@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/scripts/daemon/assurance.test.mjs

@@ -1,1791 +0,0 @@
-/**
- * assurance.test.mjs — the four ways an ask used to end in silence, and the
- * message the human now gets instead of each of them.
- *
- * Run: node --test scripts/daemon/assurance.test.mjs
- *
- * Every test here uses an INJECTED FAKE for transport. Nothing in this file
- * touches Slack, Gmail, hq or the live workspace, and no test spawns a model.
- * That is not only hygiene — it is the point being proven: the whole
- * acknowledgement path is now deterministic string work, so a test can assert
- * the exact words a human would read.
- */
-
-import { test, describe, before, beforeEach, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, mkdirSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-// Point the whole module tree at a scratch root BEFORE importing anything that
-// resolves AGENT_DIR at module load.
-const ROOT = mkdtempSync(join(tmpdir(), "assurance-test-"));
-process.env.AGENT_DIR = ROOT;
-process.env.AGENT_ROOT = ROOT;
-mkdirSync(join(ROOT, "state"), { recursive: true });
-
-const assurance = await import("./assurance.mjs");
-const receipts = await import("../../lib/comms/receipts.mjs");
-
-const {
-  shouldAcknowledge,
-  generateAck,
-  sanitiseAckText,
-  composeFailure,
-  composeSilentSuccess,
-  isOwnNarratorText,
-  SILENT_SUCCESS_EXCERPT_LIMIT,
-  classifyFailure,
-  openAndAcknowledge,
-  settleSession,
-  sweepObligations,
-  readObligation,
-  openObligations,
-  _resetObligations,
-  ACK_AFTER_MS,
-  ACK_MIN_CHARS,
-  RETIRED_NARRATOR_TEMPLATES,
-  notePlan,
-  NOTICE,
-  STALE_AFTER_MS,
-  INTERRUPT_GRACE_MS,
-  ACK_MAX_ATTEMPTS,
-  ACK_GEN_MAX_FAILURES,
-  RETRY_MAX,
-} = assurance;
-
-after(() => { try { rmSync(ROOT, { recursive: true, force: true }); } catch { /* */ } });
-
-// ---------------------------------------------------------------------------
-// Fakes
-// ---------------------------------------------------------------------------
-
-/** A transport that records what a human would have read, and can be told to fail.
- *  The ackSender mirrors responder.sendHoldingMessage's NEW contract exactly:
- *  a generated bespoke line on success, and `{sent:false, holdingText:null,
- *  genFailed:true}` — i.e. deliberate silence — when generation fails. */
-const FAKE_ACK_LINE = "Give me a few minutes on the git fixes.";
-function fakeTransport(opts = {}) {
-  const sent = [];
-  let failures = opts.failTimes || 0;
-  const impl = async (item, text, o = {}) => {
-    if (failures > 0) { failures--; return { sent: false, via: null, error: opts.error || "network unreachable" }; }
-    sent.push({ to: item.sender, channel: item.channel_id || item.channel, kind: o.kind || "reply", text });
-    return { sent: true, via: "fake", channel: item.channel_id || item.channel };
-  };
-  return { sent, impl, ackSender: async (item, cr) => {
-    if (opts.genFail) return { sent: false, holdingText: null, error: "ack_generation_failed", genFailed: true };
-    const text = opts.ackText || FAKE_ACK_LINE;
-    const r = await impl(item, text, { kind: "ack" });
-    return { sent: r.sent, holdingText: text, error: r.error };
-  } };
-}
-
-const ITEM = {
-  id: "msg-1001",
-  raw_ref: "cohort:cmql18026:1001",
-  message_id: "1001",
-  service: "cohort",
-  channel_id: "cmql1802601iihhzpf774vwbk",
-  sender: "Dana Whitfield",
-  content: "with that in mind, fix these issues you just noted please and push their fixes to git",
-};
-
-const CLASS_COMPLEX = { action: "respond", priority: "critical", model: "opus", summary: "Fix the noted issues and push the fixes to git" };
-
-beforeEach(() => { _resetObligations(); });
-
-// ---------------------------------------------------------------------------
-// 1. THE JUDGEMENT — simple asks must NOT get "I'll look into it"
-// ---------------------------------------------------------------------------
-
-describe("shouldAcknowledge — the simple/complex distinction", () => {
-  test("a fast ask answered in this turn gets NO acknowledgement", () => {
-    // The quick path already sent the answer. An ack here is pure noise.
-    const v = shouldAcknowledge({ willSpawnSession: false, item: ITEM, source: "inbox" });
-    assert.equal(v.ack, false);
-    assert.equal(v.reason, "answered-in-turn");
-  });
-
-  test("a slow ask that spawns a session DOES get one", () => {
-    const v = shouldAcknowledge({ willSpawnSession: true, item: ITEM, source: "inbox" });
-    assert.equal(v.ack, true);
-  });
-
-  test("REGRESSION: a `queue` action still gets one", () => {
-    // classifier.mjs's heuristic fallback (used when the LLM classifier itself
-    // fails) emits action:"queue". The old gate was
-    // `respond || draft || research`, so exactly when classification degraded, a
-    // directed DM got a 45-minute session and total silence. The gate no longer
-    // consults the classifier at all.
-    const v = shouldAcknowledge({ willSpawnSession: true, item: ITEM, source: "inbox", classResult: { action: "queue" } });
-    assert.equal(v.ack, true, "a degraded classification must not cost the human their acknowledgement");
-  });
-
-  test("backlog work, which nobody is waiting on, gets none", () => {
-    assert.equal(shouldAcknowledge({ willSpawnSession: true, item: ITEM, source: "backlog" }).ack, false);
-  });
-
-  test("an item with no resolvable reply target gets none (nowhere to send it)", () => {
-    const orphan = { ...ITEM, channel_id: null, channel: null };
-    assert.equal(shouldAcknowledge({ willSpawnSession: true, item: orphan, source: "inbox" }).ack, false);
-  });
-
-  test("REGRESSION: the agent's OWN echoed message is never acknowledged (self-echo guard #2)", async () => {
-    // 25/27/30 Aug 2026: the poll lane re-ingested the agent's own outbound
-    // sends and the daemon said "Looking now." to itself — in shared DMs two
-    // agents traded canned acks at each other. Ingestion now drops echoes
-    // (agent-daemon + self-echo.mjs); this is the second, independent guard on
-    // the ack decision itself.
-    const { writeFileSync } = await import("node:fs");
-    const selfEcho = await import("./lib/self-echo.mjs");
-    mkdirSync(join(ROOT, "config"), { recursive: true });
-    writeFileSync(join(ROOT, "config", "agent.json"), JSON.stringify({
-      firstName: "Isla", fullName: "Isla Roselli", memberId: "cmqh0tcml004ihhl6zev6ocb5",
-    }));
-    selfEcho._resetSelfIdentity();
-    try {
-      // The REAL echoed shape: display name verbatim, spaces and all.
-      const echo = { ...ITEM, sender: "Isla Roselli" };
-      const v = shouldAcknowledge({ willSpawnSession: true, item: echo, source: "inbox" });
-      assert.equal(v.ack, false);
-      assert.equal(v.reason, "self-sender");
-      // The old filter's normalised form must ALSO match — it is how the echo
-      // slipped through three times.
-      assert.equal(shouldAcknowledge({ willSpawnSession: true, item: { ...ITEM, sender: "isla-roselli" }, source: "inbox" }).ack, false);
-      // And a genuine human sender still gets their acknowledgement.
-      assert.equal(shouldAcknowledge({ willSpawnSession: true, item: ITEM, source: "inbox" }).ack, true);
-    } finally {
-      rmSync(join(ROOT, "config", "agent.json"), { force: true });
-      selfEcho._resetSelfIdentity();
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 1b. THE DISPATCH GATE READS THE INBOUND — a seat must not ack (and its
-//     caller must not spawn) on output its own emitter class produces.
-// ---------------------------------------------------------------------------
-
-describe("shouldAcknowledge — the dispatch gate reads item.content", () => {
-  // A peer AGENT seat, identified structurally (seat-slug id / agent↔agent DM),
-  // never by name.
-  const PEER_ACK = {
-    ...ITEM,
-    sender: "Piotr Novak",
-    sender_id: "A039",
-    content: "On it — taking a look now.",
-  };
-
-  test("REGRESSION: an ack-shaped one-liner from a peer agent seat gets NO ack and signals NO spawn", () => {
-    const v = shouldAcknowledge({ willSpawnSession: true, item: PEER_ACK, source: "inbox" });
-    assert.equal(v.ack, false);
-    assert.equal(v.reason, "peer-ack-shaped");
-    assert.equal(v.emitterClass, true, "the caller reads this to skip the session spawn too");
-  });
-
-  test("the SHAPE matches, not a phrase list — every 'Looking now' variant from a seat is refused", () => {
-    for (const content of ["On it.", "Looking now", "Taking the git fixes now — push coming.", "Still digging into this."]) {
-      const v = shouldAcknowledge({ willSpawnSession: true, item: { ...PEER_ACK, content }, source: "inbox" });
-      assert.equal(v.ack, false, `"${content}" is ack-shaped`);
-      assert.equal(v.emitterClass, true);
-    }
-  });
-
-  test("an agent↔agent DM channel is an agent-seat signal too", () => {
-    const v = shouldAcknowledge({
-      willSpawnSession: true,
-      item: { ...ITEM, sender: "Piotr Novak", channel: "dm-a016-a039", content: "On it." },
-      source: "inbox",
-    });
-    assert.equal(v.ack, false);
-    assert.equal(v.reason, "peer-ack-shaped");
-  });
-
-  test("the SAME short line from a HUMAN sender passes — shape alone is not enough", () => {
-    // No seat-slug id, no agent DM channel: treated as human, and a human's
-    // terse "On it" must never be met with silence.
-    const v = shouldAcknowledge({ willSpawnSession: true, item: { ...ITEM, content: "On it — will do." }, source: "inbox" });
-    assert.equal(v.ack, true);
-  });
-
-  test("a QUESTION or a REQUEST from a peer agent seat still passes the gate", () => {
-    for (const content of [
-      "did the migration land cleanly?",
-      "please push the fix to git",
-      "can you rerun the failing suite",
-      "fix the flaky poller test and push it",
-    ]) {
-      const v = shouldAcknowledge({ willSpawnSession: true, item: { ...PEER_ACK, content }, source: "inbox" });
-      assert.equal(v.ack, true, `"${content}" is substantive and must pass`);
-    }
-  });
-
-  test("an INFORMATION-BEARING terse line from a peer agent seat passes — facts, links, decisions and completions are not acks", () => {
-    // Re-review finding on d5abda3: the shape test alone consumed essentially
-    // every terse peer utterance — including decision grants and direct
-    // answers to questions this seat asked — and a false consume is silent to
-    // the sender and unrecoverable. Only commitment-shaped acks may be eaten.
