@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/lib/assurance/room-budget.test.mjs

@@ -1,486 +0,0 @@
-/**
- * room-budget.test.mjs — one room, one interim, whatever else is going on.
- *
- * The production failure this pins: the interim budget was per OBLIGATION and
- * never per ROOM. Eight agents with N concurrent obligations each in
- * `capital-formation` emitted up to N acks + 2N progress pings + N failure
- * notices into one channel — 9,187 messages in 21 days, ~45 % of them exact
- * duplicates, two independent timers narrating the same overlapping work at the
- * same timestamp. Every one of those decisions was individually correct.
- *
- * Run: node --test lib/assurance/room-budget.test.mjs
- */
-
-import { test, describe, beforeEach } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, readFileSync, mkdirSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  DEFAULT_ROOM_INTERIM_WINDOW_MS,
-  DEFAULT_ROOM_NOTICE_WINDOW_MS,
-  roomInterimWindowMs,
-  roomNoticeWindowMs,
-  roomKey,
-  noticeKey,
-  textDigest,
-  interimAllowed,
-  noticeAllowed,
-  recordInterim,
-  recordNotice,
-  pruneLedger,
-  claimRoomInterim,
-  claimRoomNotice,
-  ledgerPath,
-  LEDGER_BASENAME,
-  readLedger,
-  _emptyLedger,
-} from "./room-budget.mjs";
-
-const ROOM_INTERIM_WINDOW_MS = DEFAULT_ROOM_INTERIM_WINDOW_MS;
-
-const T0 = 1_757_000_000_000; // a fixed instant; nothing here reads a clock
-
-// ---------------------------------------------------------------------------
-// The pure half
-// ---------------------------------------------------------------------------
-
-describe("roomKey — a room is (service, channel) and nothing else", () => {
-  test("service and channel together name the room", () => {
-    assert.equal(roomKey({ service: "cohort", channel: "C-CAPFORM" }), "cohort|c-capform");
-  });
-
-  test("case and surrounding space never make two rooms out of one", () => {
-    assert.equal(roomKey({ service: "Cohort", channel: " C-CapForm " }), roomKey({ service: "cohort", channel: "c-capform" }));
-  });
-
-  test("a missing channel is still a room, not a crash", () => {
-    assert.equal(typeof roomKey({ service: "cohort", channel: null }), "string");
-    assert.equal(typeof roomKey({}), "string");
-    assert.equal(typeof roomKey(), "string");
-  });
-
-  test("two different channels on one service are two rooms", () => {
-    assert.notEqual(roomKey({ service: "cohort", channel: "A" }), roomKey({ service: "cohort", channel: "B" }));
-  });
-
-  test("the same channel name on two services is two rooms", () => {
-    assert.notEqual(roomKey({ service: "cohort", channel: "general" }), roomKey({ service: "slack", channel: "general" }));
-  });
-});
-
-describe("interimAllowed — the pure decision", () => {
-  test("an empty ledger allows the first interim", () => {
-    const v = interimAllowed({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    assert.equal(v.allowed, true);
-    assert.equal(v.reason, "room-budget-free");
-  });
-
-  test("a second interim inside the window is refused, and says which room and when", () => {
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    const v = interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 + 60_000 });
-    assert.equal(v.allowed, false);
-    assert.equal(v.reason, "room-budget-spent");
-    assert.equal(v.lastAt, T0);
-    assert.equal(v.room, roomKey({ service: "cohort", channel: "C1" }));
-  });
-
-  test("the window reopens exactly at the boundary, not a millisecond early", () => {
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    assert.equal(interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 + ROOM_INTERIM_WINDOW_MS - 1 }).allowed, false);
-    assert.equal(interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 + ROOM_INTERIM_WINDOW_MS }).allowed, true);
-  });
-
-  test("a spent room never silences a DIFFERENT room", () => {
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    assert.equal(interimAllowed({ ledger: led, service: "cohort", channel: "C2", now: T0 + 1 }).allowed, true);
-    assert.equal(interimAllowed({ ledger: led, service: "slack", channel: "C1", now: T0 + 1 }).allowed, true);
-  });
-
-  test("a clock that goes backwards does not hand out a free interim", () => {
-    // NTP steps, a restored snapshot, a test harness. `now` before the recorded
-    // stamp must read as "inside the window", never as "the window elapsed".
