@cohortapp/agent-sdk 2.17.0 → 2.18.4

package/lib/execution/disposition.test.mjs

@@ -1,553 +0,0 @@
-/**
- * disposition.test.mjs — the decision ladder, exercised on EVERY surface with
- * both the positive case and the negative one.
- *
- * The negatives matter as much as the positives here: an agent that replies to
- * everything is exactly as broken as one that replies to nothing.
- *
- * Run: node --test lib/execution/disposition.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { SURFACE_NAMES } from "../org/inbound/surfaces.mjs";
-import { SURFACE_POLICY } from "./surface-policy.mjs";
-import { decide, willAct, tierOf, DEFAULT_ACTOR_FLOOD_LIMIT } from "./disposition.mjs";
-
-const ME = "mem_me";
-const THEM = "mem_them";
-const NOW = Date.parse("2026-08-11T12:00:00Z");
-
-/** A permissive history: nothing seen, no chains, no floods, no failures. */
-function freshHistory(over = {}) {
-  return {
-    seen: () => false,
-    chainDepth: () => 0,
-    actorActivity: () => 0,
-    failures: () => 0,
-    degraded: false,
-    degradedReason: null,
-    ...over,
-  };
-}
-
-/** Build a candidate for a surface. */
-function cand(over = {}) {
-  return {
-    seq: 100,
-    family: "messaging",
-    kind: "send",
-    entityId: "msg_1",
-    actor: THEM,
-    at: "2026-08-11T11:59:00Z",
-    topic: "message",
-    ids: { channelId: "chan_1", messageId: "msg_1" },
-    directTo: [],
-    payload: {},
-    ...over,
-  };
-}
-
-function yes(surface, reason) { return { directed: true, surface, reason, why: reason }; }
-function no(reason) { return { directed: false, surface: null, reason, why: reason }; }
-
-/** decide() with sane defaults so each test states only what it is about. */
-function run(over = {}) {
-  return decide({
-    candidate: cand(over.candidate),
-    verdict: over.verdict || yes("dm", "dm"),
-    me: ME,
-    history: over.history === null ? undefined : (over.history || freshHistory()),
-    runtime: over.runtime || {},
-    obligation: over.obligation === undefined ? { key: "react.dm" } : over.obligation,
-    need: over.need,
-    manifest: over.manifest,
-    facts: over.facts || {},
-    nowMs: NOW,
-    actorFloodLimit: over.actorFloodLimit,
-  });
-}
-
-// ───────────────────────────────────────────────────────────────────────────
-// Per-surface coverage: every surface answers, and every surface can say no.
-// ───────────────────────────────────────────────────────────────────────────
-
-/**
- * The directed verdict each surface is reached by, and the candidate shape.
- * `candidate.surfaces` mirrors what `classifyEvent` really emits (most specific
- * first) — the undirected path reads it to decide park-vs-drop, so a test
- * candidate without it would be testing a shape that never occurs.
