling through to session dispatch`);
     }

package/scripts/daemon/agent-daemon.test.mjs

@@ -713,3 +713,120 @@ test("FAIL-SAFE: no holding ack is posted when the reply session cannot run (cla
   assert.equal(down.dispatched, true, "the session is still dispatched");
   assert.equal(res.path, "session", "answerItem took the session path");
 });
+
+// ===========================================================================
+// is_dm END-TO-END — the Cohort channel_kind is the authoritative signal.
+// ===========================================================================
+
+test("enrichItem: Cohort channel_kind decides is_dm (DM yes, GROUP_DM no)", () => {
+  // A 1:1 DM skips the election gate; a GROUP_DM is multi-participant and must
+  // go through it. Cohort ids are cuids, so the kind is the only reliable signal.
+  const dm = daemon.enrichItem({ channel: "channel/x", channel_id: "cuid_abc", channel_kind: "DM" }, "cohort");
+  assert.equal(dm.is_dm, true, "channel_kind DM → is_dm true (skips election)");
+  const group = daemon.enrichItem({ channel: "channel/x", channel_id: "cuid_abc", channel_kind: "GROUP_DM" }, "cohort");
+  assert.equal(group.is_dm, false, "channel_kind GROUP_DM → is_dm false (goes through election)");
+  const pub = daemon.enrichItem({ channel: "channel/x", channel_id: "cuid_abc", channel_kind: "public" }, "cohort");
+  assert.equal(pub.is_dm, false, "any other explicit kind → not a 1:1 DM");
+  // No kind → fall back to the Slack-style id/label prefix heuristics.
+  assert.equal(daemon.enrichItem({ channel: "dm/ceo", channel_id: "D123" }, "slack").is_dm, true);
+  assert.equal(daemon.enrichItem({ channel: "channel/roadmap", channel_id: "C123" }, "slack").is_dm, false);
+});
+
+test("enrichItem: a WIDE-path Cohort 1:1 DM (is_dm:true, NO channel_kind, cuid id) stays is_dm through the whole chain", async () => {
+  // REGRESSION. The DEFAULT inbound reader is lib/org/inbound.pullWideInbound,
+  // whose projection (lib/org/inbound/project.mjs toMessageEvent) marks a 1:1 DM
+  // with is_dm:true + channel_type:"dm" but does NOT emit channel_kind (only the
+  // non-default MESSAGING_INBOUND_WIDE=0 narrow reader sets channel_kind). Cohort
+  // channel ids are cuids, so the Slack-style "dm/"/"D…" prefix heuristics never
+  // fire on them. Before the fix, enrichItem derived is_dm ONLY from an (absent)
+  // channel_kind or those (never-matching) heuristics and CLOBBERED the true
+  // is_dm to false — routing a genuine 1:1 DM through the group election gate,
+  // which then suppressed it. This drives the real chain end to end:
+  //   toMessageEvent → eventToInboxItem → writeInboxItem → parseInboxItemYaml → enrichItem
+  // and asserts is_dm survives as true.
+  const { toMessageEvent } = await import("../../lib/org/inbound/project.mjs");
+  const { classifyEvent } = await import("../../lib/org/inbound/directedness.mjs");
+  const { eventToInboxItem } = await import("../../lib/channels/inbox-item.mjs");
+  const { writeInboxItem } = await import("../poller/utils.mjs");
+  const { parseInboxItemYaml } = await import("../poller/inbox-scan-poller.mjs");
+
+  const CUID = "clw9x7k4a0000abcd1234efgh"; // a real cuid: no "D…"/"dm/" prefix to key off
+  const cand = classifyEvent({
+    seq: 501, at: "2026-08-25T09:00:00.000Z", actor: "M-them",
+    family: "messaging", kind: "send", entity_id: "m501",
+    payload: { actor: "M-them", channelId: CUID, channelKind: "DM" },
+  });
+  const facts = { channels: new Map([[CUID, { id: CUID, kind: "DM", name: "them" }]]) };
+  const mev = toMessageEvent({
+    candidate: cand,
+    verdict: { surface: "dm", reason: "dm", directed: true },
+    hydrated: { ok: true, text: "ping", from: { id: "M-them", name: "Casey" }, channelId: CUID, channelLabel: "them" },
+    me: "M-me",
+    facts,
+  });
+
+  // The premise the regression rests on: the wide projection marks the DM but
+  // does NOT emit channel_kind.
+  assert.equal(mev.is_dm, true, "wide-path DM projects is_dm:true");
+  assert.equal(mev.channel_type, "dm");
+  assert.equal("channel_kind" in mev, false, "the DEFAULT wide reader emits NO channel_kind");
+