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    assert.equal(interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 - 60 * 60_000 }).allowed, false);
-  });
-
-  test("a corrupt or absent entry reads as 'never spoken here', never as a permanent gag", () => {
-    for (const bad of [{ rooms: null }, { rooms: { "cohort|c1": "yesterday" } }, {}, null, undefined, "nonsense"]) {
-      assert.equal(interimAllowed({ ledger: bad, service: "cohort", channel: "C1", now: T0 }).allowed, true, `${JSON.stringify(bad)} must fail open`);
-    }
-  });
-
-  test("the decision is pure: it never mutates the ledger it is given", () => {
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    const before = JSON.stringify(led);
-    interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 + 1 });
-    assert.equal(JSON.stringify(led), before);
-  });
-
-  test("the window is env-tunable and defaults to fifteen minutes", () => {
-    assert.equal(DEFAULT_ROOM_INTERIM_WINDOW_MS, 15 * 60_000);
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    assert.equal(interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 + 2000, windowMs: 1000 }).allowed, true);
-  });
-});
-
-describe("recordInterim / pruneLedger", () => {
-  test("recording returns a NEW ledger and leaves the old one untouched", () => {
-    const led = _emptyLedger();
-    const next = recordInterim({ ledger: led, service: "cohort", channel: "C1", now: T0 });
-    assert.notEqual(led, next);
-    assert.deepEqual(led.rooms, {});
-    assert.equal(next.rooms[roomKey({ service: "cohort", channel: "C1" })], T0);
-  });
-
-  test("the ledger does not grow without bound — entries older than two windows are dropped", () => {
-    // The store is a durable file on a machine that runs for months. An entry
-    // that can never refuse anything again is landfill.
-    let led = _emptyLedger();
-    for (let i = 0; i < 50; i++) led = recordInterim({ ledger: led, service: "cohort", channel: `OLD-${i}`, now: T0 });
-    led = recordInterim({ ledger: led, service: "cohort", channel: "FRESH", now: T0 + 3 * ROOM_INTERIM_WINDOW_MS });
-    const pruned = pruneLedger({ ledger: led, now: T0 + 3 * ROOM_INTERIM_WINDOW_MS });
-    assert.equal(Object.keys(pruned.rooms).length, 1);
-    assert.ok(pruned.rooms[roomKey({ service: "cohort", channel: "FRESH" })]);
-  });
-
-  test("pruning never drops an entry that can still refuse an interim", () => {
-    const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-    const pruned = pruneLedger({ ledger: led, now: T0 + ROOM_INTERIM_WINDOW_MS });
-    assert.equal(interimAllowed({ ledger: pruned, service: "cohort", channel: "C1", now: T0 + ROOM_INTERIM_WINDOW_MS - 1 }).allowed, false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// The durable edge
-// ---------------------------------------------------------------------------
-
-describe("claimRoomInterim — the durable edge, with an injected clock and fs", () => {
-  let ROOT;
-  beforeEach(() => {
-    if (ROOT) { try { rmSync(ROOT, { recursive: true, force: true }); } catch { /* */ } }
-    ROOT = mkdtempSync(join(tmpdir(), "room-budget-"));
-  });
-
-  test("THE FLOOD FIX: N concurrent obligations in one room yield exactly ONE interim", () => {
-    // 8 agents' worth of concurrent asks, arriving together, as measured.