-    for (const content of [
-      "Runway is 14 months.",           // carries a fact (digit)
-      "Yes.",                            // direct answer
-      "No.",                             // direct answer
-      "Approved.",                       // decision grant
-      "Go ahead.",                       // decision grant
-      "LGTM.",                           // review verdict
-      "Ship it.",                        // decision grant
-      "Done.",                           // completion report
-      "Merged.",                         // completion report
-      "Deployed, all green.",            // completion report
-      "Spec is at https://example.com/doc", // carries a link
-    ]) {
-      const v = shouldAcknowledge({ willSpawnSession: true, item: { ...PEER_ACK, content }, source: "inbox" });
-      assert.equal(v.ack, true, `"${content}" is information-bearing and must pass`);
-    }
-  });
-
-  test("REGRESSION: the daemon's OWN narrator lines are refused — built from the real compose* strings, so the list cannot drift", () => {
-    const narrations = [
-      // The two RETIRED progress lines. Nothing composes them any more, but an
-      // older seat on the same fleet still emits them until its autoupdate
-      // lands, and acking a peer's progress ping spawns a 45-minute session
-      // behind it — the 25/27/30 Aug loop.
-      ...RETIRED_NARRATOR_TEMPLATES,
-      "Still on this — 7 minutes in. I'll come back as soon as I've got something.",
-      "Still going — 22 minutes in. I'll follow up the moment it's done.",
-      composeFailure({}, { failure: { human: "the working session ended unexpectedly" }, willRetry: true }),
-      composeFailure({}, { failure: { human: "the work never came back with a result and has now outrun its time limit" }, willRetry: false }),
-      assurance.composeInterrupted(),
-      composeSilentSuccess({}, {}),
-      composeSilentSuccess({}, { finalText: "Here is what I found before it died." }),
-    ];
-    for (const content of narrations) {
-      const v = shouldAcknowledge({ willSpawnSession: true, item: { ...ITEM, content }, source: "inbox" });
-      assert.equal(v.ack, false, `narrator line must be refused: "${content.slice(0, 50)}…"`);
-      assert.equal(v.reason, "own-narrator-pattern");
-      assert.equal(v.emitterClass, true);
-    }
-  });
-
-  test("a human QUOTING a narrator line inside a longer message still passes (anchored full match)", () => {
-    const content = `why did you send me this?\n\n${composeSilentSuccess({}, {})}`;
-    const v = shouldAcknowledge({ willSpawnSession: true, item: { ...ITEM, content }, source: "inbox" });
-    assert.equal(v.ack, true);
-  });
-
-  test("a genuine substantive ask is untouched by the gate", () => {
-    const v = shouldAcknowledge({ willSpawnSession: true, item: ITEM, source: "inbox" });
-    assert.equal(v.ack, true);
-    assert.equal(v.reason, "session-dispatched");
-  });
-
-  test("every refusal is AUDITED — one JSONL row, self-echo-drop style", async () => {
-    const { readFileSync, rmSync: rm } = await import("node:fs");
-    const auditPath = join(ROOT, "logs", "daemon", "dispatch-gate-drops.jsonl");
-    try { rm(auditPath, { force: true }); } catch { /* */ }
-    shouldAcknowledge({ willSpawnSession: true, item: PEER_ACK, source: "inbox" });
-    shouldAcknowledge({ willSpawnSession: true, item: { ...ITEM, content: composeSilentSuccess({}, {}) }, source: "inbox" });
-    const rows = readFileSync(auditPath, "utf-8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
-    assert.equal(rows.length, 2);
-    assert.equal(rows[0].stage, "dispatch-gate");
-    assert.equal(rows[0].reason, "peer-ack-shaped");
-    assert.equal(rows[0].sender, "Piotr Novak");
-    assert.equal(rows[1].reason, "own-narrator-pattern");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 2. THE ACKNOWLEDGEMENT — one bespoke generated line, or SILENCE. Never a
-//    canned rotation (CEO directive, 2026-08-30).
-// ---------------------------------------------------------------------------
-
-describe("generateAck — bespoke line or silence, never boilerplate", () => {
-  test("the model's line is used verbatim once stripped to one clean line", async () => {
-    const a = await generateAck(ITEM, CLASS_COMPLEX, {
-      runImpl: async () => '```\n"Taking the poller fixes now — push coming."\n```',
-    });
-    assert.equal(a, "Taking the poller fixes now — push coming.");
-  });
-
-  test("REGRESSION: a failing generator yields NULL — the caller sends NOTHING, no canned fallback", async () => {
-    // The retired behaviour rotated "On it." / "Looking now." / "On it —
-    // digging in now." when convenient. The CEO's verdict: a reflex string is
-    // worse than no ack. Null is the contract for "say nothing".
-    const a = await generateAck(ITEM, CLASS_COMPLEX, {
-      runImpl: async () => { throw new Error("claude CLI spawn error: ENOENT"); },
-    });
-    assert.equal(a, null);
-  });
-
-  test("a HANGING generator is cut off at the budget and yields NULL", async () => {
-    const a = await generateAck(ITEM, CLASS_COMPLEX, {
-      timeoutMs: 25,
-      runImpl: () => new Promise(() => { /* never settles */ }),
-    });
-    assert.equal(a, null);
-  });
-
-  test("unusable output — empty, essay-length, refusals, assistant filler — yields NULL", () => {
-    assert.equal(sanitiseAckText(""), null);
-    assert.equal(sanitiseAckText("   \n\n  "), null);
-    assert.equal(sanitiseAckText("x".repeat(300)), null, "a paragraph is a reply, not an ack");
-    assert.equal(sanitiseAckText("I cannot help with that request."), null);
-    assert.equal(sanitiseAckText("I'm here to help! Let me know if you need anything else."), null);
-  });
-
-  test("multi-line output is reduced to the FIRST usable line", () => {
-    assert.equal(
-      sanitiseAckText("Taking the poller fixes now.\nsecond line that must not leak"),
-      "Taking the poller fixes now.",
-    );
-  });
-
-  test("REGRESSION: assistant-y openers are rejected — 'Sure — here it is:' is a chatbot, not a colleague", () => {
-    for (const t of [
-      "Sure — here it is:",
-      "Sure, taking a look at the git fixes.",
-      "Certainly! On the deck now.",
-      "Absolutely — picking the poller fix up.",
-      "Happy to — starting on the memo.",
-      "Of course, I'll dig into the runway numbers.",
-    ]) {
-      assert.equal(sanitiseAckText(t), null, `"${t}" must be rejected`);
-    }
-    // …while a plain colleague line still passes untouched.
-    assert.equal(sanitiseAckText("Taking the git fixes now — push coming."), "Taking the git fixes now — push coming.");
-  });
-
-  test("REGRESSION: the canned rotation is GONE from the module, not merely bypassed", async () => {
-    const { readFileSync } = await import("node:fs");
-    const src = readFileSync(new URL("./assurance.mjs", import.meta.url), "utf-8");
-    // The three retired strings may survive in comments as history, but never
-    // as a string-literal ARRAY a code path could pick from.
-    assert.doesNotMatch(src, /\[\s*"On it\.",/, "the canned rotation array must not exist");
-  });
-});
-
-describe("composeSilentSuccess — a finished answer is delivered, not silently clipped", () => {
-  const LIMIT = SILENT_SUCCESS_EXCERPT_LIMIT;
-
-  test("a normal multi-point answer (over the old 900 cap) comes through WHOLE", () => {
-    // The exact failure mode the old cap produced: a substantive multi-point
-    // answer, ~1200 chars — comfortably over the old 900 cap, well under the new
-    // budget. The reader must get every word, with no ellipsis and no marker.
-    const answer =
-      "Queue placement. A discrete task I own lands cleanest in action-stack.yaml, " +
-      "not follow-ups.yaml — the latter is external commitments with due dates, and " +
-      "this is a capture I own, not a promise to a counterparty. ".repeat(16).trim();
-    assert.ok(answer.length > 900 && answer.length < LIMIT, "fixture must straddle old cap / new budget");
-    const out = composeSilentSuccess({}, { finalText: answer });
-    assert.ok(out.includes(answer), "the full answer must be present verbatim");
-    assert.ok(!out.includes("…"), "a whole answer carries no truncation ellipsis");
-  });
-
-  test("a genuinely huge output is bounded but truncated HONESTLY — count + resend offer, never a bare ellipsis", () => {
-    const huge = "x".repeat(LIMIT + 2000);
-    const out = composeSilentSuccess({}, { finalText: huge });
-    assert.ok(out.length < huge.length, "oversized output is bounded, not dumped whole");
-    assert.ok(out.includes(String(huge.length)), "must state the true full length so nothing is lost silently");
-    assert.match(out, /resend|full/i, "must offer a path to the dropped remainder");
-  });
-
-  test("REGRESSION: a truncated recovery note is STILL recognised as the daemon's own narrator line (self-echo gate holds)", () => {
-    // If truncation broke narrator-recognition, the daemon would re-ingest and
-    // re-ack its own rescue message — the exact self-echo failure the gate exists
-    // to prevent. The honesty marker must live inside the variable excerpt slot.
-    const huge = "y".repeat(LIMIT + 2000);
-    const truncated = composeSilentSuccess({}, { finalText: huge });
-    assert.equal(isOwnNarratorText(truncated), true, "truncated silent-success must match a narrator pattern");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 3. FAILURE CLASSIFICATION — retry the transient, stop on the permanent
-// ---------------------------------------------------------------------------
-
-describe("classifyFailure", () => {
-  const cases = [
-    [{ code: 143, error: "SIGTERM" }, true, "timeout"],
-    [{ code: 137 }, true, "killed"],
-    [{ code: 1, error: "rate limit exceeded (429)" }, true, "rate_limited"],
-    [{ code: null, error: "claude CLI spawn error: ENOENT" }, false, "spawn_failed"],
-    [{ code: 1, error: "essential-only: daily budget cap reached" }, false, "budget_refused"],
-    [{ code: 1, error: "low free memory (need >=3686MB)" }, true, "resource_starved"],
-    [{ code: 0 }, false, "silent_success"],
-  ];
-  for (const [input, transient, label] of cases) {
-    test(`${label} → ${transient ? "retry" : "stop"}`, () => {
-      const f = classifyFailure(input);
-      assert.equal(f.label, label);
-      assert.equal(f.transient, transient);
-      assert.ok(f.human.length > 10, "every cause must have plain-English wording for the human");
-      assert.doesNotMatch(f.human, /error occurred|something went wrong/i, "no content-free apologies");
-    });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// 4. THE LEDGER — a debt survives the send failing
-// ---------------------------------------------------------------------------
-
-describe("openAndAcknowledge", () => {
-  test("POLICY: opening a debt says NOTHING — the interim belongs to the sweep", async () => {
-    // 3,069 opening acknowledgements in fourteen days were exactly this call
-    // speaking at t=0. The record is still written first (a crash between here
-    // and the session's first token must leave a debt the sweep finds); what is
-    // gone is the reflex in front of it.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, service: "cohort", tier: "work", deps: { ackSender: t.ackSender } });
-    assert.equal(t.sent.length, 0, "not one byte at open time");
-    assert.equal(r.acked, false);
-    assert.equal(r.ackText, null);
-    assert.equal(r.reason, "tier-work-deferred");
-    const rec = readObligation(r.key);
-    assert.equal(rec.state, "open", "the debt is open and owed");
-    assert.equal(rec.tier, "work");
-    assert.equal(rec.interimSaid, false, "and the one-interim latch is still unspent");
-  });
-
-  test("the answer tier opens the debt and forbids any interim, ever", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "answer", ack: false, deps: { ackSender: t.ackSender } });
-    assert.equal(t.sent.length, 0);
-    const rec = readObligation(r.key);
-    assert.equal(rec.interimForbidden, true, "durable on the record — the sweep runs in another tick, maybe another process");
-    const after = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 60_000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(after.acked, 0);
-    assert.equal(t.sent.length, 0, "the answer tier is silence, at open and at every sweep after it");
-  });
-
-  test("REGRESSION: an un-acknowledged debt is still visible to the sweep", async () => {
-    // The original production case: 20 of 32 acknowledgements died and the old
-    // code did `logResponse(...); return {sent:false}` — the human was never
-    // told, and nothing ever retried. Nothing is sent at open time any more, so
-    // what this now pins is the half that still matters: the debt exists.
