switchroom 0.18.28 → 0.18.29

package/telegram-plugin/gateway/turn-record-status.ts

@@ -79,6 +79,51 @@ export function backstopSendOutcome(args: {
   return 'delivered'
 }
 
+/**
+ * Resolve a backstop send's outcome using the #3276 RECEIPT gate: success
+ * requires at least one FRESH, non-card chat message id. This supersedes the
+ * naive chunk-count comparison for the turn-flush backstop, where a delivery
+ * that landed only onto the (soon-swept) progress card must count as a failure,
+ * not `complete`.
+ *
+ *   threw                              → failed
+ *   no fresh non-card id delivered     → failed  (card-only "success")
+ *   fewer fresh ids than chunks split  → failed  (partial delivery)
+ *   >=1 fresh id AND all chunks landed → delivered
+ *
+ * `cardMessageId` is the taken-over progress-card id (or null); any id equal to
+ * it is excluded from the delivered set before counting.
+ */
+export function backstopSendOutcomeGated(args: {
+  threw: boolean
+  sentIds: readonly number[]
+  chunkCount: number
+  cardMessageId: number | null
+}): DeliveryOutcome {
+  if (args.threw) return 'failed'
+  if (args.chunkCount === 0) return 'failed'
+  const freshCount = args.sentIds.filter(
+    id => args.cardMessageId == null || id !== args.cardMessageId,
+  ).length
+  // Guard 7: a card-only delivery (zero fresh ids) is a hard failure.
+  if (freshCount === 0) return 'failed'
+  if (freshCount < args.chunkCount) return 'failed'
+  return 'delivered'
+}
+
+/**
+ * Stamp a turn's `deliveryOutcome` from a resolved backstop send using the
+ * #3276 receipt gate (fresh non-card ids only). Mutates and returns the outcome.
+ */
+export function finalizeBackstopSendGated(
+  turn: { deliveryOutcome?: DeliveryOutcome },
+  send: { threw: boolean; sentIds: readonly number[]; chunkCount: number; cardMessageId: number | null },
+): DeliveryOutcome {
+  const outcome = backstopSendOutcomeGated(send)
+  turn.deliveryOutcome = outcome
+  return outcome
+}
+
 /**
  * Stamp a turn's `deliveryOutcome` from a resolved backstop send. This is the
  * exact accounting the turn-flush IIFE's `finally` performs — factored here so

package/telegram-plugin/history.ts

@@ -142,6 +142,40 @@ const MAX_LIMIT = 50
 let db: SqliteDatabase | null = null
 let dbPath: string | null = null
 