-    const said = [];
-    for (let i = 0; i < 40; i++) {
-      const v = claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + i * 1000, agentRoot: ROOT });
-      if (v.allowed) said.push(i);
-    }
-    assert.deepEqual(said, [0], `expected one interim across 40 obligations, got ${said.length}`);
-  });
-
-  test("…and the next window allows exactly one more, not a backlog burst", () => {
-    for (let i = 0; i < 40; i++) claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + i * 1000, agentRoot: ROOT });
-    let allowed = 0;
-    for (let i = 0; i < 40; i++) {
-      if (claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + ROOM_INTERIM_WINDOW_MS + i * 1000, agentRoot: ROOT }).allowed) allowed++;
-    }
-    assert.equal(allowed, 1);
-  });
-
-  test("a refused claim writes nothing and does not move the window", () => {
-    claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT });
-    claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 10 * 60_000, agentRoot: ROOT });
-    // If the refused claim had stamped the ledger, the window would run from
-    // T0+10min and the room would stay gagged past T0+15min.
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + ROOM_INTERIM_WINDOW_MS, agentRoot: ROOT }).allowed, true);
-  });
-
-  test("busy rooms never gag quiet ones", () => {
-    for (let i = 0; i < 20; i++) claimRoomInterim({ service: "cohort", channel: "busy", now: T0 + i, agentRoot: ROOT });
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "quiet", now: T0 + 100, agentRoot: ROOT }).allowed, true);
-  });
-
-  test("the store is durable — a fresh process sees the spend", () => {
-    claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT });
-    const onDisk = JSON.parse(readFileSync(ledgerPath(ROOT), "utf-8"));
-    assert.equal(onDisk.rooms[roomKey({ service: "cohort", channel: "C1" })], T0);
-    assert.equal(readLedger({ agentRoot: ROOT }).rooms[roomKey({ service: "cohort", channel: "C1" })], T0);
-  });
-
-  test("it lives beside the obligation ledger it governs", () => {
-    assert.equal(ledgerPath(ROOT), join(ROOT, "state", "obligations", "room-budget.json"));
-  });
-
-  test("an unreadable store fails OPEN — a broken file may not silence a human", () => {
-    mkdirSync(join(ROOT, "state", "obligations"), { recursive: true });
-    writeFileSync(ledgerPath(ROOT), "{ this is not json");
-    const v = claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT });
-    assert.equal(v.allowed, true);
-    assert.equal(v.degraded, true, "…but it SAYS it is degraded, so the condition is measurable");
-  });
-
-  test("an unwritable store still lets the message out, and says so", () => {
-    const v = claimRoomInterim({
-      service: "cohort", channel: "C1", now: T0, agentRoot: ROOT,
-      deps: { writeImpl: () => { throw new Error("EROFS"); } },
-    });
-    assert.equal(v.allowed, true);
-    assert.equal(v.degraded, true);
-  });
-
-  test("the clock is injected, never read from the wall", () => {
-    // Passing `now` is the contract; omitting it is a caller bug, not a licence
-    // to read Date.now() from inside a decision module.
-    const v = claimRoomInterim({ service: "cohort", channel: "C1", agentRoot: ROOT });
-    assert.equal(v.allowed, false);
-    assert.equal(v.reason, "no-clock");
-  });
-
-  test("fs is injectable end to end — no real filesystem needed", () => {
-    let stored = null;
-    const deps = {
-      readImpl: () => stored,
-      writeImpl: (_p, obj) => { stored = obj; },
-    };
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT, deps }).allowed, true);
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 1, agentRoot: ROOT, deps }).allowed, false);
-    assert.equal(stored.rooms[roomKey({ service: "cohort", channel: "C1" })], T0);
-  });
-});
-
-describe("claimRoomInterim commit:false — ask without spending", () => {
-  let ROOT;
-  beforeEach(() => {
-    if (ROOT) { try { rmSync(ROOT, { recursive: true, force: true }); } catch { /* */ } }
-    ROOT = mkdtempSync(join(tmpdir(), "room-budget-peek-"));
-  });
-
-  test("a peek does not spend the budget", () => {
-    // The interim's text comes from a model call that can fail. Spending the
-    // room's fifteen minutes BEFORE the message exists gags the room in
-    // exchange for nothing — so the caller asks first, composes, then claims.