-    const t = fakeTransport({ failTimes: 99, error: "claude CLI timed out after 60000ms" });
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work", deps: { ackSender: t.ackSender } });
-    assert.equal(r.acked, false);
-    const rec = readObligation(r.key);
-    assert.equal(rec.acknowledged, false);
-    assert.equal(rec.state, "open");
-    assert.equal(openObligations().length, 1, "the debt must be visible to the sweep");
-  });
-
-  test("REGRESSION: a generation failure in the interim branch sends NOTHING and records why", async () => {
-    // The ack generator's contract on failure is silence, never a placeholder.
-    // The branch moved from open time to the sweep; the contract did not.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => null },
-    });
-    assert.equal(t.sent.length, 0, "not one byte reached the human");
-    const rec = readObligation(r.key);
-    assert.equal(rec.acknowledged, false);
-    assert.equal(rec.ackGenFailures, 1, "the failure is counted, so the retry is bounded");
-    assert.equal(rec.state, "open", "the debt survives — the failure and stale notices still owe the human");
-  });
-
-  test("the stored summary keeps the classifier's casing — the board row and escalations read from it", async () => {
-    // `rec.summary` feeds board-mirror's row title and the needs-attention
-    // escalation record. A summary mangled at open time would resurface there.
-    // It must NOT, however, appear in any message the human reads.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({
-      item: ITEM,
-      classResult: { ...CLASS_COMPLEX, summary: "CEO checking in on work progress" },
-      deps: { ackSender: t.ackSender },
-    });
-    const rec = readObligation(r.key);
-    assert.equal(rec.summary, "CEO checking in on work progress");
-    // It must not leak into anything a human reads. Every deterministic notice
-    // the module can still compose is checked, so a future composer that starts
-    // interpolating `rec.summary` fails here.
-    for (const text of [
-      composeFailure(rec, { failure: { human: "the work ran past its time limit and got cut off" }, willRetry: true }),
-      composeFailure(rec, { failure: { human: "the work never came back with a result" }, willRetry: false }),
-      assurance.composeInterrupted(rec),
-      composeSilentSuccess(rec, {}),
-    ]) {
-      assert.doesNotMatch(text, /CEO checking in on work progress/, "the summary is internal framing, never copy");
-    }
-  });
-
-  test("speaks ONCE — a re-delivered item, and a RETRY that reopens the key, do not re-announce", async () => {
-    // The retry half is R4: a failed obligation is CLOSED, the item is
-    // re-delivered by the next poll, and a brand-new record opens under the
-    // same key. Without inheritance that record starts clean and acks from
-    // scratch — which is `On it.` arriving immediately after a failure notice,
-    // as sampled live.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1);
-    assert.equal(readObligation(r.key).interimSaid, true);
-
-    assurance.closeObligation(r.key, { outcome: "failed" });
-    const again = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    assert.equal(readObligation(again.key).interimSaid, true, "the latch is INHERITED across the reopen");
-    await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 10 * 60_000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1, "one interim per ask, across every attempt at it");
-  });
-
-  test("opens NO board row of its own — there is exactly one writer per ask", async () => {
-    // It used to mirror the obligation onto the board here, through
-    // `board.create`, while agent-daemon tracked the SAME item forty lines
-    // later through the shared ledger. One DM, two cards on one board, and the
-    // one the "On now" banner rendered was the copy with no requester, no
-    // comments and no provenance. The open belongs to the caller, which holds
-    // the full inbox item; this function only owes the acknowledgement.
-    const mirror = { calls: [], closeBoardItem: async (a) => { mirror.calls.push(a); return { mirrored: true }; } };
-    assurance._setBoardMirror(mirror);
-    try {
-      const t = fakeTransport();
-      await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-      await new Promise((r) => setTimeout(r, 5));
-      assert.equal(mirror.calls.length, 0);
-      assert.equal(typeof mirror.openBoardItem, "undefined", "there is no open hook to call");
-    } finally {
-      assurance._setBoardMirror(null);
-    }
-  });
-
-  test("closing the debt retires the board row, carrying the obligation's own verdict", async () => {
-    // `closeObligation` is the funnel EVERY terminal path goes through, and only
-    // two of them reach the daemon's onClose. A row nothing retires sits in
-    // `running`, which is the one column the "On now" banner reads.
-    const mirror = { calls: [], closeBoardItem: async (a) => { mirror.calls.push(a); return { mirrored: true }; } };
-    assurance._setBoardMirror(mirror);
-    try {
-      const t = fakeTransport();
-      const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-      assurance.closeObligation(r.key, { outcome: "failed", note: "stale-no-outcome" });
-      await new Promise((res) => setTimeout(res, 5));
-      assert.equal(mirror.calls.length, 1);
-      assert.equal(mirror.calls[0].outcome, "failed");
-      assert.equal(mirror.calls[0].rec.key, r.key);
-      assert.ok(mirror.calls[0].rec.item, "the close needs the item to identify the ask");
-    } finally {
-      assurance._setBoardMirror(null);
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 5. SESSION SETTLEMENT — the four terminal states
-// ---------------------------------------------------------------------------
-
-describe("settleSession", () => {
-  async function openOne(t) {
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    return r.key;
-  }
-
-  test("exit 0 AND the session spoke → discharge quietly, add nothing", async () => {
-    const t = fakeTransport();
-    const key = await openOne(t);
-    const before = t.sent.length;
-    const r = await settleSession({ key, ok: true, code: 0, deps: { deliverImpl: t.impl, spokeSinceImpl: () => true } });
-    assert.equal(r.verdict, "answered-by-session");
-    assert.equal(t.sent.length, before, "the human already has their answer — saying more is spam");
-    assert.equal(readObligation(key).state, "answered");
-  });
-
-  test("REGRESSION: exit 0 and the session said NOTHING → the daemon speaks", async () => {
-    // Observed live: session s-1786600074079-52, exit 0, 241s, $2.36, its own
-    // result text ending "Nothing was sent." Marked processed forever, emitted
-    // as `sent`, never re-delivered. This is that case.
-    const t = fakeTransport();
-    const key = await openOne(t);
-    const stdout = JSON.stringify({ type: "result", result: "I reviewed the three failing checks and pushed fixes for two. The third needs a decision from you. Nothing was sent." });
-    const r = await settleSession({ key, ok: true, code: 0, stdout, deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    assert.equal(r.verdict, "silent-success");
-    assert.equal(r.spoke, true);
-    const msg = t.sent.at(-1).text;
-    assert.match(msg, /didn't get a reply out to you/i);
-    assert.match(msg, /pushed fixes for two/, "the work the session actually did must reach the human");
-    assert.equal(readObligation(key).state, "answered");
-  });
-
-  test("an acknowledgement does NOT count as the session having answered", async () => {
-    const t = fakeTransport();
-    const key = await openOne(t);
-    // A truthful receipt store that only ever saw the ack.
-    const spokeSinceImpl = ({ excludeKinds }) => !(excludeKinds || []).includes("ack") ;
-    const r = await settleSession({ key, ok: true, code: 0, stdout: "", deps: { deliverImpl: t.impl, spokeSinceImpl } });
-    assert.equal(r.verdict, "silent-success", "'I'm on it' is not an answer");
-  });
-
-  test("transient failure with retries left → tell them, keep the debt, retry", async () => {
-    const t = fakeTransport();
-    const key = await openOne(t);
-    const r = await settleSession({ key, ok: false, code: 143, error: "SIGTERM", deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    assert.equal(r.willRetry, true);
-    assert.match(r.verdict, /^retrying:timeout$/);
-    const msg = t.sent.at(-1).text;
-    assert.match(msg, /ran past its time limit/i);
-    assert.match(msg, /retrying now/i);
-    assert.equal(readObligation(key).state, "open", "still owed — the retry has to be covered too");
-  });
-
-  test("permanent failure → tell them, stop, escalate durably", async () => {
-    const t = fakeTransport();
-    const key = await openOne(t);
-    const r = await settleSession({ key, ok: false, code: 1, error: "claude CLI spawn error: ENOENT", deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    assert.equal(r.willRetry, false);
-    assert.match(r.verdict, /^failed:spawn_failed$/);
-    const msg = t.sent.at(-1).text;
-    assert.match(msg, /couldn't finish this/i);
-    assert.match(msg, /stopped retrying/i);
-    assert.match(msg, /\?$/, "a dead end must end in a question, not a shrug");
-    assert.equal(readObligation(key).state, "failed");
-  });
-
-  test("retries are BOUNDED — the second timeout does not promise a third attempt", async () => {
-    const t = fakeTransport();
-    const key = await openOne(t);
-    // Simulate having already burned the allowed attempts.
-    const rec = readObligation(key);
-    rec.attempts = RETRY_MAX + 1;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(key)}.json`), JSON.stringify(rec));
-    const r = await settleSession({ key, ok: false, code: 143, error: "SIGTERM", deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    assert.equal(r.willRetry, false, "an unbounded silent retry loop is itself the defect");
-    assert.match(t.sent.at(-1).text, /stopped retrying/i);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 6. THE SWEEP — the safety net under everything above
-// ---------------------------------------------------------------------------
-
-describe("sweepObligations", () => {
-  test("THE ONE INTERIM: nothing before ACK_AFTER_MS, then exactly one bespoke line", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => "Back on the git fixes now." };
-
-    const early = await sweepObligations({ now: Date.now() + ACK_AFTER_MS - 1000, deps });
-    assert.equal(early.acked, 0);
-    assert.equal(t.sent.length, 0, "below ninety seconds the typing indicator IS the acknowledgement");
-
-    const stats = await sweepObligations({ now: Date.now() + ACK_AFTER_MS + 1000, deps });
-    assert.equal(stats.acked, 1);
-    assert.equal(t.sent[0].kind, "ack");
-    assert.equal(t.sent[0].text, "Back on the git fixes now.");
-    assert.doesNotMatch(t.sent[0].text, /^(on it|looking now)/i, "never the retired rotation");
-    assert.equal(readObligation(r.key).interimSaid, true);
-
-    // …and never a second one, however long the work runs.
