@cohortapp/agent-sdk 2.15.0 → 2.16.0

package/scripts/daemon/assurance.mjs

@@ -55,7 +55,7 @@ import { appendFileSync, mkdirSync, readdirSync, readFileSync, renameSync, unlin
 import { spawn } from "child_process";
 import { join } from "path";
 import { deliver, deliverWithRetry, replyTargetOf, canDeliverTo } from "./deliver.mjs";
-import { spokeFor } from "../../lib/comms/receipts.mjs";
+import { spokeFor, NON_ANSWER_KINDS } from "../../lib/comms/receipts.mjs";
 import { resultTextFromStdout } from "./session-outcomes.mjs";
 // The ack generator funnels through `claude --print` like every other daemon
 // model call (CEO directive 2026-04-27: no direct Anthropic API from the
@@ -68,6 +68,21 @@ import { isSelfSender, loadSelfIdentity } from "./lib/self-echo.mjs";
 // Fail-open observability (never throws): the ack-generation failure counter
 // below is what makes the ACK_GEN_TIMEOUT_MS operating point measurable.
 import * as counters from "../../lib/diagnostics/counters.mjs";
+// ── The acknowledgement-discipline decision modules (all PURE) ───────────────
+// `replyTier` decides whether this ask may make the agent speak at all;
+// `claimRoomInterim` outranks it with a per-ROOM, per-SEAT budget and
+// `claimRoomNotice` stops a byte-identical outcome notice repeating in one
+// room; `renderPlanNote` is
+// the only composer of interim copy left in the system, and carries the two
+// copy rules (GENERIC_OPENER, FORWARD_PROMISE) every interim must satisfy.
+import { replyTier } from "../../lib/assurance/tier.mjs";
+import {
+  claimRoomInterim,
+  claimRoomNotice,
+  ledgerPath as roomBudgetPath,
+  LEDGER_BASENAME as ROOM_BUDGET_BASENAME,
+} from "../../lib/assurance/room-budget.mjs";
+import { renderPlanNote, GENERIC_OPENER } from "../../lib/assurance/plan-note.mjs";
 
 // ── Board mirror seams ───────────────────────────────────────────────────────
 // Imported lazily so a board module problem can never stop the daemon booting,
@@ -107,22 +122,37 @@ const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.ur
 
 const num = (v, d) => { const n = parseInt(v, 10); return Number.isFinite(n) ? n : d; };
 
-/** How long after opening we expect the ack to already be out. The sweep
- *  compensates anything still un-acked past this — the fix for "the holding
- *  message failed and nothing ever retried it". */
-export const ACK_GRACE_MS = num(process.env.ASSURANCE_ACK_GRACE_MS, 45_000);
-
-/** Work that outruns this gets an interim update rather than silence. Set just
- *  under the measured p50 session (14.7 min) so the common case is covered,
- *  and well above the quick path so a fast answer never triggers one. */
-export const PROGRESS_AFTER_MS = num(process.env.ASSURANCE_PROGRESS_AFTER_MS, 5 * 60_000);
-
-/** Gap between interim updates. */
-export const PROGRESS_EVERY_MS = num(process.env.ASSURANCE_PROGRESS_EVERY_MS, 10 * 60_000);
+/*
+ * `ACK_GRACE_MS` (`ASSURANCE_ACK_GRACE_MS`, 45 s) WAS HERE AND IS DELETED.
+ *
+ * It meant "how long after opening we expect the ack to already be out", which
+ * presupposed an ack going out AT open. Nothing is said at open any more, so
+ * the knob tuned a mechanism that no longer exists — and a live env var that
+ * silently does nothing is worse than no knob at all, because an operator sets
+ * it and believes they have changed something. `ACK_AFTER_MS` below is the
+ * threshold that replaces it, and it means the opposite thing: not "the ack is
+ * late" but "the ask has waited long enough to be worth a word".
+ */
 
-/** Hard cap on interim updates per obligation. "Do not spam" is a requirement,
- *  not a nicety: two updates over 45 minutes is attentive, six is noise. */
-export const PROGRESS_MAX = num(process.env.ASSURANCE_PROGRESS_MAX, 2);
+/**
+ * How long an ask waits before the agent may say ANYTHING about it.
+ *
+ * This replaces `PROGRESS_AFTER_MS` / `PROGRESS_EVERY_MS` / `PROGRESS_MAX` and
+ * the `composeProgress` they drove. Those emitted a message that was a pure
+ * function of elapsed minutes — 961 of them in fourteen days, telling a reader
+ * nothing the timestamp did not already say, and twice narrating the same work
+ * from two independent timers at the same instant.
+ *
+ * Ninety seconds is chosen against the two facts that bound it: Nielsen's
+ * ten-second threshold, past which a person wants evidence of work, and the
+ * measured session distribution (p50 14.7 min), which says most work will still
+ * be running when this elapses. Below it, silence is not rudeness — it is the
+ * typing indicator doing its job.
+ *
+ * Note the sweep runs on HEALTH_INTERVAL (60 s), so the first interim lands on
+ * the second tick after this elapses, not the instant it does.
+ */
+export const ACK_AFTER_MS = num(process.env.ASSURANCE_ACK_AFTER_MS, 90_000);
 
 /** An obligation still open this long after admission has outlived every
  *  session timeout in the dispatcher (45 min for opus/inbox). Past this the
@@ -171,7 +201,7 @@ export const INTERRUPT_GRACE_MS = num(process.env.ASSURANCE_INTERRUPT_GRACE_MS,
  * Budget for generating the ONE-LINE contextual acknowledgement. Tight on
  * purpose: an ack that arrives a minute late has already failed at its job,
  * and the fallback is deliberate silence (the sweep retries generation once
- * within ACK_GRACE_MS, then stops). NOTE: this is knowingly aggressive for a
+ * once past ACK_AFTER_MS, then stops). NOTE: this is knowingly aggressive for a
  * cold `claude --print` spawn — the CEO chose "occasionally silent" over
  * "reliably canned". Operators can widen it via env.
  */
@@ -187,6 +217,20 @@ export const ACK_GEN_TIMEOUT_MS = num(process.env.ASSURANCE_ACK_GEN_TIMEOUT_MS,
  */
 export const ACK_GEN_MAX_FAILURES = num(process.env.ASSURANCE_ACK_GEN_MAX_FAILURES, 2);
 
+/**
+ * Shortest line that can still be an acknowledgement.
+ *
+ * An ack must name the thing that was asked; twenty characters is the floor
+ * below which it demonstrably does not. Every one of the generic openers
+ * measured in production — "On it.", "Checking.", "Will do.", "Got it." — is
+ * under it, so this is a second, phrasing-independent net under GENERIC_OPENER.
+ */
+export const ACK_MIN_CHARS = num(process.env.ASSURANCE_ACK_MIN_CHARS, 20);
+
+/** The tiers `lib/assurance/tier.mjs` can return; anything else is a caller bug
+ *  and is treated as `work` — the tier that can still speak once. */
+const TIER_SET = new Set(["answer", "work", "plan"]);
+
 // ---------------------------------------------------------------------------
 // Ledger
 // ---------------------------------------------------------------------------
@@ -235,14 +279,32 @@ export function readObligation(key) {
   catch { return null; }
 }
 
