@cohortapp/agent-sdk 2.5.1 → 2.6.0

package/scripts/daemon/responder.mjs

@@ -1,14 +1,23 @@
 /**
  * responder.mjs — Quick response layer
  *
- * Handles two scenarios with a single short-lived `claude --print` call:
+ * Handles two scenarios, and they no longer cost the same thing:
  *
- * 1. SIMPLE REPLIES: Invokes the Claude Code CLI to generate a response,
- *    then posts directly via Slack/Gmail API.
+ * 1. SIMPLE REPLIES: a short-lived `claude --print` call generates an answer,
+ *    which is then delivered via ./deliver.mjs. This is the only path here that
+ *    spends a model call, because it is the only one producing an ANSWER.
  *
- * 2. HOLDING MESSAGES: For complex items that need a full session,
- *    generates and sends an immediate acknowledgment so the sender
- *    knows it's being worked on.
+ * 2. ACKNOWLEDGEMENTS: for complex items that need a full session, an immediate
+ *    holding message so the sender knows the work has started.
+ *
+ *    THIS ONE USED TO SPAWN A MODEL TOO, AND THAT WAS THE BUG. A cold
+ *    `claude --print` child under a 60-second cap, on a machine at 95-99%
+ *    memory, to compose two sentences of courtesy: it lost that race 20 times
+ *    in 32, and each loss was caught, logged as `holding_message_error`, and
+ *    told the requester nothing while a 15-45 minute session ran behind a
+ *    typing indicator. It is now composed by assurance.composeAck — a string
+ *    concat and one HTTP call, which cannot time out, cannot be starved of
+ *    memory, and cannot be refused by a spend cap.
  *
  * Migrated off `@anthropic-ai/sdk` per CEO directive (Slack DM
  * D099N1JGKRQ, 2026-04-27 09:38Z + 11:33Z): all agent daemon model
@@ -16,8 +25,8 @@
  * subscription), not the Anthropic API.
  */
 
-import { readFileSync, writeFileSync, readdirSync, appendFileSync, mkdirSync } from "fs";
-import { execFileSync, spawn } from "child_process";
+import { readFileSync, readdirSync, appendFileSync, mkdirSync, existsSync } from "fs";
+import { spawn } from "child_process";
 import { join } from "path";
 import { randomUUID } from "crypto";
 import { checkRecentlySent, registerSent } from "./session-lock.mjs";
@@ -27,21 +36,29 @@ import { routingKey as deriveRoutingKey, createRouter } from "./lib/session-rout
 // scopes tools when the operator opts in (MAESTRO_SCOPED_PERMISSIONS=1), so the
 // quick-reply / holding spawn path honours the same gate as every other spawn.
 import { sessionPermissionArgs } from "../../lib/session-permissions.mjs";
-import { screenOutbound } from "../../lib/comms/send-gate.mjs";
 // Observability spine (WS — diagnostics). emitEvent("sent") marks a successful
-// quick-reply / holding send (interaction-end on the quick path); counters.bump
-// ("send.blocked") tallies a guard / send-gate / dedup block. When the send-gate
-// itself fails OPEN (infra error on an internal Slack channel) we emit
-// "onGuardFail" on the lifecycle bus so the daemon's real subscriber counts it —
-// proving the bus is live with a real consumer. All fail-open (never throw).
+// quick-reply / acknowledgement send; counters.bump("send.blocked") tallies a
+// guard / send-gate / dedup block. Both fail-open (never throw).
+//
+// The send-gate screen and its fail-open `onGuardFail` emit moved WITH the
+// transport into ./deliver.mjs, so every outbound — answer, acknowledgement,
+// progress update, failure notice — passes the one chokepoint rather than only
+// the two that happened to live in this file.
 import { emitEvent, EVENT_TYPES } from "../../lib/diagnostics/events.mjs";
 import * as counters from "../../lib/diagnostics/counters.mjs";
-import { getHookBus } from "../../lib/hooks/bus.mjs";
 // The execution ladder's rung vocabulary. This responder IS rungs 0-1
 // (`function_call` / `skill`); `isQuickReply` consults the ladder's routing
 // decision so a reply that needs a session, a plugin, a workflow or a team is
 // not answered here just because the classifier called it simple.
 import { rungById } from "../../lib/execution/route.mjs";
+// Transport, shared with the assurance layer. Sending is not generating: these
+// put an exact string in front of a human with no model in the loop, which is
+// the property the acknowledgement path needed and did not have.
+import { deliver, deliverWithRetry, resolveSlackChannel } from "./deliver.mjs";
+// The acknowledgement is now COMPOSED, not generated. See assurance.mjs for why
+// (in short: a 60s `claude --print` spawn to write "let me look into it" lost
+// its own race 2 times in 3, and lost it silently).
+import { composeAck } from "./assurance.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 const SONNET_MODEL = "claude-sonnet-4-6";
@@ -124,6 +141,97 @@ function getSlackToken() {
 
 let cachedPreamble = null;
 