-    for (let m = 2; m < 40; m++) {
-      const now = Date.now() + ACK_AFTER_MS + m * 60_000;
-      if (now - Date.now() >= STALE_AFTER_MS) break;
-      await sweepObligations({ now, deps });
-    }
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1, "one interim per obligation, full stop");
-  });
-
-  test("ONE SEAT, eight concurrent obligations in ONE room, exactly ONE interim", async () => {
-    // WHAT THIS IS AND IS NOT. It is the per-seat guarantee: one daemon holding
-    // eight concurrent debts in one channel emits one holding line, not eight.
-    //
-    // It is NOT `capital-formation` reproduced, and the title used to say it
-    // was. That room's 9,187 messages in 21 days came from EIGHT SEPARATE
-    // SEATS, each with its own AGENT_DIR on its own machine and therefore its
-    // own ledger — see room-budget.test.mjs, "the budget is per (SEAT, service,
-    // channel)". This gate's ceiling in that room is 8 x (60/15) = 32/h against
-    // a measured content-free rate of ~14/h, so it would not have been the
-    // binding constraint there. What removed the measured traffic is the
-    // deleted progress branch (961 -> 0), the sanitiser, and TIME+ONCE; this
-    // gate is the backstop that bounds what survives all three.
-    const t = fakeTransport();
-    for (let i = 0; i < 8; i++) {
-      await openAndAcknowledge({
-        item: { ...ITEM, id: `msg-${i}`, raw_ref: `cohort:capform:${i}`, message_id: `${i}` },
-        classResult: CLASS_COMPLEX,
-        tier: "work",
-      });
-    }
-    assert.equal(openObligations().length, 8, "every ask is still opened and tracked");
-
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1, `eight obligations, one message — got ${t.sent.length}`);
-    assert.equal(stats.acked, 1);
-    assert.equal(stats.suppressed, 7, "…and the seven suppressions are COUNTED, so a quiet sweep can still prove it decided");
-
-    // Over budget is not a drop: every debt is still open and still owed.
-    assert.equal(openObligations().length, 8);
-  });
-
-  test("…and the suppressed debts stay silent afterwards rather than queueing up a burst", async () => {
-    const t = fakeTransport();
-    for (let i = 0; i < 8; i++) {
-      await openAndAcknowledge({ item: { ...ITEM, id: `m-${i}`, raw_ref: `cohort:capform2:${i}` }, classResult: CLASS_COMPLEX, tier: "work" });
-    }
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-    await sweepObligations({ now: Date.now() + ACK_AFTER_MS + 1000, deps });
-    await sweepObligations({ now: Date.now() + 20 * 60_000, deps });
-    await sweepObligations({ now: Date.now() + 40 * 60_000, deps });
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1, "the window reopening must not release a backlog");
-  });
-
-  test("a DIFFERENT room is never gagged by a busy one", async () => {
-    const t = fakeTransport();
-    for (let i = 0; i < 5; i++) {
-      await openAndAcknowledge({ item: { ...ITEM, id: `b-${i}`, raw_ref: `cohort:busy:${i}` }, classResult: CLASS_COMPLEX, tier: "work" });
-    }
-    await openAndAcknowledge({
-      item: { ...ITEM, id: "quiet-1", raw_ref: "cohort:quiet:1", channel_id: "C-QUIET" },
-      classResult: CLASS_COMPLEX,
-      tier: "work",
-    });
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.acked, 2, "one per room");
-    assert.equal(new Set(t.sent.map((m) => m.channel)).size, 2);
-  });
-
-  test("REGRESSION: a failed generation sends NOTHING — bounded, then given up on", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-
-    let genCalls = 0;
-    const t0 = Date.now();
-    for (let m = 1; m <= 8; m++) {
-      await sweepObligations({ now: t0 + ACK_AFTER_MS + m * 60_000, deps: {
-        deliverImpl: t.impl,
-        spokeSinceImpl: () => false,
-        generateAckImpl: async () => { genCalls++; return null; },
-      } });
-    }
-    assert.equal(t.sent.filter((s) => s.kind === "ack").length, 0, "no canned line went out in place of the failed generation");
-    assert.ok(genCalls <= ACK_GEN_MAX_FAILURES, `generation retries are bounded, not once-a-tick forever (saw ${genCalls})`);
-    const rec = readObligation(r.key);
-    assert.equal(rec.ackSuppressed, true, "the interim is given up on…");
-    assert.equal(rec.state, "open", "…but the DEBT is not — the stale check still owes the human");
-  });
-
-  test("a failed generation does NOT spend the room's budget", async () => {
-    // Ask, compose, THEN spend. A budget burned on a message that was never
-    // composed gags the room for fifteen minutes in exchange for nothing.
-    const t = fakeTransport();
-    await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    await openAndAcknowledge({ item: { ...ITEM, id: "x2", raw_ref: "cohort:same-room:2" }, classResult: CLASS_COMPLEX, tier: "work" });
-    let calls = 0;
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: {
-        deliverImpl: t.impl,
-        spokeSinceImpl: () => false,
-        // The first obligation's generation fails; the second's succeeds.
-        generateAckImpl: async () => (++calls === 1 ? null : "Back on the git fixes now."),
-      },
-    });
-    assert.equal(stats.acked, 1, "the room's one interim went to the ask that could actually compose one");
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1);
-  });
-
-  test("work that outruns every session timeout is declared dead, not left hanging", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    const now = Date.now() + STALE_AFTER_MS + 1000;
-    const stats = await sweepObligations({ now, deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    assert.equal(stats.staled, 1);
-    assert.match(t.sent.at(-1).text, /outrun its time limit/i);
-    assert.equal(readObligation(r.key).state, "failed");
-  });
-
-  test("a debt the session has since answered is discharged silently", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    const before = t.sent.length;
-    const now = Date.now() + STALE_AFTER_MS + 1000;
-    const stats = await sweepObligations({ now, deps: { deliverImpl: t.impl, spokeSinceImpl: () => true } });
-    assert.equal(stats.closed, 1);
-    assert.equal(t.sent.length, before, "no message when the human already has their answer");
-    assert.equal(readObligation(r.key).state, "answered");
-  });
-
-  test("a debt orphaned by a DEAD daemon is spoken to", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    // Rewrite the record as if a now-dead process had opened it.
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const stats = await sweepObligations({
-      now: Date.now() + INTERRUPT_GRACE_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.interrupted, 1);
-    assert.match(t.sent.at(-1).text, /was interrupted before it finished/i);
-    assert.equal(t.sent.at(-1).kind, "notice", "an interrupted notice is an OUTCOME, not a progress ping — the kind it used to borrow no longer exists");
-  });
-
-  test("…and a SECOND interruption of the same ask says nothing more", async () => {
-    // Said once per (channel, obligationKey). Two daemon restarts over one long
-    // ask are one apology, not two — and a retry that reopens the same key
-    // inherits the notice ledger, so it is not two either.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    const { writeFileSync } = await import("node:fs");
-    const orphan = (extra = {}) => {
-      const rec = { ...readObligation(r.key), daemonPid: process.pid + 99999, ...extra };
-      writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-    };
-    orphan();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-    await sweepObligations({ now: Date.now() + INTERRUPT_GRACE_MS + 1000, deps });
-    assert.equal(t.sent.filter((m) => /interrupted/i.test(m.text)).length, 1);
-
-    orphan({ interruptedNotifiedAt: null });
-    const second = await sweepObligations({ now: Date.now() + INTERRUPT_GRACE_MS + 120_000, deps });
-    assert.equal(second.interrupted, 0);
-    assert.equal(t.sent.filter((m) => /interrupted/i.test(m.text)).length, 1, "one apology per ask, per room");
-  });
-
-  test("REGRESSION: a LIVE daemon's obligation is never declared interrupted", async () => {
-    // Two daemons on one AGENT_DIR is what an operator creates the moment they
-    // run one by hand next to the launchd one. Each sees the other's healthy,
-    // actively-running debts as foreign. With only a pid-mismatch test — which
-    // is what shipped — both then tell those requesters "my session was
-    // interrupted" while the work runs to completion behind the apology.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const before = t.sent.length;
-    const stats = await sweepObligations({
-      now: Date.now() + INTERRUPT_GRACE_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => true, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.interrupted, 0, "the owning daemon is alive — its work is not interrupted");
-    assert.equal(t.sent.length, before, "and nobody is told a lie about it");
-  });
-
-  test("REGRESSION: a FRESH obligation is never declared interrupted, dead pid or not", async () => {
-    // The age guard is the backstop for a recycled pid. One second after the ask
-    // arrived, no reading of the evidence supports "your session was interrupted".
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const stats = await sweepObligations({
-      now: Date.now() + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.interrupted, 0);
-  });
-
-  test("REGRESSION: a debt OWNED by another LIVE daemon is not ack-retried by this one (two-daemon narration)", async () => {
-    // Two live daemons on one AGENT_DIR both sweep the same ledger. The one
-    // that did NOT open this debt must not compensate its acknowledgement —
-    // the owner is alive and will; two daemons acking is one human hearing
-    // double.
-    const failing = fakeTransport({ failTimes: 99 });
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work", deps: { ackSender: failing.ackSender } });
-    assert.equal(r.acked, false);
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const working = fakeTransport();
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: {
-        deliverImpl: working.impl,
-        spokeSinceImpl: () => false,
-        generateAckImpl: async () => "Back on this now.",
-        isPidAliveImpl: () => true, // the owner is provably alive
-      },
-    });
-    assert.equal(stats.acked, 0, "the live owner narrates its own debt");
-    assert.equal(working.sent.length, 0, "not one byte from the non-owner");
-    assert.equal(readObligation(r.key).acknowledged, false);
-    assert.equal(readObligation(r.key).interimSaid, false, "and the non-owner does not spend the latch either");
-  });
-
-  test("…but once the owning daemon is DEAD, this daemon takes the interim over", async () => {
-    const failing = fakeTransport({ failTimes: 99 });
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work", deps: { ackSender: failing.ackSender } });
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const working = fakeTransport();
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: {
-        deliverImpl: working.impl,
-        spokeSinceImpl: () => false,
-        generateAckImpl: async () => "Picking your ask up now.",
-        isPidAliveImpl: () => false, // the owner is gone
-      },
-    });
-    assert.equal(stats.acked, 1, "an orphaned debt is this daemon's to speak to");
-    assert.equal(readObligation(r.key).acknowledged, true);
-  });
-
-  test("REGRESSION: a debt OWNED by another LIVE daemon gets no interim from this one", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => true, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.acked, 0, "the live owner speaks for its own debt");
-    assert.equal(stats.interrupted, 0, "and a live owner is certainly not 'interrupted'");
-    assert.equal(t.sent.length, 0);
-  });
-
-  test("…and a dead owner's debt DOES get this daemon's interim (after the interrupted notice is done)", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    rec.interruptedNotifiedAt = Date.now(); // the orphan apology already went out
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => false, generateAckImpl: async () => "Back on the git fixes now." },
-    });
-    assert.equal(stats.acked, 1);
-    assert.equal(t.sent.at(-1).text, "Back on the git fixes now.");
-  });
-
-  test("each distinct message carries a distinct idempotency suffix", async () => {
-    // hq de-dups server-side on the client message id, so two messages that key
-    // on the same suffix are ONE message as far as hq is concerned and the
-    // second is silently swallowed — "never silent" degrading into "spoke once,
-    // then silent forever". Invisible to any test that stubs transport without
-    // inspecting the options, hence this one.