+/**
+ * Loud, unconditional failure logging for the history writer.
+ *
+ * Recording bugs are silent by construction: every gateway call site wraps
+ * `recordOutbound` / `recordInbound` in a `try { … } catch {}` (or a catch that
+ * logs a caller-shaped message), and several of those catches are EMPTY. When a
+ * write throws or drops a row, the caller's empty catch hides it — the exact
+ * failure mode behind the 2026-07-16 incident (turn-flush deliveries 18944 /
+ * 18958 delivered to Telegram but absent from history.db, blinding
+ * `getRecentOutboundCount` / `hasOutboundDeliveredSince`). We therefore log HERE,
+ * inside the writer, BEFORE any throw — so even a caller's `catch {}` cannot
+ * suppress the diagnostic. Deterministic surfacing, not prompt discipline.
+ */
+function warnHistory(msg: string): void {
+  try {
+    process.stderr.write(`telegram history: ${msg}\n`)
+  } catch {
+    /* stderr write must never itself break the record path */
+  }
+}
+
+/**
+ * A Telegram message_id is a positive 32-bit-ish integer. A null / undefined /
+ * NaN / non-integer id can only arrive from a malformed send result (e.g. an
+ * API wrapper that resolved without a real message object). Inserting it either
+ * violates the NOT NULL PRIMARY KEY (throws → swallowed by an empty caller
+ * catch) or silently corrupts the key space. We filter such ids out and log
+ * loudly instead — a delivered-but-unrecorded row is a durability defect the
+ * operator must see, not a silent drop.
+ */
+function isValidMessageId(id: unknown): id is number {
+  return typeof id === 'number' && Number.isInteger(id) && id > 0
+}
+
 /**
  * Open (or create) the history DB and run migrations + retention sweep.
  * Idempotent — safe to call once at server startup.
@@ -271,6 +305,72 @@ export function initHistory(stateDir: string, retentionDays = 30): void {
     const cutoff = Math.floor(Date.now() / 1000) - retentionDays * 86400
     db.prepare('DELETE FROM messages WHERE ts < ?').run(cutoff)
   }
+
+  // Boot-time writer self-check (2026-07-16 incident hardening). "history
+  // capture enabled" was logged at every boot — including the 02:17 and 04:58
+  // restarts around the incident — yet a whole class of deliveries never
+  // reached the DB. A successful `new Database(...)` + schema DDL does NOT prove
+  // the row-insert path is functional (a read-only mount, a full disk, an
+  // orphaned inode after an in-place dir replace, or a corrupt page all pass DDL
+  // but fail INSERT). So we prove it with a real INSERT + SELECT + DELETE
+  // round-trip on a sentinel row, and log LOUDLY if it fails. This turns a
+  // silent, hours-later-discovered writer outage into a deterministic boot
+  // signal the operator can see immediately.
+  const check = verifyHistoryWritable()
+  if (!check.ok) {
+    warnHistory(
+      `WRITER SELF-CHECK FAILED at boot (path=${path}): ${check.error ?? 'unknown'} — ` +
+        `history recording is NOT durable; get_recent_messages recovery and the ` +
+        `reply-backstop already-replied suppression will be blind. Investigate the ` +
+        `DB path/mount/permissions before trusting delivery accounting.`,
+    )
+  }
+}
+
+/**
+ * Prove the history writer's INSERT path actually works, not just that the DB
+ * opened and the schema DDL ran. Performs a real INSERT + SELECT + DELETE of a
+ * sentinel row keyed on a reserved chat_id that no live chat can collide with,
+ * and cleans it up unconditionally. Returns `{ ok:false, error }` (never throws)
+ * so the boot path and an operator self-check tool can both call it safely.
+ *
+ * This is the deterministic mechanism the 2026-07-16 incident lacked: a
+ * writer that opens fine but cannot persist rows (read-only mount, full disk,
+ * orphaned inode, corruption) is caught HERE at boot instead of being inferred
+ * hours later from missing rows.
+ *
+ * No-op safe: returns `{ ok:false }` with an explanatory error if
+ * `initHistory` was never called.
+ */
+export function verifyHistoryWritable(): { ok: boolean; error?: string } {
+  if (db == null) return { ok: false, error: 'initHistory() not called' }
+  const SENTINEL_CHAT = '__history_selfcheck__'
+  const sentinelId = Date.now()
+  try {
+    // Clear any stale sentinel from a prior crashed self-check first.
+    db.prepare('DELETE FROM messages WHERE chat_id = ?').run(SENTINEL_CHAT)
+    db.prepare(
+      `INSERT OR REPLACE INTO messages
+         (chat_id, thread_id, message_id, role, ts, text)
+       VALUES (?, NULL, ?, 'assistant', ?, ?)`,
+    ).run(SENTINEL_CHAT, sentinelId, Math.floor(Date.now() / 1000), 'selfcheck')
+    const row = db
+      .prepare('SELECT text FROM messages WHERE chat_id = ? AND message_id = ?')
+      .get(SENTINEL_CHAT, sentinelId) as { text?: string } | undefined
+    if (row?.text !== 'selfcheck') {
+      return { ok: false, error: 'sentinel row not read back after insert' }
+    }
+    return { ok: true }
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) }
+  } finally {
+    // Never leave the sentinel behind, even if the SELECT/assert path threw.
+    try {
+      db.prepare('DELETE FROM messages WHERE chat_id = ?').run(SENTINEL_CHAT)
+    } catch {
+      /* best-effort cleanup */
+    }
+  }
 }
 
