@cohortapp/agent-sdk 2.18.14 → 2.18.16

package/scripts/daemon/assurance.mjs

@@ -54,8 +54,8 @@
 import { appendFileSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { spawn } from "child_process";
 import { join } from "path";
-import { deliver, deliverWithRetry, replyTargetOf, canDeliverTo } from "./deliver.mjs";
-import { spokeFor, NON_ANSWER_KINDS } from "../../lib/comms/receipts.mjs";
+import { deliver, deliverWithRetry, replyTargetOf, canDeliverTo, canReactTo, deliverReaction } from "./deliver.mjs";
+import { spokeFor, spokeSince, NON_ANSWER_KINDS } from "../../lib/comms/receipts.mjs";
 import { resultTextFromStdout } from "./session-outcomes.mjs";
 // The ack generator funnels through `claude --print` like every other daemon
 // model call (CEO directive 2026-04-27: no direct Anthropic API from the
@@ -78,14 +78,38 @@ import * as counters from "../../lib/diagnostics/counters.mjs";
 // the only composer of interim copy left in the system, and carries the two
 // copy rules (GENERIC_OPENER, FORWARD_PROMISE) every interim must satisfy.
 import { replyTier } from "../../lib/assurance/tier.mjs";
-import { isRollCallItem } from "../../lib/org/inbound/broadcast.mjs";
+import { isRollCallItem, BROADCAST_REASON } from "../../lib/org/inbound/broadcast.mjs";
+import { isMembershipReason } from "../../lib/org/inbound/directedness.mjs";
 import {
   claimRoomInterim,
   claimRoomNotice,
   ledgerPath as roomBudgetPath,
   LEDGER_BASENAME as ROOM_BUDGET_BASENAME,
 } from "../../lib/assurance/room-budget.mjs";
-import { renderPlanNote, GENERIC_OPENER } from "../../lib/assurance/plan-note.mjs";
+import { renderPlanNote, GENERIC_OPENER, MESSAGE_TALLY } from "../../lib/assurance/plan-note.mjs";
+// The first thing said is WRITTEN, not stamped: `firstReplyShape` carries the
+// model-authored opener's shape rules and `isRetiredFirstReply` rejects the
+// canned rotation this work retired. `notice-voice` does the same job for the
+// progress/failure notices, which used to be fixed strings.
+import {
+  buildNoticeSystemPrompt,
+  buildNoticeUserPrompt,
+  noticeSource,
+  noticeRejection,
+  fallbackNotice,
+} from "../../lib/assurance/notice-voice.mjs";
+import { isRetiredFirstReply, firstReplyShape } from "../../lib/assurance/first-reply.mjs";
+// The unit of acknowledgement is the CONVERSATION, not the message: four
+// messages in a row earn ONE first response that was written with all four in
+// front of it. `groupIntoBatches` + `batchVerdict` decide WHEN and WHICH;
+// `batchMessages` is what the composer is handed. All pure — see batch.mjs.
+import {
+  groupIntoBatches,
+  batchVerdict,
+  batchMessages,
+  batchQuietMs,
+  batchMaxSpanMs,
+} from "../../lib/assurance/batch.mjs";
 
 // ── Board mirror seams ───────────────────────────────────────────────────────
 // Imported lazily so a board module problem can never stop the daemon booting,
@@ -230,6 +254,36 @@ export const ACK_GEN_MAX_FAILURES = num(process.env.ASSURANCE_ACK_GEN_MAX_FAILUR
  */
 export const ACK_MIN_CHARS = num(process.env.ASSURANCE_ACK_MIN_CHARS, 20);
 
+/**
+ * How long a NOTICE may spend in generation.
+ *
+ * Twice the ack's budget, and deliberately not the same number. The ack races a
+ * typing indicator in front of someone who is about to wait minutes anyway, so
+ * ~5s is the right aggression there and silence is an acceptable loss. A notice
+ * races nothing — the work is already dead — and its loss is not silence but
+ * `fallbackNotice`, which is a worse message rather than no message. Spending a
+ * few more seconds to avoid the worse message is the right trade in exactly the
+ * direction the ack's is not.
+ */
+export const NOTICE_GEN_TIMEOUT_MS = num(process.env.ASSURANCE_NOTICE_GEN_TIMEOUT_MS, 10_000);
+
+/**
+ * `ASSURANCE_NOTICE_GEN=0` turns notice generation off and goes straight to the
+ * plain wording.
+ *
+ * An operator switch, not a feature flag: a seat whose model access is broken
+ * would otherwise pay `NOTICE_GEN_TIMEOUT_MS` per dead obligation per sweep to
+ * arrive at the same fallback it could have reached instantly. Nothing is lost
+ * when it is off — the person still hears that their work died, in a plainer
+ * sentence — which is the property that makes it safe to have a switch at all.
+ *
+ * Read at the EDGE, not captured at import, so exporting it in a shell that is
+ * already running takes effect on the next notice.
+ */
+export function noticeGenEnabled(env = process.env) {
+  return String((env && env.ASSURANCE_NOTICE_GEN) ?? "1") !== "0";
+}
+
 /** The tiers `lib/assurance/tier.mjs` can return; anything else is a caller bug
  *  and is treated as `work` — the tier that can still speak once. */
 const TIER_SET = new Set(["answer", "work", "plan"]);
@@ -344,6 +398,16 @@ export function itemSnapshot(item) {
     // reads belongs in this snapshot.
     scope_id: item.scope_id || null,
     thread_id: item.thread_id || null,
+    // WHY THIS ADDRESS PROVENANCE IS A DEBT FIELD, not decoration. The sweep and
+    // the silent-success path SPEAK from `rec.item`, long after the live item is
+    // gone, and one decision they make is whether a rescued result belongs in
+    // this room at all: a membership/broadcast-proved surface (a doc comment
+    // shared to a channel, a room this seat merely belongs to) is ambient, and
+    // dumping a finished session's result text into it is narration nobody is
+    // waiting on 1:1 — the exact leak doc-comment surfaces close silently to
+    // avoid. Without `direct_reason` in the snapshot the DM/ambient distinction
+    // is unrecoverable at sweep time; with it, the guard fails open to a DM.
+    direct_reason: item.direct_reason || null,
     sender: item.sender || null,
     sender_email: item.sender_email || null,
     subject: item.subject || null,
@@ -405,6 +469,41 @@ const IMPERATIVE_OPENER =
   /^(please\s+|pls\s+)?(fix|update|send|review|check|draft|push|share|add|remove|create|write|run|make|schedule|book|reply|investigate|look|pull|get|give|tell|let|help|find|prepare|post|email|ping|follow|stop|start|deploy|merge|revert|open|close|read|summari[sz]e|redo|rebuild|retry)\b/i;
 const REQUEST_MARKER = /\b(please|pls|can you|could you|would you|need you to)\b/i;
 