+  // eventToInboxItem carries is_dm through but (correctly) attaches no channel_kind.
+  const item = eventToInboxItem(mev);
+  assert.equal(item.is_dm, true);
+  assert.equal("channel_kind" in item, false);
+
+  // writeInboxItem → parseInboxItemYaml: the on-disk round-trip the poller does.
+  writeInboxItem("cohort", item, AGENT_DIR);
+  const dir = join(AGENT_DIR, "state", "inbox", "cohort");
+  const file = readdirSync(dir).find((f) => f.includes(item.id) && f.endsWith(".yaml"));
+  assert.ok(file, "the inbox item was written to disk");
+  const parsed = parseInboxItemYaml(readFileSync(join(dir, file), "utf8"));
+  assert.equal(parsed.is_dm, true, "is_dm survives the YAML round-trip");
+  assert.equal("channel_kind" in parsed, false, "and still no channel_kind on the wide path");
+
+  // enrichItem is the last hop before the election gate. It MUST honor the
+  // pre-existing boolean is_dm when channel_kind is absent, not clobber it.
+  const enriched = daemon.enrichItem(parsed, "cohort");
+  assert.equal(enriched.is_dm, true, "the wide-path 1:1 DM stays is_dm — it must SKIP the group election gate");
+});
+
+// ===========================================================================
+// NO FALLTHROUGH ON PERMANENT FAILURE — a permanent quick-reply send failure
+// (FORBIDDEN_SCOPE) must escalate, not spawn an autonomous session that would
+// post UNRELATED work into a channel the seat may not write to.
+// ===========================================================================
+
+test("NO FALLTHROUGH: a PERMANENT quick-reply failure escalates instead of spawning a session", async () => {
+  resetState();
+  const item = { id: "MSG-PERM", raw_ref: "slack:DPERM:1", service: "slack", channel: "dm/ceo-perm", channel_id: "DPERM0001", is_dm: true, sender: "ceo", subject: "forbidden send", content: "please post this" };
+  let dispatched = false;
+  const res = await daemon.answerItem(item, "slack", "MSG-PERM", "trace-perm", {
+    classify: async () => ({ priority: "high", action: "respond", model: "haiku", summary: "quick answer", category: "action_required", directed_at_agent: true }),
+    isQuickReply: () => true,
+    sendQuickResponse: async () => ({ sent: false, permanent: true, code: "FORBIDDEN_SCOPE", error: "FORBIDDEN_SCOPE: blocked by send-gate" }),
+    dispatch: () => { dispatched = true; },
+    claudeAvailable: () => true,
+  });
+  assert.equal(dispatched, false, "a permanent send failure must NOT spawn an autonomous session");
+  assert.equal(res.path, "quick_reply_permanent");
+  assert.match(res.reason, /FORBIDDEN_SCOPE/);
+  const naDir = join(AGENT_DIR, "state", "obligations", "needs-attention");
+  assert.ok(existsSync(naDir) && readdirSync(naDir).length > 0, "a durable needs-attention escalation was written for an operator");
+});
+
+test("NO FALLTHROUGH: a TRANSIENT quick-reply failure still falls through to a full session", async () => {
+  resetState();
+  const item = { id: "MSG-TRAN", raw_ref: "slack:DTRAN:1", service: "slack", channel: "dm/ceo-tran", channel_id: "DTRAN0001", is_dm: true, sender: "ceo", subject: "transient send", content: "please post this" };
+  let dispatched = false;
+  const res = await daemon.answerItem(item, "slack", "MSG-TRAN", "trace-tran", {
+    classify: async () => ({ priority: "high", action: "respond", model: "haiku", summary: "quick answer", category: "action_required", directed_at_agent: true }),
+    isQuickReply: () => true,
+    sendQuickResponse: async () => ({ sent: false, error: "hq 503 blip" }), // transient: NO permanent flag
+    sendHoldingMessage: async () => ({ sent: true, holdingText: "on it" }),
+    dispatch: (_p, _it, _cr, _s, opts) => { dispatched = true; opts.onClose({ ok: true, code: 0 }); },
+    claudeAvailable: () => true,
+  });
+  assert.equal(dispatched, true, "a transient failure falls through to the full session, as before");
+  assert.equal(res.path, "session");
+});

package/scripts/daemon/cadence-handlers.mjs

@@ -667,16 +667,32 @@ async function guardDynamicJobs({ event, agentRoot }, opts = {}) {
 
 const MESSAGING_CURSOR_REL = join("state", "messaging", "inbound-cursor.json");
 