-/** Every obligation on disk, open and closed. */
+/**
+ * Every obligation on disk, open and closed.
+ *
+ * NOT every `*.json` in the directory. The room-budget ledger lives at
+ * `state/obligations/room-budget.json` — the path the design names — and it is
+ * not a debt: it has no `key` and no `state`. Parsed as one it became a phantom
+ * record that inflated every count derived from this function and that
+ * `pruneObligations` tried to unlink once a minute as `unknown.json` (harmless
+ * only by accident, because nothing can key to "unknown"). Two guards, because
+ * the first is a name and names get changed: skip the ledger by basename, and
+ * require a usable `key` of anything that survives.
+ */
 export function listObligations() {
   const out = [];
   let files = [];
-  try { files = readdirSync(obligationDir()).filter((f) => f.endsWith(".json")); }
+  try {
+    files = readdirSync(obligationDir())
+      .filter((f) => f.endsWith(".json") && f !== ROOM_BUDGET_BASENAME);
+  }
   catch { return out; }
   for (const f of files) {
-    try { out.push(JSON.parse(readFileSync(join(obligationDir(), f), "utf-8"))); }
+    try {
+      const rec = JSON.parse(readFileSync(join(obligationDir(), f), "utf-8"));
+      if (!rec || typeof rec !== "object" || typeof rec.key !== "string" || !rec.key) continue;
+      out.push(rec);
+    }
     catch { /* a corrupt record must not hide the rest */ }
   }
   return out;
@@ -380,14 +442,32 @@ export function looksLikePeerAckShape(item) {
  *
  * @returns {RegExp[]}
  */
+/**
+ * Narrator lines this daemon NO LONGER EMITS, kept verbatim so the dispatch
+ * gate still recognises them.
+ *
+ * `composeProgress` is deleted (see ACK_AFTER_MS), but the fleet updates one
+ * machine at a time and an older seat next to this one goes on emitting these
+ * two sentences for as long as it takes its autoupdate to land. Dropping the
+ * patterns with the emitter would mean this seat ACKS a peer's progress ping
+ * and spawns a 15-45 minute session behind it — the exact 25/27/30 Aug loop the
+ * gate was built to stop. They are frozen literals rather than derived strings
+ * precisely because nothing composes them any more.
+ *
+ * @type {readonly string[]}
+ */
+export const RETIRED_NARRATOR_TEMPLATES = Object.freeze([
+  "Still on this — 1 minutes in. I'll come back as soon as I've got something.",
+  "Still going — 1 minutes in. I'll follow up the moment it's done.",
+]);
+
 let _narratorPatterns = null;
 export function narratorPatterns() {
   if (_narratorPatterns) return _narratorPatterns;
   const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const CAUSE = "@@CAUSE@@"; // sentinel, regex-safe, never in real output
   const templates = [
-    composeProgress({ openedAt: 0, progressSent: 0 }, { now: 60_000 }),   // "Still on this — N minutes in. …"
-    composeProgress({ openedAt: 0, progressSent: 1 }, { now: 60_000 }),   // "Still going — N minutes in. …"
+    ...RETIRED_NARRATOR_TEMPLATES,                                        // no longer emitted; still recognised
     composeFailure({}, { failure: { human: CAUSE }, willRetry: true }),   // "Hit a problem — …. Retrying now; …"
     composeFailure({}, { failure: { human: CAUSE }, willRetry: false }),  // "Couldn't finish this — …. I've stopped retrying …"
     composeInterrupted(),                                                 // "Heads up — my session on this was interrupted …"
@@ -456,32 +536,56 @@ function logDispatchGateRefusal(item, reason) {
  * FALLBACK emits when the LLM classifier itself fails. So exactly when the
  * system was degraded, a directed DM got a 15-minute session and no ack at all.
  *
+ * WHAT CHANGED, 2026-09-12. "A session is spawning" is still NECESSARY for an
+ * interim, but it is no longer SUFFICIENT, because it was the interim rate
+ * being equal to the session rate that produced the flood. The verdict now
+ * also carries a TIER (`lib/assurance/tier.mjs`), and the tier decides whether
+ * anything may be said at all:
+ *
+ *   answer — nothing, ever. The reply is the acknowledgement.
+ *   work   — nothing now; the sweep may say ONE line after ACK_AFTER_MS, if the
+ *            room's budget allows it.
+ *   plan   — one message, and it is the plan the session itself stated.
+ *
+ * Note what `ack: true` now MEANS: "an interim is permitted later", never "say
+ * something at once". No message leaves this module at open time any more.
+ *
  * @param {object} o
  * @param {boolean} o.willSpawnSession  is a session being dispatched for this item
  * @param {object}  [o.item]            the inbox item
  * @param {string}  [o.source]          "inbox" | "backlog"
- * @returns {{ack:boolean, reason:string}}
+ * @param {object}  [o.classResult]     classifier verdict (answerable/action/priority)
+ * @param {number|null} [o.rung]        routed execution rung, when one is known
+ * @returns {{ack:boolean, reason:string, tier:string, emitterClass?:boolean}}
  */
 export function shouldAcknowledge(o = {}) {
-  if (!o.willSpawnSession) return { ack: false, reason: "answered-in-turn" };
-  if (o.source && o.source !== "inbox") return { ack: false, reason: "no-waiting-human" };
+  const cr = o.classResult || {};
+  const tier = replyTier({
+    answerable: cr.answerable,
+    action: cr.action,
+    priority: cr.priority,
+    rung: Number.isFinite(o.rung) ? o.rung : (Number.isFinite(cr.rung) ? cr.rung : null),
+    willSpawnSession: o.willSpawnSession === true,
+  });
+  if (!o.willSpawnSession) return { ack: false, reason: "answered-in-turn", tier };
+  if (o.source && o.source !== "inbox") return { ack: false, reason: "no-waiting-human", tier };
   const item = o.item || {};
-  if (!item.service) return { ack: false, reason: "no-service" };
-  if (!replyTargetOf(item)) return { ack: false, reason: "no-reply-target" };
+  if (!item.service) return { ack: false, reason: "no-service", tier };
+  if (!replyTargetOf(item)) return { ack: false, reason: "no-reply-target", tier };
   // A service this agent has no transport for. Saying "I'm on it" into a
   // channel we cannot write to is not an acknowledgement, it is an exception
   // with a nicer name — and the sweep would then retry that impossible send
   // once a minute forever. The DEBT is still opened (see openAndAcknowledge):
   // an ask we cannot answer in public is exactly the one an operator must be
   // told about, and that is what needs-attention is for.
-  if (!canDeliverTo(item)) return { ack: false, reason: "no-transport" };
+  if (!canDeliverTo(item)) return { ack: false, reason: "no-transport", tier };
   // Nobody is waiting on work the agent gave itself.
-  if (item.self_originated === true) return { ack: false, reason: "self-originated" };
+  if (item.self_originated === true) return { ack: false, reason: "self-originated", tier };
   // SECOND SELF-ECHO GUARD. Ingestion (agent-daemon pollService/processItem)
   // already drops the agent's own outbound echoes; this is the belt to that
   // brace, so even an echo that arrives by a path the poll filter never saw
   // cannot make the agent say "on it" to itself (the 25/27/30 Aug loop).
-  if (isSelfSender(item)) return { ack: false, reason: "self-sender" };
+  if (isSelfSender(item)) return { ack: false, reason: "self-sender", tier };
   // ── THE DISPATCH GATE READS THE INBOUND ───────────────────────────────────
   // Output of this seat's own EMITTER CLASS earns neither an ack nor a session:
   // (a) a daemon narrator line — progress / failure / interrupted / terminal —
@@ -492,13 +596,19 @@ export function shouldAcknowledge(o = {}) {
   // too. Every refusal is audited (logs/daemon/dispatch-gate-drops.jsonl).
   if (isOwnNarratorText(item.content)) {
     logDispatchGateRefusal(item, "own-narrator-pattern");
-    return { ack: false, reason: "own-narrator-pattern", emitterClass: true };
+    return { ack: false, reason: "own-narrator-pattern", emitterClass: true, tier };
   }
   if (looksLikePeerAckShape(item)) {
     logDispatchGateRefusal(item, "peer-ack-shaped");
-    return { ack: false, reason: "peer-ack-shaped", emitterClass: true };
+    return { ack: false, reason: "peer-ack-shaped", emitterClass: true, tier };
   }
-  return { ack: true, reason: "session-dispatched" };
+  // ── THE TIER ──────────────────────────────────────────────────────────────
+  // The answer tier is silence by construction: the reply arrives in this turn,
+  // so an interim in front of it is the content-free traffic this whole change
+  // exists to delete. The DEBT is still opened by the caller — silence about
+  // timing is not silence about outcome.
+  if (tier === "answer") return { ack: false, reason: "tier-answer", tier };
+  return { ack: true, reason: "session-dispatched", tier };
 }
 