+/**
+ * Why this session could not be measured, or null when it could.
+ *
+ * Exported and pure so the FAILING paths are testable without a spawn harness —
+ * they are the ones that used to record nothing at all, and they are the
+ * expensive ones (a 60s timeout is a full minute of paid model work).
+ *
+ * @param {{parsed:object|null, timedOut:boolean, exitCode:number|null,
+ *          parseError:Error|null, timeoutMs:number}} o
+ * @returns {string|null}
+ */
+export function unmeasuredReasonFor({ parsed, timedOut, exitCode, parseError, timeoutMs }) {
+  if (parsed) return null;
+  if (timedOut) return `cli-timeout-${timeoutMs}ms`;
+  if (exitCode !== 0 && exitCode != null) return `cli-exit-${exitCode}`;
+  if (parseError) return "json-parse-failed";
+  return "no-json-envelope";
+}
+
+/**
+ * Append a cost-ledger row for a responder session (source "responder").
+ *
+ * The responder spawns `claude --print` for every quick reply and holding
+ * message and, until now, recorded NOTHING — that spend existed only on the
+ * Anthropic bill. A budget governor cannot cap what it cannot see, so an
+ * entire class of the agent's paid work was structurally exempt.
+ *
+ * Token counts come from the run's `--output-format json` envelope. When the
+ * envelope is missing or unparseable we record measurement:"unknown" via
+ * --tokens-unknown, NEVER a zero: a zero that means "unmeasured" is what made
+ * the governor blind in the first place.
+ *
+ * EVERY EXIT PATH RECORDS, INCLUDING THE FAILING ONES. A timeout and a non-zero
+ * exit are the two most expensive outcomes this daemon has — the model ran, the
+ * tokens were generated and billed, and only the delivery failed. Recording only
+ * the happy path is the same "unmeasured looks free" bug one level up: on a
+ * single observed day 15 sessions hit `CLAUDE_CLI_TIMEOUT_MS` (60s of paid model
+ * work each) and wrote no ledger row at all, so neither the governor nor doctor
+ * could see them. The caller now records exactly once per spawn, on `close`,
+ * BEFORE the settled/exit-code returns.
+ *
+ * Best-effort, detached, never throws — cost accounting must not be able to
+ * break a reply.
+ *
+ * @param {{json:object|null, model:string, durationMs:number, exitCode:number, unmeasuredReason:string|null}} o
+ */
+function recordResponderCost({ json, model, durationMs, exitCode, unmeasuredReason }) {
+  try {
+    const trackerPath = join(AGENT_REPO_DIR, "scripts/cost/track-claude-usage.mjs");
+    if (!existsSync(trackerPath)) return;
+
+    const usage = json && typeof json.usage === "object" && json.usage ? json.usage : null;
+    const inputTokens = usage ? Number(usage.input_tokens) : NaN;
+    const outputTokens = usage ? Number(usage.output_tokens) : NaN;
+    const measured = Number.isFinite(inputTokens) && Number.isFinite(outputTokens);
+
+    // Map the CLI-resolved model id onto the tracker's coarse pricing class.
+    const resolved = json && typeof json.model === "string" ? json.model : model || "";
+    const modelClass = /opus/i.test(resolved) ? "opus" : /haiku/i.test(resolved) ? "haiku" : "sonnet";
+
+    const args = [
+      trackerPath, "record",
+      "--cadence", "responder",
+      "--source", "responder",
+      "--model", modelClass,
+      "--duration-ms", String(durationMs),
+      "--exit", String(exitCode),
+    ];
+
+    if (measured) {
+      args.push("--input-tokens", String(inputTokens));
+      args.push("--output-tokens", String(outputTokens));
+      const cacheRead = Number(usage.cache_read_input_tokens);
+      if (Number.isFinite(cacheRead)) args.push("--cache-read-tokens", String(cacheRead));
+      const cacheWrite = Number(usage.cache_creation_input_tokens);
+      if (Number.isFinite(cacheWrite)) args.push("--cache-creation-tokens", String(cacheWrite));
+      const totalCost = Number(json.total_cost_usd);
+      if (Number.isFinite(totalCost) && totalCost >= 0) args.push("--total-cost-usd", String(totalCost));
+    } else {
+      const reason = unmeasuredReason || (json ? "no-usage-field" : "no-json-envelope");
+      args.push("--tokens-unknown", reason);
+      console.warn(`[responder] session usage unmeasured (${reason}) — recorded as unknown, not zero`);
+    }
+
+    spawn(process.execPath, args, {
+      stdio: "ignore",
+      env: { ...process.env, AGENT_ROOT: AGENT_REPO_DIR, AGENT_DIR: AGENT_REPO_DIR },
+    }).unref();
+  } catch { /* cost tracking is best-effort */ }
+}
+
 // Spawn `claude --print` with the supplied system + user prompts and model.
 // Mirrors the pattern used in classifier.mjs:
 //   • child_process.spawn (not exec) — avoids shell-escape injection on
@@ -144,6 +252,7 @@ let cachedPreamble = null;
 // @returns {Promise<{ text: string, jsonResult: object|null, exitCode: number }>}
 function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
   const { sessionId = null, router = null, routingKey = null } = opts;
+  const startedAt = Date.now();
 