- */
-const CHAT_SURFACES = ["dm", "mention", "thread_reply"];
-const SURFACE_CASES = {
-  dm:           { verdict: yes("dm", "dm"),                  candidate: { family: "messaging", kind: "send", surfaces: CHAT_SURFACES } },
-  mention:      { verdict: yes("mention", "mention"),        candidate: { family: "messaging", kind: "send", surfaces: CHAT_SURFACES } },
-  thread_reply: { verdict: yes("thread_reply", "thread"),    candidate: { family: "messaging", kind: "send", surfaces: CHAT_SURFACES } },
-  call:         { verdict: yes("call", "participant"),       candidate: { family: "calling", kind: "invite", topic: "call", surfaces: ["call"], ids: { callId: "call_1" } } },
-  task_assigned:{ verdict: yes("task_assigned", "assignee"), candidate: { family: "board", kind: "item.assigned", topic: "task", surfaces: ["task_assigned"], ids: { taskId: "t1" } } },
-  task_comment: { verdict: yes("task_comment", "assignee"),  candidate: { family: "board", kind: "item.commented", topic: "task", surfaces: ["task_comment"], ids: { taskId: "t1" } } },
-  file_comment: { verdict: yes("file_comment", "channel"),   candidate: { family: "file", kind: "comment", topic: "file", surfaces: ["file_comment"], ids: { fileId: "f1", channelId: "c1" } } },
-  doc_comment:  { verdict: yes("doc_comment", "owner"),      candidate: { family: "files", kind: "comment", topic: "file", surfaces: ["doc_comment"], ids: { fileId: "d1" } } },
-  approval:     { verdict: yes("approval", "approver"),      candidate: { family: "approval", kind: "requested", topic: "approval", surfaces: ["approval"], ids: { approvalId: "a1" } } },
-  decision:     { verdict: yes("decision", "direct"),        candidate: { family: "decision", kind: "proposed", topic: "decision", surfaces: ["decision"], ids: { decisionId: "d1" } } },
-  escalation:   { verdict: yes("escalation", "waiting_on"),  candidate: { family: "escalation", kind: "raised", topic: "escalation", surfaces: ["escalation"], ids: { escalationId: "e1" } } },
-  handoff:      { verdict: yes("handoff", "direct"),         candidate: { family: "handoff", kind: "offered", topic: "handoff", surfaces: ["handoff"], ids: { handoffId: "h1" } } },
-  email:        { verdict: yes("email", "direct"),           candidate: { family: "email", kind: "received", topic: "email", surfaces: ["email"], ids: { messageId: "e1" } } },
-  // JOINT 3. `attendee` is the reason `resolveCalendar` emits when the ACL'd
-  // `calendar.list` read (owner OR attendeeRows) proved the event is this
-  // seat's — the payload can only ever prove `calendar_owner`.
-  calendar:     { verdict: yes("calendar", "attendee"),      candidate: { family: "calendar", kind: "event.created", topic: "calendar", surfaces: ["calendar"], ids: { eventId: "ev1" } } },
-};
-
-test("every inbound surface has a decision case in this test file", () => {
-  assert.deepEqual(Object.keys(SURFACE_CASES).sort(), [...SURFACE_NAMES].sort());
-});
-
-test("POSITIVE: every surface, when directed, produces an ACTING decision with reasoning", () => {
-  for (const [surface, c] of Object.entries(SURFACE_CASES)) {
-    const d = run(c);
-    assert.ok(willAct(d), `${surface} → ${d.disposition} (${d.reason}) — a directed event must not be dropped`);
-    assert.ok(d.why.length >= 2, `${surface} produced no reasoning`);
-    assert.ok(Number.isInteger(d.rung), `${surface} produced no rung`);
-    assert.equal(d.surface, surface);
-  }
-});
-
-test("NEGATIVE: every surface, when NOT directed, is ignored with the verdict's reason", () => {
-  for (const [surface, c] of Object.entries(SURFACE_CASES)) {
-    const d = run({ ...c, verdict: no("not_a_member") });
-    assert.equal(d.disposition, "ignore", `${surface} replied to something that was not addressed to it`);
-    assert.equal(d.reason, "not_a_member");
-    assert.ok(d.why.length >= 1, "even an ignore explains itself");
-    // Park-vs-drop is decided over the surfaces the event COULD have been —
-    // an undirected verdict names no surface, so the candidate's list is the
-    // only honest input.
-    const expectPark = c.candidate.surfaces.some((s) => SURFACE_POLICY[s].ambientDrop === false);
-    assert.equal(d.ambient, expectPark, `${surface} park-vs-drop`);
-  }
-});
-
-test("conversational surfaces answer NOW; work surfaces queue", () => {
-  assert.equal(run(SURFACE_CASES.dm).disposition, "react_now");
-  assert.equal(run(SURFACE_CASES.mention).disposition, "react_now");
-  assert.equal(run(SURFACE_CASES.thread_reply).disposition, "react_now");
-  assert.equal(run(SURFACE_CASES.escalation).disposition, "react_now");
-  assert.equal(run(SURFACE_CASES.handoff).disposition, "react_now");
-
-  // A board comment is answerable but nobody is watching for it → next tick.
-  assert.equal(run(SURFACE_CASES.task_comment).disposition, "schedule");
-  assert.equal(run(SURFACE_CASES.task_comment).reason, "batch_surface");
-  // A task assignment is work, not conversation.