 // ---------------------------------------------------------------------------
@@ -603,6 +713,16 @@ export function sanitiseAckText(raw) {
   t = t.replace(/^["'“”](.*)["'“”]$/s, "$1").trim();
   if (!t) return null;
   if (t.length > 200) return null;
+  // THE PROMPT, ENFORCED. The ack system prompt has said "Never a generic 'on
+  // it' or 'looking into it'" since it was written; nothing checked, and 3,069
+  // generic acks shipped in fourteen days (28.8% of all agent messages). The
+  // pattern is imported from the copy-rule home rather than re-typed here, so
+  // the instruction and the filter cannot disagree again.
+  if (GENERIC_OPENER.test(t)) return null;
+  // Anything this short cannot be specific to what was asked, which is the one
+  // thing the prompt requires of it. "On it." is 6 characters; so is every
+  // variant that would slip past the pattern above by rephrasing.
+  if (t.length < ACK_MIN_CHARS) return null;
   if (/^(i can'?t|i cannot|i'?m sorry|sorry[, ]|as an ai|i am an ai|error\b)/i.test(t)) return null;
   if (/let me know if|i'?m here to help|happy to help|great question/i.test(t)) return null;
   // Assistant-y openers. "Sure — here it is:" is a chatbot clearing its throat,
@@ -711,16 +831,24 @@ function withTimeout(promise, ms) {
   ]).finally(() => clearTimeout(timer));
 }
 
-/** An interim update. Says how long it has been and that the work is live —
- *  short, no internal topic aside, no filler. */
-export function composeProgress(rec, o = {}) {
-  const now = Number.isFinite(o.now) ? o.now : Date.now();
-  const mins = Math.max(1, Math.round((now - (rec.openedAt || now)) / 60_000));
-  if ((rec.progressSent || 0) === 0) {
-    return `Still on this — ${mins} minutes in. I'll come back as soon as I've got something.`;
-  }
-  return `Still going — ${mins} minutes in. I'll follow up the moment it's done.`;
-}
+/*
+ * `composeProgress` WAS HERE, AND IS DELETED.
+ *
+ * It rendered "Still on this — N minutes in. I'll come back as soon as I've got
+ * something." from nothing but `now - openedAt`. A message that is a pure
+ * function of elapsed minutes cannot carry progress: it tells a reader exactly
+ * what the timestamp on the acknowledgement already told them, and it makes a
+ * promise ("I'll come back as soon as…") that 272 measured acknowledgements
+ * never kept. Nothing read the running session's stdout, its tool calls or its
+ * partial findings, so the message COULD not say anything a clock could not.
+ *
+ * 961 of them shipped in fourteen days. Two independent timers over overlapping
+ * work put "Still on this — 5 minutes in" beside "Still going — 15 minutes in"
+ * at the same timestamp in a live channel.
+ *
+ * If a genuinely long job must report, it reports CONTENT — see
+ * `lib/assurance/plan-note.mjs` and `notePlan` below — or it stays quiet.
+ */
 
 /**
  * The failure notice. Says WHAT HAPPENED and WHAT HAPPENS NEXT, in that order,
@@ -818,16 +946,152 @@ export function classifyFailure(o = {}) {
   return { transient: true, label: `exit_${code == null ? "unknown" : code}`, human: "the working session ended with an error" };
 }
 
+// ---------------------------------------------------------------------------
+// Notices: said once per (channel, obligationKey)
+// ---------------------------------------------------------------------------
+
+/**
+ * The outcome notices, as distinct things a human may be told.
+ *
+ * Note that `FAILURE_RETRYING` and `FAILURE_FINAL` are SEPARATE ids and both
+ * may be said. They carry different facts — "a retry is running" and "I have
+ * stopped" — and collapsing them into one "failure notice" would have meant a
+ * human who was told a retry was in flight never learned it had been abandoned.
+ * What is being suppressed is the REPEAT of the same fact, which is what the
+ * retry loop produced: the same sentence three times in one minute.
+ */
+export const NOTICE = Object.freeze({
+  FAILURE_RETRYING: "failure:retrying",
+  FAILURE_FINAL: "failure:final",
+  INTERRUPTED: "interrupted",
+  SILENT_SUCCESS: "silent-success",
+});
+
+/**
+ * The dedupe key. `(channel, obligationKey, notice)` — the channel is in the
+ * key because the same ask re-routed to a different room genuinely has not been
+ * answered there.
+ */
+function noticeId(rec, notice) {
+  const ch = String((rec && rec.channel) || "").trim().toLowerCase() || "unknown";
+  return `${notice}|${ch}`;
+}
+
+/** Has this exact notice already reached this room for this debt? */
+export function noticeAlreadySaid(rec, notice) {
+  const map = rec && rec.notices && typeof rec.notices === "object" ? rec.notices : null;
+  if (!map) return false;
+  return Number.isFinite(map[noticeId(rec, notice)]);
+}
+
+/** Record that it has. Mutates `rec`; the caller persists. */
+export function markNoticeSaid(rec, notice, now) {
+  if (!rec) return;
+  if (!rec.notices || typeof rec.notices !== "object") rec.notices = {};
+  rec.notices[noticeId(rec, notice)] = Number.isFinite(now) ? now : Date.now();
+}
+
+/**
+ * Say an outcome notice — once per debt, and never as a byte-identical repeat
+ * of one already on this room's screen.
+ *
+ * TWO DEDUPES, BECAUSE THEY ANSWER DIFFERENT QUESTIONS.
+ *
+ *   per (channel, obligationKey, notice) — `noticeAlreadySaid`, inherited
+ *   across a retry that reopens the same key. This is R4: notice → retry →
+ *   fresh record under the same key → notice again.
+ *
+ *   per (room, notice, exact sentence) — `claimRoomNotice`. This is the SIBLING
+ *   case the first one structurally cannot reach. Twenty separate asks in one
+ *   channel whose sessions all die the same way are twenty separate records,
+ *   and `composeFailure`'s stale text contains nothing about which ask it is
+ *   ("Couldn't finish this — the work never came back with a result and has now
+ *   outrun its time limit…"), so the reader gets the same sentence twenty times
+ *   and cannot tell any of them apart. Verified as still-broken after the first
+ *   dedupe shipped: 20 obligations in one room, 20 byte-identical messages.
+ *   That is the sampled defect this package cites — "the same failure sentence
+ *   three times in one minute" — in the shape the retry-loop fix does not cover.
+ *
+ * WHAT IS NOT SUPPRESSED, and this is the whole safety argument. Only an
+ * IDENTICAL sentence is. A different cause, a different excerpt, "a retry is
+ * running" versus "I have stopped" — all distinct text, all said, at any
+ * volume, because each carries a fact the reader does not have. And the
+ * escalation record is written per obligation by the caller regardless, so an
+ * operator still sees every dead ask in needs-attention even when the room only
+ * heard about the first.
+ *
+ * @param {object} o
+ * @param {object} o.rec        the obligation record; MUTATED, caller persists
+ * @param {string} o.notice     a NOTICE id
+ * @param {string} o.text       the exact composed sentence
+ * @param {object} o.item       the item snapshot to deliver against
+ * @param {string} o.kind       delivery kind ("failure" | "notice")
+ * @param {string} o.idempotencySuffix
+ * @param {number} o.now
+ * @param {function} o.send     the delivery impl (injected by the caller)
+ * @param {function} [o.roomNoticeImpl] test seam for the room-scoped dedupe
+ * @returns {Promise<{sent:boolean, reason:string}>}
+ */
+async function sayOutcomeNotice(o) {
+  const { rec, notice, text, item, kind, now } = o;
+  if (noticeAlreadySaid(rec, notice)) {
+    console.log(`[assurance] ${notice} notice for ${rec.key} already delivered to ${rec.channel} — not repeating it`);
+    counters.bump("assurance.notice_deduped", { notice, scope: "obligation" });
+    return { sent: false, reason: "notice-already-said" };
+  }
+  const claim = o.roomNoticeImpl || claimRoomNotice;
+  const peek = claim({
+    service: rec.service, channel: rec.channel, notice, text, now,
+    agentRoot: AGENT_REPO_DIR, commit: false,
+  });
+  if (peek && peek.allowed === false) {
+    // This room already has this exact sentence on screen. Stamp the record
+    // too: the fact HAS been told here, so a later tick of this same debt must
+    // not re-say it once the room window rolls over.
+    markNoticeSaid(rec, notice, now);
+    console.log(`[assurance] ${notice} for ${rec.key} is byte-identical to one already in ${rec.channel} — not repeating it`);
+    counters.bump("assurance.notice_deduped", { notice, scope: "room" });
+    return { sent: false, reason: peek.reason || "room-notice-duplicate" };
+  }
+  const res = await o.send(item, text, { kind, idempotencySuffix: o.idempotencySuffix });
+  if (res && res.sent) {
+    markNoticeSaid(rec, notice, now);
+    // SPEND ONLY ON A DELIVERED MESSAGE, exactly as the interim budget does: a
+    // send that failed is a room that heard nothing, and recording it would
+    // suppress the one message that still needed to go out.
+    claim({
+      service: rec.service, channel: rec.channel, notice, text, now,
+      agentRoot: AGENT_REPO_DIR, commit: true,
+    });
+  }
+  return { sent: !!(res && res.sent), reason: res && res.sent ? "sent" : ((res && res.error) || "send-failed") };
+}
+
 // ---------------------------------------------------------------------------
 // Lifecycle
 // ---------------------------------------------------------------------------
 