   return new Promise((resolvePromise, rejectPromise) => {
     const args = [
@@ -152,11 +261,18 @@ function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
       ...daemonClaudeArgs(),
       "--model", model,
       "--append-system-prompt", systemPrompt,
+      // --output-format json is only valid in combination with --print (per b1
+      // report). We always pass --print above, so this is safe.
+      //
+      // This used to be requested ONLY when a sessionId was supplied, which
+      // meant every non-routed reply ran with no usage envelope and therefore
+      // no way to price it. Every reply this daemon sends costs real money;
+      // asking for the envelope unconditionally is what makes it measurable.
+      // The parse below already has a raw-text fallback for older CLIs.
+      "--output-format", "json",
     ];
     if (sessionId) {
-      // --output-format json is only valid in combination with --print (per
-      // b1 report). We always pass --print above, so this is safe.
-      args.push("--session-id", sessionId, "--output-format", "json");
+      args.push("--session-id", sessionId);
     }
 
     const proc = spawn(CLAUDE_BIN, args, {
@@ -170,10 +286,17 @@ function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
     let stdout = "";
     let stderr = "";
     let settled = false;
+    // A spawn is billed exactly once, on its first `close`, whatever the exit
+    // path was. `settled` tracks the PROMISE; this tracks the LEDGER, and the
+    // two must not be conflated — that conflation is what made every timeout
+    // and every non-zero exit invisible spend.
+    let costRecorded = false;
+    let timedOut = false;
 
     const timer = setTimeout(() => {
       if (settled) return;
       settled = true;
+      timedOut = true;
       try { proc.kill("SIGTERM"); } catch (_) { /* noop */ }
       setTimeout(() => { try { if (!proc.killed) proc.kill("SIGKILL"); } catch (_) { /* noop */ } }, 2000);
       rejectPromise(new Error(`claude CLI timed out after ${CLAUDE_CLI_TIMEOUT_MS}ms`));
@@ -205,6 +328,43 @@ function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
         });
       }
 
+      // (b3) We always ask for JSON now, so always try to parse it. Parsed HERE,
+      // above every early return, because the cost record needs it on the
+      // failing paths too: a CLI that timed out or exited non-zero has often
+      // already emitted a usable usage envelope, and even when it has not, the
+      // session must be billed as UNMEASURED rather than not billed at all.
+      const trimmed = (stdout || "").trim();
+      let parsed = null;
+      let parseError = null;
+      try {
+        // Per b1 report: top-level `session_id` (snake_case UUID), `result`
+        // (text), `is_error` (bool). Top-level `uuid` is the message UUID,
+        // NOT the session id — do NOT use it.
+        parsed = trimmed ? JSON.parse(trimmed) : null;
+        if (!parsed) parseError = new Error("no stdout");
+      } catch (err) {
+        // Legacy fallback (rollout-safety): older CLIs or unexpected output
+        // shapes shouldn't crash the daemon. Log a warning, surface the raw
+        // text, and let the caller decide whether to call router.touch.
+        parseError = err;
+        console.warn(`[responder] claude CLI JSON parse failed (sessionId=${sessionId}): ${err.message} — falling back to raw stdout`);
+      }
+
+      // Every reply this daemon sends is a paid Claude session — INCLUDING the
+      // ones that time out and the ones that exit non-zero, which are the two
+      // most expensive outcomes there are (the model ran; only the delivery
+      // failed). Record before any early return, exactly once per spawn.
+      if (!costRecorded) {
+        costRecorded = true;
+        recordResponderCost({
+          json: parsed,
+          model,
+          durationMs: Date.now() - startedAt,
+          exitCode: code,
+          unmeasuredReason: unmeasuredReasonFor({ parsed, timedOut, exitCode: code, parseError, timeoutMs: CLAUDE_CLI_TIMEOUT_MS }),
+        });
+      }
+
       if (settled) return;
       settled = true;
       clearTimeout(timer);
@@ -214,24 +374,10 @@ function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
         return;
       }
 
-      // (b3) If we asked for JSON, parse it. Otherwise return raw text.
-      if (sessionId) {
-        const trimmed = (stdout || "").trim();
-        try {
-          const parsed = JSON.parse(trimmed);
-          // Per b1 report: top-level `session_id` (snake_case UUID), `result`
-          // (text), `is_error` (bool). Top-level `uuid` is the message UUID,
-          // NOT the session id — do NOT use it.
-          resolvePromise({ text: parsed.result ?? "", jsonResult: parsed, exitCode: code });
-        } catch (parseErr) {
-          // Legacy fallback (rollout-safety): older CLIs or unexpected output
-          // shapes shouldn't crash the daemon. Log a warning, surface the raw
-          // text, and let the caller decide whether to call router.touch.
-          console.warn(`[responder] claude CLI JSON parse failed (sessionId=${sessionId}): ${parseErr.message} — falling back to raw stdout`);
-          resolvePromise({ text: trimmed, jsonResult: null, exitCode: code });
-        }
+      if (parsed) {
+        resolvePromise({ text: parsed.result ?? "", jsonResult: parsed, exitCode: code });
       } else {
-        resolvePromise({ text: stdout, jsonResult: null, exitCode: code });
+        resolvePromise({ text: trimmed, jsonResult: null, exitCode: code });
       }
     });
 