-  assert.equal(run(SURFACE_CASES.task_assigned).disposition, "schedule");
-  assert.equal(run(SURFACE_CASES.task_assigned).reason, "not_respondable");
-  // An email is answerable, but on the batch tick and behind an approval.
-  assert.equal(run(SURFACE_CASES.email).disposition, "schedule");
-});
-
-test("a call invite is scheduled, never conversationally answered — hq holds the floor", () => {
-  const d = run(SURFACE_CASES.call);
-  assert.equal(d.disposition, "schedule");
-  assert.equal(d.reason, "not_respondable");
-  assert.equal(d.action.method, null);
-});
-
-test("approvals and decisions ESCALATE — the agent never decides its own", () => {
-  for (const s of ["approval", "decision"]) {
-    const d = run(SURFACE_CASES[s]);
-    assert.equal(d.disposition, "escalate", `${s} was self-decided`);
-    assert.equal(d.reason, "cannot_self_decide");
-    assert.ok(d.why.some((w) => /never be resolved by the agent itself/.test(w)));
-  }
-});
-
-test("replying by email carries an `external` approval gate; a DM does not", () => {
-  const email = run(SURFACE_CASES.email);
-  assert.deepEqual(email.gates.approval, { required: true, classes: ["external"] });
-  const dm = run(SURFACE_CASES.dm);
-  assert.equal(dm.gates.approval, undefined);
-});
-
-test("a reply into a SHARED room takes the thread lease; a DM does not", () => {
-  assert.ok(run(SURFACE_CASES.mention).gates.arbitration, "two agents must not answer one @mention");
-  assert.ok(run(SURFACE_CASES.thread_reply).gates.arbitration);
-  assert.equal(run(SURFACE_CASES.dm).gates.arbitration, undefined, "nobody else is in a DM");
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// The ignore cases — the half of this system that is normally missing.
-// ───────────────────────────────────────────────────────────────────────────
-
-test("IGNORE: the emergency stop beats everything", () => {
-  const d = run({ runtime: { emergencyStop: true } });
-  assert.equal(d.disposition, "ignore");
-  assert.equal(d.reason, "emergency_stop");
-});
-
-test("IGNORE: a `halt` directive stops the seat; `pause_schedules` does NOT stop answering", () => {
-  assert.equal(run({ runtime: { directive: "halt" } }).reason, "halt");
-
-  // pause_schedules: keeps answering...
-  const answering = run({ ...SURFACE_CASES.dm, runtime: { directive: "pause_schedules" } });
-  assert.equal(answering.disposition, "react_now", "a paused seat still answers");
-  // ...but stops queueing new work.
-  const queueing = run({ ...SURFACE_CASES.task_assigned, runtime: { directive: "pause_schedules" } });
-  assert.equal(queueing.disposition, "ignore");
-  assert.equal(queueing.reason, "paused");
-});
-
-test("IGNORE: my own echo, even if the directedness layer let it through", () => {
-  const d = run({ candidate: { actor: ME } });
-  assert.equal(d.disposition, "ignore");
-  assert.equal(d.reason, "own_echo");
-});
-
-test("IGNORE: a redelivery. The SSE push and the sweep both deliver the same event", () => {
-  const d = run({ history: freshHistory({ seen: () => true }) });
-  assert.equal(d.disposition, "ignore");
-  assert.equal(d.reason, "duplicate");
-});
-
-test("IGNORE: the ping-pong ceiling stops an agent talking to itself", () => {
-  // a space allows 2 agent turns
-  const at2 = run({ ...SURFACE_CASES.mention, history: freshHistory({ chainDepth: () => 2 }) });
-  assert.equal(at2.disposition, "ignore");
-  assert.equal(at2.reason, "reply_chain_depth");
-  assert.equal(at2.chainDepth, 2);
-
-  // one below the ceiling still answers, and says how deep it is
-  const at1 = run({ ...SURFACE_CASES.mention, history: freshHistory({ chainDepth: () => 1 }) });
-  assert.equal(at1.disposition, "react_now");
-  assert.ok(at1.why.some((w) => /1 prior agent turn/.test(w)));
-
-  // a DM tolerates a longer exchange than a public space
-  const dmAt2 = run({ ...SURFACE_CASES.dm, history: freshHistory({ chainDepth: () => 2 }) });
-  assert.equal(dmAt2.disposition, "react_now");
-});
-
-test("IGNORE: an undirected event on a drop-only surface is dropped, not parked", () => {
-  // A board assignment that is not mine, an approval that is not on my desk, a
-  // call in a room I am not in — none of these are worth a second pass.