 /**
- * Open a debt and acknowledge it — in that order.
+ * Open the debt. SAY NOTHING.
+ *
+ * This function used to be named for what it did: open a debt and acknowledge
+ * it, in that order. It no longer acknowledges anything at open time, and the
+ * name is kept only because every caller and every injected test seam in the
+ * fleet uses it.
+ *
+ * WHY NOTHING IS SAID HERE ANY MORE
  *
- * The record is written BEFORE the send, so a crash between the two leaves an
- * un-acked obligation the sweep will notice and compensate. Written after, a
- * crash would leave a human waiting on a debt that nothing knows exists.
+ * Speaking at open time made the interim rate equal to the session rate, which
+ * is what 3,069 opening acknowledgements in fourteen days actually were. An ask
+ * that is answered in ninety seconds needed no holding line; an ask that takes
+ * fifteen minutes is better served by ONE line at ninety seconds than by a
+ * reflex at zero. So the decision moves to the sweep (branch (d)), where two
+ * facts exist that do not exist here: how long the human has actually waited,
+ * and how much this ROOM has already been told.
+ *
+ * What still happens here, unchanged, is the part that was never the problem:
+ * the durable record is written before anything else, so a crash between this
+ * line and the session's first token leaves a debt the sweep will find.
  *
  * @param {object} a
  * @param {object} a.item
@@ -835,18 +1099,17 @@ export function classifyFailure(o = {}) {
  * @param {string} [a.service]
  * @param {string} [a.traceId]
  * @param {number} [a.now]
- * @param {object} [a.deps] {ackSender} — `(item, classResult) => {sent, holdingText,
- *        error}`, i.e. exactly responder.sendHoldingMessage's contract, so the
- *        daemon's existing injected-fake seam keeps working unchanged. Defaults
- *        to generating the line (generateAck; null ⇒ send nothing) and handing
- *        it to transport.
- * @param {boolean} [a.ack=true] open the debt but say nothing. Used when there
- *        is no transport to the requester: the debt is REAL — a session is
- *        about to run and may die — but the compensating action is an operator
- *        escalation, not a message into a channel that does not exist. Opening
- *        it anyway is what turned "one failed session silently deletes the ask"
- *        into a bounded retry with a durable trace.
- * @returns {Promise<{key:string|null, opened:boolean, acked:boolean, ackText:string|null, error?:string}>}
+ * @param {string} [a.tier] "answer" | "work" | "plan" — from `shouldAcknowledge`.
+ *        Recorded on the debt; it is what the sweep consults when deciding
+ *        whether this obligation may ever produce an interim.
+ * @param {object} [a.deps] {ackSender} — retained as a seam for callers that
+ *        still inject one; it is NOT called from this function any more.
+ * @param {boolean} [a.ack=true] false opens the debt and forbids any interim
+ *        ever. Used when there is no transport to the requester: the debt is
+ *        REAL — a session is about to run and may die — but the compensating
+ *        action is an operator escalation, not a message into a channel that
+ *        does not exist.
+ * @returns {Promise<{key:string|null, opened:boolean, acked:boolean, ackText:string|null, reason?:string, tier?:string, error?:string}>}
  */
 export async function openAndAcknowledge(a = {}) {
   const item = a.item || {};
@@ -855,11 +1118,12 @@ export async function openAndAcknowledge(a = {}) {
   const now = Number.isFinite(a.now) ? a.now : Date.now();
   const classResult = a.classResult || {};
   const wantAck = a.ack !== false;
+  const tier = TIER_SET.has(a.tier) ? a.tier : "work";
 
   const existing = readObligation(key);
-  if (existing && existing.state === "open" && existing.acknowledged) {
-    // Already acknowledged (a re-delivery of the same item). Acknowledge ONCE.
-    return { key, opened: false, acked: true, ackText: null, reason: "already-acknowledged" };
+  if (existing && existing.state === "open" && existing.interimSaid) {
+    // A re-delivery of an item this room has already been spoken to about.
+    return { key, opened: false, acked: true, ackText: null, reason: "already-acknowledged", tier: existing.tier || tier };
   }
 
   const rec = existing && existing.state === "open" ? existing : {
@@ -882,8 +1146,16 @@ export async function openAndAcknowledge(a = {}) {
     ackAt: null,
     ackAttempts: 0,
     deliverable: canDeliverTo(item),
-    progressSent: 0,
-    lastProgressAt: null,
+    // THE ONE-INTERIM LATCH. True once anything courtesy-shaped has reached
+    // this human about this ask — an ack or a plan note — and never false
+    // again. It is INHERITED below across a retry that reopens the same key,
+    // which is the half R4 was missing: the old code opened a fresh record per
+    // attempt and each one acked from scratch.
+    interimSaid: false,
+    interimAt: null,
+    // Which outcome notices have already been delivered for this (channel,
+    // key). Also inherited, for the same reason.
+    notices: {},
     attempts: 0,
     lastError: null,
     sessionId: null,
@@ -892,8 +1164,23 @@ export async function openAndAcknowledge(a = {}) {
     state: "open",
     item: itemSnapshot(item),
   };
+  // INHERITANCE ACROSS A RETRY. A stale/failed obligation is CLOSED, and the
+  // item is then re-delivered by the next poll, which opens a brand-new record
+  // under the same key. Without this the new record starts with a clean slate
+  // and narrates the whole lifecycle again — the measured "same failure
+  // sentence three times in one minute", and `On it.` immediately after it.
+  if (existing && existing !== rec) {
+    rec.interimSaid = existing.interimSaid === true;
+    rec.interimAt = existing.interimAt || null;
+    rec.notices = (existing.notices && typeof existing.notices === "object") ? { ...existing.notices } : {};
+  }
+  rec.tier = tier;
   rec.daemonPid = process.pid;
   if (rec.deliverable === undefined) rec.deliverable = canDeliverTo(item);
+  // `ack:false` is durable on the record, not merely an argument: the sweep runs
+  // in a different tick (and possibly a different process) and must be able to
+  // see that this debt was never allowed to speak.
+  if (!wantAck) rec.interimForbidden = true;
   writeRecord(rec);
 