+/**
+ * Is this inbound the SHAPE of another seat's OUTCOME NOTICE?
+ *
+ * WHY A SHAPE TEST IS NOW NEEDED AT ALL. `isOwnNarratorText` matches the
+ * daemon's notices verbatim, and it could, because they were deterministic
+ * strings composed by this very file — `narratorPatterns()` derives its regexes
+ * from the composers so the two cannot drift. `generateFailureNotice` ends
+ * that: a notice is now written per ask, in the seat's own voice, so no
+ * verbatim pattern can recognise one. Without this, a peer's generated "that
+ * export died on me, I've flagged it" reaches the dispatch gate as an ordinary
+ * message, earns an ack, and spawns a 15-45 minute session behind it — the
+ * 25/27/30 Aug loop, reopened by the very change that made the notices humane.
+ *
+ * Narrow on purpose, and narrower than `looksLikePeerAckShape`: the sender must
+ * be an agent seat (a human can never match — see `senderLooksLikeAgentSeat`),
+ * the text must be short, and it must carry BOTH a first-person subject and a
+ * failure predicate. A peer reporting a fact ("the export is 400 rows short")
+ * or asking for help ("can you take this one?") still passes the gate, because
+ * a false consume is silent to the sender and unrecoverable while a false pass
+ * costs one audited redundant session.
+ *
+ * @param {object} item
+ * @returns {boolean}
+ */
+export function looksLikePeerOutcomeNotice(item) {
+  const content = String((item && item.content) || "").trim();
+  if (!content) return false;
+  if (content.length > 400) return false;
+  if (!senderLooksLikeAgentSeat(item)) return false;
+  if (REQUEST_MARKER.test(content)) return false;
+  if (IMPERATIVE_OPENER.test(content)) return false;
+  if (!/\b(i|my|i'?ve|i'?m)\b/i.test(content)) return false;
+  return /\b(didn'?t (get through|finish|complete)|never came back|ran out of time|outrun its time limit|broke before it finished|was cut off|stopped (trying|retrying)|flagged it|ended (with an error|unexpectedly)|my (machine|end) restarted)\b/i.test(content);
+}
+
 /**
  * Is this inbound the SHAPE of an acknowledgement from a peer agent seat?
  *
@@ -462,6 +561,17 @@ export function looksLikePeerAckShape(item) {
 export const RETIRED_NARRATOR_TEMPLATES = Object.freeze([
   "Still on this — 1 minutes in. I'll come back as soon as I've got something.",
   "Still going — 1 minutes in. I'll follow up the moment it's done.",
+  // The two failure sentences `composeFailure` stamped until 2026-09-25, with
+  // the sentinel standing in for the interpolated cause exactly as the derived
+  // templates below do. They MUST stay here now that nothing composes them:
+  // two seats in the fleet were still running a preserved local copy of this
+  // daemon on 2026-09-25 (Ravi Patel and Daniel Connors, both reporting SDK
+  // 2.18.13 while executing an older `$AGENT_ROOT/scripts/daemon` tree), so a
+  // seat that has updated goes on RECEIVING these from seats that have not.
+  // Dropping them with the emitter would mean this seat acks a peer's failure
+  // notice and spawns a 15-45 minute session behind it.
+  "Hit a problem — @@CAUSE@@. Retrying now; if it fails again I'll come straight back rather than leave you waiting.",
+  "Couldn't finish this — @@CAUSE@@. I've stopped retrying and flagged it so it isn't lost. Want me to try a narrower version, hand it off, or leave it with you?",
 ]);
 
 let _narratorPatterns = null;
@@ -571,6 +681,15 @@ export function shouldAcknowledge(o = {}) {
     willSpawnSession: o.willSpawnSession === true,
   });
   if (!o.willSpawnSession) return { ack: false, reason: "answered-in-turn", tier };
+  // ONE FIRST REPLY PER FLURRY. Stamped by the poll loop, which is the only
+  // place that sees more than one item at a time (`agent-daemon.pollService`).
+  // `ack:false` here is what the daemon turns into `interimForbidden` on the
+  // record, so the silence is durable: no later sweep in any process speaks for
+  // a message whose flurry has already been answered. The DEBT is still opened
+  // by the caller — every item in the batch keeps its own obligation and its
+  // own answer.
+  const batched = o.item || {};
+  if (batched.covered_by_batch === true) return { ack: false, reason: "covered-by-batch", tier };
   if (o.source && o.source !== "inbox") return { ack: false, reason: "no-waiting-human", tier };
   const item = o.item || {};
   if (!item.service) return { ack: false, reason: "no-service", tier };
@@ -605,6 +724,10 @@ export function shouldAcknowledge(o = {}) {
     logDispatchGateRefusal(item, "peer-ack-shaped");
     return { ack: false, reason: "peer-ack-shaped", emitterClass: true, tier };
   }
+  if (looksLikePeerOutcomeNotice(item)) {
+    logDispatchGateRefusal(item, "peer-outcome-notice");
+    return { ack: false, reason: "peer-outcome-notice", emitterClass: true, tier };
+  }
   // ── A ROLL-CALL NEVER GETS AN INTERIM ─────────────────────────────────────
   // A human asked the whole room for a line each. Thirteen "checking now"
   // lines followed by thirteen answers is twice the traffic and half the
@@ -738,9 +861,15 @@ function runAckModelWith(seat, systemPrompt, userPrompt, o = {}) {
  * Null is a first-class answer here — it means "send nothing". Rejected:
  * empty output, fenced/quoted wrappers that survive stripping into nothing,
  * anything over 200 chars (that is a reply, not an ack), refusal/meta text,
- * and the assistant-y boilerplate the communication policy bans.
+ * the assistant-y boilerplate the communication policy bans, and — when the
+ * line is standing in for a FLURRY — a tally of it.
+ *
+ * @param {unknown} raw
+ * @param {{batched?: boolean}} [opts] `batched:true` when this line answers
+ *        more than one message, which is the only case where the prompt bans
+ *        counting and therefore the only case where the filter may.
  */
-export function sanitiseAckText(raw) {
+export function sanitiseAckText(raw, opts = {}) {
   if (raw == null) return null;
   let t = String(raw).replace(/```[a-z]*\n?|```/gi, "").trim();
   // First non-empty line only — an ack is one line by definition.
@@ -755,6 +884,15 @@ export function sanitiseAckText(raw) {
   // pattern is imported from the copy-rule home rather than re-typed here, so
   // the instruction and the filter cannot disagree again.
   if (GENERIC_OPENER.test(t)) return null;
+  // THE BATCHED PROMPT, ENFORCED, and for the same reason one line up. The
+  // batched close instruction says "never count them, never say how many there
+  // are"; nothing checked the output, and the real path returned "Four
+  // messages received." and "I have 4 messages from you." verbatim. A tally is
+  // a report about an inbox — a colleague replies to what was asked.
+  if (opts && opts.batched === true && MESSAGE_TALLY.test(t)) {
+    counters.bump("ack.generation_failed", { cause: "message_tally" });
+    return null;
+  }
   // Anything this short cannot be specific to what was asked, which is the one
   // thing the prompt requires of it. "On it." is 6 characters; so is every
   // variant that would slip past the pattern above by rephrasing.
@@ -788,18 +926,65 @@ function buildAckSystemPrompt() {
   ].join("\n");
 }
 