-    const peek = claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT, commit: false });
-    assert.equal(peek.allowed, true);
-    assert.equal(peek.committed, false);
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 1, agentRoot: ROOT }).allowed, true, "the peek left the budget unspent");
-  });
-
-  test("a peek still reports a spent room", () => {
-    claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT });
-    const peek = claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 1000, agentRoot: ROOT, commit: false });
-    assert.equal(peek.allowed, false);
-    assert.equal(peek.reason, "room-budget-spent");
-  });
-
-  test("a committing claim says so", () => {
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT }).committed, true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// The HONEST SCOPE of the guarantee
-// ---------------------------------------------------------------------------
-
-describe("the budget is per (SEAT, service, channel) — not per (service, channel)", () => {
-  let A, B;
-  beforeEach(() => {
-    A = mkdtempSync(join(tmpdir(), "room-seat-a-"));
-    B = mkdtempSync(join(tmpdir(), "room-seat-b-"));
-  });
-
-  test("two seats in ONE room each get their own interim, because they share no store", () => {
-    // This is the arithmetic the module header now states rather than glosses.
-    // `agentRoot` is AGENT_DIR — one agent's repo on one Mac mini. There is no
-    // shared filesystem between seats, so the guarantee this module can make is
-    // per seat. The measured room had EIGHT seats in it: the ceiling this gate
-    // alone imposes there is 8 x (60/15) = 32 interims an hour, against a
-    // measured content-free rate of ~14/h. It is the backstop, not the thing
-    // that removed the measured flood.
-    //
-    // Pinned as a TEST rather than left in prose because the comment that said
-    // otherwise survived a review: an operator who reads "one room, one message"
-    // will size the next change wrong.
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0, agentRoot: A }).allowed, true);
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + 1, agentRoot: B }).allowed, true,
-      "a second SEAT is not gagged by the first — there is no store between them");
-    // …and within either seat the guarantee still holds absolutely.
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + 2, agentRoot: A }).allowed, false);
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + 3, agentRoot: B }).allowed, false);
-  });
-
-  test("the eight-seat ceiling is exactly eight per window, and no more", () => {
-    const seats = [];
-    for (let i = 0; i < 8; i++) seats.push(mkdtempSync(join(tmpdir(), `room-seat-${i}-`)));
-    let spoke = 0;
-    // Each seat tries ten times inside one window; each may speak once.
-    for (const seat of seats) {
-      for (let i = 0; i < 10; i++) {
-        if (claimRoomInterim({ service: "cohort", channel: "capital-formation", now: T0 + i, agentRoot: seat }).allowed) spoke++;
-      }
-    }
-    assert.equal(spoke, 8, "eight seats, eight interims per window — the honest ceiling");
-    for (const seat of seats) rmSync(seat, { recursive: true, force: true });
-  });
-});
-
-describe("the window default is resolved at the EDGE, never captured at import", () => {
-  // The gate report for this package claimed the pure modules read no
-  // clock/env/fs. A `const X = process.env.Y` at module scope falsified that
-  // and, more concretely, meant an operator who exported the variable after the
-  // first import silently got the stale default.
-  test("roomInterimWindowMs reads the env it is given, every time it is called", () => {
-    assert.equal(roomInterimWindowMs({}), DEFAULT_ROOM_INTERIM_WINDOW_MS);
-    assert.equal(roomInterimWindowMs({ ASSURANCE_ROOM_INTERIM_WINDOW_MS: "60000" }), 60_000);
-    assert.equal(roomNoticeWindowMs({ ASSURANCE_ROOM_NOTICE_WINDOW_MS: "1000" }), 1000);
-    // Garbage falls back rather than producing NaN, which would compare false
-    // against every elapsed time and make the budget decorative.