-    const seen = [];
-    const impl = async (item, text, o = {}) => { seen.push(o.idempotencySuffix); return { sent: true, via: "fake", channel: "c" }; };
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-
-    const deps = { deliverImpl: impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-    await sweepObligations({ now: Date.now() + ACK_AFTER_MS + 1000, deps });          // the interim
-    await settleSession({ key: r.key, ok: false, code: 143, error: "SIGTERM", deps }); // the failure notice
-    await sweepObligations({ now: Date.now() + STALE_AFTER_MS + 1000, deps });         // the stale notice
-
-    assert.ok(seen.length >= 2, `expected several distinct sends, saw ${seen.length}`);
-    assert.equal(new Set(seen).size, seen.length, `suffixes must be unique per message, got ${JSON.stringify(seen)}`);
-  });
-
-  test("emits at most ONE message per obligation per tick", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    // Old enough to qualify for BOTH the interrupted notice and the interim.
-    const rec = readObligation(r.key);
-    rec.daemonPid = process.pid + 99999;
-    const { writeFileSync } = await import("node:fs");
-    writeFileSync(join(ROOT, "state", "obligations", `${assurance.sanitiseKey(r.key)}.json`), JSON.stringify(rec));
-    const now = Date.now() + INTERRUPT_GRACE_MS + 1000;
-    await sweepObligations({ now, deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, isPidAliveImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE } });
-    assert.equal(t.sent.length, 1, "two messages in one tick reads as a malfunction");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 7. RECEIPTS — the evidence the whole guarantee rests on
-// ---------------------------------------------------------------------------
-
-describe("delivery receipts", () => {
-  test("a recorded send is visible to a later spokeSince query", () => {
-    const now = Date.now();
-    receipts.recordOutbound({ service: "cohort", channel: "C-RECEIPT-1", kind: "reply", chars: 12, agentRoot: ROOT, now });
-    assert.equal(receipts.spokeSince({ channel: "C-RECEIPT-1", sinceMs: now - 1000, agentRoot: ROOT }), true);
-  });
-
-  test("acks and progress pings are excludable — they are not answers", () => {
-    const now = Date.now();
-    receipts.recordOutbound({ service: "cohort", channel: "C-RECEIPT-2", kind: "ack", agentRoot: ROOT, now });
-    receipts.recordOutbound({ service: "cohort", channel: "C-RECEIPT-2", kind: "progress", agentRoot: ROOT, now });
-    assert.equal(
-      receipts.spokeSince({ channel: "C-RECEIPT-2", sinceMs: now - 1000, excludeKinds: ["ack", "progress", "failure"], agentRoot: ROOT }),
-      false,
-    );
-  });
-
-  test("REGRESSION: an 'interrupted' notice is not an answer either", async () => {
-    // The interrupted apology moved from kind "progress" to kind "notice" when
-    // progress pings were deleted. A kind that is not in the non-answer set
-    // reads to `spokeFor` as "the human was spoken to", which would discharge
-    // an unanswered debt the moment a daemon restarted — the exact class of bug
-    // the receipt ledger exists to prevent.
-    const { NON_ANSWER_KINDS } = await import("../../lib/comms/receipts.mjs");
-    assert.ok(NON_ANSWER_KINDS.includes("notice"), "every courtesy kind the daemon can emit belongs in the non-answer set");
-    const now = Date.now();
-    receipts.recordOutbound({ service: "cohort", channel: "C-NOTICE", kind: "notice", agentRoot: ROOT, now });
-    assert.equal(
-      receipts.spokeFor({ obligation: { key: "k", channel: "C-NOTICE", openedAt: now - 1000 }, now, siblingOpenCount: 1, agentRoot: ROOT }).heard,
-      false,
-    );
-  });
-
-  test("every kind the daemon actually sends is classified as answer or courtesy — none left unclassified", async () => {
-    // A new kind that nobody adds to the set silently becomes "this discharged
-    // the debt" — the discharge-an-unanswered-debt bug the receipt ledger
-    // exists to prevent.
-    //
-    // DERIVED FROM THE EMITTERS, not hand-listed. The hand-written literal this
-    // replaces could not fail when a kind was added, and had ALREADY missed one:
-    // `plan` was being emitted by notePlan and was absent from the list. Same
-    // shape as narratorPatterns(), which derives its strings from the composers
-    // rather than restating them.
-    const { NON_ANSWER_KINDS } = await import("../../lib/comms/receipts.mjs");
-    const { readFileSync } = await import("node:fs");
-    const here = new URL(".", import.meta.url).pathname;
-    // Line-scoped, and `counters.bump` lines are skipped: a counter LABEL is
-    // not a delivery kind (responder.mjs tags its dedup/generation counters
-    // `kind: "holding"`, which never reaches a receipt). Erring toward a false
-    // alarm is deliberate — a spurious failure sends someone to look, a silent
-    // miss is the bug this test is for.
-    const emitted = new Set();
-    for (const f of ["assurance.mjs", "responder.mjs"]) {
-      for (const line of readFileSync(join(here, f), "utf-8").split("\n")) {
-        if (line.includes("counters.bump")) continue;
-        const m = /\bkind:\s*"([a-z-]+)"/.exec(line);
-        if (m) emitted.add(m[1]);
-      }
-    }
-    assert.ok(emitted.size >= 5, `the scan must find the emitters — found ${[...emitted].join(", ")}`);
-    // The ONE kind that is an answer. Everything else the daemon emits about an
-    // ask is a courtesy and must not discharge the debt.
-    const ANSWERS = new Set(["reply"]);
-    for (const kind of emitted) {
-      assert.equal(
-        NON_ANSWER_KINDS.includes(kind),
-        !ANSWERS.has(kind),
-        `"${kind}" is emitted by the daemon and is ${ANSWERS.has(kind) ? "an answer" : "a courtesy"} — lib/comms/receipts.mjs NON_ANSWER_KINDS must say so`,
-      );
-    }
-    // Pinned explicitly as well, so a scan that silently stops matching is also
-    // a failure rather than a green run over an empty set.
-    for (const kind of ["ack", "notice", "failure", "plan"]) {
-      assert.ok(emitted.has(kind), `"${kind}" must still be found by the scan`);
-      assert.ok(NON_ANSWER_KINDS.includes(kind), `"${kind}" is a courtesy`);
-    }
-  });
-
-  test("an unreadable ledger reads as 'the human heard nothing', never as 'fine'", () => {
-    // The fail-open direction is deliberate: the cost of guessing wrong this way
-    // is one redundant message; guessing the other way is the bug being fixed.
-    assert.equal(receipts.spokeSince({ channel: "never-used-channel", sinceMs: Date.now(), agentRoot: ROOT }), false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 7. ATTRIBUTION — a room is shared; a debt is not
-// ---------------------------------------------------------------------------
-
-describe("attribution: which debt did that message actually discharge", () => {
-  const mk = (id, content) => ({
-    id, raw_ref: `cohort:C-SHARED:${id}`, message_id: id, service: "cohort",
-    channel: "C-SHARED", channel_id: "C-SHARED", sender: "Dana Whitfield", content,
-  });
-
-  test("REGRESSION: one session's answer does NOT discharge a different ask in the same room", async () => {
-    // The owner sends two things a minute apart in one DM. Two debts, one room.
-    // Keyed on the room alone — which is what shipped — the first session's
-    // reply closed BOTH, and the second ask, which nobody answered, was recorded
-    // as "answered" with not one word sent about it. This is that scenario.
-    const t = fakeTransport();
-    const a = mk("ASK-A", "what's our runway?");
-    const b = mk("ASK-B", "also please fix the flaky poller test and push it");
-    const ra = await openAndAcknowledge({ item: a, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    const rb = await openAndAcknowledge({ item: b, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    assurance.noteSession(ra.key, "s-A");
-    assurance.noteSession(rb.key, "s-B");
-
-    // Session A answers, stamping the receipt with the debt it was spawned for.
-    receipts.recordOutbound({
-      service: "cohort", channel: "C-SHARED", kind: "session",
-      obligationKey: ra.key, sessionId: "s-A", agentRoot: ROOT,
-    });
-
-    const before = t.sent.length;
-    const settledA = await settleSession({ key: ra.key, ok: true, code: 0, deps: { deliverImpl: t.impl } });
-    assert.equal(settledA.verdict, "answered-by-session");
-    assert.equal(settledA.basis, "obligation-keyed");
-    assert.equal(t.sent.length, before, "A was answered — saying more would be spam");
-
-    // B exited 0 having said nothing. It must NOT ride on A's receipt.
-    const settledB = await settleSession({
-      key: rb.key, ok: true, code: 0,
-      stdout: JSON.stringify({ type: "result", result: "Could not reproduce the flake." }),
-      deps: { deliverImpl: t.impl },
-    });
-    assert.equal(settledB.verdict, "silent-success", "B was never answered and must be rescued");
-    assert.match(t.sent.at(-1).text, /didn't get a reply out to you/i);
-    assert.match(t.sent.at(-1).text, /Could not reproduce the flake/, "and B's actual work reaches the human");
-  });
-
-  test("an UNATTRIBUTED message in a room holding two open debts discharges neither", async () => {
-    const t = fakeTransport();
-    const a = mk("AMB-A", "first ask");
-    const b = mk("AMB-B", "second ask");
-    const ra = await openAndAcknowledge({ item: a, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    await openAndAcknowledge({ item: b, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    assurance.noteSession(ra.key, "s-amb");
-    receipts.recordOutbound({ service: "cohort", channel: "C-SHARED", kind: "session", agentRoot: ROOT });
-
-    const r = await settleSession({ key: ra.key, ok: true, code: 0, stdout: "", deps: { deliverImpl: t.impl } });
-    assert.equal(r.verdict, "silent-success", "ambiguous evidence is not evidence");
-  });
-
-  test("an unattributed message DOES discharge the only open debt in a quiet room", async () => {
-    // The tolerant rung. A send lane that loses the dispatcher's env still leaves
-    // a receipt; treating that as silence would make every such reply produce a
-    // redundant apology. Safe only because the room holds one debt and a session
-    // of ours has actually run.