-/** Read the org-messaging inbound cursor (seq). Fail-open → 0 (from genesis). */
+/**
+ * Read the org-messaging inbound cursor (seq).
+ *
+ * Returns `null` when there is NO cursor on disk (or it is corrupt/unreadable) —
+ * NOT 0. The distinction is load-bearing, exactly as it is for the push channel
+ * (lib/org/push.readCursor): `cursor=0` on the events read means "replay the
+ * ENTIRE org ledger from genesis", so a fresh install that started at 0 would
+ * wake on every historical message in the workspace. `null` is the caller's cue
+ * to SEED from the push channel head instead (see guardMessagingInbound), so a
+ * (re)install starts at "now" and replays nothing. A real, persisted cursor
+ * (always > 0 in practice — see writeMessagingCursor) is returned as-is.
+ */
 function readMessagingCursor(agentRoot) {
   try {
     const p = join(agentRoot, MESSAGING_CURSOR_REL);
-    if (!existsSync(p)) return 0;
+    if (!existsSync(p)) return null;
     const obj = JSON.parse(readFileSync(p, "utf8"));
     const c = Number(obj && obj.cursor);
-    return Number.isFinite(c) ? c : 0;
+    // A non-finite / non-positive cursor is corrupt, not "from genesis" — treat it
+    // as absent (seed from head) rather than replaying all history. Aligned with
+    // lib/org/push.readCursor (`n > 0`): a persisted cursor is always > 0 (seeded
+    // from a head that is null-or->0, then only advanced forward), so 0 is never a
+    // real watermark — accepting it would replay the entire org ledger.
+    return Number.isFinite(c) && c > 0 ? c : null;
   } catch {
-    return 0;
+    return null;
   }
 }
 
@@ -764,7 +780,34 @@ async function guardMessagingInbound({ event, agentRoot, log }, opts = {}) {
       opts.toInboxImpl || (await import("../../lib/channels/inbox-item.mjs")).eventToInboxItem;
     const writeInboxItem = opts.writeImpl || (await import("../poller/utils.mjs")).writeInboxItem;
 
-    const cursor = readMessagingCursor(agentRoot);
+    let cursor = readMessagingCursor(agentRoot);
+    if (cursor == null) {
+      // FIRST RUN (or a corrupt cursor): no usable inbound cursor on disk. Do NOT
+      // start the poll lane at genesis — `events?cursor=0` replays the ENTIRE org
+      // ledger and wakes the fresh agent on every historical message. Seed from
+      // the PUSH CHANNEL HEAD instead: the SSE lane bootstraps at head and
+      // persists that seq to state/org/push-cursor.json, so it is the local
+      // "everything before this is history" watermark. Persist it as our starting
+      // cursor so a crash before the first advance cannot fall back to genesis.
+      let head = null;
+      try {
+        head = typeof opts.pushHeadImpl === "function"
+          ? opts.pushHeadImpl(agentRoot)
+          : (await import("../../lib/org/push.mjs")).readCursor(agentRoot);
+      } catch { head = null; }
+      if (head == null) {
+        // Neither lane has established a head yet (truly fresh install, push not
+        // yet connected). Replaying the backlog is the ONE thing we must not do,
+        // so hold this tick — the push channel writes a head shortly and the next
+        // tick seeds from it. Never silent: the reason says exactly why 0 routed.
+        if (typeof log === "function") {
+          log("info", "[messaging-inbound] fresh install: no inbound cursor and no push-channel head yet — holding this tick to avoid replaying the org backlog");
+        }
+        return { ok: true, decision: "inline", cadence: event.cadence, reason: "awaiting push-channel head to seed inbound cursor (fresh install)", routed: 0 };
+      }
+      cursor = Number(head);
+      writeMessagingCursor(agentRoot, cursor);
+    }
     // Pass the agent id explicitly. It is what suppresses the agent's OWN
     // outbound echoes — without it `me` is null, every echo-filter branch is
     // skipped, and the agent re-ingests its own replies as fresh inbound (a