 /**
@@ -404,6 +504,13 @@ interface RecordInboundArgs {
  */
 export function recordInbound(args: RecordInboundArgs): void {
   if (args.message_id == null) return
+  if (!isValidMessageId(args.message_id)) {
+    warnHistory(
+      `recordInbound: dropping row with invalid message_id=${String(args.message_id)} ` +
+        `(chat=${args.chat_id}) — a delivered inbound will be absent from history`,
+    )
+    return
+  }
   const stmt = requireDb().prepare(`
     INSERT OR REPLACE INTO messages
       (chat_id, thread_id, message_id, role, user, user_id, ts, text, attachment_kind, group_id, reply_to_message_id, reply_to_text, forwarded_from, forwarded_from_type, forwarded_from_id, forwarded_date, forwarded_message_id)
@@ -453,7 +560,35 @@ interface RecordOutboundArgs {
 export function recordOutbound(args: RecordOutboundArgs): void {
   if (args.message_ids.length === 0) return
   const ts = args.ts ?? Math.floor(Date.now() / 1000)
-  const groupId = args.message_ids[0]!
+  // Filter out invalid ids (null/undefined/NaN/non-positive) BEFORE the insert.
+  // A malformed send result (an API wrapper that resolved without a real message
+  // object) would otherwise inject a NULL/NaN message_id: the NOT NULL PRIMARY
+  // KEY throws, and the caller's `catch {}` swallows it — the delivered reply is
+  // then absent from history AND the failure is invisible. This was the shape of
+  // the 2026-07-16 turn-flush loss (18944/18958 delivered, never recorded). We
+  // log loudly and record only the valid rows instead of losing them silently.
+  const validRows: Array<{ id: number; text: string; attachKind: string | null }> = []
+  for (let i = 0; i < args.message_ids.length; i++) {
+    const id = args.message_ids[i]
+    if (!isValidMessageId(id)) {
+      warnHistory(
+        `recordOutbound: dropping chunk ${i} with invalid message_id=${String(id)} ` +
+          `(chat=${args.chat_id}) — a delivered outbound will be absent from history, ` +
+          `blinding the reply-backstop already-replied suppression`,
+      )
+      continue
+    }
+    validRows.push({
+      id,
+      // Outbound redaction: the agent→user direction has no other secret scrub,
+      // so this is the chokepoint that keeps an agent-echoed secret out of the
+      // message store. Masks the secret bytes in place; surrounding text kept.
+      text: redact(args.texts[i] ?? ''),
+      attachKind: args.attachment_kinds?.[i] ?? null,
+    })
+  }
+  if (validRows.length === 0) return
+  const groupId = validRows[0]!.id
   const stmt = requireDb().prepare(`
     INSERT OR REPLACE INTO messages
       (chat_id, thread_id, message_id, role, user, user_id, ts, text, attachment_kind, group_id)
@@ -463,30 +598,25 @@ export function recordOutbound(args: RecordOutboundArgs): void {
   // writes if the process dies mid-loop. The transaction signature is
   // typed as variadic-unknown for genericity; cast the typed callback
   // through the wider shape.
-  const tx = requireDb().transaction(((rows: Array<[number, string, string | null]>) => {
-    for (const [msgId, text, attachKind] of rows) {
-      stmt.run(
-        args.chat_id,
-        args.thread_id ?? null,
-        msgId,
-        ts,
-        text,
-        attachKind,
-        groupId,
-      )
+  const tx = requireDb().transaction(((rows: Array<{ id: number; text: string; attachKind: string | null }>) => {
+    for (const r of rows) {
+      stmt.run(args.chat_id, args.thread_id ?? null, r.id, ts, r.text, r.attachKind, groupId)
     }
   }) as (...args: unknown[]) => unknown)
-  // Outbound redaction: the agent→user direction has no other secret
-  // scrub, so this is the chokepoint that keeps an agent-echoed secret out
-  // of the message store (e.g. an agent quoting a token it read from a file
-  // or a not-yet-vaulted value). Masks the secret bytes in place; the
-  // surrounding reply text is preserved.
-  const rows: Array<[number, string, string | null]> = args.message_ids.map((id, i) => [
-    id,
-    redact(args.texts[i] ?? ''),
-    args.attachment_kinds?.[i] ?? null,
-  ])
-  tx(rows)
+  // Surface a write failure LOUDLY before rethrowing. Callers wrap this in a
+  // `catch {}` / caller-shaped catch; without this log an insert failure (disk
+  // full, read-only mount, lock exhaustion) would be completely invisible —
+  // exactly the diagnostic gap the 2026-07-16 incident exposed. Rethrow so the
+  // caller's existing control flow is unchanged.
+  try {
+    tx(validRows)
+  } catch (err) {
+    warnHistory(
+      `recordOutbound: INSERT failed (chat=${args.chat_id} ids=[${validRows.map((r) => r.id).join(',')}]): ` +
+        `${err instanceof Error ? err.message : String(err)} — this outbound will be absent from history`,
+    )
+    throw err
+  }
 }
 