-function buildAckUserPrompt(item, classResult) {
+/**
+ * @param {object} item        the inbound item the reply is addressed to
+ * @param {object} classResult
+ * @param {{sender:string|null,text:string}[]} [batch]  EVERY message this one
+ *        line has to answer, oldest first (see lib/assurance/batch.mjs). One
+ *        entry — the ordinary case — renders exactly as it always did.
+ */
+/**
+ * The messages a batched ack actually speaks for, oldest first.
+ *
+ * ONE PREDICATE, TWO CONSUMERS, deliberately. `buildAckUserPrompt` uses it to
+ * decide whether to emit the "never count them" instruction, and `generateAck`
+ * uses it to decide whether `sanitiseAckText` may enforce that instruction. If
+ * the two ever computed "is this a flurry" separately they could disagree, and
+ * a filter stricter (or laxer) than its own prompt is the exact failure this
+ * module keeps rediscovering.
+ *
+ * @param {{sender?:string|null,text?:string}[]|undefined} batch
+ * @returns {{sender?:string|null,text:string}[]}
+ */
+function ackBatchMessages(batch) {
+  return Array.isArray(batch) ? batch.filter((m) => m && m.text) : [];
+}
+
+function buildAckUserPrompt(item, classResult, batch) {
   const parts = [];
-  if (item && item.sender) parts.push(`From: ${String(item.sender).slice(0, 80)}`);
-  const content = String((item && (item.content || item.subject)) || "").trim();
-  if (content) parts.push(`Message:\n${content.slice(0, 600)}`);
+  const msgs = ackBatchMessages(batch);
+  if (msgs.length > 1) {
+    // A FLURRY. The line that goes out is a reply to the conversation, so the
+    // composer sees the conversation — not the last message with the rest
+    // thrown away, and not a count of them. "I have four messages" is a report
+    // about an inbox; a colleague answers what was asked.
+    parts.push(
+      `These arrived together, oldest first. They are one conversation, and you are replying to all of them at once:\n`
+      + msgs.map((m) => `- ${m.sender ? `${String(m.sender).slice(0, 60)}: ` : ""}${m.text}`).join("\n"),
+    );
+  } else {
+    if (item && item.sender) parts.push(`From: ${String(item.sender).slice(0, 80)}`);
+    const content = String((item && (item.content || item.subject)) || "").trim();
+    if (content) parts.push(`Message:\n${content.slice(0, 600)}`);
+  }
   const thread = String((item && item.thread_context) || "").trim();
   if (thread) {
     const tail = thread.split("\n").filter(Boolean).slice(-6).join("\n");
     parts.push(`Recent thread:\n${tail.slice(0, 600)}`);
   }
+  // A FLURRY GETS ONE LINE THAT ANSWERS ALL OF IT. The poll loop stamps
+  // `batch_size` on the leader; without this the model writes a line about one
+  // message while four are on screen, which reads as the agent having noticed
+  // only the first.
+  const batchSize = Number(item && item.batch_size);
+  if (Number.isFinite(batchSize) && batchSize > 1) {
+    parts.push(`(They sent ${batchSize} messages in a row just now. Your one line should cover all of them, not just the one above.)`);
+  }
   if (classResult && classResult.summary) parts.push(`(Your own read of the ask: ${String(classResult.summary).slice(0, 120)})`);
-  return `${parts.join("\n\n")}\n\nWrite the one-line acknowledgement now.`;
+  const close = msgs.length > 1
+    ? `Write the one-line acknowledgement now. It answers ALL of the above together — never count them, never say how many there are, never take them one at a time.`
+    : `Write the one-line acknowledgement now.`;
+  return `${parts.join("\n\n")}\n\n${close}`;
 }
 
 /**
@@ -822,7 +1007,10 @@ function buildAckUserPrompt(item, classResult) {
  *
  * @param {object} item        the inbound item ({sender, content, thread_context, …})
  * @param {object} [classResult]
- * @param {object} [opts] {runImpl, timeoutMs} — runImpl is the test seam
+ * @param {object} [opts] {runImpl, timeoutMs, batch} — runImpl is the test seam;
+ *        `batch` is every message this one line has to answer, oldest first
+ *        (lib/assurance/batch.mjs). Absent or single-entry is the ordinary case
+ *        and composes exactly as before.
  * @returns {Promise<string|null>}
  */
 export async function generateAck(item, classResult = {}, opts = {}) {
@@ -830,10 +1018,10 @@ export async function generateAck(item, classResult = {}, opts = {}) {
   const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : ACK_GEN_TIMEOUT_MS;
   try {
     const raw = await withTimeout(
-      run(buildAckSystemPrompt(), buildAckUserPrompt(item, classResult), { timeoutMs }),
+      run(buildAckSystemPrompt(), buildAckUserPrompt(item, classResult, opts.batch), { timeoutMs }),
       timeoutMs,
     );
-    const text = sanitiseAckText(raw);
+    const text = sanitiseAckText(raw, { batched: ackBatchMessages(opts.batch).length > 1 });
     if (text == null) {
       console.warn(`[assurance] ack generation produced nothing usable — staying silent (no canned fallback, by design)`);
       counters.bump("ack.generation_failed", { cause: "unusable_output", timeout_ms: timeoutMs });
@@ -887,18 +1075,191 @@ function withTimeout(promise, ms) {
  */
 