@@ -264,16 +410,31 @@ function logResponse(entry) {
 /**
  * Write an interaction record so future sessions can see this exchange.
  * Both the incoming message and the agent's reply are logged.
+ *
+ * THIS USED TO REFUSE EVERY SERVICE BUT SLACK. The guard read
+ * `item.service !== "slack"`, so a Cohort conversation — the agent's own
+ * workspace, and the only surface the owner actually uses — was never written
+ * down. `loadConversationHistory` then read from a directory tree that was
+ * therefore never created, returned null for every item on every service, and
+ * the generator answered a bare "?" chase message with "What's on your mind?".
+ * The owner's next line was "Why can't you see the context of our ongoing
+ * conversation?". That question had a one-word answer, and it was this guard.
+ *
+ * Records are now filed under the item's own service, so each service's history
+ * reads back through the matching lookup in `loadConversationHistory`.
  */
-function logInteraction(item, responseText) {
-  if (!item || !item.sender || item.service !== "slack") return;
+function logInteraction(item, responseText, o = {}) {
+  if (!item || !item.sender || !item.service) return;
+  const service = String(item.service);
   const senderSlug = item.sender.replace(/\s+/g, "-").toLowerCase();
-  const channelId = resolveSlackChannel(item);
+  const channelId = service === "slack"
+    ? resolveSlackChannel(item)
+    : (item.channel_id || item.channel || null);
 
   // Write to both channel-ID and sender-slug directories
   const dirs = [];
-  if (channelId) dirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
-  dirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
+  if (channelId) dirs.push(join(AGENT_REPO_DIR, "memory", "interactions", service, String(channelId)));
+  dirs.push(join(AGENT_REPO_DIR, "memory", "interactions", service, `dm-${senderSlug}`));
 
   const incomingEntry = {
     ts: item.ts || item.timestamp || new Date().toISOString(),
@@ -282,7 +443,7 @@ function logInteraction(item, responseText) {
     type: item.is_reply ? "thread_reply" : "dm",
     content: item.content || "",
     received_at: new Date().toISOString(),
-    classification: "quick_reply",
+    classification: o.classification || "quick_reply",
     response_sent: true,
   };
 
@@ -293,7 +454,7 @@ function logInteraction(item, responseText) {
     type: "reply",
     content: responseText,
     sent_at: new Date().toISOString(),
-    via: "quick_reply_responder",
+    via: o.classification === "holding" ? "holding_ack" : "quick_reply_responder",
   };
 
   for (const dir of dirs) {
@@ -362,15 +523,23 @@ function loadUserProfile(sender) {
 // Load recent conversation history for context
 // ---------------------------------------------------------------------------
 
+/**
+ * The reader half of `logInteraction`. It looked ONLY under
+ * `memory/interactions/slack/…`, so even once a Cohort exchange was written it
+ * would not have been found. Both halves are now keyed on the item's service.
+ */
 function loadConversationHistory(item) {
-  if (!item || !item.sender) return null;
+  if (!item || !item.sender || !item.service) return null;
 
+  const service = String(item.service);
   const senderSlug = item.sender.replace(/\s+/g, "-").toLowerCase();
-  const channelId = resolveSlackChannel(item);
+  const channelId = service === "slack"
+    ? resolveSlackChannel(item)
+    : (item.channel_id || item.channel || null);
 
   const candidateDirs = [];
-  if (channelId) candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
-  candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
+  if (channelId) candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", service, String(channelId)));
+  candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", service, `dm-${senderSlug}`));
 
   const entries = [];
   for (const dir of candidateDirs) {
@@ -412,9 +581,13 @@ function loadConversationHistory(item) {
 // generateResponse() through this slot.
 let _generateResponse;
 /**
- * Test seam: replace the response generator. Pass a function `(item,
- * classResult, isHolding) => Promise<string>` to force reply text; pass nothing
- * to restore the real CLI-backed generator. Returns a restore fn.
+ * Test seam: replace the response generator. Pass a function
+ * `(item, classResult) => Promise<string>` to force reply text; pass nothing to
+ * restore the real CLI-backed generator. Returns a restore fn.
+ *
+ * The third `isHolding` parameter is gone — this seam now covers ANSWERS only.
+ * The acknowledgement path no longer generates anything, so there is nothing
+ * there to stub.
  */
 export function setGenerateResponseForTests(fn) {
   const prev = _generateResponse;
@@ -422,28 +595,23 @@ export function setGenerateResponseForTests(fn) {
   return () => { _generateResponse = prev; };
 }
 
-async function realGenerateResponse(item, classResult, isHolding = false) {
+/**
+ * Generate an ANSWER. Only an answer.
+ *
+ * This used to take an `isHolding` flag and, when set, spend a model call
+ * writing an acknowledgement. That branch is gone: acknowledgements are
+ * composed (assurance.composeAck), and the flag is deliberately not kept "just
+ * in case", because keeping it is how it comes back. The one thing a model was
+ * adding to a courtesy sentence was phrasing variety, at a cost of 13-46
+ * seconds when it worked and total silence when it did not.
+ */
+async function realGenerateResponse(item, classResult) {
   const preamble = loadPreamble();
   const profile = loadUserProfile(item.sender);
-  // Use Sonnet for holding messages (speed matters), but the classifier's
-  // recommended model for actual replies (Opus for CEO, Sonnet for routine)
-  const model = isHolding ? SONNET_MODEL : (classResult.model === "opus" ? "claude-opus-4-6" : SONNET_MODEL);
-
-  let systemPrompt;
-  if (isHolding) {
-    systemPrompt = `${preamble}
-
-You are generating a brief acknowledgment/holding message. The sender has made a request that requires complex work. You need to:
-1. Acknowledge receipt of their message
-2. Briefly confirm what you understand they need
-3. Let them know you're working on it
-4. Give a rough timeframe if appropriate (e.g., "I'll have this ready within the hour")
-
-Keep it to 2-3 sentences max. Be warm but efficient. Match the sender's communication style.
-Do NOT use phrases like "I'm on it!" or overly casual language. Be professional.
-${profile ? `\nSender profile:\n${profile}` : ""}`;
-  } else {
-    systemPrompt = `${preamble}
+  // The classifier's recommended model (Opus for CEO, Sonnet for routine).
+  const model = classResult.model === "opus" ? "claude-opus-4-6" : SONNET_MODEL;
+
+  const systemPrompt = `${preamble}
 