 interface RecordEditArgs {

package/telegram-plugin/shared/local-time.ts

@@ -67,3 +67,59 @@ export function tzAbbrev(ms: number, tz: string): string {
       .find((p) => p.type === 'timeZoneName')?.value ?? tz
   )
 }
+
+/**
+ * Resolve the agent's configured timezone from the process environment, the
+ * SAME cascade `bin/timezone-hook.sh` and the config resolver use:
+ * `SWITCHROOM_TIMEZONE` → `TZ` → `UTC`. Centralised so the inbound-tag,
+ * forwarded_date, and recent-buffer callsites can't drift.
+ */
+export function resolveEnvTimezone(env: NodeJS.ProcessEnv = process.env): string {
+  return env.SWITCHROOM_TIMEZONE ?? env.TZ ?? 'UTC'
+}
+
+/**
+ * Full model-facing local wall-clock stamp, e.g.
+ * `Thursday 2026-07-16 04:09 PM AEST`.
+ *
+ * The deterministic replacement for the UTC ISO strings the model used to see
+ * on inbound channel tags (`ts="…Z"`), `forwarded_date`, and the
+ * `get_recent_messages` buffer. am/pm form in the agent's CONFIGURED timezone,
+ * with NO "UTC" / trailing-Z — so the LLM can never read one of these as UTC
+ * "now" and reason an offset wrong.
+ *
+ * Format matches the CORE of `bin/timezone-hook.sh`'s stamp —
+ * `%A %Y-%m-%d %I:%M %p %Z` (weekday, ISO date, am/pm, zone abbrev) — so the
+ * inbound-tag time and the UserPromptSubmit local-time hint read the same way.
+ * The hook additionally appends a ` (UTC±HH:MM)` numeric-offset LABEL that this
+ * helper deliberately omits: the abbrev (AEST/EDT) already disambiguates, and
+ * keeping the output free of any "UTC" substring makes the deterministic
+ * no-UTC-current-time guard trivially strict for every callsite. So it is NOT
+ * a byte-for-byte match — same core shape, minus the offset tail.
+ *
+ * Pure / total: an invalid IANA `tz` (misconfigured agent) degrades to the
+ * same am/pm shape rendered in UTC rather than throwing out of the inbound
+ * path — a bad zone must never crash a turn.
+ */
+export function fmtLocalStamp(ms: number, tz: string): string {
+  try {
+    const at = new Date(ms)
+    const weekday = new Intl.DateTimeFormat('en-US', {
+      timeZone: tz,
+      weekday: 'long',
+    }).format(at)
+    // localDay (en-CA) yields YYYY-MM-DD and throws first on a bad zone.
+    const date = localDay(ms, tz)
+    const time = new Intl.DateTimeFormat('en-US', {
+      timeZone: tz,
+      hour: '2-digit',
+      minute: '2-digit',
+      hour12: true,
+    }).format(at) // "04:09 PM"
+    return `${weekday} ${date} ${time} ${tzAbbrev(ms, tz)}`
+  } catch {
+    // Invalid IANA zone — degrade to am/pm in UTC rather than crash the turn.
+    if (tz !== 'UTC') return fmtLocalStamp(ms, 'UTC')
+    return new Date(ms).toISOString()
+  }
+}