-    assert.equal(roomInterimWindowMs({ ASSURANCE_ROOM_INTERIM_WINDOW_MS: "soon" }), DEFAULT_ROOM_INTERIM_WINDOW_MS);
-    assert.equal(roomNoticeWindowMs(undefined) > 0, true);
-  });
-
-  test("an env set AFTER this module was first imported still takes effect", () => {
-    const ROOT = mkdtempSync(join(tmpdir(), "room-env-"));
-    const prev = process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS;
-    try {
-      process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS = "1000";
-      assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT }).allowed, true);
-      assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 999, agentRoot: ROOT }).allowed, false);
-      assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 1000, agentRoot: ROOT }).allowed, true,
-        "the one-second window was honoured, so the value was not folded at import time");
-    } finally {
-      if (prev === undefined) delete process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS;
-      else process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS = prev;
-      rmSync(ROOT, { recursive: true, force: true });
-    }
-  });
-
-  test("the pure decision never reads the environment — it defaults to the CONSTANT", () => {
-    const prev = process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS;
-    try {
-      process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS = "1000";
-      const led = recordInterim({ ledger: _emptyLedger(), service: "cohort", channel: "C1", now: T0 });
-      assert.equal(
-        interimAllowed({ ledger: led, service: "cohort", channel: "C1", now: T0 + 2000 }).allowed,
-        false,
-        "the pure function used the 15-minute constant, not the environment",
-      );
-    } finally {
-      if (prev === undefined) delete process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS;
-      else process.env.ASSURANCE_ROOM_INTERIM_WINDOW_MS = prev;
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Identical outcome notices
-// ---------------------------------------------------------------------------
-
-describe("textDigest / noticeKey", () => {
-  test("the same sentence digests the same however it is spaced", () => {
-    assert.equal(textDigest("Couldn't finish this — it timed out."), textDigest("  Couldn't finish   this — it timed out.  "));
-  });
-
-  test("a different sentence digests differently", () => {
-    assert.notEqual(textDigest("Hit a problem — it timed out. Retrying now."), textDigest("Couldn't finish this — it timed out."));
-  });
-
-  test("the key separates room, notice id and sentence", () => {
-    const base = { service: "cohort", channel: "C1", notice: "failure:final", text: "same" };
-    assert.notEqual(noticeKey(base), noticeKey({ ...base, channel: "C2" }));
-    assert.notEqual(noticeKey(base), noticeKey({ ...base, notice: "failure:retrying" }));
-    assert.notEqual(noticeKey(base), noticeKey({ ...base, text: "different" }));
-    assert.equal(noticeKey(base), noticeKey({ ...base }));
-  });
-});
-
-describe("claimRoomNotice — a byte-identical outcome notice is not said twice in one room", () => {
-  let ROOT;
-  const STALE = "Couldn't finish this — the work never came back with a result and has now outrun its time limit. I've stopped retrying and flagged it so it isn't lost.";
-  beforeEach(() => { ROOT = mkdtempSync(join(tmpdir(), "room-notice-")); });
-
-  test("THE SIBLING CASE: twenty debts, one sentence, one message", () => {
-    // The per-obligation notice ledger cannot reach this: twenty separate asks
-    // are twenty separate records, and the stale sentence carries nothing about
-    // which ask it is, so the reader gets the identical line twenty times and
-    // cannot tell any of them apart.
-    let said = 0;
-    for (let i = 0; i < 20; i++) {
-      if (claimRoomNotice({ service: "cohort", channel: "C-CAPFORM", notice: "failure:final", text: STALE, now: T0 + i * 1000, agentRoot: ROOT }).allowed) said++;
-    }
-    assert.equal(said, 1, `twenty identical failure sentences must reach one room once — got ${said}`);
-  });
-
-  test("a DIFFERENT sentence is never suppressed, at any volume", () => {
-    // This is the safety argument. Suppressing information a reader does not
-    // have re-creates the original bug: a person never told their work died.
