Harden heartbeat into forced timeout updates

HEARTBEAT.md

@@ -13,6 +13,7 @@
 #   2) CURRENT_STATE.md
 #   3) known blockers (launch/model/auth/tool/path/scope/policy/external)
 # - Then send a real user-visible status update (who / status / output / next).
+# - IMPORTANT: if there is still no fresh evidence, you must still send a timeout update using plain truth (`blocked`, `launch failure`, `no change`, or the exact blocker). Do not stay silent waiting for a better answer.
 # - After sending the update, treat the timer as reset from now.
 # - If the project state is `done`, `paused`, `failed`, or `cancelled`, do not send heartbeat progress nudges.
 #

memory/project-heartbeat-state.json

@@ -1,14 +1,15 @@
 {
   "version": 1,
   "activeProject": {
-    "name": "Geopolitical Turbulence Trapper restart",
+    "name": "ACP + Codex smoke test",
     "state": "armed",
-    "timeoutMin": 10,
-    "lastUserVisibleUpdateAt": "2026-03-09T07:04:00+10:00",
-    "lastCheckAt": "2026-03-09T07:04:00+10:00",
+    "timeoutMin": 15,
+    "lastUserVisibleUpdateAt": "2026-03-09T12:58:00+10:00",
+    "lastCheckAt": "2026-03-09T12:58:00+10:00",
     "trackedWorkers": [
-      "main"
+      "main",
+      "codex (ACP)"
     ],
-    "notes": "Tao approved restarting the project at 07:04 under the new evidence-gated workflow. Restart begins in dispatching state, with main owning the Milestone 2 restart directly instead of pretending delegated workers are active. Upgrade only after fresh visible execution evidence appears; otherwise mark blocked on launch/stall rather than sending empty progress updates."
+    "notes": "Tao approved trying a harder anti-silence rule. This project is now the active heartbeat test. If 15 minutes pass without fresh ACP execution evidence, main must still send a user-visible timeout update with blocked/no-change/plain blocker wording instead of staying silent. Current known blocker: acpx non-interactive permissions likely block writes/exec in ACP smoke tests."
   }
 }

skills/project-heartbeat/SKILL.md

@@ -67,6 +67,24 @@ If 10 minutes pass with no meaningful update while the project is active:
 4. send a user-visible update
 5. return to `armed` if still active, else `closed`
 
+## Hard anti-silence rule
+This is stricter than a reminder.
+
+If the timeout window expires and there is still no fresh execution evidence, main must still send a user-visible update.
+
+Allowed timeout updates when there is no new evidence:
+- `blocked`
+- `launch failure`
+- `no change`
+- `still waiting on <specific blocker>`
+
+Disallowed timeout behavior:
+- saying nothing
+- waiting for a "more complete" answer before updating Tao
+- reusing old optimistic wording like `in_progress` without fresh evidence
+
+Silence after timeout is itself a process failure.
+
 ## Worker check order
 When timeout fires, check in this order:
 1. worker session history / visible traces