package/telegram-plugin/tests/backstop-delivery.test.ts

@@ -0,0 +1,250 @@
+import { describe, expect, it, vi } from 'vitest'
+
+import {
+  BackstopDeliveryLedger,
+  backstopReceiptIds,
+  backstopDelivered,
+  runBackstopDelivery,
+} from '../gateway/backstop-delivery.js'
+import {
+  backstopSendOutcomeGated,
+  finalizeBackstopSendGated,
+  computeTurnStatus,
+} from '../gateway/turn-record-status.js'
+
+/**
+ * #3276 — the turn-flush backstop delivered by editing the ephemeral progress
+ * card and counted that card-edit id as an answer delivery, so the turn record
+ * said `complete` while the card was GC'd and nothing durable reached the chat.
+ *
+ * These assert the deterministic OUTCOMES the fix guarantees:
+ *  - a delivered answer is a FRESH non-card chat id (guard 7),
+ *  - `complete` IFF such an id exists; card-only "success" ⇒ `send_failed`,
+ *  - a per-turn backstop double-fire latch (guard 5),
+ *  - a bounded retry resumes mid-chunk and never re-sends chunk 0 (guard 6),
+ *  - terminal failure reports `delivered:false` so the caller leaves the
+ *    delivery obligation OPEN (finding 1).
+ */
+
+describe('guard 7 — receipt gate: a delivered answer is a FRESH non-card chat id', () => {
+  it('primary: a fresh chat id is recorded whose id ≠ any card id', () => {
+    const cardId = 500
+    const sentIds = [777] // a fresh sendMessage id, not the card
+    const fresh = backstopReceiptIds(sentIds, cardId)
+    expect(fresh).toEqual([777])
+    expect(fresh).not.toContain(cardId)
+    expect(backstopDelivered(sentIds, cardId)).toBe(true)
+  })
+
+  it('card-present: the delivered id excludes backstopCardMessageId', () => {
+    const cardId = 18944
+    // The pre-fix backstop pushed the card id into sentIds via editMessageText.
+    const raw = [18944]
+    expect(backstopReceiptIds(raw, cardId)).toEqual([])
+    expect(backstopDelivered(raw, cardId)).toBe(false)
+  })
+
+  it('mixed: only the fresh ids survive the gate', () => {
+    const cardId = 18944
+    expect(backstopReceiptIds([18944, 18950, 18951], cardId)).toEqual([18950, 18951])
+  })
+})
+
+describe('status honesty — complete IFF a real non-card id exists', () => {
+  it('card-only delivery ⇒ send_failed, never complete', () => {
+    const cardId = 18944
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: false,
+      sentIds: [18944], // only the card was edited
+      chunkCount: 1,
+      cardMessageId: cardId,
+    })
+    expect(turn.deliveryOutcome).toBe('failed')
+    expect(computeTurnStatus(turn)).toBe('send_failed')
+  })
+
+  it('fresh chat id delivered ⇒ complete', () => {
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: false,
+      sentIds: [18950],
+      chunkCount: 1,
+      cardMessageId: 18944,
+    })
+    expect(turn.deliveryOutcome).toBe('delivered')
+    expect(computeTurnStatus(turn)).toBe('complete')
+  })
+
+  it('partial multi-chunk (fewer fresh ids than chunks) ⇒ send_failed', () => {
+    expect(
+      backstopSendOutcomeGated({ threw: false, sentIds: [18950], chunkCount: 2, cardMessageId: null }),
+    ).toBe('failed')
+  })
+
+  it('throw ⇒ failed regardless of ids', () => {
+    expect(
+      backstopSendOutcomeGated({ threw: true, sentIds: [18950], chunkCount: 1, cardMessageId: null }),
+    ).toBe('failed')
+  })
+