-  for (const s of ["task_assigned", "approval", "call", "decision"]) {
-    const d = run({ ...SURFACE_CASES[s], verdict: no("not_a_member") });
-    assert.equal(d.ambient, false, `${s} should drop, not park`);
-  }
-});
-
-test("PARK: chat traffic that matched no rule is kept for the ambient sweep", () => {
-  const d = run({ ...SURFACE_CASES.mention, verdict: no("ambient_channel_traffic") });
-  assert.equal(d.disposition, "ignore");
-  assert.equal(d.ambient, true, "it could have been a mention whose hydration was incomplete");
-  assert.deepEqual(d.plausibleSurfaces, CHAT_SURFACES);
-});
-
-test("IGNORE: a malformed event never crashes the ladder", () => {
-  assert.equal(decide({}).reason, "not_classified");
-  assert.equal(decide({ candidate: null, verdict: null }).reason, "not_classified");
-  // A candidate with no verdict fails CLOSED on speaking, without dropping silently.
-  const noVerdict = decide({ candidate: cand(), me: ME, nowMs: NOW });
-  assert.equal(noVerdict.disposition, "ignore");
-  assert.equal(noVerdict.reason, "no_verdict");
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// Downgrades — nothing is ever silently dropped for load or money.
-// ───────────────────────────────────────────────────────────────────────────
-
-test("DOWNGRADE not silence: a flooding actor gets batched, not muted", () => {
-  // Assert on a NON-DM surface (an @mention): a directed 1:1 DM is now EXEMPT
-  // from actor-flood (see the next test), so it can no longer stand in for the
-  // general batching behaviour.
-  const floodMention = (over) => run({
-    verdict: yes("mention", "mention"),
-    candidate: { family: "messaging", kind: "send", surfaces: ["mention"] },
-    ...over,
-  });
-  const d = floodMention({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT }) });
-  assert.equal(d.disposition, "schedule");
-  assert.equal(d.reason, "actor_flood");
-  assert.equal(d.batched, true);
-  // one under the limit still answers turn-by-turn
-  const under = floodMention({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT - 1 }) });
-  assert.equal(under.disposition, "react_now");
-});
-
-test("a directed 1:1 DM is EXEMPT from actor-flood batching", () => {
-  // The flood counter tallies ALL of an actor's activity (their doc/board edits
-  // included), so a genuine 1:1 message must not be batched just because the same
-  // person tripped the limit elsewhere. Even far over the limit, a DM reacts now.
-  const d = run({ history: freshHistory({ actorActivity: () => DEFAULT_ACTOR_FLOOD_LIMIT * 5 }) });
-  assert.equal(d.disposition, "react_now");
-  assert.equal(d.reason, "directed_now");
-});
-
-test("DOWNGRADE not silence: an exhausted budget queues the reply", () => {
-  for (const runtime of [{ dailyCapExhausted: true }, { remainingCents: 0 }]) {
-    const d = run({ runtime });
-    assert.equal(d.disposition, "schedule");
-    assert.equal(d.reason, "budget_exhausted");
-  }
-});
-
-test("a lane-tier event outside working hours waits; a directed one does not", () => {
-  const lane = run({ verdict: yes("thread_reply", "thread"), runtime: { withinWorkingHours: false } });
-  assert.equal(lane.disposition, "schedule");
-  assert.equal(lane.reason, "outside_hours");
-
-  const direct = run({ verdict: yes("dm", "dm"), runtime: { withinWorkingHours: false } });
-  assert.equal(direct.disposition, "react_now", "someone addressed me directly — hours do not apply");
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// Delegate / escalate
-// ───────────────────────────────────────────────────────────────────────────
-
-test("DELEGATE: a lane-tier event whose owner is someone else is routed to them", () => {
-  const d = run({ verdict: yes("thread_reply", "thread"), facts: { ownerId: THEM } });
-  assert.equal(d.disposition, "delegate");
-  assert.equal(d.delegateTo, THEM);
-});
-
-test("NEGATIVE: an event I own, or one aimed directly at me, is NOT delegated away", () => {
-  assert.notEqual(run({ verdict: yes("thread_reply", "thread"), facts: { ownerId: ME } }).disposition, "delegate");
-  // T0 beats ownership: if someone named me, I answer, even on someone else's item.