-    let said = 0;
-    for (let i = 0; i < 20; i++) {
-      const text = `Couldn't finish this — cause number ${i}. I've stopped retrying.`;
-      if (claimRoomNotice({ service: "cohort", channel: "C-CAPFORM", notice: "failure:final", text, now: T0 + i * 1000, agentRoot: ROOT }).allowed) said++;
-    }
-    assert.equal(said, 20, "every distinct fact is still said");
-  });
-
-  test("'a retry is running' and 'I have stopped' stay separately sayable", () => {
-    const retrying = "Hit a problem — it timed out. Retrying now; if it fails again I'll come straight back.";
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:retrying", text: retrying, now: T0, agentRoot: ROOT }).allowed, true);
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0 + 1, agentRoot: ROOT }).allowed, true);
-  });
-
-  test("a different ROOM is never gagged by a busy one", () => {
-    claimRoomNotice({ service: "cohort", channel: "busy", notice: "failure:final", text: STALE, now: T0, agentRoot: ROOT });
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "quiet", notice: "failure:final", text: STALE, now: T0 + 1, agentRoot: ROOT }).allowed, true);
-  });
-
-  test("the window reopens, because the same fact a day later is news again", () => {
-    claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0, agentRoot: ROOT });
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0 + DEFAULT_ROOM_NOTICE_WINDOW_MS - 1, agentRoot: ROOT }).allowed, false);
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0 + DEFAULT_ROOM_NOTICE_WINDOW_MS, agentRoot: ROOT }).allowed, true);
-  });
-
-  test("commit:false asks without spending", () => {
-    const peek = claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0, agentRoot: ROOT, commit: false });
-    assert.equal(peek.allowed, true);
-    assert.equal(peek.committed, false);
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0 + 1, agentRoot: ROOT }).allowed, true,
-      "the peek left it unspent — a send that never happened must not silence the next one");
-  });
-
-  test("FAIL-OPEN, and the OPPOSITE way to the interim: no clock ⇒ say it", () => {
-    // An interim is a courtesy and is safe to drop. "Your work died" is not.
-    const v = claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, agentRoot: ROOT });
-    assert.equal(v.allowed, true);
-    assert.equal(v.degraded, true);
-  });
-
-  test("an unreadable ledger lets the notice through, flagged", () => {
-    mkdirSync(join(ROOT, "state", "obligations"), { recursive: true });
-    writeFileSync(ledgerPath(ROOT), "{ not json");
-    const v = claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0, agentRoot: ROOT });
-    assert.equal(v.allowed, true);
-    assert.equal(v.degraded, true);
-  });
-
-  test("interims and notices share one file without evicting each other", () => {
-    claimRoomInterim({ service: "cohort", channel: "C1", now: T0, agentRoot: ROOT });
-    claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0 + 1, agentRoot: ROOT });
-    const led = JSON.parse(readFileSync(ledgerPath(ROOT), "utf-8"));
-    assert.equal(Object.keys(led.rooms).length, 1, "the interim spend survived the notice write");
-    assert.equal(Object.keys(led.notices).length, 1);
-    assert.equal(claimRoomInterim({ service: "cohort", channel: "C1", now: T0 + 2, agentRoot: ROOT }).allowed, false);
-    assert.equal(claimRoomNotice({ service: "cohort", channel: "C1", notice: "failure:final", text: STALE, now: T0 + 3, agentRoot: ROOT }).allowed, false);
-  });
-
-  test("the notice map is pruned too, so the file cannot grow without bound", () => {
-    let led = _emptyLedger();
-    for (let i = 0; i < 50; i++) {
-      led = recordNotice({ ledger: led, service: "cohort", channel: "C1", notice: "failure:final", text: `old ${i}`, now: T0 });
-    }
-    const pruned = pruneLedger({ ledger: led, now: T0 + 3 * DEFAULT_ROOM_NOTICE_WINDOW_MS });
-    assert.equal(Object.keys(pruned.notices).length, 0);
-  });
-});
-
-describe("the ledger basename is exported, because its reader has to skip it", () => {
-  test("LEDGER_BASENAME is the file ledgerPath produces", () => {
-    // `assurance.listObligations` parses every *.json in this directory as a
-    // debt record. It skips this one BY NAME, so the name must be one string.
-    assert.equal(ledgerPath("/tmp/x").endsWith(`/${LEDGER_BASENAME}`), true);
-    assert.equal(LEDGER_BASENAME, "room-budget.json");
-  });
-});

package/lib/assurance/tier.test.mjs

@@ -1,174 +0,0 @@
-/**
- * tier.test.mjs — the reply tier, across the whole classifier matrix.
- *
- * The tier is the ONE decision that says whether a human hears anything before
- * the answer. Getting it wrong in the loud direction is the 3,069 generic acks
- * and 961 clock-derived nags measured in production on 2026-09-12; getting it
- * wrong in the quiet direction is the silence the obligation ledger was built
- * to end. So every cell of the matrix is pinned here rather than sampled.