package/scripts/daemon/cadence-handlers.test.mjs

@@ -445,6 +445,10 @@ test("messaging-inbound: pulls new directed items and routes them into the inbox
     { event: { cadence: "messaging-inbound" }, agentRoot: root, log: () => {} },
     {
       cfg: { org: { cohort: { enabled: true, base: "https://x", token: "t", agentId: "me" } } },
+      // Fresh root → no inbound cursor. Seed from the push-channel head so the
+      // pull starts at "now" (not genesis). The stub stands in for
+      // lib/org/push.readCursor.
+      pushHeadImpl: () => 5,
       pullImpl: async () => ({ events: [ev1, ev2], nextCursor: 12 }),
       toInboxImpl: (e) => ({ id: e.message_id, service: "cohort", content: e.text }),
       writeImpl: (service, item) => written.push({ service, item }),
@@ -461,20 +465,67 @@ test("messaging-inbound: pulls new directed items and routes them into the inbox
   assert.equal(JSON.parse(readFileSync(cursorFile, "utf8")).cursor, 12);
 });
 
+test("messaging-inbound: FIRST RUN seeds the inbound cursor from the push-channel head (no backlog replay)", async () => {
+  const root = tmpRoot();
+  let pulledCursor = null;
+  const res = await guardMessagingInbound(
+    { event: { cadence: "messaging-inbound" }, agentRoot: root, log: () => {} },
+    {
+      cfg: { org: { cohort: { enabled: true, base: "https://x", token: "t" } } },
+      // The push channel has advanced to seq 4200. A fresh install must start
+      // there, NOT at 0 (which would replay the whole org ledger).
+      pushHeadImpl: () => 4200,
+      pullImpl: async ({ cursor }) => { pulledCursor = cursor; return { events: [], nextCursor: cursor }; },
+      toInboxImpl: () => ({}),
+      writeImpl: () => { throw new Error("should not write an item"); },
+    },
+  );
+  assert.equal(res.ok, true);
+  assert.equal(res.decision, "inline");
+  assert.equal(pulledCursor, 4200, "the pull started at the push head, not at genesis");
+  const cursorFile = join(root, "state", "messaging", "inbound-cursor.json");
+  assert.ok(existsSync(cursorFile), "the seeded head is persisted so a crash cannot fall back to genesis");
+  assert.equal(JSON.parse(readFileSync(cursorFile, "utf8")).cursor, 4200);
+});
+
+test("messaging-inbound: FIRST RUN with no push head yet HOLDS the tick (never replays from genesis)", async () => {
+  const root = tmpRoot();
+  const res = await guardMessagingInbound(
+    { event: { cadence: "messaging-inbound" }, agentRoot: root, log: () => {} },
+    {
+      cfg: { org: { cohort: { enabled: true, base: "https://x", token: "t" } } },
+      pushHeadImpl: () => null, // push channel has not established a head yet
+      pullImpl: async () => { throw new Error("must not pull before a head exists"); },
+      toInboxImpl: () => ({}),
+      writeImpl: () => { throw new Error("must not write"); },
+    },
+  );
+  assert.equal(res.ok, true);
+  assert.equal(res.decision, "inline");
+  assert.equal(res.routed, 0);
+  assert.match(res.reason, /awaiting push-channel head/);
+  assert.ok(!existsSync(join(root, "state", "messaging", "inbound-cursor.json")), "no cursor seeded while we wait for a head");
+});
+
 test("messaging-inbound: no new directed items → inline, routed 0, cursor unchanged", async () => {
   const root = tmpRoot();
+  // A cursor already exists (not a first run), so seeding is skipped and the pull
+  // starts from the persisted seq. Nothing new → the cursor must not move.
+  const cursorFile = join(root, "state", "messaging", "inbound-cursor.json");
+  mkdirSync(join(root, "state", "messaging"), { recursive: true });
+  writeFileSync(cursorFile, JSON.stringify({ cursor: 9, updatedAt: "2026-01-01T00:00:00Z" }));
   const res = await guardMessagingInbound(
     { event: { cadence: "messaging-inbound" }, agentRoot: root, log: () => {} },
     {
       cfg: { org: { cohort: { enabled: true, base: "https://x", token: "t" } } },
-      pullImpl: async ({ cursor }) => ({ events: [], nextCursor: cursor }),
+      pullImpl: async ({ cursor }) => { assert.equal(cursor, 9, "pull starts from the persisted cursor"); return { events: [], nextCursor: cursor }; },
       toInboxImpl: () => ({}),
       writeImpl: () => { throw new Error("should not write"); },
     },
   );
   assert.equal(res.decision, "inline");
   assert.equal(res.routed, 0);
-  assert.ok(!existsSync(join(root, "state", "messaging", "inbound-cursor.json")), "no cursor write when nothing advanced");
+  assert.equal(JSON.parse(readFileSync(cursorFile, "utf8")).cursor, 9, "cursor unchanged when nothing advanced");
 });
 