-  assert.notEqual(run({ verdict: yes("dm", "dm"), facts: { ownerId: THEM } }).disposition, "delegate");
-});
-
-test("DELEGATE: an unreachable capability goes to a peer who has it", () => {
-  const d = run({ facts: { capabilityReachable: false, capableMemberId: THEM } });
-  assert.equal(d.disposition, "delegate");
-  assert.equal(d.delegateTo, THEM);
-  assert.equal(d.drift.kind, "unreachable_capability");
-});
-
-test("ESCALATE: a capability wall with no peer asks the owner — it never fails silently", () => {
-  const d = run({ facts: { capabilityReachable: false } });
-  assert.equal(d.disposition, "escalate");
-  assert.equal(d.reason, "unreachable_capability");
-  assert.deepEqual(d.options, ["grant the capability", "retarget the objective", "retire the obligation"]);
-  assert.equal(d.drift.kind, "unreachable_capability");
-});
-
-test("ESCALATE: genuine ambiguity asks with concrete options, it does not guess", () => {
-  const d = run({ facts: { ambiguousOptions: ["ship it", "hold for legal"] } });
-  assert.equal(d.disposition, "escalate");
-  assert.equal(d.reason, "ambiguous");
-  assert.equal(d.options.length, 2);
-  // ONE option is not ambiguity — that is just the answer.
-  assert.notEqual(run({ facts: { ambiguousOptions: ["ship it"] } }).disposition, "escalate");
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// Staleness ladder (§6.4)
-// ───────────────────────────────────────────────────────────────────────────
-
-test("staleness: <24h is business as usual", () => {
-  assert.equal(run({ runtime: { mandateStaleSeconds: 3600 } }).disposition, "react_now");
-});
-
-test("staleness: >72h defers anything not offline-safe, and keeps what is", () => {
-  const stale = { mandateStaleSeconds: 80 * 3600 };
-  // email is external → deferred
-  const email = run({ ...SURFACE_CASES.email, runtime: stale });
-  assert.equal(email.disposition, "schedule");
-  assert.equal(email.reason, "mandate_stale_deferred");
-  assert.equal(email.drift.kind, "mandate_stale");
-  // an internal DM is offline-safe → still answered
-  const dm = run({ ...SURFACE_CASES.dm, runtime: stale });
-  assert.equal(dm.disposition, "react_now");
-  assert.ok(dm.why.some((w) => /offline-safe/.test(w)));
-});
-
-test("staleness: >7d idles and reports drift once — it does not go dark silently", () => {
-  const d = run({ runtime: { mandateStaleSeconds: 8 * 86400 } });
-  assert.equal(d.disposition, "ignore");
-  assert.equal(d.reason, "mandate_stale");
-  assert.equal(d.drift.kind, "mandate_stale");
-});
-
-test("staleness: the RECOVERY surfaces are exempt, or a partitioned agent could never recover", () => {
-  // The deadlock this guards: §6.4 refreshes the cache "on every topic:mandate
-  // frame" AND idles the daemon past 7d. Applied uniformly, the one event that
-  // clears the staleness is the one staleness drops, and the agent never comes
-  // back without a human.