- *
- * Run: node --test lib/assurance/tier.test.mjs
- */
-
-import { test, describe } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  replyTier,
-  TIERS,
-  ANSWER_MAX_RUNG,
-  PLAN_MIN_RUNG,
-  PLAN_ACTIONS,
-  PLAN_PRIORITIES,
-} from "./tier.mjs";
-
-/** Every value `classifier.mjs` can emit — the real enums, not a sample. */
-const ACTIONS = ["respond", "draft", "research", "queue", "archive", "ignore"];
-const PRIORITIES = ["critical", "high", "normal", "ignore"];
-/** Every rung in `lib/execution/route.RUNGS`, plus "not routed yet". */
-const RUNGS = [0, 1, 2, 3, 4, 5, null];
-
-describe("replyTier — the three tiers and nothing else", () => {
-  test("every cell of the matrix returns one of exactly three tiers", () => {
-    for (const action of ACTIONS) {
-      for (const priority of PRIORITIES) {
-        for (const rung of RUNGS) {
-          for (const answerable of [true, false, null, undefined]) {
-            for (const willSpawnSession of [true, false]) {
-              const t = replyTier({ answerable, action, priority, rung, willSpawnSession });
-              assert.ok(TIERS.includes(t), `{${action}/${priority}/rung:${rung}/answerable:${answerable}/spawn:${willSpawnSession}} → ${t}`);
-            }
-          }
-        }
-      }
-    }
-  });
-
-  test("no session spawning ⇒ answer tier, whatever the classifier said", () => {
-    // The reply arrives in this turn. An interim in front of an answer the
-    // human is about to read is the definition of content-free traffic.
-    for (const action of ACTIONS) {
-      for (const priority of PRIORITIES) {
-        for (const rung of RUNGS) {
-          assert.equal(
-            replyTier({ answerable: false, action, priority, rung, willSpawnSession: false }),
-            "answer",
-            `${action}/${priority}/rung:${rung} with no session must be "answer"`,
-          );
-        }
-      }
-    }
-  });
-
-  test("answerable at rung 0 or 1 is the answer tier — the reply IS the acknowledgement", () => {
-    // `willSpawnSession` UNKNOWN: the caller is asking hypothetically (which is
-    // how WP-2's effort router will use it), so the classifier verdict decides.
-    for (const rung of [0, ANSWER_MAX_RUNG]) {
-      assert.equal(replyTier({ answerable: true, action: "respond", priority: "high", rung }), "answer");
-      assert.equal(replyTier({ answerable: true, action: "respond", priority: "high", rung, willSpawnSession: false }), "answer");
-    }
-  });
-
-  test("REGRESSION: an ASSERTED session disqualifies the answer tier, however answerable the item looked", () => {
-    // THE QUICK-PATH FALL-THROUGH. agent-daemon.mjs tries a quick reply first;
-    // when that reply fails transiently or is blocked by validation it falls
-    // THROUGH to a full session dispatch and asks for a tier with
-    // willSpawnSession:true while classResult.answerable is still true. The
-    // answer tier's whole premise — "the reply arrives in this turn" — is
-    // exactly what the fall-through has falsified.
-    //
-    // Latent rather than live only because `rung` is null today (R13). The
-    // moment WP-2 routes it, that item would have landed in `answer`,
-    // shouldAcknowledge would have returned ack:false, the sweep would have
-    // read the durable tier as never-speak, and a 15-45 minute session would
-    // have run with the human hearing NOTHING at all. Pinned before WP-2 lands
-    // on top of it.
-    for (const rung of [0, ANSWER_MAX_RUNG]) {
-      assert.equal(
-        replyTier({ answerable: true, action: "respond", priority: "high", rung, willSpawnSession: true }),
-        "work",
-        `rung ${rung}: a spawning session speaks once at most — it is never silent`,
-      );
-    }
-    // …and the plan tier still outranks it, because rung 3+ is a project.