+  it('empty split (0 chunks) ⇒ failed, not delivered', () => {
+    expect(
+      backstopSendOutcomeGated({ threw: false, sentIds: [], chunkCount: 0, cardMessageId: null }),
+    ).toBe('failed')
+  })
+})
+
+describe('guard 5 — once-per-turn backstop double-fire latch', () => {
+  it('claim returns true exactly once per turnId', () => {
+    const ledger = new BackstopDeliveryLedger()
+    expect(ledger.claim('#18925')).toBe(true)
+    expect(ledger.claim('#18925')).toBe(false)
+    // A different turn is independent.
+    expect(ledger.claim('#18929')).toBe(true)
+  })
+
+  it('release re-opens the latch after a terminal failure', () => {
+    const ledger = new BackstopDeliveryLedger()
+    ledger.claim('#t')
+    ledger.release('#t')
+    expect(ledger.claim('#t')).toBe(true)
+  })
+})
+
+describe('guard 6 — per-chunk idempotency ledger: retry never re-sends chunk 0', () => {
+  it('resumes at the first unsent chunk after a partial send', () => {
+    const ledger = new BackstopDeliveryLedger()
+    const turnId = '#partial'
+    const chunkCount = 3
+    ledger.markPending(turnId, 0)
+    ledger.recordChunk(turnId, 0, [1001])
+    ledger.markPending(turnId, 1)
+    ledger.recordChunk(turnId, 1, [1002])
+    ledger.markPending(turnId, 2) // in-flight, never acked
+
+    expect(ledger.hasChunk(turnId, 0)).toBe(true)
+    expect(ledger.hasChunk(turnId, 1)).toBe(true)
+    expect(ledger.hasChunk(turnId, 2)).toBe(false)
+    expect(ledger.unsentIndices(turnId, chunkCount)).toEqual([2])
+
+    ledger.recordChunk(turnId, 2, [1003])
+    expect(ledger.sentIds(turnId)).toEqual([1001, 1002, 1003])
+    expect(ledger.sentIds(turnId)[0]).toBe(1001)
+  })
+
+  it('sentIds are returned in chunk-index order regardless of record order', () => {
+    const ledger = new BackstopDeliveryLedger()
+    ledger.recordChunk('#o', 2, [3])
+    ledger.recordChunk('#o', 0, [1])
+    ledger.recordChunk('#o', 1, [2])
+    expect(ledger.sentIds('#o')).toEqual([1, 2, 3])
+  })
+
+  it('entries() zip a resplit chunk (2 ids for 1 input chunk) in order', () => {
+    const ledger = new BackstopDeliveryLedger()
+    ledger.recordChunk('#z', 0, [10])
+    ledger.recordChunk('#z', 1, [11, 12]) // chunk 1 length-resplit into 2 sends
+    expect(ledger.entries('#z')).toEqual([
+      { index: 0, messageIds: [10] },
+      { index: 1, messageIds: [11, 12] },
+    ])
+  })
+})
+
+/**
+ * Integration oracles over `runBackstopDelivery` — the exact orchestration that
+ * replaced the card-coupled send. It drives the real retry/ledger/receipt code
+ * with an injected `sendChunk`, asserting on what reaches `recordOutbound` and
+ * on the `delivered`/`exhausted` decision the gateway feeds to the obligation
+ * ledger + turn record.
+ */
+describe('runBackstopDelivery — integration oracle over the delivery wiring', () => {
+  it('records a FRESH non-card id in history; delivered=true (#3276 primary)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 18944
+    const recorded: Array<{ ids: number[]; texts: string[] }> = []
+    const sendChunk = vi.fn(async (i: number) => [18950 + i]) // fresh chat ids
+    const res = await runBackstopDelivery(
+      ledger,
+      '#18925',
+      ['the answer'],
+      cardId,
+      { sendChunk, recordOutbound: (ids, texts) => recorded.push({ ids, texts }) },
+    )
+    expect(res.delivered).toBe(true)