 /**
- * The failure notice. Says WHAT HAPPENED and WHAT HAPPENS NEXT, in that order,
- * because those are the two things the human is missing when a session dies.
- * Terse and human: never blames the human, never hides behind "an error
- * occurred", never ends without a next step, and never shows internal framing.
+ * The failure notice's DEGRADED path — what is said when generation is
+ * unavailable. `generateFailureNotice` is the primary; this is its floor.
+ *
+ * WHAT THIS FUNCTION USED TO BE, AND WHY IT IS NOT THAT ANY MORE. It returned
+ * two fixed sentences:
+ *
+ *   "Hit a problem — ${cause}. Retrying now; if it fails again I'll come
+ *    straight back rather than leave you waiting."
+ *   "Couldn't finish this — ${cause}. I've stopped retrying and flagged it so
+ *    it isn't lost. Want me to try a narrower version, hand it off, or leave it
+ *    with you?"
+ *
+ * Both are in `first-reply.RETIRED_FIRST_REPLIES` now, which means this file
+ * can no longer produce either of them and a test fails if it starts to. They
+ * were screenshotted by the owner on 2026-09-25 out of three different channels
+ * from two different seats on the same day, which is the whole complaint: every
+ * dead session in the fleet said the same sentence, so a reader could not tell
+ * which of their asks had died. Five byte-identical copies landed in one
+ * channel inside two hours on 2026-09-23 (message ids cmuegc8ox…, cmuegc9fw…,
+ * cmuekxzl3…, cmuekz7il…, cmuel0jlb…, all `failure-stale`, all channel
+ * cmql16b7c01d2hhzpjk51b8xn).
+ *
+ * `fallbackNotice` interpolates the TOPIC as well as the cause, which is the
+ * structural fix: two sibling failures are now two distinguishable sentences.
+ * The rest of the contract is unchanged — says what happened, then what happens
+ * next, never blames the human, never hides behind "an error occurred", never
+ * ends without a next step, never shows internal framing.
+ *
+ * @param {object} rec the obligation record; its item supplies the topic
+ * @param {object} o {failure, willRetry, topic}
  */
 export function composeFailure(rec, o = {}) {
+  const f = o.failure || {};
+  return fallbackNotice({
+    kind: o.willRetry ? NOTICE.FAILURE_RETRYING : NOTICE.FAILURE_FINAL,
+    cause: f.human || "the working session ended unexpectedly",
+    topic: o.topic != null ? o.topic : noticeTopic(rec),
+    willRetry: !!o.willRetry,
+  });
+}
+
+/**
+ * The topic clause a notice may name — from the HUMAN'S OWN WORDS or not at all.
+ *
+ * `rec.summary` IS DELIBERATELY NOT CONSULTED, and this is the one line in this
+ * change that a reviewer should check hardest. The classifier's summary is
+ * internal framing: it is written ABOUT the sender in the third person ("The
+ * CEO checking in on work progress"), and interpolating it into a message the
+ * sender reads produces the "(CEO asking what machine…)" bleed that
+ * `topicClause` was rewritten to end — its header says so in as many words, and
+ * `assurance.test.mjs` pins it ("the summary is internal framing, never copy").
+ * A first draft of this function read `rec.summary` for the topic and walked
+ * straight back into it; the test caught it, which is why the test exists.
+ *
+ * So: the item's SUBJECT, which is a line the sender typed, or nothing. An
+ * empty topic yields "The work you asked for" — honest, and not a guess.
+ *
+ * Sibling distinctness does NOT depend on this being populated: that guarantee
+ * is structural and lives in the work-keyed room claim (`room-budget.noticeKey`),
+ * which refuses a second notice about the same ask whatever words it wears. The
+ * topic is the nicety on top, taken only when a human authored one.
+ */
+function noticeTopic(rec) {
+  const r = rec && typeof rec === "object" ? rec : {};
+  const raw = String((r.item && r.item.subject) || "").trim();
+  if (!raw) return "";
+  const t = raw.replace(/\s+/g, " ").replace(/[.!?]+$/, "");
+  return t.length > 0 && t.length <= 80 ? t : "";
+}
+
+/**
+ * THE FAILURE NOTICE, WRITTEN RATHER THAN STAMPED.
+ *
+ * Same cheapest-model path as the holding ack (`ackSpawn`), the real cause and
+ * the real ask in hand, the agent's own voice, about THIS piece of work. Every
+ * guarantee the deterministic version bought is kept — see
+ * `lib/assurance/notice-voice.mjs`, which owns the checks:
+ *
+ *   it cannot claim success        `claimsSuccess`
+ *   it cannot invent a cause       `inventsFacts`
+ *   it cannot reissue a retired
+ *     sentence                     `isRetiredFirstReply`
+ *   it always produces SOMETHING   this function, which falls back rather than
+ *                                  returning null
+ *
+ * THAT LAST ONE IS THE DELIBERATE DIVERGENCE FROM `generateAck`, and it is the
+ * decision this change is really making. `generateAck` returns null and the
+ * caller says NOTHING, because a holding line nobody composed costs the reader
+ * nothing they will not have in minutes. A failure notice nobody composed costs
+ * them the one fact they cannot get any other way: that the thing they are
+ * waiting for is dead. Never-told is strictly worse than plainly-told, so this
+ * path speaks — and stamps `degraded` so the condition is countable instead of
+ * invisible.
+ *
+ * @param {object} rec
+ * @param {object} o {failure, willRetry, kind}
+ * @param {object} [opts] {runImpl, timeoutMs} test seams
+ * @returns {Promise<{text:string, generated:boolean, degraded:boolean, cause:string}>}
+ */
+/**
+ * ONE WRITTEN NOTICE PER ROOM PER WINDOW; the rest get the plain sentence.
+ *
+ * The guarantee this protects is the measured one: twenty sibling asks dying
+ * together in one channel must not become twenty messages. Byte-identity used
+ * to do that for free, because every notice in the fleet was the same string —
+ * and generating a bespoke notice per ask is precisely what destroys that for
+ * free. So the FIRST dead ask in a room gets the written, specific message and
+ * its siblings inside the window compose the plain one, which is byte-identical
+ * across them and therefore coalesced to nothing by the text claim in
+ * `sayOutcomeNotice`.
+ *
+ * Nobody loses a fact: every sibling still writes its own escalation record, so
+ * an operator sees every dead ask in needs-attention exactly as before. What is
+ * withheld is the nineteenth rendering of the same news into one room.
+ *
+ * Claimed with `commit: true` up front, unlike the notice itself. The cost of a
+ * claim spent on a generation that then fails is one sibling reading the plain
+ * sentence instead of a written one — which is the outcome this function exists
+ * to hand out anyway.
+ */
+function claimWrittenVoice(rec, notice, now, impl) {
+  const claim = impl || claimRoomNotice;
+  const v = claim({
+    service: rec && rec.service, channel: rec && rec.channel,
+    notice: `voice:${notice}`, text: "one-written-notice-per-room",
+    now, agentRoot: AGENT_REPO_DIR, commit: true,
+  });
+  return !(v && v.allowed === false);
+}
+
+export async function generateFailureNotice(rec, o = {}, opts = {}) {
   const f = o.failure || {};
   const cause = f.human || "the working session ended unexpectedly";
-  if (o.willRetry) {
-    return `Hit a problem — ${cause}. Retrying now; if it fails again I'll come straight back rather than leave you waiting.`;
+  const kind = o.kind || (o.willRetry ? NOTICE.FAILURE_RETRYING : NOTICE.FAILURE_FINAL);
+  const topic = noticeTopic(rec);
+  const item = (rec && rec.item) || {};
+  const promptArgs = {
+    kind,
+    cause,
+    topic,
+    askText: String(item.content || item.subject || "").trim(),
+    sender: item.sender || "",
+    willRetry: !!o.willRetry,
+  };
+  const degradedText = () =>
+    fallbackNotice({ kind, cause, topic, willRetry: !!o.willRetry });
+
+  const run = typeof opts.runImpl === "function" ? opts.runImpl : runAckModel;
+  const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : NOTICE_GEN_TIMEOUT_MS;
+  if (typeof opts.runImpl !== "function" && !noticeGenEnabled()) {
+    counters.bump("notice.generation_skipped", { notice: kind, reason: "disabled" });
+    return { text: degradedText(), generated: false, degraded: true, cause };
+  }
+  if (o.mayWrite === false) {
+    // A sibling. See `claimWrittenVoice`: one written notice per room per
+    // window, the rest plain — and `degraded` is deliberately FALSE here,
+    // because nothing is broken. This is the design working.
+    counters.bump("notice.generation_skipped", { notice: kind, reason: "room-voice-claimed" });
+    return { text: degradedText(), generated: false, degraded: false, cause };
+  }
+  try {
+    const raw = await withTimeout(
+      run(buildNoticeSystemPrompt({ kind, agentName: ackAgentName() }), buildNoticeUserPrompt(promptArgs), { timeoutMs }),
+      timeoutMs,
+    );
+    // THE REASON IS RECORDED, not just the failure. `unusable_output` for all
+    // eleven rejections could not tell "the model is unavailable" from "the
+    // model is fine and `inventsFacts` is too strict" — and the second is a
+    // live possibility, since any digit absent from the cause is refused. The
+    // degraded line is meant to be the rare path; `notice.generation_failed`
+    // broken out by reason is how anyone finds out whether it still is.
+    const verdict = noticeRejection(raw, { source: noticeSource(promptArgs) });
+    if (verdict.ok) return { text: verdict.text, generated: true, degraded: false, cause };
+    counters.bump("notice.generation_failed", { cause: `unusable:${verdict.reason}`, notice: kind });
+    console.warn(`[assurance] ${kind} notice generation produced nothing usable [${verdict.reason}] — sending the plain version (a dead ask is never left unsaid)`);
+    return { text: degradedText(), generated: false, degraded: true, cause, rejected: verdict.reason };
+  } catch (err) {
+    const msg = String((err && err.message) || "");
+    const why = /timed out/i.test(msg) ? "timeout"
+      : /spawn error|ENOENT|EACCES/i.test(msg) ? "spawn_failed"
+        : "error";
+    counters.bump("notice.generation_failed", { cause: why, notice: kind });
+    console.warn(`[assurance] ${kind} notice generation failed (${msg}) — sending the plain version [cause:${why}]`);
+    return { text: degradedText(), generated: false, degraded: true, cause };
   }
-  return `Couldn't finish this — ${cause}. I've stopped retrying and flagged it so it isn't lost. Want me to try a narrower version, hand it off, or leave it with you?`;
 }
 