-    assert.equal(replyTier({ answerable: true, action: "respond", priority: "high", rung: 4, willSpawnSession: true }), "plan");
-  });
-
-  test("a routed rung of 3 or above is the plan tier, whatever the action", () => {
-    for (const rung of RUNGS.filter((r) => r != null && r >= PLAN_MIN_RUNG)) {
-      for (const action of ACTIONS) {
-        assert.equal(
-          replyTier({ answerable: false, action, priority: "normal", rung, willSpawnSession: true }),
-          "plan",
-          `rung ${rung} / ${action} must be "plan"`,
-        );
-      }
-    }
-  });
-
-  test("research or draft at critical/high priority is the plan tier even with no routed rung", () => {
-    for (const action of PLAN_ACTIONS) {
-      for (const priority of PLAN_PRIORITIES) {
-        assert.equal(replyTier({ answerable: false, action, priority, rung: null, willSpawnSession: true }), "plan");
-      }
-    }
-  });
-
-  test("…and the same actions at normal priority are only work", () => {
-    for (const action of PLAN_ACTIONS) {
-      for (const priority of ["normal", "ignore"]) {
-        assert.equal(replyTier({ answerable: false, action, priority, rung: null, willSpawnSession: true }), "work");
-      }
-    }
-  });
-
-  test("the ordinary directed ask — respond/high, unrouted — is work: silence, then at most one line", () => {
-    // This is the shape of the overwhelming majority of the 10,667 measured
-    // agent messages. It must NOT be plan tier, or the flood returns wearing a
-    // better costume.
-    assert.equal(replyTier({ answerable: false, action: "respond", priority: "high", rung: null, willSpawnSession: true }), "work");
-    assert.equal(replyTier({ answerable: false, action: "queue", priority: "critical", rung: null, willSpawnSession: true }), "work");
-  });
-
-  test("an ABSENT rung is never read as the cheapest rung", () => {
-    // `lib/backlog` already learned this: absence is not rung 0. A missing rung
-    // may not buy the answer tier's silence-on-the-strength-of-a-quick-path,
-    // and may not buy the plan tier's licence to speak either.
-    assert.equal(replyTier({ answerable: true, action: "respond", priority: "high", rung: null, willSpawnSession: true }), "work");
-    assert.equal(replyTier({ answerable: true, action: "respond", priority: "high", rung: undefined, willSpawnSession: true }), "work");
-  });
-
-  test("a non-numeric or out-of-range rung is treated as unrouted, never as a licence to speak", () => {
-    for (const rung of ["3", "team", NaN, Infinity, -1, 6, {}, []]) {
-      assert.equal(
-        replyTier({ answerable: false, action: "respond", priority: "normal", rung, willSpawnSession: true }),
-        "work",
-        `rung ${JSON.stringify(rung)} must not be trusted`,
-      );
-    }
-  });
-
-  test("answerable only counts when it is strictly true", () => {
-    // classifier.mjs coerces a missing/odd field to false for the same reason:
-    // never guess "answerable".
-    for (const answerable of ["true", 1, {}, null, undefined]) {
-      assert.equal(replyTier({ answerable, action: "respond", priority: "high", rung: 0, willSpawnSession: true }), "work");
-    }
-  });
-
-  test("garbage in gives work out — the tier never throws and never invents silence", () => {
-    // Fail-open direction: the tier that can still speak, never the tier that
-    // cannot. A classifier failure must not silently mute the agent.
-    assert.equal(replyTier(), "work");
-    assert.equal(replyTier(null), "work");
-    assert.equal(replyTier({}), "work");
-    assert.equal(replyTier({ action: 12, priority: [], rung: "x", willSpawnSession: "yes" }), "work");
-  });
-
-  test("the tier is a pure function — same input, same answer, no ambient reads", () => {
-    const args = { answerable: false, action: "research", priority: "critical", rung: null, willSpawnSession: true };
-    const first = replyTier(args);
-    for (let i = 0; i < 50; i++) assert.equal(replyTier(args), first);
-    assert.deepEqual(args, { answerable: false, action: "research", priority: "critical", rung: null, willSpawnSession: true }, "the argument is not mutated");
-  });
-});