-  for (const surface of ["mandate", "alert"]) {
-    const c = { family: surface, kind: "changed", topic: surface, ids: {}, entityId: "x" };
-    for (const stale of [30 * 3600, 80 * 3600, 8 * 86400, 400 * 86400]) {
-      const d = run({
-        candidate: c,
-        verdict: yes(surface, "direct"),
-        runtime: { mandateStaleSeconds: stale },
-        obligation: null,
-      });
-      assert.notEqual(d.disposition, "ignore", `${surface} was dropped at ${stale}s stale`);
-      assert.notEqual(d.reason, "mandate_stale", `${surface} was gated at ${stale}s stale`);
-    }
-  }
-});
-
-test("the staleness exemption is announced, never applied quietly", () => {
-  const d = run({
-    candidate: { family: "mandate", kind: "changed", topic: "mandate", ids: {}, entityId: "x" },
-    verdict: yes("mandate", "direct"),
-    runtime: { mandateStaleSeconds: 9 * 86400 },
-    obligation: null,
-  });
-  assert.ok(
-    d.why.some((w) => /recovery surface/.test(w)),
-    "the trace must say the ladder was skipped and why",
-  );
-});
-
-test("the exemption does NOT leak to a surface that can speak outside the org", () => {
-  const d = run({ ...SURFACE_CASES.email, runtime: { mandateStaleSeconds: 9 * 86400 } });
-  assert.equal(d.disposition, "ignore");
-  assert.equal(d.reason, "mandate_stale");
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// Plan coverage + observe-only
-// ───────────────────────────────────────────────────────────────────────────
-
-test("a directed event with NO matching obligation is handled once, cheaply, and flagged", () => {
-  const d = run({ obligation: null });
-  assert.ok(willAct(d));
-  assert.ok(d.rung <= 1, `unplanned work must be bounded, got rung ${d.rung}`);
-  assert.equal(d.drift.kind, "uncovered_event");
-  assert.ok(d.why.some((w) => /no obligation in the compiled plan/.test(w)));
-});
-
-test("a matched obligation lifts the rung cap and carries its key through", () => {
-  const d = run({
-    obligation: { key: "react.dm", objective_id: "obj_1" },
-    need: { filesystem: true },
-  });
-  assert.equal(d.obligationKey, "react.dm");
-  assert.equal(d.objectiveId, "obj_1");
-  assert.equal(d.drift, null);
-  assert.equal(d.rung, 3, "a planned obligation is not capped at rung 1");
-});
-
-test("observe-only keeps the DECISION and downgrades only the EFFECT", () => {
-  const d = run({ runtime: { enforcement: "observe_only" } });
-  assert.equal(d.observeOnly, true);
-  assert.equal(d.disposition, "react_now", "the decision is still recorded honestly");
-  assert.ok(d.why.some((w) => /observe_only/.test(w)));
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// Degradation is loud
-// ───────────────────────────────────────────────────────────────────────────
-
-test("a missing journal history DISABLES the guards and says so", () => {
-  const d = decide({ candidate: cand(), verdict: yes("dm", "dm"), me: ME, nowMs: NOW, obligation: { key: "k" } });
-  assert.ok(d.degraded.includes("history_absent"));
-  assert.ok(d.why.some((w) => /guards are INACTIVE/.test(w)));
-});
-
-test("a degraded journal read is surfaced on the decision", () => {
-  const d = run({ history: freshHistory({ degraded: true, degradedReason: "3 unparseable lines" }) });
-  assert.ok(d.degraded.some((x) => /history_degraded/.test(x)));
-});
-
-test("an unknown surface degrades to the restrictive default, loudly", () => {
-  const d = run({ verdict: yes("surface_from_the_future", "direct") });
-  assert.ok(d.degraded.some((x) => /unknown_surface/.test(x)));
-  assert.notEqual(d.disposition, "react_now", "an unknown surface must not be spoken on");
-  assert.equal(d.policySurface, "default");
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// Invariants
-// ───────────────────────────────────────────────────────────────────────────
-
-test("every decision is total: a disposition, a reason, a trace, and an id", () => {
-  const inputs = [
-    {}, { verdict: no("x") }, { runtime: { emergencyStop: true } },
-    ...Object.values(SURFACE_CASES),