 /**
@@ -930,6 +1291,32 @@ export function composeSilentSuccess(rec, o = {}) {
   return `${head} I don't have a clean result to show you, though. Want me to run it again?`;
 }
 
+/**
+ * Is this obligation's surface AMBIENT rather than a 1:1 the requester waits on?
+ *
+ * The signal is `direct_reason` — WHY the inbound join decided this event was
+ * this seat's — carried into the snapshot by `itemSnapshot`. A membership or
+ * broadcast reason (`channel`/`participant`/`shared`, or `collective`) is
+ * access-shaped: the seat was addressed because it can SEE the thing, not
+ * because anything named it, so any number of seats in the room hold the same
+ * event. An identity-shaped reason (a DM, `owner`, `named`, an assignee) is one
+ * person waiting on one reply.
+ *
+ * FAILS OPEN TO "NOT AMBIENT" (i.e. narrate). An item whose provenance was
+ * never stamped — the historical default, and every pre-existing silent-success
+ * test — is treated as a waiting DM, because the cost of narrating into a real
+ * DM is nothing and the cost of silencing one is the very defect this module
+ * exists to fix.
+ *
+ * @param {object} rec the obligation record; its `item.direct_reason` is read
+ * @returns {boolean}
+ */
+function isAmbientSurface(rec) {
+  const reason = String((rec && rec.item && rec.item.direct_reason) || "");
+  if (!reason) return false; // unknown provenance → treat as a DM, narrate
+  return isMembershipReason(reason) || reason === BROADCAST_REASON;
+}
+
 /** A session interrupted by the daemon itself dying/restarting. */
 export function composeInterrupted() {
   return `Heads up — my session on this was interrupted before it finished (my end restarted). I've picked it back up; I'll come back with the answer.`;
@@ -1076,10 +1463,42 @@ async function sayOutcomeNotice(o) {
     return { sent: false, reason: "notice-already-said" };
   }
   const claim = o.roomNoticeImpl || claimRoomNotice;
-  const peek = claim({
-    service: rec.service, channel: rec.channel, notice, text, now,
-    agentRoot: AGENT_REPO_DIR, commit: false,
-  });
+  // ── TWO CLAIMS, BECAUSE THEY ANSWER DIFFERENT QUESTIONS ──────────────────
+  //
+  // BY WORK — "has this piece of work already been declared dead in this room?"
+  // Added 2026-09-25 with generated notices, and required by them. The
+  // text-keyed claim below was load-bearing only while every failure notice in
+  // the fleet was the same deterministic string; `generateFailureNotice` writes
+  // one per ask, so two notices about the SAME dead ask composed a minute apart
+  // by two sweeps are two different sentences saying the same thing to the same
+  // person, and byte-identity no longer finds them. Keyed on the obligation
+  // key, the second is refused whatever words it wears — across a retry that
+  // reopens the obligation and across a daemon restart that rebuilds it,
+  // because the ledger is on disk and the work-keyed window is a day.
+  //
+  // BY TEXT — "would a second copy of this exact sentence add anything?" This
+  // is the ORIGINAL claim and it is deliberately still here. It is what keeps
+  // twenty sibling debts staling together from putting twenty indistinguishable
+  // sentences in one room (`assurance.test.mjs` pins that at 20 → 1), and it is
+  // still reachable in the two cases that matter: the degraded path and the
+  // `ASSURANCE_NOTICE_GEN=0` path both compose the plain sentence, which IS
+  // byte-identical across siblings. Deleting it while adding the work claim
+  // would have swapped one guarantee for another rather than adding one — the
+  // sibling test caught exactly that, which is why it is worth the two calls.
+  //
+  // BOTH must allow. Either refusal suppresses, and a send that lands commits
+  // both; a send that fails commits neither, so the room that heard nothing is
+  // not charged for it.
+  const work = String((rec && rec.key) || "").trim();
+  const claimArgs = [
+    { service: rec.service, channel: rec.channel, notice, text, work, now, agentRoot: AGENT_REPO_DIR },
+    { service: rec.service, channel: rec.channel, notice, text, now, agentRoot: AGENT_REPO_DIR },
+  ];
+  let peek = null;
+  for (const args of claimArgs) {
+    const v = claim({ ...args, commit: false });
+    if (v && v.allowed === false) { peek = v; break; }
+  }
   if (peek && peek.allowed === false) {
     // This room already has this exact sentence on screen. Stamp the record
     // too: the fact HAS been told here, so a later tick of this same debt must
@@ -1095,10 +1514,7 @@ async function sayOutcomeNotice(o) {
     // SPEND ONLY ON A DELIVERED MESSAGE, exactly as the interim budget does: a
     // send that failed is a room that heard nothing, and recording it would
     // suppress the one message that still needed to go out.
-    claim({
-      service: rec.service, channel: rec.channel, notice, text, now,
-      agentRoot: AGENT_REPO_DIR, commit: true,
-    });
+    for (const args of claimArgs) claim({ ...args, commit: true });
   }
   return { sent: !!(res && res.sent), reason: res && res.sent ? "sent" : ((res && res.error) || "send-failed") };
 }
@@ -1464,6 +1880,24 @@ export async function settleSession(a = {}) {
   }
 
   if (a.ok && !heard) {
+    // A CLEAN SILENT EXIT OUTSIDE A DM CLOSES QUIETLY, LIKE A DOC COMMENT.
+    // The rescue message exists to hand a waiting requester the result their
+    // session produced but never sent. On an ambient/membership-proved surface
+    // there is no such requester — the seat was addressed because it can see
+    // the room, not because anyone named it — so the same message is result
+    // text NARRATED into a shared room, the leak doc-comment surfaces already
+    // close silently to avoid. The debt is still discharged (silent is not
+    // un-closed); only the narration is withheld. `direct_reason` reaches here
+    // through `itemSnapshot`, and the guard fails open to narrating.
+    if (isAmbientSurface(rec)) {
+      closeObligation(a.key, {
+        outcome: "answered",
+        now,
+        note: "session exited 0 without speaking; ambient surface closed without narration",
+      });
+      counters.bump("assurance.silent_success_ambient", { service: rec.service });
+      return { spoke: false, text: null, verdict: "silent-success", willRetry: false };
+    }
     const finalText = safeResultText(a.stdout);
     const text = composeSilentSuccess(rec, { finalText });
     const res = await send(item, text, { kind: "reply", idempotencySuffix: `rescue-${rec.attempts || 0}` });
@@ -1484,7 +1918,17 @@ export async function settleSession(a = {}) {
   rec.lastFailureAt = now;
   writeRecord(rec);
 
