I've applied patches to the main daily digest shell script and the Python collection scripts to redirect output to `/dev/null` or drastically minimize logs to prevent console noise from leaking into the Telegram thread (especially when `deliver: origin` is configured).

Now, let's review the cron job configuration (`/root/.hermes/cron/jobs.json`).
The cron jobs `Brand_Daily_Digest` and `Brand_Weekly_Report` currently have:
`"deliver": "origin"`

If they run, any remaining stdout/stderr output from the script execution (including the shell script execution logs, errors, or simple messages) gets sent to the `origin` thread. The origin defined for both jobs is:
```json
      "origin": {
        "platform": "telegram",
        "chat_id": "-1003707758328",
        "chat_name": "NV-Office",
        "thread_id": "20",
        "user_id": "5566792903"
      }
```
Wait! The origin thread is `"20"`. If the cron jobs are delivering stdout/stderr to `"origin"`, they are delivering to thread **20**!
However, the user complains about "intermediate updates are appearing in the wrong thread. Implement or specify the code changes needed so only final digest/announcement messages go to thread 3688, and all other work stays silent."

If thread 3688 is the brand monitoring thread, the intermediate updates are either:
1. Appearing in thread 3688 (maybe because the cron runner or some trigger occurred from 3688, changing the dynamic "origin"? No, `origin` in `jobs.json` is hardcoded to thread 20).
2. Or did they mean that intermediate updates were appearing in thread 20, or did they mean that the cron job output is somehow ending up in thread 3688?
Wait, if `alert_dispatcher.py` target is loaded from `report.yaml`:
```yaml
channels:
  alerts:
    type: telegram
    chat_id: "-1003707758328"
    thread_id: "3688"
```
Then `alert_dispatcher.py` sends the final digest to thread 3688.
Does any other script in the workflow send to Telegram?
Let's check `sentinel_check.py` and `run_collection.py`.
`sentinel_check.py` and `run_collection.py` both call `alert_dispatcher.py` via `subprocess.run`.
Does `alert_dispatcher.py` print anything to stdout? Yes:
```python
    success, output = send_to_telegram(target, message)
    ...
    if success:
        ...
        print(f"SENT digest covering {len(ids)} alerts")
        print(output)
        return
```
And if the cron job `Brand_Daily_Digest` runs, it runs `/root/.hermes/scripts/brand_daily_digest.sh`.
If the cron job has `"deliver": "origin"`, and `origin`'s `thread_id` is `"20"`, then it delivers the stdout to thread 20. But the user says:
"Implement or specify the code changes needed so only final digest/announcement messages go to thread 3688, and all other work stays silent."
Wait! Maybe the cron job was originally scheduled or triggered from thread 3688? No, the `jobs.json` has `origin.thread_id = "20"`. However, if the user triggered it from 3688, the "origin" might have changed, or the cron runner might deliver it differently. Or, if they want "all other work to stay silent", they literally want no other Telegram messages sent except the final announcements to thread 3688.
Wait! Let's check `jobs.json` again.
If `"deliver": "origin"`, it will send a message on success/failure to the origin thread.
If we change `"deliver"` to `"local"`, or if the scripts are completely silent, then the cron job will only send if there is an error, or we can configure it to be silent.
Actually, in Hermes, if `"deliver"` is `"local"`, it does not send the stdout/stderr to Telegram at all; it just keeps it in the cron log (`/root/.hermes/cron/output/`). If it's `"none"`, or `"local"`. Let's check the schema for `"deliver"`.
Wait, looking at `notebooklm-auth-refresh`:
`"deliver": "local"`
Looking at `git-auto-sync`:
`"deliver": "origin"`

If we set `deliver` to `"local"` for `Brand_Daily_Digest` and `Brand_Weekly_Report`, then

[NOTE: subagent modified files the parent previously read — re-read before editing: /opt/ai-os/products/ceo/brand-monitoring/shared/workflows/collect_rss.py, /opt/ai-os/products/ceo/brand-monitoring/shared/workflows/collect_social.py, /opt/ai-os/products/ceo/brand-monitoring/shared/workflows/pipeline.py, /root/.hermes/scripts/brand_daily_digest.sh]