+    expect(res.exhausted).toBe(false)
+    expect(recorded).toHaveLength(1)
+    // A real fresh chat id landed in history whose id ≠ the progress-card id.
+    expect(recorded[0].ids).toEqual([18950])
+    expect(recorded[0].ids).not.toContain(cardId)
+    expect(backstopReceiptIds(recorded[0].ids, cardId)).toEqual([18950])
+  })
+
+  it('card-only "delivery" can never happen — the receipt gate excludes the card id', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 18944
+    // Even if a buggy send echoed the card id, the receipt gate drops it.
+    const sendChunk = vi.fn(async () => [cardId])
+    const res = await runBackstopDelivery(ledger, '#c', ['x'], cardId, { sendChunk })
+    expect(res.delivered).toBe(false)
+    expect(res.exhausted).toBe(true)
+  })
+
+  it('retry resumes mid-chunk — chunk 0 is NOT re-sent on attempt 2 (guard 6, finding 1)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const calls: number[] = []
+    let failedOnce = false
+    const sendChunk = vi.fn(async (i: number) => {
+      calls.push(i)
+      if (i === 2 && !failedOnce) {
+        failedOnce = true
+        throw new Error('FLOOD_WAIT_ACTIVE')
+      }
+      return [700 + i]
+    })
+    const res = await runBackstopDelivery(ledger, '#resume', ['c0', 'c1', 'c2'], null, { sendChunk }, 3)
+
+    expect(res.delivered).toBe(true)
+    expect(res.sentIds).toEqual([700, 701, 702])
+    // chunk 0 and 1 sent exactly once; chunk 2 attempted twice (fail, then ok).
+    expect(calls.filter(i => i === 0)).toHaveLength(1) // <-- chunk 0 never re-sent
+    expect(calls.filter(i => i === 1)).toHaveLength(1)
+    expect(calls.filter(i => i === 2)).toHaveLength(2)
+    expect(res.attempts).toBe(2)
+  })
+
+  it('terminal failure ⇒ delivered=false / exhausted=true after maxAttempts (obligation left open)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const sendChunk = vi.fn(async () => { throw new Error('FLOOD_WAIT_ACTIVE') })
+    const res = await runBackstopDelivery(ledger, '#dead', ['only chunk'], null, { sendChunk }, 3)
+    expect(res.delivered).toBe(false)
+    expect(res.exhausted).toBe(true)
+    expect(res.attempts).toBe(3) // exhausted the bounded retry
+    expect(res.sentIds).toEqual([]) // nothing landed
+    // This is the exact input the gateway uses: delivered=false ⇒ it records
+    // send_failed AND leaves the obligation OPEN (noteTurnEnded, not close).
+    expect(backstopSendOutcomeGated({
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: null,
+    })).toBe('failed')
+  })
+
+  it('recordOutbound texts are ALIGNED to sent ids even when a chunk resplits (finding 5)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const recorded: Array<{ ids: number[]; texts: string[] }> = []
+    // chunk 1 lands TWO ids (a length-resplit); a naive chunks.slice zip would
+    // misalign. entries()-based zip repeats the source text per landed id.
+    const sendChunk = vi.fn(async (i: number) => (i === 1 ? [11, 12] : [10]))
+    await runBackstopDelivery(
+      ledger, '#zip', ['A', 'B'], null,
+      { sendChunk, recordOutbound: (ids, texts) => recorded.push({ ids, texts }) },
+    )
+    expect(recorded[0].ids).toEqual([10, 11, 12])
+    expect(recorded[0].texts).toEqual(['A', 'B', 'B'])
+    expect(recorded[0].ids).toHaveLength(recorded[0].texts.length)
+  })
+})