   // NOTE: opening the board row is NOT done here. It belongs to the caller
@@ -905,51 +1192,101 @@ export async function openAndAcknowledge(a = {}) {
   // a private message.
 
   if (!wantAck || !rec.deliverable) {
-    // The debt is on the books and the sweep will not try to speak into a
-    // channel that does not exist (see sweepObligations branch (b)). What it
-    // WILL do is escalate if the work then fails — which is the whole point of
-    // opening a record we cannot acknowledge.
-    return { key, opened: true, acked: false, ackText: null, reason: rec.deliverable ? "ack-suppressed" : "no-transport" };
+    return { key, opened: true, acked: false, ackText: null, tier, reason: rec.deliverable ? "ack-suppressed" : "no-transport" };
   }
+  if (rec.interimSaid) {
+    return { key, opened: true, acked: true, ackText: null, tier, reason: "interim-already-said" };
+  }
+  // The debt is open and an interim is PERMITTED — later, by the sweep, if the
+  // human is still waiting after ACK_AFTER_MS and the room can afford it.
+  return { key, opened: true, acked: false, ackText: null, tier, reason: `tier-${tier}-deferred` };
+}
 
-  const ackSender = (a.deps && a.deps.ackSender)
-    || (async (i, cr) => {
-      // GENERATE, then send — and if generation yields nothing, send NOTHING.
-      // The canned-string fallback is gone by design; see generateAck.
-      const t = await generateAck(i, cr, a.deps && a.deps.ackGen);
-      if (t == null) return { sent: false, holdingText: null, error: "ack_generation_failed", genFailed: true };
-      const r = await deliverWithRetry(i, t, { kind: "ack", ...(a.deps && a.deps.sleep ? { sleep: a.deps.sleep } : {}) });
-      return { sent: r.sent, holdingText: t, error: r.error };
-    });
-  const res = await ackSender(item, classResult);
-  const text = (res && res.holdingText) || null;
+/**
+ * PLAN TIER: post the plan the session itself stated — once, or not at all.
+ *
+ * The only interim that is allowed to exist at full volume. The daemon calls
+ * this as soon as it has the session's first assistant turn; `renderPlanNote`
+ * turns that turn's stated intent into at most three bullets IN THE MODEL'S OWN
+ * WORDS, or returns null. Null means post NOTHING — a rendered template over an
+ * absent first turn would be a fabricated plan, which is strictly worse than
+ * the generic ack it replaced, because it would be a specific lie rather than a
+ * vague reflex.
+ *
+ * Same three gates as the sweep's interim: the tier must permit it, the debt
+ * must not already have spoken (`interimSaid`), and the ROOM must be able to
+ * afford it. Unlike the sweep's interim this one is not time-gated — a plan is
+ * the first step of the work, not a stand-in for it, so it is worth hearing at
+ * once.
+ *
+ * If no plan can be derived, nothing is posted here and the obligation falls
+ * back to the sweep's single interim at ACK_AFTER_MS. That is not a silent
+ * downgrade to a template: the fallback is the bespoke generated line, which
+ * never claims to be a plan.
+ *
+ * NOT YET CALLED BY THE DAEMON, AND THAT IS A ROUTING FACT, NOT AN OVERSIGHT.
+ * The only place a first assistant turn could come from is the dispatched
+ * session's stdout, and `dispatcher.mjs` spawns with `--output-format json`
+ * (not `stream-json`) precisely so the run's stdout carries the cost ledger's
+ * token usage. That format yields ONE result object when the process exits — by
+ * which time the session has already delivered its answer, and a "plan" posted
+ * behind it would be the machine narrating work it has finished. Streaming the
+ * session is a dispatcher change and belongs with WP-2's dispatcher wiring.
+ *
+ * Until then a plan-tier debt degrades to the WORK path — the sweep's single
+ * interim at ACK_AFTER_MS, inside the room budget — because the sweep gates on
+ * `tier !== "answer"`, not on `tier === "work"`. Pinned by a test, because the
+ * failure that would matter is the other one: a tier that produces silence.
+ *
+ * @param {object} a
+ * @param {string} a.key         obligation key
+ * @param {unknown} a.firstTurn  the session's first assistant turn, in any of
+ *                               the shapes `firstAssistantText` understands
+ * @param {number} [a.now]
+ * @param {object} [a.deps] {deliverImpl, roomBudgetImpl, renderImpl}
+ * @returns {Promise<{spoke:boolean, text:string|null, reason:string}>}
+ */
+export async function notePlan(a = {}) {
+  const rec = readObligation(a.key);
+  if (!rec) return { spoke: false, text: null, reason: "no-obligation" };
+  if (rec.state !== "open") return { spoke: false, text: null, reason: "not-open" };
+  if (rec.tier !== "plan") return { spoke: false, text: null, reason: `tier-${rec.tier || "unknown"}` };
+  if (rec.interimSaid) return { spoke: false, text: null, reason: "interim-already-said" };
+  if (rec.interimForbidden || rec.deliverable === false) return { spoke: false, text: null, reason: "no-transport" };
 