-  const text = composeFailure(rec, { failure, willRetry });
+  // GENERATED, not stamped. `generateFailureNotice` always returns text — the
+  // degraded path is a plainer sentence, never silence — so the guarantee the
+  // deterministic composer bought is intact while the words are this ask's own.
+  const noticeId0 = willRetry ? NOTICE.FAILURE_RETRYING : NOTICE.FAILURE_FINAL;
+  const notice0 = await generateFailureNotice(
+    rec,
+    { failure, willRetry, mayWrite: claimWrittenVoice(rec, noticeId0, now, a.deps && a.deps.roomNoticeImpl) },
+    a.deps && a.deps.noticeGen,
+  );
+  const text = notice0.text;
+  if (notice0.degraded) counters.bump("assurance.notice_degraded", { notice: willRetry ? NOTICE.FAILURE_RETRYING : NOTICE.FAILURE_FINAL });
   // SAID ONCE PER (channel, key, notice). The retry loop is what made this
   // necessary: a transient failure posts a notice, the item is retried, a fresh
   // obligation opens under the same key, it fails the same way, and the same
@@ -1632,14 +2076,111 @@ export async function sweepObligations(a = {}) {
   }
 }
 
+/**
+ * PURE. May this debt still produce a courtesy interim at all?
+ *
+ * The four durable latches, in one place, because branch (e)'s entry condition
+ * and the batch membership test MUST be the same predicate. When they were the
+ * same expression written twice, a batch could count a member that the branch
+ * would never have spoken for — inflating the batch, moving `lastAt`, and
+ * delaying an acknowledgement on behalf of a record that was already silent.
+ *
+ * @param {object} rec
+ * @returns {boolean}
+ */
+export function interimEligible(rec) {
+  if (!rec || typeof rec !== "object") return false;
+  return !rec.interimSaid && !rec.interimForbidden && !rec.ackSuppressed && rec.tier !== "answer";
+}
+
+/**
+ * The batch `rec` belongs to this tick.
+ *
+ * Membership is every OPEN, interim-eligible, deliverable debt in the same
+ * conversation that this tick has not already consumed — plus `rec` itself
+ * unconditionally, since it is the record asking. `consumed` holds the keys
+ * branches (a)–(d) have already closed or spoken to in this pass: a debt that
+ * has just been declared stale is not waiting for an acknowledgement, and
+ * counting it would let a dead ask hold a live one's batch open.
+ *
+ * Not pure (it reads nothing, but it takes the sweep's live arrays); the
+ * decisions it delegates to — `groupIntoBatches`, `batchVerdict` — are.
+ */
+function batchFor(rec, open, consumed, now, isForeignAlive = () => false) {
+  const records = open.filter(
+    (r) => r === rec || (
+      !consumed.has(r.key)
+      && interimEligible(r)
+      && r.deliverable !== false
+      // A SIBLING ANOTHER LIVE DAEMON OWNS IS NOT OURS TO SILENCE. The sweep
+      // already refuses to NARRATE a debt whose `daemonPid` belongs to a live
+      // foreign process (see `foreignOwnerAlive` at the top of the loop), for
+      // the obvious reason that two daemons on one AGENT_DIR would otherwise
+      // say the same thing twice. Batching reaches further than narrating
+      // did: the carrier LATCHES every member it speaks for, so without this
+      // the carrier would set `interimSaid` on a debt the other process was
+      // about to acknowledge, and that acknowledgement would never be sent by
+      // anybody. Only reachable with two daemons sharing one obligations
+      // directory — already pathological — but the previous per-record code
+      // could not reach it at all, because it never touched another record.
+      && !isForeignAlive(r)
+    ),
+  );
+  const batches = groupIntoBatches({ records, now });
+  return batches.find((b) => b.records.includes(rec)) || { conversation: null, urgent: false, records: [rec] };
+}
+
+/**
+ * Is this debt owned by a DIFFERENT, provably live process?
+ *
+ * One definition, two callers — the sweep's per-record narrating gate and
+ * `batchFor`'s membership filter — because a batch that admits a record the
+ * sweep would refuse to narrate can latch it silent on that owner's behalf.
+ *
+ * @param {object} rec
+ * @param {(pid:number)=>boolean} alive
+ */
+function ownedByLiveForeign(rec, alive) {
+  return !!(rec && rec.daemonPid && rec.daemonPid !== process.pid && alive(rec.daemonPid));
+}
+
+/**
+ * Latch a whole batch silent without saying anything.
+ *
+ * SILENT IS NOT DROPPED, and the distinction is the one this module was built
+ * on: `state` is untouched, so every debt stays open, swept, and covered by
+ * the stale and failure notices. What is withheld is the courtesy — the half
+ * that carries no information the reader cannot get from the answer itself.
+ */
+function latchBatchSilent(verdict, now, reason) {
+  const all = verdict.carrier ? [verdict.carrier, ...verdict.speaksFor] : verdict.speaksFor;
+  for (const r of all) {
+    if (!r) continue;
+    r.interimSaid = true;
+    r.interimSuppressedAt = now;
+    r.interimSuppressedReason = reason;
+    writeRecord(r);
+  }
+}
+
 async function _sweepObligations(a = {}) {
   const now = Number.isFinite(a.now) ? a.now : Date.now();
   const send = (a.deps && a.deps.deliverImpl) || deliver;
   const heardBy = (a.deps && (a.deps.spokeForImpl || a.deps.spokeSinceImpl)) || spokeFor;
   const alive = (a.deps && a.deps.isPidAliveImpl) || isPidAlive;
-  const stats = { swept: 0, acked: 0, staled: 0, closed: 0, interrupted: 0, unreachable: 0, suppressed: 0 };
+  const stats = {
+    swept: 0, acked: 0, staled: 0, closed: 0, interrupted: 0, unreachable: 0, suppressed: 0,
+    // How many debts this tick's acknowledgements spoke FOR rather than to —
+    // the flurry that drew one line instead of four — and how many batches are
+    // deliberately still assembling. Both are ordinary operation, not faults;
+    // they are counted because a batching window nobody can measure is a
+    // window nobody can size.
+    batched: 0, batchWaiting: 0,
+  };
 
   const open = openObligations();
+  // Keys this pass has already closed or spoken to. See `batchFor`.
+  const consumed = new Set();
   for (const rec of open) {
     stats.swept++;
     // Two clocks, deliberately. `age` is how long the HUMAN has been waiting and
@@ -1659,7 +2200,7 @@ async function _sweepObligations(a = {}) {
     // gone. The terminal branches above and below — answered, undeliverable,
     // stale — stay shared: closing a discharged or dead debt is safe from
     // either process, and branch (e) already proves the owner dead itself.
-    const foreignOwnerAlive = !!(rec.daemonPid && rec.daemonPid !== process.pid && alive(rec.daemonPid));
+    const foreignOwnerAlive = ownedByLiveForeign(rec, alive);
 