-    const t = fakeTransport();
-    const solo = { ...ITEM, id: "SOLO-1", raw_ref: "cohort:C-QUIET:SOLO-1", channel: "C-QUIET", channel_id: "C-QUIET" };
-    const r = await openAndAcknowledge({ item: solo, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    assurance.noteSession(r.key, "s-solo");
-    receipts.recordOutbound({ service: "cohort", channel: "C-QUIET", kind: "session", agentRoot: ROOT });
-
-    const before = t.sent.length;
-    const settled = await settleSession({ key: r.key, ok: true, code: 0, deps: { deliverImpl: t.impl } });
-    assert.equal(settled.verdict, "answered-by-session");
-    assert.equal(settled.basis, "sole-debt-in-room");
-    assert.equal(t.sent.length, before);
-  });
-
-  test("REGRESSION: a message that arrives before any session of ours ran is not our answer", async () => {
-    // A debt whose acknowledgement failed, and something unrelated posts into the
-    // room. Closing on that leaves a human never acknowledged, never answered,
-    // and the debt recorded as discharged.
-    const t = fakeTransport();
-    const solo = { ...ITEM, id: "PRE-1", raw_ref: "cohort:C-PRE:PRE-1", channel: "C-PRE", channel_id: "C-PRE" };
-    const r = await openAndAcknowledge({ item: solo, classResult: CLASS_COMPLEX, tier: "work" });
-    assert.equal(readObligation(r.key).acknowledged, false, "nothing is said at open time any more");
-    receipts.recordOutbound({ service: "cohort", channel: "C-PRE", kind: "reply", agentRoot: ROOT });
-
-    const stats = await sweepObligations({ now: Date.now() + ACK_AFTER_MS + 1000, deps: { deliverImpl: t.impl, generateAckImpl: async () => "Finally picking your ask up now." } });
-    assert.equal(stats.closed, 0, "no session of ours had run — that message was not our answer");
-    assert.equal(stats.acked, 1, "instead the interim is finally sent");
-    assert.equal(t.sent.at(-1).text, "Finally picking your ask up now.");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 8. UNREACHABLE CHANNELS — an impossible send must not become a loop
-// ---------------------------------------------------------------------------
-
-describe("channels with no transport", () => {
-  const TELEGRAM = {
-    id: "TG-1", raw_ref: "telegram:12345:9", message_id: "TG-1",
-    service: "telegram", channel_id: "12345", sender: "Dana Whitfield",
-    content: "please redo the deck and send it over",
-  };
-
-  test("no acknowledgement is promised on a service we cannot write to", () => {
-    const v = shouldAcknowledge({ willSpawnSession: true, item: TELEGRAM, source: "inbox" });
-    assert.equal(v.ack, false);
-    assert.equal(v.reason, "no-transport");
-  });
-
-  test("REGRESSION: the debt is still opened, and the sweep escalates it ONCE instead of retrying forever", async () => {
-    // What shipped: the ack branch's `continue` sat above the stale branch, so an
-    // obligation whose send could never succeed was retried once per tick —
-    // 1,440 impossible sends a day, an immortal debt, and a human told nothing.
-    const t = fakeTransport();
-    const opened = await openAndAcknowledge({ item: TELEGRAM, classResult: CLASS_COMPLEX, ack: false });
-    assert.equal(opened.opened, true, "the debt exists even though we cannot speak to it");
-    assert.equal(readObligation(opened.key).deliverable, false);
-
-    let attempts = 0;
-    const counting = async (...a) => { attempts++; return t.impl(...a); };
-    const t0 = Date.now();
-    for (let m = 1; m <= 240; m++) {
-      await sweepObligations({ now: t0 + m * 60_000, deps: { deliverImpl: counting } });
-    }
-    assert.equal(attempts, 0, "not one impossible send is attempted");
-    const rec = readObligation(opened.key);
-    assert.equal(rec.state, "undeliverable", "the debt is resolved, not immortal");
-    assert.equal(openObligations().length, 0);
-  });
-
-  test("an acknowledgement that keeps failing is counted out and escalated", async () => {
-    const t = fakeTransport({ failTimes: 999 });
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    const t0 = Date.now();
-    let ticks = 0;
-    for (let m = 1; m <= 60; m++) {
-      const s = await sweepObligations({ now: t0 + m * 60_000, deps: { deliverImpl: t.impl, generateAckImpl: async () => FAKE_ACK_LINE } });
-      ticks++;
-      if (s.unreachable) break;
-    }
-    assert.ok(ticks <= ACK_MAX_ATTEMPTS + 2, `gave up after ${ticks} ticks, not forever`);
-    assert.equal(readObligation(r.key).state, "undeliverable");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 9. THE RETRY CLOCK — never contradict a message already sent
-// ---------------------------------------------------------------------------
-
-describe("a running retry is not declared dead", () => {
-  test("REGRESSION: 'I'm retrying it now' is not followed by 'I've stopped retrying' five minutes later", async () => {
-    // Attempt 1 is SIGTERMed at the dispatcher's 45-minute cap. STALE_AFTER_MS is
-    // 50 minutes and the clock used to run from the ORIGINAL arrival, so at
-    // minute 50 the sweep told the same human the exact opposite of what they had
-    // been told at minute 45 — while the retry was still running.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    assurance.noteSession(r.key, "s-1");
-    const t0 = readObligation(r.key).openedAt;
-
-    const settled = await settleSession({
-      key: r.key, ok: false, code: 143, error: "session_close exit 143",
-      now: t0 + 45 * 60_000, deps: { deliverImpl: t.impl, spokeSinceImpl: () => false },
-    });
-    assert.equal(settled.willRetry, true);
-    assert.match(t.sent.at(-1).text, /retrying now/i);
-
-    const stats = await sweepObligations({ now: t0 + 51 * 60_000, deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    assert.equal(stats.staled, 0, "the retry is minutes old, not fifty");
-    assert.equal(readObligation(r.key).state, "open");
-    assert.doesNotMatch(t.sent.at(-1).text, /stopped retrying/i);
-  });
-
-  test("but a retry that itself goes nowhere DOES eventually stale out", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, deps: { ackSender: t.ackSender } });
-    assurance.noteSession(r.key, "s-1");
-    const t0 = readObligation(r.key).openedAt;
-    await settleSession({
-      key: r.key, ok: false, code: 143, error: "session_close exit 143",
-      now: t0 + 45 * 60_000, deps: { deliverImpl: t.impl, spokeSinceImpl: () => false },
-    });
-    const stats = await sweepObligations({
-      now: t0 + 45 * 60_000 + STALE_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false },
-    });
-    assert.equal(stats.staled, 1, "the promise still has a floor under it");
-    assert.match(t.sent.at(-1).text, /outrun its time limit/i);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// 10. ACKNOWLEDGEMENT DISCIPLINE — the 2026-09-12 policy, against the measured
-//     production strings that made it necessary.
-// ---------------------------------------------------------------------------
-
-describe("sanitiseAckText enforces the prompt the model was already given", () => {
-  // The ack system prompt has said "Never a generic 'on it' or 'looking into
-  // it'" since it was written. Nothing checked. 3,069 generic acknowledgements
-  // shipped in fourteen days — 28.8% of every message this fleet sent — and 272
-  // of them were never followed by a substantive reply within the hour.
-  //
-  // These are the REAL strings, as observed in org_default_adaptic.
-  const OBSERVED_IN_PRODUCTION = [
-    "On it.",
-    "On it",
-    "On it — digging in now.",
-    "Looking now.",
-    "Looking into it.",
-    "Looking into this now.",
-    "Checking.",
-    "Checking now.",
-    "One moment.",
-    "Got it.",
-    "Got it — will do.",
-    "Will do.",
-    "Working on it.",
-    "Taking a look.",
-    "Digging in now.",
-  ];
-
-  for (const line of OBSERVED_IN_PRODUCTION) {
-    test(`rejects the measured generic ack: ${JSON.stringify(line)}`, () => {
-      assert.equal(sanitiseAckText(line), null, "rejection ⇒ null ⇒ send nothing, which is the existing correct failure mode");
-    });
-  }
-
-  test("rejects anything under the minimum length, whatever its phrasing", () => {
-    // The second, phrasing-independent net. A line too short to name the thing
-    // that was asked cannot be specific to it, which is the one thing the
-    // prompt requires.
-    assert.equal(ACK_MIN_CHARS, 20);
-    assert.equal(sanitiseAckText("Sorted, starting."), null);
-    assert.equal(sanitiseAckText("Yep."), null);
-    assert.equal(sanitiseAckText("Onto it now, boss."), null);
-  });
-
-  test("…and still accepts a line that actually names the ask", () => {
-    // The discipline must not become a gag. A bespoke line is exactly what the
-    // prompt asks for, and it survives.
-    for (const good of [
-      "Give me a few minutes on the git fixes.",
-      "Pulling the July ledger against the forecast now.",
-      "Starting on the regulator gap analysis — the Thursday one.",
-    ]) {
-      assert.equal(sanitiseAckText(good), good, `"${good}" is specific and must pass`);
-    }
-  });
-
-  test("REGRESSION: the ack prompt and the filter read the same pattern, so they cannot drift again", async () => {
-    // The whole defect was an instruction with no enforcement behind it. The
-    // filter now imports GENERIC_OPENER from the copy-rule module; this pins
-    // that every opener the prompt names is in fact refused.
-    const { GENERIC_OPENER } = await import("../../lib/assurance/plan-note.mjs");
-    for (const opener of ["on it", "looking now", "looking into", "checking", "one moment", "got it", "will do", "working on it", "taking a look", "digging in"]) {
-      assert.match(opener, GENERIC_OPENER, `the prompt forbids "${opener}" — the filter must too`);
-    }
-  });
-});
-
-describe("failure notices are said ONCE per (channel, obligationKey)", () => {
-  test("REGRESSION: the same failure sentence does not reach one room three times in a minute", async () => {
-    // Sampled live at 06:32Z on 2026-09-12: the same failure sentence three
-    // times inside one minute, and `On it.` again immediately after. The cause
-    // was a retry loop that narrated every attempt — notice, retry, a FRESH
-    // obligation under the same key, notice again — with nothing suppressing
-    // the repeat.
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-
-    for (let attempt = 0; attempt < 3; attempt++) {
-      const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-      assurance.noteSession(r.key, `s-${attempt}`);
-      await settleSession({ key: r.key, ok: false, code: 143, error: "SIGTERM", deps });
-      // Whatever the outcome, the item is re-delivered and the key reopens.
-      assurance.closeObligation(r.key, { outcome: "failed" });
-    }
-
-    const failures = t.sent.filter((m) => m.kind === "failure");
-    assert.equal(failures.length, 1, `the same sentence went out ${failures.length} times; the whole point is once`);
-    assert.match(failures[0].text, /hit a problem/i);
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 0, "and no `On it.` behind it either");
-  });
-
-  test("…but 'a retry is running' and 'I have stopped' remain two separate, sayable facts", async () => {
-    // Collapsing them would leave a human who was told a retry was in flight
-    // never learning it had been abandoned. What is suppressed is the REPEAT of
-    // one fact, not the second fact.