 test("messaging-inbound: org not configured → inline no-op (fail-open)", async () => {
@@ -496,6 +547,7 @@ test("messaging-inbound: MESSAGING_INBOUND_ESCALATE=1 escalates when items arriv
       { event: { cadence: "messaging-inbound" }, agentRoot: tmpRoot(), log: () => {} },
       {
         cfg: { org: { cohort: { enabled: true, base: "https://x", token: "t" } } },
+        pushHeadImpl: () => 1,
         pullImpl: async () => ({ events: [{ message_id: "m1", text: "@me" }], nextCursor: 1 }),
         toInboxImpl: (e) => ({ id: e.message_id }),
         writeImpl: () => {},
@@ -514,6 +566,7 @@ test("messaging-inbound: fully fail-open (pull throws → inline, never throws)"
     { event: { cadence: "messaging-inbound" }, agentRoot: tmpRoot(), log: () => {} },
     {
       cfg: { org: { cohort: { enabled: true, base: "https://x", token: "t" } } },
+      pushHeadImpl: () => 3,
       pullImpl: async () => { throw new Error("network down"); },
     },
   );
@@ -737,6 +790,7 @@ test("messaging-inbound (JOINT 3): the DEFAULT reader is wide — no family filt
     {
       cfg: { org: { cohort: { enabled: true, base: "https://x.test", token: "t" } } },
       agentId: ME,
+      pushHeadImpl: () => 1, // fresh root: seed past genesis so the ledger read runs
       fetchImpl,
       toInboxImpl: (e) => ({ id: e.id, service: "cohort", kind: e.kind, content: e.text }),
       writeImpl: (service, item) => written.push({ service, item }),
@@ -765,6 +819,7 @@ test("messaging-inbound (JOINT 3): MESSAGING_INBOUND_WIDE=0 falls back to the na
       {
         cfg: { org: { cohort: { enabled: true, base: "https://x.test", token: "t" } } },
         agentId: "member-me",
+        pushHeadImpl: () => 1, // fresh root: seed past genesis so the read runs
         // The narrow reader pins family=messaging,calling on its URL; assert the
         // degradation is announced rather than inferred from an empty inbox.
         fetchImpl: async () => ({ ok: true, status: 200, headers: { get: () => "application/json" }, text: async () => JSON.stringify({ events: [], nextCursor: 0 }), json: async () => ({ events: [], nextCursor: 0 }) }),

package/scripts/daemon/inbox-deferral.mjs

@@ -199,38 +199,63 @@ export function promoteDeferred(channel, agentRoot) {
       matches.push({
         file,
         timestamp: readScalar(body, "timestamp") || "",
+        // THE SURFACE within the channel. `channel_id` names the ROOM; a single
+        // room carries several independent conversations at once — a directed 1:1
+        // DM thread AND the actor's own doc/board/decision events that resolve to
+        // the same channel_id. Bundling "latest-wins across the whole channel"
+        // folded those unrelated surfaces into one and silently dropped
+        // (`.processed-bundled`) a directed DM because a newer doc-comment event
+        // arrived in the same room. thread_context only ever carries the SAME
+        // thread's history, so bundling is sound ONLY within one surface. Key on
+        // thread_id, else the surface's own scope_id, else "" (a bare-channel
+        // burst — the original same-thread case, preserved).
+        surface:
+          readScalar(body, "thread_id") ||
+          readScalar(body, "scope_id") ||
+          "",
       });
     }
     if (matches.length === 0) continue;
 