     // (a) The session already answered — discharge without saying anything.
     // Attributed, not room-wide: see spokeFor. An unattributed message in a room
@@ -1675,6 +2216,7 @@ async function _sweepObligations(a = {}) {
     });
     if (v && v.heard) {
       closeObligation(rec.key, { outcome: "answered", now, note: `receipt:${v.basis}` });
+      consumed.add(rec.key);
       stats.closed++;
       continue;
     }
@@ -1692,6 +2234,7 @@ async function _sweepObligations(a = {}) {
       };
       escalate(rec, { failure, now, told: false });
       closeObligation(rec.key, { outcome: "undeliverable", now, note: failure.label });
+      consumed.add(rec.key);
       stats.unreachable++;
       continue;
     }
@@ -1705,7 +2248,13 @@ async function _sweepObligations(a = {}) {
     // exactly the obligations that most need one.
     if (workAge >= STALE_AFTER_MS) {
       const failure = { transient: false, label: "no_outcome", human: "the work never came back with a result and has now outrun its time limit" };
-      const text = composeFailure(rec, { failure, willRetry: false });
+      const notice = await generateFailureNotice(
+        rec,
+        { failure, willRetry: false, mayWrite: claimWrittenVoice(rec, NOTICE.FAILURE_FINAL, now, a.deps && a.deps.roomNoticeImpl) },
+        a.deps && a.deps.noticeGen,
+      );
+      const text = notice.text;
+      if (notice.degraded) counters.bump("assurance.notice_degraded", { notice: NOTICE.FAILURE_FINAL });
       // SAID ONCE PER (channel, key) — AND once per identical sentence per
       // room. The retry loop used to narrate every attempt (notice → retry →
       // fresh obligation → notice), and the notice ledger inherited across the
@@ -1726,6 +2275,7 @@ async function _sweepObligations(a = {}) {
       writeRecord(rec);
       escalate(rec, { failure, now, told: !!(res && res.sent) });
       closeObligation(rec.key, { outcome: "failed", now, note: "stale-no-outcome" });
+      consumed.add(rec.key);
       stats.staled++;
       continue;
     }
@@ -1754,7 +2304,18 @@ async function _sweepObligations(a = {}) {
         counters.bump("assurance.notice_deduped", { notice: NOTICE.INTERRUPTED });
         continue;
       }
-      const text = composeInterrupted(rec);
+      const interruptedNotice = await generateFailureNotice(
+        rec,
+        {
+          failure: { human: "my end restarted while it was running" },
+          willRetry: false,
+          kind: NOTICE.INTERRUPTED,
+          mayWrite: claimWrittenVoice(rec, NOTICE.INTERRUPTED, now, a.deps && a.deps.roomNoticeImpl),
+        },
+        a.deps && a.deps.noticeGen,
+      );
+      const text = interruptedNotice.text;
+      if (interruptedNotice.degraded) counters.bump("assurance.notice_degraded", { notice: NOTICE.INTERRUPTED });
       const res = await sayOutcomeNotice({
         rec, notice: NOTICE.INTERRUPTED, text, item, kind: "notice",
         idempotencySuffix: `interrupted-${rec.attempts || 0}`, now, send,
@@ -1763,12 +2324,26 @@ async function _sweepObligations(a = {}) {
       rec.interruptedNotifiedAt = now;
       rec.daemonPid = process.pid;
       writeRecord(rec);
+      consumed.add(rec.key);
       if (res.sent) stats.interrupted++;
       continue;
     }
 