package/telegram-plugin/tests/forward-origin.test.ts

@@ -30,10 +30,15 @@ import {
   FORWARDED_FROM_NAME_MAX,
   type ForwardOriginInfo,
 } from '../gateway/forward-origin.js'
+import { fmtLocalStamp, resolveEnvTimezone } from '../shared/local-time.js'
 
 // Synthetic fixtures only — no real Telegram ids/names (check-no-pii-secrets).
 const DATE = 1750000000 // unix seconds
-const DATE_ISO = new Date(DATE * 1000).toISOString()
+// switchroom #tz-fix: forwarded_date is now the agent's LOCAL am/pm wall clock
+// (NOT UTC ISO), so it can't compete with the local-time hint. Compute the
+// expected value through the SAME helper production uses, so the assertion is
+// deterministic under whatever TZ the runner env carries.
+const DATE_LOCAL = fmtLocalStamp(DATE * 1000, resolveEnvTimezone())
 
 function userOrigin(overrides: Partial<{
   first_name: string
@@ -204,7 +209,7 @@ describe('buildForwardOriginMeta — channel-tag attrs', () => {
       forwarded_from: 'Ada Lovelace (@adalove)',
       forwarded_from_type: 'user',
       forwarded_from_id: '42',
-      forwarded_date: DATE_ISO,
+      forwarded_date: DATE_LOCAL,
     })
   })
 
@@ -245,6 +250,28 @@ describe('buildForwardOriginMeta — channel-tag attrs', () => {
   it('no origins → empty record (no attrs on a normal message)', () => {
     expect(buildForwardOriginMeta([])).toEqual({})
   })
+
+  // switchroom #tz-fix (deterministic outcome): under a real configured zone
+  // the forwarded_date the MODEL sees is LOCAL am/pm with NO "UTC" / trailing-Z.
+  it('renders forwarded_date as LOCAL am/pm — never a UTC ISO string', () => {
+    const prevTz = process.env.SWITCHROOM_TIMEZONE
+    const prevTZ = process.env.TZ
+    process.env.SWITCHROOM_TIMEZONE = 'Australia/Melbourne'
+    delete process.env.TZ
+    try {
+      const meta = buildForwardOriginMeta([{ name: 'Ada', type: 'user', id: 42, date: DATE }])
+      const d = meta.forwarded_date!
+      // e.g. "Sunday 2025-06-15 08:26 PM AEST" — weekday, ISO date, am/pm, abbrev.
+      expect(d).toMatch(/ (?:AM|PM) [A-Za-z]{2,5}$/)
+      expect(d).not.toContain('UTC')
+      expect(d.endsWith('Z')).toBe(false)
+    } finally {
+      if (prevTz === undefined) delete process.env.SWITCHROOM_TIMEZONE
+      else process.env.SWITCHROOM_TIMEZONE = prevTz
+      if (prevTZ === undefined) delete process.env.TZ
+      else process.env.TZ = prevTZ
+    }
+  })
 })
 
 describe('coalesced bursts — dedupe + numbered siblings', () => {
@@ -264,7 +291,7 @@ describe('coalesced bursts — dedupe + numbered siblings', () => {
     expect(meta.forwarded_from).toBe('Alice Q (@aliceq)')
     expect(meta.forwarded_from_2).toBeUndefined()
     // First occurrence wins — the emitted date is the first part's.
-    expect(meta.forwarded_date).toBe(DATE_ISO)
+    expect(meta.forwarded_date).toBe(DATE_LOCAL)
   })
 
   it('multi-origin burst: first origin bare, second gets _2 keys in order', () => {