-    // Latest-wins: lex-sort ISO timestamps, take the most recent.
-    matches.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-    const latest = matches[matches.length - 1];
-    const older = matches.slice(0, -1);
-
-    // Promote the latest back to live inbox.
-    try {
-      const live = latest.file.replace(/\.deferred$/, "");
-      renameSync(join(inboxDir, latest.file), join(inboxDir, live));
-      result.promoted++;
-      result.service = service;
-    } catch {
-      // If the rename failed (race with another process), leave it
-      // as .deferred — the next session-close will retry.
+    // Group by surface within the channel, then bundle latest-wins WITHIN each
+    // group. Distinct surfaces each promote their own latest; none is dropped
+    // just because a newer message landed on a different surface in the room.
+    const groups = new Map();
+    for (const m of matches) {
+      if (!groups.has(m.surface)) groups.set(m.surface, []);
+      groups.get(m.surface).push(m);
     }
 
-    // Mark older bursts as bundled — their content is already part of
-    // the latest item's thread_context, so they don't need their own
-    // session, but we preserve the file for audit.
-    for (const m of older) {
+    for (const group of groups.values()) {
+      // Latest-wins: lex-sort ISO timestamps, take the most recent.
+      group.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+      const latest = group[group.length - 1];
+      const older = group.slice(0, -1);
+
+      // Promote the latest back to live inbox.
       try {
-        renameSync(
-          join(inboxDir, m.file),
-          join(inboxDir, m.file.replace(/\.deferred$/, ".processed-bundled"))
-        );
-        result.bundled++;
+        const live = latest.file.replace(/\.deferred$/, "");
+        renameSync(join(inboxDir, latest.file), join(inboxDir, live));
+        result.promoted++;
+        result.service = service;
       } catch {
-        // Best-effort; missing file is fine.
+        // If the rename failed (race with another process), leave it
+        // as .deferred — the next session-close will retry.
+      }
+
+      // Mark older bursts as bundled — their content is already part of
+      // the latest item's thread_context, so they don't need their own
+      // session, but we preserve the file for audit.
+      for (const m of older) {
+        try {
+          renameSync(
+            join(inboxDir, m.file),
+            join(inboxDir, m.file.replace(/\.deferred$/, ".processed-bundled"))
+          );
+          result.bundled++;
+        } catch {
+          // Best-effort; missing file is fine.
+        }
       }
     }
   }

package/scripts/daemon/inbox-deferral.test.mjs

@@ -12,11 +12,13 @@ function makeAgentRoot() {
   return root;
 }
 
-function writeInboxItem(root, name, { channel_id, timestamp, id = "test-id" }) {
+function writeInboxItem(root, name, { channel_id, timestamp, id = "test-id", thread_id, scope_id }) {
   const body = [
     `id: "${id}"`,
     `service: "slack"`,
     `channel_id: "${channel_id}"`,
+    ...(thread_id ? [`thread_id: "${thread_id}"`] : []),
+    ...(scope_id ? [`scope_id: "${scope_id}"`] : []),
     `timestamp: "${timestamp}"`,
     `content: |`,
     `  body`,
@@ -118,6 +120,42 @@ test("promoteDeferred with multiple items: keeps latest, bundles rest", () => {
   }
 });
 