     // (e) THE ONE INTERIM. This is the only branch in the system that emits a
-    // courtesy message, and it is gated four ways before it does:
+    // courtesy message, and it is gated six ways before it does:
+    //
+    //   BATCH  — the unit is the CONVERSATION, not the message. Every open,
+    //            eligible debt in this room forms one batch; the batch is not
+    //            ready until it has been QUIET (20 s) after its newest member,
+    //            and when it is ready exactly ONE of them — the newest — writes
+    //            the line, having been handed all of their messages. The others
+    //            are latched `interimSaid` with `spokenForBy` naming the
+    //            carrier. This is what the room budget could not do: the budget
+    //            caps HOW MANY, it cannot choose WHICH, and "one arbitrary
+    //            reply out of four" is not "one reply to the four".
+    //   ANSWER — and before any of it, `spokeSince`: if something substantive
+    //            has already reached this room since the batch opened, a
+    //            holding line behind it is a contradiction. See PIN 2.
     //
     //   TIME   — nothing at all before ACK_AFTER_MS. Below ninety seconds the
     //            typing indicator is the acknowledgement; a message there is
@@ -1805,11 +2380,89 @@ async function _sweepObligations(a = {}) {
     // generation that yields nothing usable still sends NOTHING rather than a
     // canned line. The debt stays open either way: silence about timing is not
     // silence about outcome, and the failure/stale notices still speak.
-    if (
-      !rec.interimSaid && !rec.interimForbidden && !rec.ackSuppressed
-      && rec.tier !== "answer"
-      && !foreignOwnerAlive && age >= ACK_AFTER_MS
-    ) {
+    // THE AGE GATE MOVED INTO THE BATCH VERDICT, AND HAD TO.
+    //
+    // It used to live here as `age >= ACK_AFTER_MS`, per record. With a batch
+    // that deadlocks: in a four-message flurry only the OLDEST record is past
+    // ninety seconds, and the record that must speak is the NEWEST — so the
+    // oldest entered the branch and deferred to a carrier that the branch
+    // itself would not admit for another nine seconds, every tick, forever.
+    // `batchVerdict` measures the same ninety seconds from the batch's FIRST
+    // arrival, which is the same promise to the same waiting human, made once
+    // for the conversation instead of once per message.
+    if (interimEligible(rec) && !foreignOwnerAlive) {
+      // ── THE UNIT OF ACKNOWLEDGEMENT IS THE CONVERSATION ────────────────────
+      // Four messages in a row must not draw four acknowledgements, and — the
+      // half the room budget alone could never give — the ONE that does go out
+      // must have been written with all four in front of it. The budget caps
+      // HOW MANY; this decides WHICH and WHEN. See lib/assurance/batch.mjs.
+      const mine = batchFor(rec, open, consumed, now, (r) => ownedByLiveForeign(r, alive));
+      const verdict = batchVerdict({
+        batch: mine,
+        now,
+        ackAfterMs: ACK_AFTER_MS,
+        quietMs: batchQuietMs(),
+        maxSpanMs: batchMaxSpanMs(),
+      });
+
+      // ONE DECISION PER BATCH PER TICK. Only the carrier decides; every
+      // other member of the batch defers to it in this pass and is latched by
+      // it below if it speaks. Checked BEFORE readiness so the counters,
+      // the receipt question and the budget peek each happen once per
+      // conversation rather than once per message in it.
+      if (verdict.carrier !== rec) continue;
+
+      // BOUNDARY PIN 1 — A BATCH THAT IS NOT READY CHANGES NOTHING.
+      // `ready:false` means "still assembling", never "refused": nothing is
+      // latched, nothing is spent, no counter moves. That is the only way the
+      // LAST message of a flurry can join the batch it belongs to — if an
+      // unready tick latched its older siblings silent, message four would
+      // arrive into a room that had already decided not to speak.
+      if (!verdict.ready) {
+        stats.batchWaiting++;
+        continue;
+      }
+
+      // BOUNDARY PIN 2 — AN ANSWER OUTRANKS THE COURTESY THAT PRECEDES IT.
+      // A batch still open when the work finishes must not post a holding line
+      // behind the answer. Branch (a) cannot catch this: `spokeFor` refuses to
+      // close a debt on an unattributed receipt while siblings are open
+      // (`ambiguous-room`), which is right for CLOSING — guessing which debt a
+      // message answered is how an unanswered ask gets marked answered — and
+      // wrong for SPEAKING. The question an interim has to pass is weaker and
+      // room-shaped: has this person already heard something substantive from
+      // me since they asked? If they have, "I'm looking at this" is false
+      // whichever debt it belonged to. The debts stay open and tracked; only
+      // the courtesy is withheld, exactly as over-budget is treated.
+      // NOT `spokeSinceImpl`: branch (a) already claims that name as an alias
+      // for its `spokeFor` seam, and one injected fake driving two different
+      // questions is how a test proves the wrong thing.
+      const spokeImpl = (a.deps && a.deps.roomSpokeImpl) || spokeSince;
+      // AND IT ASKS ONLY ONCE A SESSION HAS ACTUALLY RUN. This is the same
+      // condition `spokeFor`'s rung 3 imposes, and for the same reason: before
+      // any session of ours has run, a message in this room came from
+      // somewhere else — a cadence post, a broadcast, a different debt
+      // entirely — and treating it as the answer to a flurry nobody has
+      // started work on would leave a person never acknowledged and never
+      // answered. Once a session HAS run, a substantive message in the room is
+      // overwhelmingly that work landing, whichever debt carries its receipt.
+      const anyRan = mine.records.some((r) => (r.attempts || 0) > 0);
+      let answered = false;
+      try {
+        answered = anyRan && spokeImpl({
+          channel: rec.channel,
+          sinceMs: verdict.firstAt,
+          excludeKinds: NON_ANSWER_KINDS,
+          agentRoot: AGENT_REPO_DIR,
+        }) === true;
+      } catch { answered = false; } // a receipt-ledger fault must not gag the room
+      if (answered) {
+        latchBatchSilent(verdict, now, "answer-already-landed");
+        counters.bump("assurance.interim_suppressed", { reason: "answer-already-landed" });
+        stats.suppressed += verdict.size;
+        continue;
+      }
+
       const budgetOf = (a.deps && a.deps.roomBudgetImpl) || claimRoomInterim;
       // ASK, then compose, then SPEND. The interim's text comes from a model
       // call that can fail; claiming the room's fifteen minutes before the
@@ -1825,15 +2478,62 @@ async function _sweepObligations(a = {}) {
         // OVER BUDGET IS NOT A DROP. The debt stays open and tracked exactly as
         // it was; what is withheld is the content-free half. The room has heard
         // from this agent inside the window and does not need to hear it again.
-        rec.interimSaid = true;
-        rec.interimSuppressedAt = now;
-        writeRecord(rec);
+        // The whole batch is latched, not just the carrier: its siblings are in
+        // the same room and would each re-ask the same refused question.
+        latchBatchSilent(verdict, now, (budget && budget.reason) || "room-budget");
         counters.bump("assurance.interim_suppressed", { reason: (budget && budget.reason) || "room-budget" });
-        stats.suppressed++;
+        stats.suppressed += verdict.size;
         continue;
       }
+      // ── SOMETIMES A REACTION IS THE WHOLE REPLY ────────────────────────
+      // The owner's third case, and the narrowest: "sometimes the initial
+      // response can be an emoji response". `firstReplyShape` decides, not a
+      // prompt — the distinction it draws is that an emoji acknowledges an FYI
+      // and never answers a QUESTION, and a rule stated only in a prompt is a
+      // rule nothing checks (the ack prompt banned "on it" from the day it was
+      // written and 3,069 of them shipped anyway).
+      //
+      // Reached only here, inside every gate the interim already passes — time,
+      // tier, once, room budget — so a reaction can never be louder than the
+      // line it replaces. It is cheaper than a line in the one way that matters
+      // to a reader: it adds no row to the channel.
+      const shape = firstReplyShape({
+        tier: rec.tier,
+        action: rec.action,
+        directed: rec.directed !== false,
+        text: item.content || item.subject || "",
+        reactionsAvailable: canReactTo(item),
+        reaction: "seen",
+      });
+      if (shape.shape === "react") {
+        const react = (a.deps && a.deps.reactImpl) || deliverReaction;
+        const rres = await react(item, shape.emoji);
+        if (rres && rres.sent) {
+          budgetOf({ service: rec.service, channel: rec.channel, now, agentRoot: AGENT_REPO_DIR, commit: true });
+          rec.acknowledged = true;
+          rec.ackAt = now;
+          rec.interimSaid = true;
+          rec.interimAt = now;
+          rec.ackShape = "react";
+          writeRecord(rec);
+          counters.bump("assurance.interim_reaction", { emoji: shape.emoji });
+          stats.acked++;
+          continue;
+        }
+        // A reaction that would not go out is not a reason to stay silent —
+        // fall through and write the line instead.
+        counters.bump("assurance.interim_reaction_failed", { reason: (rres && rres.error) || "unknown" });
+      }
+
       const gen = (a.deps && a.deps.generateAckImpl) || generateAck;
-      const text = await gen(item, { summary: rec.summary, model: rec.model, priority: rec.priority });
+      // THE BATCH, oldest first, is what the line is composed from. With one
+      // member this is the message itself and the prompt is unchanged.
+      const batchText = batchMessages(mine.records);
+      const text = await gen(
+        item,
+        { summary: rec.summary, model: rec.model, priority: rec.priority },
+        { batch: batchText },
+      );
       if (text == null) {
         rec.ackGenFailures = (rec.ackGenFailures || 0) + 1;
         if (rec.ackGenFailures >= ACK_GEN_MAX_FAILURES) {
@@ -1855,8 +2555,23 @@ async function _sweepObligations(a = {}) {
         rec.ackAt = now;
         rec.interimSaid = true;
         rec.interimAt = now;
+        rec.batchSize = verdict.size;
+        rec.batchReason = verdict.reason;
         writeRecord(rec);
+        // THE SIBLINGS THIS LINE SPOKE FOR. Latched here and not left to the
+        // room budget, for a reason that is not cosmetic: the budget expires
+        // after fifteen minutes, and a sibling still open at minute sixteen
+        // would then post a SECOND first-contact line about a conversation
+        // that was acknowledged a quarter of an hour ago. `interimSaid` never
+        // expires; the budget does.
+        for (const sib of verdict.speaksFor) {
+          sib.interimSaid = true;
+          sib.interimAt = now;
+          sib.spokenForBy = rec.key;
+          writeRecord(sib);
+        }
         stats.acked++;
+        stats.batched += verdict.speaksFor.length;
       } else {
         // A permanent refusal (no transport, policy block) is worth five ticks
         // of nobody's time; count it out at once.
@@ -1932,11 +2647,16 @@ export default {
   generateAck,
   sanitiseAckText,
   composeFailure,
+  generateFailureNotice,
+  noticeGenEnabled,
+  _buildAckUserPromptForTest: buildAckUserPrompt,
   composeSilentSuccess,
   composeInterrupted,
+  looksLikePeerOutcomeNotice,
   classifyFailure,
   openAndAcknowledge,
   notePlan,
+  interimEligible,
   _resetSweepGuard,
   noticeAlreadySaid,
   markNoticeSaid,