 You are generating a direct response to this message. Be concise and actionable.
 If it's a question, answer it. If it's a request, confirm and describe what you'll do or have done.
@@ -452,7 +620,6 @@ If it's informational, acknowledge appropriately.
 Keep responses focused — 1-4 sentences for simple items, up to a short paragraph for more nuanced ones.
 Match the sender's tone and urgency level.
 ${profile ? `\nSender profile:\n${profile}` : ""}`;
-  }
 
   const conversationHistory = loadConversationHistory(item);
 
@@ -569,171 +736,17 @@ function validateQuickReply(text) {
 }
 
 // ---------------------------------------------------------------------------
-// Send via Slack API
-// ---------------------------------------------------------------------------
-
-async function sendSlackMessage(channel, text, threadTs = null) {
-  // Unified send-gate (P0-3): the daemon quick-reply/holding path must pass the
-  // same chokepoint as the shell senders + BaseAdapter — banned-phrase, AI
-  // disclosure, and information-barrier screening at one place. Block on deny.
-  try {
-    const gate = await screenOutbound({ channel: "slack", recipient: channel, text, agentRoot: AGENT_REPO_DIR });
-    if (gate && gate.allow === false) {
-      throw new Error(`send-gate blocked Slack reply: ${gate.reason}`);
-    }
-  } catch (err) {
-    if (/send-gate blocked/.test(err.message)) throw err; // a real block propagates
-    // gate infra error (module/policy unreadable): fail-open for internal Slack
-    // channels (matches send-gate's internal posture) — never silently drop.
-    console.warn(`[responder] send-gate check errored (allowing internal Slack): ${err.message}`);
-    // Observability: the send-gate just FAILED OPEN — surface it on the lifecycle
-    // bus so the daemon's onGuardFail subscriber counts it (the bus's one real
-    // consumer). Fire-and-forget; emit is fully isolated and never throws.
-    try {
-      Promise.resolve(getHookBus().emit("onGuardFail", { guard: "send_gate", channel: "slack", recipient: channel, reason: err.message, failed_open: true }))
-        .catch(() => { /* bus emit is isolated; never propagate */ });
-    } catch { /* never let telemetry break the send path */ }
-  }
-
-  // Always use user token — bot tokens can't access DM channels
-  const token = getSlackToken();
-  if (!token) throw new Error("No Slack token available (set SLACK_USER_TOKEN in .env)");
-
-  const body = {
-    channel,
-    text,
-    ...(threadTs ? { thread_ts: threadTs } : {}),
-  };
-
-  const res = await fetch("https://slack.com/api/chat.postMessage", {
-    method: "POST",
-    headers: {
-      "Authorization": `Bearer ${token}`,
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify(body),
-  });
-
-  const data = await res.json();
-  if (!data.ok) {
-    throw new Error(`Slack API error: ${data.error}`);
-  }
-
-  return data;
-}
-
-// ---------------------------------------------------------------------------
-// Send via Gmail API (draft or send)
-// Currently logs the response — full Gmail send integration can be added
-// ---------------------------------------------------------------------------
-
-async function sendGmailResponse(item, text) {
-  const to = item.sender_email || item.sender;
-  const subject = `Re: ${item.subject || "(no subject)"}`;
-  const sendScript = join(AGENT_REPO_DIR, "scripts", "send-email-threaded.py");
-
-  try {
-    const args = [sendScript, to, subject, text];
-    if (item.subject) {
-      args.push("--reply-to-subject", item.subject);
-    }
-
-    execFileSync("python3", args, {
-      cwd: AGENT_REPO_DIR,
-      timeout: 30000,
-      encoding: "utf-8",
-      env: { ...process.env },
-    });
-
-    return { sent: true, via: "smtp", to };
-  } catch (err) {
-    console.error(`[responder] Gmail send failed for ${to}: ${err.message}`);
-    // Fall back to draft file so the response is not lost
-    const draftPath = join(AGENT_REPO_DIR, "outputs", "drafts",
-      `${today()}-quick-reply-${item.sender.replace(/[^a-z0-9]/gi, "-")}.md`);
-    mkdirSync(join(AGENT_REPO_DIR, "outputs", "drafts"), { recursive: true });
-    const content = `# Quick Reply Draft (SEND FAILED)\n\nTo: ${to}\nSubject: ${subject}\nGenerated: ${new Date().toISOString()}\nError: ${err.message}\n\n---\n\n${text}\n`;
-    writeFileSync(draftPath, content);
-    return { sent: false, via: "draft_fallback", draft_path: draftPath, error: err.message };
