switchroom 0.19.13 → 0.19.15

package/telegram-plugin/hooks/silent-end-scan.mjs

@@ -58,12 +58,18 @@
 import { statSync } from 'node:fs'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
+import {
+  isNarrationBlock,
+  isEphemeralTool,
+  selectBackstopDelivery,
+  SUBSTANTIVE_MIN_CHARS,
+} from './narration-classify.mjs'
 
 const REPLY_TOOLS = new Set([
   'mcp__switchroom-telegram__reply',
   'mcp__switchroom-telegram__stream_reply',
 ])
-const FINAL_ANSWER_MIN_CHARS = 200
+const FINAL_ANSWER_MIN_CHARS = SUBSTANTIVE_MIN_CHARS
 // Match the gateway's silent-marker classifier (gateway.ts:6692 — the
 // `isSilentFlushMarker` helper accepts trailing punctuation + case
 // variants like "NO_REPLY." / "no_reply").
@@ -101,29 +107,13 @@ export function endsWithSilentMarker(text) {
   return SILENT_MARKER_RE.test(lines[lines.length - 1])
 }
 
-// ── Narration heuristics — ported from `turn-flush-safety.ts:198-274` ──
-//
-// Kept byte-parallel with `selectFlushDeliveryText` / `isNarrationBlock` so
-// the JOINED multi-block prose the scan persists as `pendingText` (for the
-// capture-divergence corner) matches what the gateway flush would itself have
-// delivered. The scan has no structural `followedByToolUse` provenance, so it
-// uses the opener/trailer heuristic fallback (the same branch the TS side
-// takes when the flag is absent). MUST stay in sync with the TS source; a
-// drift only affects the rare capture-empty corner, never the primary flush.
-const NARRATION_OPENER =
-  /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i
-const NARRATION_TRAILER = /(?:\.{3}|…|:)\s*$/
-
-function isTrailingNarrationLine(block) {
-  const t = block.trim()
-  if (t.length === 0 || t.length >= FINAL_ANSWER_MIN_CHARS) return false
-  if (t.includes('\n')) return false
-  return NARRATION_TRAILER.test(t)
-}
-
-function isNarrationBlock(block) {
-  return NARRATION_OPENER.test(block.trimStart()) || isTrailingNarrationLine(block)
-}
+// The narration heuristic (`isNarrationBlock`) and the STRUCTURAL rule
+// (`isStructuralNarration`) live in the ONE shared classifier
+// `./narration-classify.mjs`, imported at the top. Before switchroom#3513 this
+// `.mjs` carried a byte-parallel COPY of the TS heuristic with a "MUST stay in
+// sync" comment — the exact hand-synced drift that let intent-narration leak.
+// Both the bundled gateway TS (`turn-flush-safety.ts`) and this unbundled hook
+// now import the same module, so a single edit governs every classifier.
 
 /**
  * Choose the prose the captured-prose bridge should deliver from the trailing
@@ -403,7 +393,8 @@ export function scanTurnForFinalReply(jsonl) {
     if (obj?.type !== 'assistant') continue
     const content = obj?.message?.content
     if (!Array.isArray(content)) continue
-    for (const c of content) {
+    for (let ci = 0; ci < content.length; ci++) {
+      const c = content[ci]
       if (c?.type === 'text') {
         // Plain assistant text carve-out (#2053): a turn that ends with
         // a trailing bare NO_REPLY / HEARTBEAT_OK line — emitted as
@@ -428,16 +419,36 @@ export function scanTurnForFinalReply(jsonl) {
           // bridge): when this turn ends up blocked, the joined undelivered
           // text becomes `pendingText` so the gateway can deliver the model's
           // real answer directly. Trimmed per-block; joined below.
+          //
+          // #3513 follow-up (MF1): carry the block's text/length; the STRUCTURAL
+          // provenance `followedByToolUse` is NOT computed per-message here (the
+          // old `content.slice(ci+1)` only saw a tool later in this SAME message,
+          // missing the cross-message shape [text-only message] → [tool_use in the
+          // NEXT message]). It is filled by the PER-TURN two-pass below, which
+          // sees a turn-continuing tool_use ANYWHERE later in the turn.
           blocks.push({
             kind: 'text',
             chars: String(c.text ?? '').trim().length,
             text: String(c.text ?? '').trim(),
+            followedByToolUse: false,
           })
         }
         continue
       }
       if (c?.type !== 'tool_use') continue
-      if (!REPLY_TOOLS.has(c.name)) continue
+      if (!REPLY_TOOLS.has(c.name)) {
+        // #3513 follow-up (MF1): a turn-CONTINUING tool_use (any tool NOT in the
+        // ephemeral surface set and NOT a reply tool) is the deterministic signal
+        // that every PRIOR text block — including ones in earlier messages — was
+        // intra-turn narration. Record it as an ordered provenance marker so the
+        // two-pass below can retro-mark those blocks. Ephemeral surface tools
+        // (react / pin / typing / edit / delete) are NOT turn-continuing: a text
+        // block followed only by them is still the terminal answer.
+        if (!isEphemeralTool(c.name)) {
+          blocks.push({ kind: 'work-tool' })
+        }
+        continue
+      }
       const input = c.input ?? {}
       const text = String(input.text ?? '')
       // Silent-marker carve-out: the operator explicitly signaled
@@ -464,6 +475,28 @@ export function scanTurnForFinalReply(jsonl) {
     }
   }
 