-    { facts: { capabilityReachable: false } },
-    { runtime: { mandateStaleSeconds: 9 * 86400 } },
-  ];
-  for (const i of inputs) {
-    const d = run(i);
-    assert.ok(["react_now", "schedule", "delegate", "escalate", "ignore"].includes(d.disposition));
-    assert.ok(typeof d.reason === "string" && d.reason.length > 0);
-    assert.ok(Array.isArray(d.why));
-    assert.ok("key" in d && "thread" in d);
-    assert.ok(typeof d.at === "string");
-  }
-});
-
-test("tierOf: named-outright reasons are T0; lane reasons are T1; unknown is conservative", () => {
-  assert.equal(tierOf("dm"), "T0");
-  assert.equal(tierOf("assignee"), "T0");
-  assert.equal(tierOf("waiting_on"), "T0");
-  assert.equal(tierOf("channel"), "T1");
-  assert.equal(tierOf("thread"), "T1");
-  assert.equal(tierOf("something_new"), "T1", "an unknown reason must not be promoted to T0");
-  assert.equal(tierOf(undefined), "T1");
-});
-
-test("willAct is false for exactly the ignore disposition", () => {
-  assert.equal(willAct(run(SURFACE_CASES.dm)), true);
-  assert.equal(willAct(run({ runtime: { emergencyStop: true } })), false);
-  assert.equal(willAct(null), false);
-  assert.equal(willAct({ disposition: "nonsense" }), false);
-});
-
-test("decide is PURE: the same inputs give the same decision", () => {
-  const a = run(SURFACE_CASES.mention);
-  const b = run(SURFACE_CASES.mention);
-  assert.deepEqual(a, b);
-});
-
-// ───────────────────────────────────────────────────────────────────────────
-// The escalate deadlock. Regression for a live failure, not a hypothetical.
-// ───────────────────────────────────────────────────────────────────────────
-
-test("ESCALATE is never blast-radius gated — gating it deadlocks the only route to a human", () => {
-  // `approval` and `decision` carry actionClasses:["irreversible"] AND
-  // selfApprove:false, so rule 6 always escalates them. Attaching the approval
-  // gate to that escalation means: to escalate an approval, first get an
-  // approval. drive.mjs step 4 fails closed, so the effect never ran and the
-  // lane produced nothing. Observed live (writes=[]).
-  for (const s of ["approval", "decision"]) {
-    const d = run(SURFACE_CASES[s]);
-    assert.equal(d.disposition, "escalate");
-    assert.equal(d.gates.approval, undefined, `${s} escalation was gated behind an approval`);
-    assert.ok(
-      d.why.some((w) => /would deadlock it/.test(w)),
-      "dropping the gate must be stated out loud, never done quietly",
-    );
-  }
-});
-
-test("an escalation carries >= 2 concrete options — hq refuses a question with fewer", () => {
-  // hq's escalation.ask 400s below two options ("a question with fewer is a
-  // message, not a decision"). Nothing supplies facts.ambiguousOptions for an
-  // approval, so without the surface policy's declared set the ladder decided
-  // `escalate` and the effect had nothing to ask with.
-  for (const s of ["approval", "decision"]) {
-    const d = run(SURFACE_CASES[s]);
-    assert.ok(Array.isArray(d.options), `${s} carried no options array`);
-    assert.ok(d.options.length >= 2, `${s} escalation offered ${d.options.length} option(s)`);
-    assert.equal(new Set(d.options).size, d.options.length, "duplicate labels are not a choice");
-  }
-});
-
-test("a caller-supplied option set beats the surface policy's default", () => {
-  const d = run({
-    ...SURFACE_CASES.approval,
-    facts: { ambiguousOptions: ["ship it", "hold it", "hand it to finance"] },
-  });
-  assert.deepEqual(d.options, ["ship it", "hold it", "hand it to finance"]);
-});
-
-test("SCHEDULE keeps its blast-radius gate — the queue drain does not re-enter this ladder", () => {
-  // The exemption is for handovers (escalate/delegate) only. An inbound email
-  // queues, and dropping the `external` gate here would lose it for good.
-  const email = run(SURFACE_CASES.email);
-  assert.equal(email.disposition, "schedule");
-  assert.deepEqual(email.gates.approval, { required: true, classes: ["external"] });
-});