+test("promoteDeferred bundles WITHIN a surface, not across the whole channel", () => {
+  // A directed 1:1 DM thread AND the actor's doc-comment events resolve to the
+  // same channel_id. Bundling latest-wins across the channel would drop the DM
+  // just because a newer doc event landed. Each surface must promote its own
+  // latest; nothing is bundled across surfaces.
+  const root = makeAgentRoot();
+  try {
+    // The directed DM (one message, thread T-DM).
+    writeInboxItem(root, "dm-1.yaml.deferred", {
+      channel_id: "room-1", thread_id: "T-DM", id: "dm-1",
+      timestamp: "2026-05-13T00:00:30Z",
+    });
+    // Two doc-comment events on the same room but a different surface (scope S-DOC),
+    // the later of which would have "won" under the old channel-wide bundling.
+    writeInboxItem(root, "doc-1.yaml.deferred", {
+      channel_id: "room-1", scope_id: "S-DOC", id: "doc-1",
+      timestamp: "2026-05-13T00:01:00Z",
+    });
+    writeInboxItem(root, "doc-2.yaml.deferred", {
+      channel_id: "room-1", scope_id: "S-DOC", id: "doc-2",
+      timestamp: "2026-05-13T00:02:00Z",
+    });
+    const r = promoteDeferred("room-1", root);
+    assert.equal(r.promoted, 2, "the DM and the latest doc event are BOTH promoted");
+    assert.equal(r.bundled, 1, "only the older doc event (same surface) is bundled");
+    const files = readdirSync(join(root, "state", "inbox", "slack")).sort();
+    assert.deepEqual(files, [
+      "dm-1.yaml",                    // the directed DM survives — NOT dropped
+      "doc-1.yaml.processed-bundled", // older doc event folded into doc-2
+      "doc-2.yaml",                   // latest doc event promoted
+    ]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("promoteDeferred ignores items in other channels", () => {
   const root = makeAgentRoot();
   try {

package/scripts/daemon/responder.mjs

@@ -901,6 +901,15 @@ export async function sendQuickResponse(item, classResult, routed = null) {
       via: delivered.via,
       ...(delivered.channel ? { channel: delivered.channel } : {}),
       ...(delivered.draft_path ? { draft_path: delivered.draft_path } : {}),
+      // PROPAGATE THE PERMANENCE. `deliver` marks a failure the send-gate refused
+      // (FORBIDDEN_SCOPE) or hq declared unroutable (NOT_FOUND/BAD_REQUEST) as
+      // `permanent` with the RPC `code`. Without carrying these up, the caller
+      // (agent-daemon.answerItem) could not tell a transient blip from an
+      // impossible send, so it fell through to a full autonomous session — which
+      // then posted UNRELATED work into a channel this seat was just told it may
+      // not write to. The daemon uses `permanent` to escalate instead of spawn.
+      ...(delivered.permanent ? { permanent: true } : {}),
+      ...(delivered.code ? { code: delivered.code } : {}),
       ...(delivered.error ? { error: delivered.error } : {}),
     };
 

package/scripts/poller/inbox-scan-poller.mjs

@@ -111,6 +111,13 @@ export function parseInboxItemYaml(body) {
   if (channelType) item.channel_type = channelType;
   if (isPrivate !== undefined) item.is_private = isPrivate;
   if (isDm !== undefined) item.is_dm = isDm;
+  // THE CHANNEL KIND. Cohort's only reliable DM signal, written by
+  // scripts/poller/utils.inboxItemToYaml when present. Attached only when the
+  // writer emitted it so a non-Cohort item keeps its old shape; the daemon's
+  // enrichItem reads it to tell a 1:1 DM (skips the election) from a GROUP_DM
+  // (goes through the election as a multi-participant channel).
+  const channelKind = scalar("channel_kind");
+  if (channelKind) item.channel_kind = channelKind;
   // The hq chain kind, when the org projection carried one through the writer.
   // Attached only when present so a non-org item keeps exactly its old shape;
   // `lib/execution/intake.fromInboxItem` prefers it over the surface so an

package/scripts/poller/utils.mjs

@@ -239,6 +239,17 @@ raw_ref: "${item.raw_ref || ""}"
     yaml += `channel_id: "${item.channel_id}"\n`;
   }
 
+  // THE CHANNEL KIND (DM / GROUP_DM / PUBLIC / …). Cohort's only reliable DM
+  // signal (its channel ids are cuids, so the "D…"/"dm/" prefix heuristics never
+  // fire). Written ONLY when present so a non-Cohort item is byte-identical to
+  // before; the daemon's `enrichItem` reads it to route a 1:1 DM past the group
+  // election gate while a GROUP_DM still goes through it. Enumerated writers like
+  // this one drop anything not named here, which is exactly how the signal was
+  // lost between eventToInboxItem and parseInboxItemYaml.
+  if (item.channel_kind) {
+    yaml += `channel_kind: "${item.channel_kind}"\n`;
+  }
+
   // CONFIDENTIALITY SIGNALS. Slack's conversation-ID prefix is not a reliable
   // type indicator (a private channel can carry a `C…` id), so downstream
   // consumers — notably the daemon's fail-closed outcome gate,