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Resolve Slack channel ID from item
-// ---------------------------------------------------------------------------
-
-function resolveSlackChannel(item) {
-  // Direct channel ID (starts with D for DM, C for channel)
-  if (item.channel && /^[DC][A-Z0-9]{8,}$/.test(item.channel)) return item.channel;
-  if (item.channel_id) return item.channel_id;
-
-  // Extract from raw_ref format: "slack:D099N1JGKRQ:1775331885.690669"
-  if (item.raw_ref) {
-    const match = item.raw_ref.match(/slack:([DC][A-Z0-9]+):/);
-    if (match) return match[1];
-    // Also try bare channel ID in raw_ref
-    const bare = item.raw_ref.match(/^([DC][A-Z0-9]{8,})$/);
-    if (bare) return bare[1];
-  }
-
-  return null;
-}
-
-// ---------------------------------------------------------------------------
-// Public API
+// Transport
 // ---------------------------------------------------------------------------
-
-/**
- * Send a quick response to a simple item. No claude --print session needed.
- * Uses Sonnet API to generate text, then posts directly via Slack/Gmail.
- *
- * @returns {{ sent: boolean, text: string, channel: string }} result
- */
-
-/**
- * Send a reply back onto Cohort (the org's own messaging app).
- *
- * The responder dispatched on `item.service` and only ever knew "slack" and
- * "gmail", so a `cohort` item fell through to `{ sent: false }`: the agent
- * COMPOSED a reply and dropped it on the floor, logging "not_sent". Observed in
- * production — an agent quietly did that to a human's DMs three times in a row.
- *
- * Routing is by CHANNEL, not by person: `channel_id` is the room the inbound
- * arrived in, which is also where the answer belongs (a DM room for a DM, the
- * space for a space). Threading is preserved when the inbound was threaded.
- *
- * Goes through lib/org/messaging.sendMessage rather than the raw RPC so the
- * outbound send-gate, the afterSend hook and cost attribution all still run —
- * the same chokepoint every other channel uses.
- */
-async function sendCohortReply(item, text) {
-  try {
-    const channel = item.channel_id || item.channel || "";
-    if (!channel) return { sent: false, via: null, error: "no channel_id on item" };
-    const { sendMessage } = await import("../../lib/org/messaging.mjs");
-    const { loadOrgConfig } = await import("../../lib/org/client.mjs");
-    const agentRoot = process.env.AGENT_ROOT || process.env.AGENT_DIR || process.cwd();
-    const frame = await sendMessage(
-      {
-        channel,
-        body: text,
-        // Stable per (message, kind) so a retry dedupes server-side instead of
-        // double-posting into a real room.
-        idempotencyId: `reply-${item.message_id || item.id || Date.now()}`,
-        ...(item.thread_id ? { threadId: item.thread_id } : {}),
-      },
-      { cfg: loadOrgConfig(agentRoot), agentRoot },
-    );
-    if (frame && frame.ok) return { sent: true, via: "cohort", channel };
-    return {
-      sent: false,
-      via: null,
-      error: (frame && frame.error && frame.error.message) || "send failed",
-    };
-  } catch (err) {
-    return { sent: false, via: null, error: err && err.message };
-  }
-}
+//
+// The three per-service senders used to live here, private to this module, so
+// the ONLY thing that could ever reach a human was a generated reply. That is
+// why an acknowledgement had to be generated: there was no other way to speak.
+//
+// They now live in ./deliver.mjs and are shared with the assurance layer, so a
+// courtesy message, a progress update and a failure notice all travel the same
+// road as an answer — and a successful send writes a delivery RECEIPT, which is
+// how the daemon can later tell a session that answered from one that did not.
 
 export async function sendQuickResponse(item, classResult, routed = null) {
   const startTime = Date.now();
@@ -754,7 +767,7 @@ export async function sendQuickResponse(item, classResult, routed = null) {
     : null;
 
   try {
-    const text = await _generateResponse(item, classResult, false);
+    const text = await _generateResponse(item, classResult);
 
     // Validate before sending — block replies that violate critical rules
     const validationIssues = validateQuickReply(text);
@@ -776,48 +789,48 @@ export async function sendQuickResponse(item, classResult, routed = null) {
 
     let sendResult = { sent: false };
 
