Scope

The rules bind HARNESS-GENERATED notices only: messages the app itself writes
into an inbox. They never touch a message an agent wrote by hand.

All worker and spawn notices go through informGod (src/main/index.ts).

Left out on purpose, each named:

• Agent-authored mail: routeOnce (src/main/hive.ts) to
  routeMessage to deliver. Untouched.
• God's spawn objective to a new worker (src/main/index.ts): that is a
  dispatch, not a notice.
• Scheduler missions (src/main/index.ts): operator-configured recurring
  requests; a signature would kill every repeat of a standup by design.
• Webhook and Slack inbound (src/main/index.ts, the webhook hive.send
  after addTask): a human's message.
• Closing time (src/main/closingTime.ts): an operator
  flow that waits for ACKs.
• ASK-ME answers and spawn requests: unchanged.
• Condense-abort (src/main/reflect.ts): it is a log.jsonl event only
  and never reaches an inbox today, so there is nothing to gate. If it ever
  becomes a notice, it takes kind condense with key <agentId>:<reason>.

HiveManager.send (src/main/hive.ts) keeps its behaviour: the gate is a
NEW method beside it, sendNotice, and only the call sites above move to it.

Where the state lives

One file under the hive root: <hive>/notice-ledger.json, written atomically
(tmp file, rename). Never renderer state.

{ "version": 1,
  "delivered": { "<agentId>": { "<signature>": { "at": "<iso>", "ctx": ["..."] } } },
  "deferred": [ { "to": "<agentId>", "sig": "...", "notice": {}, "payload": {}, "from": "breaker", "at": "<iso>" } ] }

• An entry older than 30 days (NOTICE_LEDGER_TTL_MS) is pruned on load AND
  before every write. Until then the set stays small for two
  reasons. A heartbeat or breaker signature leaves on re-arm. A worker or
  spawn signature carries a worker id or a request file, so there are at most
  as many as there were workers and requests in 30 days.
• At most 50 held notices per recipient (NOTICE_DEFER_CAP). The oldest is
  evicted and logged.
• If the ledger is corrupt or unwritable, delivery goes on. The worst case is
  one repeated notice; an agent's message is never lost.
• The gate follows root, so a changed harness home gets its own ledger.
• Every verdict except deliver is logged to log.jsonl as kind notice:
  duplicate, defer, dead, evicted or rearmed, with its signature.

Signature per notice kind

The signature is <kind>:<key>, kept per recipient.

The reason class is the breaker reason with its figures removed: the text
before the first colon, digits stripped, lower case (breakerReasonClass).
So "looping: 7x" and "looping: 9x" are one finding, and "error storm" is a
different one.

The four rules and their hook points

Rule 1: signature dedup, persisted

• Gate: NoticeGate.decide returns duplicate when the signature is on the
  ledger for that recipient or is already held for it.
  NoticeGate.markDelivered records it after the send.
• Hook: HiveManager.sendNotice, a new method placed right after send
  (src/main/hive.ts).
• Survives a restart: the ledger is a file. The breaker's own escalation latch
  (src/main/breaker.ts, tick) is in memory and starts healthy after a
  restart, which is where a repeat came from.

Rule 2: re-arm only once the condition is cleared

• Gate: NoticeGate.rearm(to, kind, cleared) drops a signature only when the
  caller's predicate says its condition is gone. There is no timer.
• The same call also drops a HELD notice of that kind whose condition cleared
  while it waited. Example: a steer held while the agent waited on
  the human, after the agent has turned healthy again. It is dropped, never
  delivered as stale news.
• Hooks:
  • heartbeat: in reengageGod (src/main/index.ts), before the send,
    measured against god's live inbox;
  • breaker: in runBreakerBeat, just before if (d.action === 'none') continue; (src/main/index.ts), on d.state.level === 'healthy';
  • worker: after liveWorkers.set (src/main/index.ts).