-  if (res && res.sent) {
-    rec.acknowledged = true;
-    rec.ackAt = Number.isFinite(a.now) ? a.now : Date.now();
+  const now = Number.isFinite(a.now) ? a.now : Date.now();
+  const render = (a.deps && a.deps.renderImpl) || renderPlanNote;
+  const text = render(a.firstTurn);
+  // NEVER FABRICATE A PLAN. No derivable plan is not a reason to say something
+  // else; it is a reason to say nothing.
+  if (!text) return { spoke: false, text: null, reason: "no-plan-stated" };
+
+  const budget = (a.deps && a.deps.roomBudgetImpl ? a.deps.roomBudgetImpl : claimRoomInterim)({
+    service: rec.service, channel: rec.channel, now, agentRoot: AGENT_REPO_DIR,
+  });
+  if (!budget || !budget.allowed) {
+    rec.interimSaid = true;
+    rec.interimSuppressedAt = now;
     writeRecord(rec);
-    return { key, opened: true, acked: true, ackText: text };
+    counters.bump("assurance.interim_suppressed", { reason: (budget && budget.reason) || "room-budget" });
+    return { spoke: false, text: null, reason: (budget && budget.reason) || "room-budget-spent" };
   }
-  if (res && res.genFailed) {
-    // The MODEL failed, not the channel. Deliberate silence: no message went
-    // out and none will be faked. The debt stays open; the sweep gives
-    // generation one more chance (bounded by ACK_GEN_MAX_FAILURES), and the
-    // progress/failure notices still cover the human either way.
-    rec.ackGenFailures = (rec.ackGenFailures || 0) + 1;
-    if (rec.ackGenFailures >= ACK_GEN_MAX_FAILURES) rec.ackSuppressed = true;
-    rec.lastError = "ack_generation_failed";
+
+  const send = (a.deps && a.deps.deliverImpl) || deliver;
+  const res = await send(rec.item || {}, text, { kind: "plan", idempotencySuffix: "plan" });
+  if (res && res.sent) {
+    rec.acknowledged = true;
+    rec.ackAt = now;
+    rec.interimSaid = true;
+    rec.interimAt = now;
     writeRecord(rec);
-    console.warn(`[assurance] ack for ${key} not generated — deliberate silence; debt open${rec.ackSuppressed ? ", further ack attempts suppressed" : " for one sweep retry"}`);
-    return { key, opened: true, acked: false, ackText: null, error: rec.lastError, reason: "ack-generation-failed" };
+    return { spoke: true, text, reason: "plan-posted" };
   }
-  // NOT fatal, and NOT forgotten: the debt stays open and un-acked, and the
-  // sweep retries it within ACK_GRACE_MS. This is precisely the case the old
-  // code logged and dropped.
-  rec.lastError = (res && res.error) || "ack send failed";
-  rec.ackAttempts = (rec.ackAttempts || 0) + 1;
+  // A failed send leaves the latch OPEN: the sweep's interim branch is the
+  // backstop, exactly as it is for a failed ack.
+  rec.lastError = (res && res.error) || "plan send failed";
   writeRecord(rec);
-  console.warn(`[assurance] ack not delivered for ${key} (${rec.lastError}) — obligation left open for sweep`);
-  return { key, opened: true, acked: false, ackText: text, error: rec.lastError };
+  return { spoke: false, text, reason: rec.lastError };
 }
 
 /**
@@ -1077,7 +1414,7 @@ export async function settleSession(a = {}) {
     obligation: rec,
     now,
     siblingOpenCount: siblingsInRoom(rec, openObligations()),
-    excludeKinds: ["ack", "progress", "failure"],
+    excludeKinds: NON_ANSWER_KINDS,
     agentRoot: AGENT_REPO_DIR,
     // Legacy shape, for a seam injected as the older channel-scoped predicate.
     channel: rec.channel,
@@ -1112,7 +1449,25 @@ export async function settleSession(a = {}) {
   writeRecord(rec);
 
   const text = composeFailure(rec, { failure, willRetry });
-  const res = await send(item, text, { kind: "failure", idempotencySuffix: `failure-${attempts}` });
+  // SAID ONCE PER (channel, key, notice). The retry loop is what made this
+  // necessary: a transient failure posts a notice, the item is retried, a fresh
+  // obligation opens under the same key, it fails the same way, and the same
+  // sentence lands again — three times in one minute, as measured. The notice
+  // ledger is inherited across that reopen (see openAndAcknowledge), so the
+  // repeat is suppressed at the source. The two DISTINCT facts — "a retry is
+  // running" and "I have stopped" — remain separately sayable.
+  //
+  // The sibling case — twenty separate asks in one room whose sessions all die
+  // the same way, each composing the identical sentence — is covered by the
+  // room-scoped half of `sayOutcomeNotice`, which the per-record ledger
+  // structurally cannot reach.
+  const notice = willRetry ? NOTICE.FAILURE_RETRYING : NOTICE.FAILURE_FINAL;
+  const res = await sayOutcomeNotice({
+    rec, notice, text, item, kind: "failure",
+    idempotencySuffix: `failure-${attempts}`, now, send,
+    roomNoticeImpl: a.deps && a.deps.roomNoticeImpl,
+  });
+  writeRecord(rec);
 
   if (willRetry) {
     // The debt stays OPEN and the inbox item stays un-`.processed`, so the next
@@ -1127,12 +1482,12 @@ export async function settleSession(a = {}) {
     // message they received minutes earlier, while the retry runs.
     rec.lastAttemptAt = now;
     writeRecord(rec);
-    return { spoke: !!(res && res.sent), text, verdict: `retrying:${failure.label}`, willRetry: true };
+    return { spoke: res.sent, text, verdict: `retrying:${failure.label}`, willRetry: true };
   }
 
-  escalate(rec, { failure, now, told: !!(res && res.sent) });
+  escalate(rec, { failure, now, told: res.sent });
   closeObligation(a.key, { outcome: "failed", now, note: failure.label });
-  return { spoke: !!(res && res.sent), text, verdict: `failed:${failure.label}`, willRetry: false };
+  return { spoke: res.sent, text, verdict: `failed:${failure.label}`, willRetry: false };
 }
 
 function safeResultText(stdout) {
@@ -1191,17 +1546,57 @@ export function escalate(rec, o = {}) {
  * needs is on disk, so the first tick after a restart is as effective as the
  * hundredth tick of a healthy process.
  *
+ * NOT RE-ENTRANT, AND ENFORCED. `agent-daemon.mjs` fires this on a 60-second
+ * `setInterval` with no in-flight guard of its own, and one tick is NOT bounded
+ * by 60 seconds: branch (e) peeks the room budget, then awaits `generateAck` —
+ * a cold `claude --print` spawn bounded at ACK_GEN_TIMEOUT_MS — serialised per
+ * obligation. A daemon holding a dozen-plus eligible obligations in distinct
+ * rooms spends more than a tick in generation alone, so tick N+1 would begin
+ * while tick N was still composing. Both would then peek the SAME room's budget
+ * and read "allowed", because the spend is only committed after a successful
+ * send. That is a read-compose-write race, and the `commit:false` peek is what
+ * widened it from a read-then-write one.
+ *
+ * A module-scoped flag rather than a lock file: the overlap is within ONE
+ * process, a lock file would add a way to wedge the sweep permanently, and the
+ * cross-process case (two daemons on one AGENT_DIR) is a different exposure
+ * already covered by `foreignOwnerAlive`. Reset in a `finally`, so a throw
+ * cannot leave the sweep disabled for the life of the daemon; `_resetSweepGuard`
+ * is the test seam.
+ *
+ * Skipping is NOT a lost tick. Every decision here is derived from disk and
+ * from `now`, so the next tick 60 seconds later reaches exactly the same
+ * conclusions about anything still owed.
+ *
  * @param {object} [a]
  * @param {number} [a.now]
  * @param {object} [a.deps] {deliverImpl, spokeSinceImpl}
- * @returns {Promise<{swept:number, acked:number, progressed:number, staled:number, closed:number}>}
+ * @returns {Promise<{swept:number, acked:number, staled:number, closed:number, interrupted:number, unreachable:number, suppressed:number, skipped?:boolean}>}
  */
+let _sweepInFlight = false;
+
+/** Test seam for the re-entrancy guard above. */
+export function _resetSweepGuard() { _sweepInFlight = false; }
+
 export async function sweepObligations(a = {}) {
+  if (_sweepInFlight) {
+    counters.bump("assurance.sweep_overlap", {});
+    return { swept: 0, acked: 0, staled: 0, closed: 0, interrupted: 0, unreachable: 0, suppressed: 0, skipped: true };
+  }
+  _sweepInFlight = true;
+  try {
+    return await _sweepObligations(a);
+  } finally {
+    _sweepInFlight = false;
+  }
+}
+
+async function _sweepObligations(a = {}) {
   const now = Number.isFinite(a.now) ? a.now : Date.now();
   const send = (a.deps && a.deps.deliverImpl) || deliver;
   const heardBy = (a.deps && (a.deps.spokeForImpl || a.deps.spokeSinceImpl)) || spokeFor;
   const alive = (a.deps && a.deps.isPidAliveImpl) || isPidAlive;
-  const stats = { swept: 0, acked: 0, progressed: 0, staled: 0, closed: 0, interrupted: 0, unreachable: 0 };
+  const stats = { swept: 0, acked: 0, staled: 0, closed: 0, interrupted: 0, unreachable: 0, suppressed: 0 };
 