+    // Slack keeps its sent-registry dedup check ahead of the send (the registry
+    // is Slack-keyed); every service then goes through the one transport.
     if (item.service === "slack") {
       const channel = resolveSlackChannel(item);
-      if (channel) {
-        // Check sent-message registry for duplicates
-        const threadTs = item.thread_id || null;
-        const dupCheck = checkRecentlySent(channel, threadTs, "quick_reply");
-        if (!dupCheck.allowed) {
-          console.log(`[responder] Quick reply blocked by sent-registry: ${dupCheck.reason}`);
-          logResponse({ type: "quick_response_dedup_blocked", sender: item.sender, reason: dupCheck.reason });
-          // Observability: a send-gate (dedup registry) block — count it.
-          counters.bump("send.blocked", { stage: "dedup", service: "slack", reason: dupCheck.reason });
-          return { sent: false, text: null, blocked: true, reason: dupCheck.reason };
-        }
-
-        await sendSlackMessage(channel, text, threadTs);
-        registerSent(channel, threadTs, "quick_reply", "quick-responder", text.substring(0, 100));
-        sendResult = { sent: true, channel, via: "slack_api" };
-        // Observability: a quick reply actually left the agent — interaction-end
-        // on the quick path. Ambient trace_id (set by the daemon at item_received)
-        // correlates it; item.trace_id is carried explicitly as a belt-and-braces
-        // hand-off. Never throws.
-        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "slack", channel, via: "quick_reply" } });
-        // Log interaction to memory so future sessions have context
-        logInteraction(item, text);
-      } else {
+      if (!channel) {
         console.warn(`[responder] Could not resolve Slack channel for ${item.sender} (channel: ${item.channel}, raw_ref: ${item.raw_ref})`);
-        sendResult = { sent: false, reason: "no_channel_id" };
+        return { sent: false, text: null, reason: "no_channel_id" };
       }
-    } else if (item.service === "gmail") {
-      const gmailResult = await sendGmailResponse(item, text);
-      sendResult = { sent: gmailResult.sent, via: gmailResult.via, ...(gmailResult.draft_path ? { draft_path: gmailResult.draft_path } : {}), ...(gmailResult.to ? { to: gmailResult.to } : {}) };
-      if (gmailResult.sent) {
-        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "gmail", via: gmailResult.via } });
-        logInteraction(item, text);
+      const dupCheck = checkRecentlySent(channel, item.thread_id || null, "quick_reply");
+      if (!dupCheck.allowed) {
+        console.log(`[responder] Quick reply blocked by sent-registry: ${dupCheck.reason}`);
+        logResponse({ type: "quick_response_dedup_blocked", sender: item.sender, reason: dupCheck.reason });
+        // Observability: a send-gate (dedup registry) block — count it.
+        counters.bump("send.blocked", { stage: "dedup", service: "slack", reason: dupCheck.reason });
+        return { sent: false, text: null, blocked: true, reason: dupCheck.reason };
       }
-    } else if (item.service === "cohort") {
-      const orgResult = await sendCohortReply(item, text);
-      sendResult = { sent: orgResult.sent, via: orgResult.via, ...(orgResult.channel ? { channel: orgResult.channel } : {}), ...(orgResult.error ? { error: orgResult.error } : {}) };
-      if (orgResult.sent) {
-        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "cohort", channel: orgResult.channel, via: "quick_reply" } });
-        logInteraction(item, text);
+    }
+
+    const delivered = await deliver(item, text, { kind: "reply" });
+    sendResult = {
+      sent: delivered.sent,
+      via: delivered.via,
+      ...(delivered.channel ? { channel: delivered.channel } : {}),
+      ...(delivered.draft_path ? { draft_path: delivered.draft_path } : {}),
+      ...(delivered.error ? { error: delivered.error } : {}),
+    };
+
+    if (delivered.sent) {
+      if (item.service === "slack") {
+        registerSent(resolveSlackChannel(item), item.thread_id || null, "quick_reply", "quick-responder", text.substring(0, 100));
       }
+      // Observability: a quick reply actually left the agent — interaction-end
+      // on the quick path. Ambient trace_id (set by the daemon at item_received)
+      // correlates it; item.trace_id is carried explicitly as a belt-and-braces
+      // hand-off. Never throws.
+      emitEvent({
+        type: EVENT_TYPES.SENT,
+        trace_id: item.trace_id || undefined,
+        attrs: { service: item.service, channel: delivered.channel || null, via: "quick_reply" },
+      });
+      // Log interaction to memory so future sessions have context.
+      logInteraction(item, text);
     }
 
     const duration = Date.now() - startTime;
@@ -845,52 +858,89 @@ export async function sendQuickResponse(item, classResult, routed = null) {
 }
 
 /**
- * Send a holding message for a complex item, then return the message text
- * so it can be included in the dispatched session's prompt.
+ * Acknowledge an ask that is about to become a long-running session, and return
+ * the text so the session's own prompt can see what the human was already told.
+ *
+ * THIS NO LONGER CALLS A MODEL, AND THAT IS THE WHOLE POINT.
+ *
+ * It used to. `_generateResponse(item, classResult, true)` spawned a cold
+ * `claude --print` child under a 60-second hard cap to compose two sentences of
+ * courtesy. On a box at 95-99% memory that spawn lost its race 20 times in 32;
+ * every loss threw, was caught below, logged as `holding_message_error`, and
+ * told the requester nothing at all — while a session ran for a median of 14.7
+ * minutes behind a typing indicator the human reads as "she's replying".
  *
- * @returns {{ sent: boolean, holdingText: string }} result
+ * Generation was never needed here. An acknowledgement has a fixed shape, and
+ * the one genuinely useful variable in it — what the ask is about — was already
+ * computed by the classifier and sitting in `classResult.summary`. So the text
+ * is composed (assurance.composeAck) and handed straight to transport. The path
+ * is now a string concat plus one HTTP call: it cannot time out, cannot be
+ * starved of memory, and cannot be refused by a spend cap.
+ *
+ * Failure is still possible (the network exists), and it is still not fatal —
+ * but it is no longer FORGOTTEN. The caller opens an obligation before calling
+ * this, and the assurance sweep retries any acknowledgement still undelivered
+ * after ASSURANCE_ACK_GRACE_MS.
+ *
+ * @returns {{ sent: boolean, holdingText: string|null }} result
  */
 export async function sendHoldingMessage(item, classResult) {
   const startTime = Date.now();
 