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false };
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    assurance.noteSession(r.key, "s-1");
-    const first = await settleSession({ key: r.key, ok: false, code: 143, error: "SIGTERM", deps });
-    assert.equal(first.willRetry, true);
-
-    // The retry runs and fails terminally.
-    assurance.noteSession(r.key, "s-2");
-    const second = await settleSession({ key: r.key, ok: false, code: null, error: "claude CLI spawn error: ENOENT", deps });
-    assert.equal(second.willRetry, false);
-
-    const texts = t.sent.filter((m) => m.kind === "failure").map((m) => m.text);
-    assert.equal(texts.length, 2);
-    assert.match(texts[0], /retrying now/i);
-    assert.match(texts[1], /stopped retrying/i);
-  });
-
-  test("the notice ledger records WHICH notice reached WHICH room", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    await settleSession({ key: r.key, ok: false, code: 143, error: "SIGTERM", deps: { deliverImpl: t.impl, spokeSinceImpl: () => false } });
-    const rec = readObligation(r.key);
-    const ids = Object.keys(rec.notices || {});
-    assert.equal(ids.length, 1);
-    assert.ok(ids[0].startsWith(NOTICE.FAILURE_RETRYING), `expected a ${NOTICE.FAILURE_RETRYING} stamp, got ${ids[0]}`);
-    assert.ok(ids[0].includes(String(ITEM.channel_id).toLowerCase()), "the channel is part of the key — the same ask re-routed elsewhere genuinely has not been answered there");
-  });
-
-  test("a stale notice is not repeated for a key that already heard one", async () => {
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-    for (let attempt = 0; attempt < 3; attempt++) {
-      await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-      await sweepObligations({ now: Date.now() + STALE_AFTER_MS + 1000, deps });
-    }
-    assert.equal(t.sent.filter((m) => m.kind === "failure").length, 1);
-  });
-
-  // ── THE SIBLING SHAPE, which the per-record ledger structurally cannot reach ─
-  //
-  // The dedupe above is keyed on the obligation RECORD, so it covers the RETRY
-  // loop: notice → retry → fresh record under the same key → notice again. It
-  // does NOT cover SIBLINGS. Twenty separate inbound asks in one room whose
-  // sessions all die the same way are twenty separate records, and the stale
-  // branch's sentence contains nothing about which ask it is — so the room gets
-  // the identical line twenty times and the reader cannot tell any of them
-  // apart. That is the commoner shape whenever a dispatcher or model path is
-  // down, and it is the one the sampled "same failure sentence three times in
-  // one minute" is most likely to have actually been.
-
-  test("REGRESSION: twenty SIBLING debts staling together say the identical sentence ONCE", async () => {
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-    for (let i = 0; i < 20; i++) {
-      await openAndAcknowledge({
-        item: { ...ITEM, id: `sib-${i}`, raw_ref: `cohort:sibling:${i}`, message_id: `${i}` },
-        classResult: CLASS_COMPLEX,
-        tier: "work",
-      });
-    }
-    assert.equal(openObligations().length, 20, "every ask is still opened and tracked");
-
-    await sweepObligations({ now: Date.now() + STALE_AFTER_MS + 60_000, deps });
-
-    const failures = t.sent.filter((m) => m.kind === "failure");
-    assert.equal(failures.length, 1, `twenty byte-identical failure sentences reached one room ${failures.length} times`);
-    // Nothing is LOST: every dead ask is still escalated for an operator, and
-    // every debt is still closed. Only the duplicate sentence is withheld.
-    assert.equal(openObligations().length, 0, "all twenty debts were still discharged");
-    const { readdirSync } = await import("node:fs");
-    assert.equal(readdirSync(join(ROOT, "state", "obligations", "needs-attention")).length, 20,
-      "…and an operator still sees all twenty in needs-attention");
-  });
-
-  test("…but twenty siblings that fail DIFFERENTLY are all said, because each is a fact the reader lacks", async () => {
-    // The safety argument for the suppression above. Only an IDENTICAL sentence
-    // is withheld; suppressing information a person does not have re-creates
-    // the original bug — someone never told their work died.
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false };
-    const CAUSES = [
-      { code: null, error: "claude CLI spawn error: ENOENT" },
-      { code: 0, error: "" },
-    ];
-    let sent = 0;
-    for (let i = 0; i < CAUSES.length; i++) {
-      const r = await openAndAcknowledge({
-        item: { ...ITEM, id: `diff-${i}`, raw_ref: `cohort:different:${i}` },
-        classResult: CLASS_COMPLEX,
-        tier: "work",
-      });
-      assurance.noteSession(r.key, `s-${i}`);
-      const res = await settleSession({ key: r.key, ok: false, ...CAUSES[i], deps });
-      if (res.spoke) sent++;
-    }
-    assert.equal(sent, CAUSES.length, "distinct causes are distinct sentences and every one is said");
-    const texts = new Set(t.sent.filter((m) => m.kind === "failure").map((m) => m.text));
-    assert.equal(texts.size, CAUSES.length);
-  });
-
-  test("a sibling in a DIFFERENT room still hears it — the coalescing is per room", async () => {
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE };
-    await openAndAcknowledge({ item: { ...ITEM, id: "r1-a", raw_ref: "cohort:r1:a" }, classResult: CLASS_COMPLEX, tier: "work" });
-    await openAndAcknowledge({ item: { ...ITEM, id: "r1-b", raw_ref: "cohort:r1:b" }, classResult: CLASS_COMPLEX, tier: "work" });
-    await openAndAcknowledge({
-      item: { ...ITEM, id: "r2-a", raw_ref: "cohort:r2:a", channel_id: "C-OTHER-ROOM" },
-      classResult: CLASS_COMPLEX, tier: "work",
-    });
-    await sweepObligations({ now: Date.now() + STALE_AFTER_MS + 60_000, deps });
-    const failures = t.sent.filter((m) => m.kind === "failure");
-    assert.equal(failures.length, 2, "one per room");
-    assert.equal(new Set(failures.map((m) => m.channel)).size, 2);
-  });
-
-  test("a suppressed duplicate is still stamped on its own record, so it cannot leak out later", async () => {
-    // If the record's own ledger did not learn the fact had been told in this
-    // room, the next tick would re-say it the moment the room window rolled
-    // over — turning suppression into a delay.
-    const t = fakeTransport();
-    const deps = { deliverImpl: t.impl, spokeSinceImpl: () => false };
-    const a = await openAndAcknowledge({ item: { ...ITEM, id: "st-a", raw_ref: "cohort:stamp:a" }, classResult: CLASS_COMPLEX, tier: "work" });
-    const b = await openAndAcknowledge({ item: { ...ITEM, id: "st-b", raw_ref: "cohort:stamp:b" }, classResult: CLASS_COMPLEX, tier: "work" });
-    assurance.noteSession(a.key, "s-a");
-    assurance.noteSession(b.key, "s-b");
-    await settleSession({ key: a.key, ok: false, code: 143, error: "SIGTERM", deps });
-    await settleSession({ key: b.key, ok: false, code: 143, error: "SIGTERM", deps });
-    assert.equal(t.sent.filter((m) => m.kind === "failure").length, 1);
-    const recB = readObligation(b.key);
-    assert.ok(Object.keys(recB.notices || {}).some((k) => k.startsWith(NOTICE.FAILURE_RETRYING)),
-      "the suppressed record carries the stamp, so a later tick does not re-say it");
-  });
-});
-
-describe("the sweep is not re-entrant", () => {
-  // agent-daemon.mjs fires sweepObligations() on a 60-second setInterval with no
-  // in-flight guard of its own, and ONE TICK IS NOT BOUNDED BY 60 SECONDS:
-  // branch (e) peeks the room budget with commit:false, then awaits a cold
-  // `claude --print` spawn, serialised per obligation. A daemon with a dozen-plus
-  // eligible obligations in distinct rooms spends more than a tick in generation
-  // alone, so tick N+1 begins while tick N is still composing — and BOTH peek the
-  // same room's budget and read "allowed", because the spend is only committed
-  // after a successful send.
-
-  test("an overlapping sweep is refused rather than allowed to double-spend a room", async () => {
-    const t = fakeTransport();
-    await openAndAcknowledge({ item: { ...ITEM, id: "re-1", raw_ref: "cohort:reentry:1" }, classResult: CLASS_COMPLEX, tier: "work" });
-    await openAndAcknowledge({ item: { ...ITEM, id: "re-2", raw_ref: "cohort:reentry:2" }, classResult: CLASS_COMPLEX, tier: "work" });
-
-    const now = Date.now() + ACK_AFTER_MS + 1000;
-    let overlapped = null;
-    // A generator that starts a SECOND sweep while the first is still awaiting
-    // it — exactly the shape a slow `claude --print` produces on the timer.
-    const deps = {
-      deliverImpl: t.impl,
-      spokeSinceImpl: () => false,
-      generateAckImpl: async () => {
-        if (overlapped === null) overlapped = await sweepObligations({ now, deps });
-        return FAKE_ACK_LINE;
-      },
-    };
-
-    const first = await sweepObligations({ now, deps });
-    assert.equal(overlapped && overlapped.skipped, true, "the re-entrant call was refused");
-    assert.equal(overlapped.acked, 0, "…and it spoke to nobody");
-    assert.equal(first.acked, 1, "the outer sweep still did its one room's work");
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1, "one room, one interim, even across overlapping ticks");
-  });
-
-  test("the guard is released even when the sweep throws, so it cannot disable the daemon", async () => {
-    await openAndAcknowledge({ item: { ...ITEM, id: "thr-1", raw_ref: "cohort:throw:1" }, classResult: CLASS_COMPLEX, tier: "work" });
-    const boom = {
-      deliverImpl: async () => { throw new Error("transport exploded"); },
-      spokeSinceImpl: () => false,
-      generateAckImpl: async () => FAKE_ACK_LINE,
-    };
-    await assert.rejects(() => sweepObligations({ now: Date.now() + ACK_AFTER_MS + 1000, deps: boom }));
-    // The very next tick must run. Before the `finally`, this returned skipped.
-    const after = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 2000,
-      deps: { deliverImpl: async () => ({ sent: true, via: "fake" }), spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.notEqual(after.skipped, true, "a throw must not leave the sweep disabled for the life of the daemon");
-  });
-});
-
-describe("the room-budget ledger is not an obligation", () => {
-  // It lives at state/obligations/room-budget.json — the path the design names
-  // — inside a directory whose reader JSON-parses every *.json as a debt record.
-  // Parsed as one it was a phantom with no `key` and no `state`: it inflated
-  // every count derived from listObligations(), and pruneObligations() called
-  // unlinkSync(pathFor(undefined)) -> state/obligations/unknown.json on every
-  // tick, swallowed by a catch. Harmless only because nothing can key to
-  // "unknown" today.