   const open = openObligations();
   for (const rec of open) {
@@ -1232,7 +1627,7 @@ export async function sweepObligations(a = {}) {
       obligation: rec,
       now,
       siblingOpenCount: siblingsInRoom(rec, open),
-      excludeKinds: ["ack", "progress", "failure"],
+      excludeKinds: NON_ANSWER_KINDS,
       agentRoot: AGENT_REPO_DIR,
       channel: rec.channel,
       sinceMs: rec.openedAt || now,
@@ -1270,36 +1665,155 @@ export async function sweepObligations(a = {}) {
     if (workAge >= STALE_AFTER_MS) {
       const failure = { transient: false, label: "no_outcome", human: "the work never came back with a result and has now outrun its time limit" };
       const text = composeFailure(rec, { failure, willRetry: false });
-      const res = await send(item, text, { kind: "failure", idempotencySuffix: "failure-stale" });
+      // SAID ONCE PER (channel, key) — AND once per identical sentence per
+      // room. The retry loop used to narrate every attempt (notice → retry →
+      // fresh obligation → notice), and the notice ledger inherited across the
+      // reopen closes that. The OTHER shape reaches the same screen: this
+      // branch's `human` text is a fixed string with nothing in it about which
+      // ask died, so twenty sibling debts staling together composed twenty
+      // byte-identical sentences into one room. `sayOutcomeNotice` carries both
+      // dedupes; see its header for why suppressing the identical copy loses no
+      // information and why a DIFFERENT notice is never suppressed.
+      const res = await sayOutcomeNotice({
+        rec, notice: NOTICE.FAILURE_FINAL, text, item, kind: "failure",
+        idempotencySuffix: "failure-stale", now, send,
+        roomNoticeImpl: a.deps && a.deps.roomNoticeImpl,
+      });
+      // Persist BEFORE closing: `closeObligation` re-reads the record from
+      // disk, so an in-memory notice stamp that is not written is a stamp the
+      // next retry will not inherit.
+      writeRecord(rec);
       escalate(rec, { failure, now, told: !!(res && res.sent) });
       closeObligation(rec.key, { outcome: "failed", now, note: "stale-no-outcome" });
       stats.staled++;
       continue;
     }
 
-    // (d) An acknowledgement that never made it out. Compensate it — this is
-    // the 66%-of-the-time case that used to be logged and dropped. Bounded
-    // twice: ACK_MAX_ATTEMPTS above bounds failed SENDS, and
-    // ACK_GEN_MAX_FAILURES here bounds failed GENERATIONS — a model path that
-    // cannot produce the line stops being asked, the ack is given up on
-    // (deliberate silence, never a canned line), and the debt itself stays
-    // open so progress/failure notices still speak.
-    if (!rec.acknowledged && !rec.ackSuppressed && !foreignOwnerAlive && age >= ACK_GRACE_MS) {
+    // (d) Interrupted: the debt was opened by a daemon that is no longer this
+    // process, and nothing has closed it. The work died with that process.
+    //
+    // A pid MISMATCH alone does not establish that. Two daemons on one AGENT_DIR
+    // — a manual run next to the launchd one, which is what an operator does
+    // while debugging — each see the other's healthy, actively-running debts as
+    // foreign. Unguarded, both tell those requesters "my session was
+    // interrupted" seconds after the ask arrived, while the work runs fine
+    // behind the apology. So: the owning process must be provably GONE, and the
+    // debt must have sat still long enough that a live handover would have shown
+    // up by now.
+    if (
+      rec.daemonPid && rec.daemonPid !== process.pid && !rec.interruptedNotifiedAt
+      && workAge >= INTERRUPT_GRACE_MS && !alive(rec.daemonPid)
+    ) {
+      if (noticeAlreadySaid(rec, NOTICE.INTERRUPTED)) {
+        // Said once per (channel, key), inherited across a retry that reopens
+        // the same key. Two daemon restarts over one long ask are one apology.
+        rec.interruptedNotifiedAt = now;
+        rec.daemonPid = process.pid;
+        writeRecord(rec);
+        counters.bump("assurance.notice_deduped", { notice: NOTICE.INTERRUPTED });
+        continue;
+      }
+      const text = composeInterrupted(rec);
+      const res = await sayOutcomeNotice({
+        rec, notice: NOTICE.INTERRUPTED, text, item, kind: "notice",
+        idempotencySuffix: `interrupted-${rec.attempts || 0}`, now, send,
+        roomNoticeImpl: a.deps && a.deps.roomNoticeImpl,
+      });
+      rec.interruptedNotifiedAt = now;
+      rec.daemonPid = process.pid;
+      writeRecord(rec);
+      if (res.sent) stats.interrupted++;
+      continue;
+    }
+
+    // (e) THE ONE INTERIM. This is the only branch in the system that emits a
+    // courtesy message, and it is gated four ways before it does:
+    //
+    //   TIME   — nothing at all before ACK_AFTER_MS. Below ninety seconds the
+    //            typing indicator is the acknowledgement; a message there is
+    //            the reflex that produced 3,069 of them in a fortnight.
+    //   TIER   — the `answer` tier is checked HERE as well as at the call site.
+    //            `shouldAcknowledge` already returns ack:false for it, which the
+    //            daemon turns into `interimForbidden`, but the tier is durable on
+    //            the record and is the thing that actually means "never speak
+    //            about this one"; a caller that passes the tier and forgets the
+    //            flag must not be able to re-open the flood.
+    //   ONCE   — `interimSaid` latches true and is inherited across a retry that
+    //            reopens the same key, so a retry loop cannot re-introduce
+    //            itself as a first contact.
+    //   ROOM   — and above all of those, the per-(service, channel) budget:
+    //            at most ONE interim per room per window, however many
+    //            obligations are open in it — FOR THIS SEAT. The ledger lives
+    //            under AGENT_DIR, and there is no shared store between seats,
+    //            so an 8-seat room's ceiling from this gate alone is 8 × (60/15)
+    //            = 32/h, against a measured content-free rate of ~14/h in that
+    //            room. It is therefore the BACKSTOP, not the thing that removes
+    //            the measured flood: the deleted progress branch (961 → 0), the
+    //            sanitiser, and TIME+ONCE above are what do that. What this gate
+    //            uniquely prevents is one seat holding twenty concurrent asks in
+    //            one channel emitting twenty individually-defensible holding
+    //            lines. See room-budget.mjs's header for the full arithmetic.
+    //
+    // ORDERED AFTER the interrupted notice, deliberately. An OUTCOME outranks a
+    // courtesy: "my session was interrupted" is a fact the human cannot get any
+    // other way, and a holding line posted immediately in front of it ("I'm on
+    // the git fixes") reads as the machine contradicting itself.
+    //
+    // Generation is still bounded twice — ACK_MAX_ATTEMPTS above bounds failed
+    // SENDS, ACK_GEN_MAX_FAILURES here bounds failed GENERATIONS — and a
+    // generation that yields nothing usable still sends NOTHING rather than a
+    // canned line. The debt stays open either way: silence about timing is not
+    // silence about outcome, and the failure/stale notices still speak.
+    if (
+      !rec.interimSaid && !rec.interimForbidden && !rec.ackSuppressed
+      && rec.tier !== "answer"
+      && !foreignOwnerAlive && age >= ACK_AFTER_MS
+    ) {
+      const budgetOf = (a.deps && a.deps.roomBudgetImpl) || claimRoomInterim;
+      // ASK, then compose, then SPEND. The interim's text comes from a model
+      // call that can fail; claiming the room's fifteen minutes before the
+      // message exists would gag the room in exchange for nothing.
+      const budget = budgetOf({
+        service: rec.service,
+        channel: rec.channel,
+        now,
+        agentRoot: AGENT_REPO_DIR,
+        commit: false,
+      });
+      if (!budget || !budget.allowed) {
+        // OVER BUDGET IS NOT A DROP. The debt stays open and tracked exactly as
+        // it was; what is withheld is the content-free half. The room has heard
+        // from this agent inside the window and does not need to hear it again.
+        rec.interimSaid = true;
+        rec.interimSuppressedAt = now;
+        writeRecord(rec);
+        counters.bump("assurance.interim_suppressed", { reason: (budget && budget.reason) || "room-budget" });
+        stats.suppressed++;
+        continue;
+      }
       const gen = (a.deps && a.deps.generateAckImpl) || generateAck;
       const text = await gen(item, { summary: rec.summary, model: rec.model, priority: rec.priority });
       if (text == null) {
         rec.ackGenFailures = (rec.ackGenFailures || 0) + 1;
         if (rec.ackGenFailures >= ACK_GEN_MAX_FAILURES) {
           rec.ackSuppressed = true;
-          console.warn(`[assurance] ack for ${rec.key} suppressed after ${rec.ackGenFailures} failed generations — deliberate silence, never a canned line`);
+          console.warn(`[assurance] interim for ${rec.key} suppressed after ${rec.ackGenFailures} failed generations — deliberate silence, never a canned line`);
         }
         writeRecord(rec);
         continue; // nothing to send; one decision per obligation per tick
       }
       const res = await send(item, text, { kind: "ack", idempotencySuffix: "ack" });
       if (res && res.sent) {
+        // SPEND ONLY ON A DELIVERED MESSAGE. A send that failed is a room that
+        // heard nothing; charging it anyway would gag the room for fifteen
+        // minutes AND latch this debt shut, so the one case the sweep exists to
+        // compensate — an interim that would not go out — would be the one case
+        // it stopped compensating.
+        budgetOf({ service: rec.service, channel: rec.channel, now, agentRoot: AGENT_REPO_DIR, commit: true });
         rec.acknowledged = true;
         rec.ackAt = now;
+        rec.interimSaid = true;
+        rec.interimAt = now;
         writeRecord(rec);
         stats.acked++;
       } else {
@@ -1312,45 +1826,19 @@ export async function sweepObligations(a = {}) {
       continue; // one message per obligation per tick, always
     }
 