Rule 3: defer non-urgent notices while the recipient waits for input

• "Waiting" is known in the main process already. HookServer feeds every hook
  boundary to its observer (src/main/hooks.ts). The observer now also
  gets tool_name, the only change in hooks.ts.
• WaitTracker (new, in src/main/noticeGate.ts) marks an agent waiting
  when:
  • a Notification that classifyHook (src/main/workerWake.ts) calls
    needsHuman arrives, which is a permission prompt;
  • or a PreToolUse of AskUserQuestion arrives, which is an open question.
• The wait clears on:
  • the next PostToolUse, UserPromptSubmit, Stop, SubagentStop,
    SessionStart or PreCompact;
  • a PreToolUse of any other tool;
  • forget at PTY teardown, beside workerWake.forget
    (src/main/index.ts);
  • a Notification of class idle. This is the exit when a
    prompt or question is closed with Esc, which sends no PostToolUse. The
    agent then sits at the idle prompt, so a held notice cannot wait for the
    next prompt or a restart.
• The idle prompt ("waiting for your input" after a finished turn) is NOT a
  wait: that agent is free.
• Unlike the watchdog's five-minute window (WORKER_WAKE_HITL_REARM_MS,
  src/main/workerWake.ts), the wait ends on evidence, not on a clock.
• Wiring: waitTracker sits beside workerWake (src/main/index.ts).
  The HookServer observer feeds both.
  hive.setWaitingProbe(id => waitTracker.isWaiting(id)) connects it.
• Release: hive.flushNotices at the top of runWorkerWakeBeat
  (src/main/index.ts). That is before the nudge pass, so a released
  notice is announced in the same beat.
• Urgent goes anyway: only breaker constrain is urgent. It is written into the
  inbox at once. The typed wake nudge still keeps its own HITL guard
  (WorkerWakeWatchdog.decide, and the renderer's guarded queue), so nothing
  is ever typed into an open permission dialog. That guard is unchanged.
• A held notice is sent later byte for byte as it was built (subject, body,
  sender). It gets its message id when it is sent.

Rule 4: nothing to dead sessions

• "Dead" comes from the registry (hive.noticeFacts). The recipient is dead
  when it is missing from registry.agents or has archived: true
  (src/main/hive.ts; setArchived at teardown and on a closed tab).
• God is never dead: god is the bounce target and the human's proxy. This
  holds for the registry's godId and for the literal god, also before any
  god is registered.
• A dead notice is dropped and logged. It is NOT bounced to god: a notice
  about a dead agent's loop is not news for anyone.
• A held notice whose recipient died while it waited is dropped at
  flushNotices and logged with held: true.
• Unchanged: an agent's own mail to an unknown id still bounces to god
  (routeMessage, src/main/hive.ts).

What must not change (and the test that holds it)

• Agent-authored mail is delivered exactly once and unchanged. The test sends
  two outbox messages with the same subject, while god counts as waiting and a
  heartbeat is held. Both arrive with their body and subject intact, and a
  second routeOnce routes 0.
• HiveManager.send stays ungated. The test sends the same request twice:
  two inbox files, and no ledger is created.
• No change to:
  • the ASK-ME flow, spawn requests and spawn objectives;
  • scheduler missions, webhook, Slack and closing time;
  • the hop cap, the bounces and the message log.
• The breaker's levels and actions are unchanged; only the delivery of its
  steer and constrain text is gated. A stop still kills the PTY.
• The heartbeat cadence and back-off are unchanged. A suppressed heartbeat
  still backs off, as a sent one does.
• Message texts are unchanged: same subjects, same bodies.

Tests

test/notice-gate.test.cjs adds 23 tests in the fork's own harness
(node --test, test/load-ts.cjs). They cover each rule on the pure gate, each
rule on a real HiveManager floor in a temp home (restart included), the
WaitTracker classifications, and the two boundary tests above. Each of the five
follow-up assertions (the Esc exit, a PreToolUse of another tool clearing the wait, the
held drop, prune before a write, god never dead) goes red when its fix line is
removed.