   try {
-    const text = await _generateResponse(item, classResult, true);
-    let sendResult = { sent: false };
+    const text = composeAck(item, classResult);
 
     if (item.service === "slack") {
       const channel = resolveSlackChannel(item);
-      if (channel) {
-        // Check sent-message registry for duplicates
-        const threadTs = item.thread_id || null;
-        const dupCheck = checkRecentlySent(channel, threadTs, "holding");
-        if (!dupCheck.allowed) {
-          console.log(`[responder] Holding message blocked by sent-registry: ${dupCheck.reason}`);
-          logResponse({ type: "holding_dedup_blocked", sender: item.sender, reason: dupCheck.reason });
-          counters.bump("send.blocked", { stage: "dedup", service: "slack", kind: "holding", reason: dupCheck.reason });
-          return { sent: false, holdingText: null, blocked: true, reason: dupCheck.reason };
-        }
-
-        await sendSlackMessage(channel, text, threadTs);
-        registerSent(channel, threadTs, "holding", "quick-responder", text.substring(0, 100));
-        sendResult = { sent: true, channel, via: "slack_api" };
-      } else {
+      if (!channel) {
         console.warn(`[responder] Could not resolve Slack channel for holding msg to ${item.sender} (channel: ${item.channel}, raw_ref: ${item.raw_ref})`);
+        logResponse({ type: "holding_message_error", sender: item.sender, error: "no_channel_id" });
+        return { sent: false, holdingText: null, error: "no_channel_id" };
       }
-    } else if (item.service === "gmail") {
-      const gmailResult = await sendGmailResponse(item, text);
-      sendResult = { sent: gmailResult.sent, via: gmailResult.via, ...(gmailResult.draft_path ? { draft_path: gmailResult.draft_path } : {}), ...(gmailResult.to ? { to: gmailResult.to } : {}) };
-    } else if (item.service === "cohort") {
-      const orgResult = await sendCohortReply(item, text);
-      sendResult = { sent: orgResult.sent, via: orgResult.via, ...(orgResult.error ? { error: orgResult.error } : {}) };
+      const dupCheck = checkRecentlySent(channel, item.thread_id || null, "holding");
+      if (!dupCheck.allowed) {
+        console.log(`[responder] Holding message blocked by sent-registry: ${dupCheck.reason}`);
+        logResponse({ type: "holding_dedup_blocked", sender: item.sender, reason: dupCheck.reason });
+        counters.bump("send.blocked", { stage: "dedup", service: "slack", kind: "holding", reason: dupCheck.reason });
+        return { sent: false, holdingText: null, blocked: true, reason: dupCheck.reason };
+      }
+    }
+
+    // Bounded retry on the SEND (not on any generation — there isn't any). A
+    // courtesy message that gives up on one dropped socket is how silence
+    // happens; ~3 seconds of retry in front of a waiting human is proportionate.
+    const delivered = await deliverWithRetry(item, text, { kind: "ack" });
+    const sendResult = {
+      sent: delivered.sent,
+      via: delivered.via,
+      ...(delivered.channel ? { channel: delivered.channel } : {}),
+      ...(delivered.error ? { error: delivered.error } : {}),
+    };
+
+    if (delivered.sent && item.service === "slack") {
+      registerSent(resolveSlackChannel(item), item.thread_id || null, "holding", "quick-responder", text.substring(0, 100));
+    }
+    if (delivered.sent) {
+      // The holding message never emitted `sent` and never logged an interaction,
+      // so an acknowledgement was invisible to the trace chain AND to the
+      // session's own memory of the conversation. Both now happen.
+      emitEvent({
+        type: EVENT_TYPES.SENT,
+        trace_id: item.trace_id || undefined,
+        attrs: { service: item.service, channel: delivered.channel || null, via: "holding" },
+      });
+      logInteraction(item, text, { classification: "holding" });
     }
 
     const duration = Date.now() - startTime;
     logResponse({
-      type: "holding_message",
+      type: delivered.sent ? "holding_message" : "holding_message_error",
       sender: item.sender,
       service: item.service,
       duration_ms: duration,
       text_length: text.length,
+      generated: false,
+      attempts: delivered.attempts || 1,
       ...sendResult,
     });
 
@@ -898,6 +948,9 @@ export async function sendHoldingMessage(item, classResult) {
     return { sent: sendResult.sent, holdingText: text, ...sendResult };
 
   } catch (err) {
+    // Unreachable in practice — deliverWithRetry does not throw — but a silent
+    // catch here is exactly the bug being fixed, so it stays loud and the text
+    // is still returned so the session prompt knows what was (not) said.
     console.error(`[responder] Holding message failed for ${item.sender}:`, err.message);
     logResponse({ type: "holding_message_error", sender: item.sender, error: err.message });
     return { sent: false, holdingText: null, error: err.message };