-    // (e) Interrupted: the debt was opened by a daemon that is no longer this
-    // process, and nothing has closed it. The work died with that process.
+    // (f) WAS "long work gets progress, not silence — capped". DELETED.
     //
-    // A pid MISMATCH alone does not establish that. Two daemons on one AGENT_DIR
-    // — a manual run next to the launchd one, which is what an operator does
-    // while debugging — each see the other's healthy, actively-running debts as
-    // foreign. Unguarded, both tell those requesters "my session was
-    // interrupted" seconds after the ask arrived, while the work runs fine
-    // behind the apology. So: the owning process must be provably GONE, and the
-    // debt must have sat still long enough that a live handover would have shown
-    // up by now.
-    if (
-      rec.daemonPid && rec.daemonPid !== process.pid && !rec.interruptedNotifiedAt
-      && workAge >= INTERRUPT_GRACE_MS && !alive(rec.daemonPid)
-    ) {
-      const text = composeInterrupted(rec);
-      const res = await send(item, text, { kind: "progress", idempotencySuffix: `interrupted-${rec.attempts || 0}` });
-      rec.interruptedNotifiedAt = now;
-      rec.daemonPid = process.pid;
-      writeRecord(rec);
-      if (res && res.sent) stats.interrupted++;
-      continue;
-    }
-
-    // (f) Long work gets progress, not silence — capped.
-    const sinceUpdate = now - (rec.lastProgressAt || rec.ackAt || rec.openedAt || now);
-    const due = (rec.progressSent || 0) === 0
-      ? age >= PROGRESS_AFTER_MS
-      : sinceUpdate >= PROGRESS_EVERY_MS;
-    if (due && !foreignOwnerAlive && (rec.progressSent || 0) < PROGRESS_MAX) {
-      const text = composeProgress(rec, { now });
-      const res = await send(item, text, { kind: "progress", idempotencySuffix: `progress-${(rec.progressSent || 0) + 1}` });
-      if (res && res.sent) {
-        rec.progressSent = (rec.progressSent || 0) + 1;
-        rec.lastProgressAt = now;
-        writeRecord(rec);
-        stats.progressed++;
-      }
-    }
+    // It emitted `composeProgress`, whose entire content was `now - openedAt`
+    // rendered as minutes. 961 of those shipped in fourteen days. Nothing read
+    // the running session's stdout, its tool calls or its partial findings, so
+    // the branch could not have said anything a reader could not already see on
+    // the clock — and it said it from a per-obligation timer, so two
+    // overlapping debts in one room narrated each other at the same instant.
+    //
+    // Long work now reports CONTENT or it stays quiet: `notePlan` posts the
+    // plan the session itself stated, once, subject to the same room budget.
+    // The human is not left in the dark — the stale check (c) and the failure
+    // path in `settleSession` still speak, and they carry facts.
   }
 
   pruneObligations({ now });
@@ -1364,17 +1852,30 @@ export function pruneObligations(o = {}) {
   let removed = 0;
   for (const rec of listObligations()) {
     if (!rec || rec.state === "open") continue;
+    // A record with no key cannot be addressed, so `pathFor` would resolve to
+    // `unknown.json` and delete whatever happens to be there. `listObligations`
+    // already refuses those; this is the belt to that brace, because the cost
+    // of the two disagreeing is silent data loss rather than a bad count.
+    if (typeof rec.key !== "string" || !rec.key) continue;
+    // A closed record missing its stamp is still due for pruning — `|| 0` keeps
+    // that, deliberately. The phantom this guard is really about is the one
+    // with no key at all, handled above.
     if (now - (rec.closedAt || 0) < CLOSED_RETENTION_MS) continue;
     try { unlinkSync(pathFor(rec.key)); removed++; } catch { /* best-effort */ }
   }
   return removed;
 }
 
-/** Test seam: wipe the ledger. */
+/** Test seam: wipe the ledger — obligations, escalations AND the room budget.
+ *  The room budget lives in the same directory and is part of the same state:
+ *  a reset that leaves it behind makes the next test's first interim depend on
+ *  which tests ran before it. */
 export function _resetObligations() {
+  _sweepInFlight = false; // a test that threw mid-sweep must not disable the next one
   for (const rec of listObligations()) {
     try { unlinkSync(pathFor(rec.key)); } catch { /* */ }
   }
+  try { unlinkSync(roomBudgetPath(AGENT_REPO_DIR)); } catch { /* absent is the normal case */ }
   try {
     const dir = join(obligationDir(), "needs-attention");
     for (const f of readdirSync(dir)) { try { unlinkSync(join(dir, f)); } catch { /* */ } }
@@ -1389,12 +1890,15 @@ export default {
   narratorPatterns,
   generateAck,
   sanitiseAckText,
-  composeProgress,
   composeFailure,
   composeSilentSuccess,
   composeInterrupted,
   classifyFailure,
   openAndAcknowledge,
+  notePlan,
+  _resetSweepGuard,
+  noticeAlreadySaid,
+  markNoticeSaid,
   noteSession,
   settleSession,
   sweepObligations,