-  test("a sweep that spends a room's budget does not add an obligation to the ledger", async () => {
-    const t = fakeTransport();
-    await openAndAcknowledge({ item: { ...ITEM, id: "led-1", raw_ref: "cohort:ledger:1" }, classResult: CLASS_COMPLEX, tier: "work" });
-    await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    const { existsSync } = await import("node:fs");
-    assert.equal(existsSync(join(ROOT, "state", "obligations", "room-budget.json")), true, "the budget really was written there");
-    const all = assurance.listObligations();
-    assert.equal(all.length, 1, `one ask, one record — got ${all.length}`);
-    assert.equal(all.every((r) => typeof r.key === "string" && r.key), true, "every record the reader returns is addressable");
-  });
-
-  test("pruning never unlinks state/obligations/unknown.json", async () => {
-    const { writeFileSync, existsSync } = await import("node:fs");
-    const decoy = join(ROOT, "state", "obligations", "unknown.json");
-    writeFileSync(decoy, JSON.stringify({ not: "an obligation" }));
-    assurance.pruneObligations({ now: Date.now() + 10 * 24 * 3600_000 });
-    assert.equal(existsSync(decoy), true, "a keyless record must never be resolved to a path and deleted");
-    try { (await import("node:fs")).unlinkSync(decoy); } catch { /* cleanup only */ }
-  });
-});
-
-describe("notePlan — the plan tier says the plan, or says nothing", () => {
-  const FIRST_TURN = {
-    type: "assistant",
-    message: { content: [{ type: "text", text: "1. Pull the July ledger rows and the signed forecast.\n2. Reconcile them line by line and mark every variance over 5%.\n3. Write up the three biggest gaps with the numbers behind each." }] },
-  };
-
-  test("posts the plan the SESSION stated, once", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "plan" });
-    const res = await notePlan({ key: r.key, firstTurn: FIRST_TURN, now: Date.now(), deps: { deliverImpl: t.impl } });
-    assert.equal(res.spoke, true);
-    assert.equal(t.sent.length, 1);
-    assert.match(t.sent[0].text, /Pull the July ledger rows/);
-    assert.match(t.sent[0].text, /three biggest gaps/);
-    assert.equal(readObligation(r.key).interimSaid, true);
-
-    const again = await notePlan({ key: r.key, firstTurn: FIRST_TURN, now: Date.now(), deps: { deliverImpl: t.impl } });
-    assert.equal(again.spoke, false);
-    assert.equal(again.reason, "interim-already-said");
-    assert.equal(t.sent.length, 1, "one message, and it is the plan");
-  });
-
-  test("NEVER FABRICATES: no stated plan ⇒ nothing is posted", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "plan" });
-    for (const turn of [null, undefined, "", "Sure, happy to look at that.", { type: "result" }, "{truncated"]) {
-      const res = await notePlan({ key: r.key, firstTurn: turn, now: Date.now(), deps: { deliverImpl: t.impl } });
-      assert.equal(res.spoke, false, `${JSON.stringify(turn)} must post nothing`);
-      assert.equal(res.reason, "no-plan-stated");
-    }
-    assert.equal(t.sent.length, 0);
-    assert.equal(readObligation(r.key).interimSaid, false, "and the latch is left unspent, so the sweep's one interim is still available");
-  });
-
-  test("the ROOM budget outranks the plan tier too", async () => {
-    const t = fakeTransport();
-    const a = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "plan" });
-    const b = await openAndAcknowledge({ item: { ...ITEM, id: "p2", raw_ref: "cohort:same-room:p2" }, classResult: CLASS_COMPLEX, tier: "plan" });
-    assert.equal((await notePlan({ key: a.key, firstTurn: FIRST_TURN, now: Date.now(), deps: { deliverImpl: t.impl } })).spoke, true);
-    const second = await notePlan({ key: b.key, firstTurn: FIRST_TURN, now: Date.now(), deps: { deliverImpl: t.impl } });
-    assert.equal(second.spoke, false);
-    assert.equal(second.reason, "room-budget-spent");
-    assert.equal(t.sent.length, 1);
-  });
-
-  test("a plan-tier debt is NEVER silent, even though no caller supplies a first turn yet", async () => {
-    // `notePlan` is exported and tested but not called by the daemon:
-    // dispatcher.mjs spawns with `--output-format json` (not `stream-json`), so
-    // the session's stdout arrives as one object at exit — after the answer has
-    // gone out. Streaming is a dispatcher change and belongs with WP-2.
-    //
-    // What must hold in the meantime is that the plan tier degrades to the WORK
-    // path rather than to silence. The sweep gates on `tier !== "answer"`, so it
-    // does; this pins it, because a tier that mutes a 15-45 minute session is
-    // the one failure this whole package exists to end.
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: { ...ITEM, id: "plan-fb", raw_ref: "cohort:planfb:1" }, classResult: CLASS_COMPLEX, tier: "plan" });
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.acked, 1, "the plan tier falls back to the one interim, not to nothing");
-    assert.equal(t.sent.filter((m) => m.kind === "ack").length, 1);
-    assert.equal(readObligation(r.key).interimSaid, true, "…and it is still only one");
-  });
-
-  test("a work-tier or answer-tier debt is never given a plan", async () => {
-    const t = fakeTransport();
-    for (const tier of ["work", "answer"]) {
-      const r = await openAndAcknowledge({ item: { ...ITEM, id: `t-${tier}`, raw_ref: `cohort:tier:${tier}` }, classResult: CLASS_COMPLEX, tier });
-      const res = await notePlan({ key: r.key, firstTurn: FIRST_TURN, now: Date.now(), deps: { deliverImpl: t.impl } });
-      assert.equal(res.spoke, false);
-      assert.equal(res.reason, `tier-${tier}`);
-    }
-    assert.equal(t.sent.length, 0);
-  });
-
-  test("a plan posted, then the session answers — the debt discharges with no extra word", async () => {
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "plan" });
-    await notePlan({ key: r.key, firstTurn: FIRST_TURN, now: Date.now(), deps: { deliverImpl: t.impl } });
-    const before = t.sent.length;
-    const settled = await settleSession({ key: r.key, ok: true, code: 0, deps: { deliverImpl: t.impl, spokeForImpl: () => ({ heard: true, basis: "receipt" }) } });
-    assert.equal(settled.verdict, "answered-by-session");
-    assert.equal(t.sent.length, before, "the daemon adds nothing on top of the session's own answer");
-  });
-});
-
-describe("COPY: no promise without a mechanism", async () => {
-  // §5.1.5. An interim may not contain a future-tense commitment unless a
-  // DURABLE obligation exists and the sweep can close it. The two deleted
-  // progress lines broke this twice over: they promised ("I'll come back as
-  // soon as I've got something") from a timer that had no idea whether anything
-  // would ever come back, and 272 acknowledgements proved the promise empty.
-  // IMPORTED, never re-typed. The sibling test one describe-block up exists to
-  // stop the ack prompt and its filter drifting apart; a copy test that
-  // re-declares the pattern it is checking has the identical defect. The local
-  // copy this replaces had already drifted: it was missing the `revert`
-  // alternative and the whole `i will (come back|...)` branch, so
-  // "I will report back once the reconciliation is done" was dropped by the
-  // implementation and would have PASSED the test's own check.
-  const { FORWARD_PROMISE } = await import("../../lib/assurance/plan-note.mjs");
-
-  test("the deleted progress lines are gone from the module entirely", () => {
-    assert.equal(typeof assurance.composeProgress, "undefined", "composeProgress may not be reintroduced");
-    assert.equal(typeof assurance.PROGRESS_AFTER_MS, "undefined");
-    assert.equal(typeof assurance.PROGRESS_EVERY_MS, "undefined");
-    assert.equal(typeof assurance.PROGRESS_MAX, "undefined");
-  });
-
-  test("…and the retired strings are still RECOGNISED, so a peer running older code cannot restart the loop", () => {
-    for (const line of RETIRED_NARRATOR_TEMPLATES) {
-      assert.equal(isOwnNarratorText(line), true, `"${line}" must still be recognised as machinery talking`);
-    }
-  });
-
-  test("every interim the system can emit is promise-free", async () => {
-    // The plan note is the only composed interim left; the other is the
-    // model-generated ack, which the sanitiser governs. Both are checked.
-    const { renderPlanNote } = await import("../../lib/assurance/plan-note.mjs");
-    const note = renderPlanNote("1. Pull the ledger rows for July.\n2. Reconcile them against the signed forecast.\n3. I'll come back as soon as I've got something.");
-    assert.ok(note);
-    assert.doesNotMatch(note, FORWARD_PROMISE, "a plan bullet carries no durable backing and may not promise a return");
-
-    // A generated ack that promises is still admissible ONLY because a durable
-    // obligation is what carries it — pinned here so the coupling is explicit.
-    const promising = "Starting on the July reconciliation now; I'll come back with the variances.";
-    assert.equal(sanitiseAckText(promising), promising);
-    const t = fakeTransport();
-    const r = await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "work" });
-    await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => promising },
-    });
-    assert.equal(t.sent.length, 1);
-    const rec = readObligation(r.key);
-    assert.equal(rec.state, "open", "the promise is backed: the debt is durable…");
-    assert.equal(openObligations().some((o) => o.key === r.key), true, "…and the sweep can still find it and close it");
-  });
-
-  test("an obligation the sweep CANNOT close never gets to promise anything", async () => {
-    // No transport ⇒ no interim, at open time or ever. A promise into a channel
-    // that does not exist is the purest form of the broken-promise failure.
-    const t = fakeTransport();
-    const TELEGRAM_ITEM = { ...ITEM, id: "TG-9", raw_ref: "telegram:9", service: "telegram", channel: null, channel_id: null };
-    const r = await openAndAcknowledge({ item: TELEGRAM_ITEM, classResult: CLASS_COMPLEX, tier: "work", ack: false });
-    assert.equal(readObligation(r.key).interimForbidden, true);
-    await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 1000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => "I'll come back as soon as I've got something." },
-    });
-    assert.equal(t.sent.length, 0);
-  });
-});
-
-describe("the answer tier is silent even when a caller gets the flag wrong", () => {
-  test("a record whose TIER is answer never produces an interim, ack:true or not", async () => {
-    // Defence in depth. `shouldAcknowledge` returns ack:false for the answer
-    // tier and the daemon turns that into `interimForbidden`, but the tier is
-    // the durable fact on the record and is what "never speak about this one"
-    // actually means. A caller that passes the tier and forgets the flag must
-    // not be able to re-open the flood.
-    const t = fakeTransport();
-    await openAndAcknowledge({ item: ITEM, classResult: CLASS_COMPLEX, tier: "answer", ack: true });
-    assert.equal(readObligation(ITEM.raw_ref).interimForbidden, undefined, "the flag was NOT set — this is the caller bug being defended against");
-    const stats = await sweepObligations({
-      now: Date.now() + ACK_AFTER_MS + 60_000,
-      deps: { deliverImpl: t.impl, spokeSinceImpl: () => false, generateAckImpl: async () => FAKE_ACK_LINE },
-    });
-    assert.equal(stats.acked, 0);
-    assert.equal(t.sent.length, 0, "the tier alone is enough to keep it quiet");
-  });
-});