+  // 2b. #3513 follow-up (MF1) — PER-TURN two-pass structural provenance. Walk
+  //     the flattened blocks in REVERSE and mark each text block
+  //     `followedByToolUse` iff a turn-continuing tool_use (`kind:'work-tool'`,
+  //     recorded above for any non-ephemeral, non-reply tool) appears LATER
+  //     anywhere in the turn — not just later in its own message. This is the
+  //     root-cause fix: the per-message computation missed the cross-message
+  //     shape ([text-only message] → [tool_use in the NEXT message]), leaking
+  //     intra-turn narration to the bridge/sweep. A `deliver` (reply-tool) marker
+  //     does NOT reset the flag: reply provenance is handled by the deliver
+  //     cursor (lastAllowBlockIdx), not the structural mark.
+  {
+    let sawWorkToolLater = false
+    for (let i = blocks.length - 1; i >= 0; i--) {
+      const b = blocks[i]
+      if (b.kind === 'work-tool') {
+        sawWorkToolLater = true
+        continue
+      }
+      if (b.kind === 'text') b.followedByToolUse = sawWorkToolLater
+    }
+  }
+
   // 3. Find the LAST delivery event's position, then check whether any
   //    plain-text block appears strictly after it. This is the fix for
   //    the "at least once" bug: a naive scan that stops at the FIRST
@@ -478,60 +511,50 @@ export function scanTurnForFinalReply(jsonl) {
     }
   }
   const undeliveredSlice = blocks.slice(lastAllowBlockIdx + 1)
-  const sawUndeliveredTextAfterAllow = undeliveredSlice
-    .some((b) => b.kind === 'text' && (b.chars ?? 0) >= FINAL_ANSWER_MIN_CHARS)
+  // #3513 follow-up — the ONE shared backstop coalescer selects the terminal
+  // delivery from the trailing text blocks (in source order, carrying the
+  // per-TURN structural provenance filled by the two-pass above).
+  // `selectBackstopDelivery` UNCONDITIONALLY excludes any block a
+  // turn-continuing tool followed (no length/wording gate — the #3515 substance
+  // heuristic is gone on the backstop path) and joins the maximal terminal
+  // suffix run of non-tool-followed blocks. `null` ⇒ nothing deliverable
+  // (pure narration run, or an empty-terminal fragment below the floor).
+  const backstopBlocks = undeliveredSlice
+    .filter((b) => b.kind === 'text' && typeof b.text === 'string')
+    .map((b) => ({ text: b.text, followedByToolUse: b.followedByToolUse }))
+  const backstopSelected = selectBackstopDelivery(backstopBlocks)
+  const backstopText =
+    backstopSelected != null && typeof backstopSelected.text === 'string'
+      ? backstopSelected.text
+      : undefined
 
-  // Option A transcript-prose bridge: isolate the undelivered final-answer
-  // prose so the gateway can deliver it directly.
-  //
-  // Finding 2 (#3228): a real dropped answer is a SINGLE substantive block —
-  // NOT concatenated inter-tool narration ("Let me check…", "Still querying…")
-  // that only crosses the floor once joined. The old code joined ALL post-
-  // delivery text blocks and surfaced the join whenever the COMBINED length
-  // hit the floor, so a run of short narration masqueraded as a final answer
-  // (and in the zero-delivery case that join was every text block in the
-  // turn). Instead, deliver only the LAST block that CLEARS the substance
-  // floor ON ITS OWN. This mirrors the block decision itself
-  // (`sawUndeliveredTextAfterAllow`, which requires a single ≥floor block) and
-  // handles the "big answer then short closer" shape by delivering the answer,
-  // not the closer. When no single block clears the floor, `pendingText` stays
-  // undefined and the gateway falls through to the re-prompt / represent nets.
-  const substantiveBlocks = undeliveredSlice.filter(
-    (b) =>
-      b.kind === 'text' &&
-      typeof b.text === 'string' &&
-      (b.chars ?? 0) >= FINAL_ANSWER_MIN_CHARS,
-  )
+  // The interim-ack path (`trailing-text-after-reply`) keeps the 200-char
+  // substance floor: a short trailing closer after a real reply is not a
+  // dropped answer. A qualifying delivery already happened, so blocking here
+  // only re-nags for a genuine ≥floor dropped answer.
+  const sawUndeliveredTextAfterAllow =
+    backstopText != null && backstopText.trim().length >= FINAL_ANSWER_MIN_CHARS
   const pendingText =
-    substantiveBlocks.length > 0
-      ? substantiveBlocks[substantiveBlocks.length - 1].text
+    backstopText != null && backstopText.trim().length >= FINAL_ANSWER_MIN_CHARS
+      ? backstopText
       : undefined
+  // `hasTrailingProse` INTENTIONALLY still counts ANY non-empty trailing prose
+  // (narration included): in the zero-reply case it gates the single-writer
+  // election to ALLOW the stop (`flush-will-deliver`) rather than BLOCK+nag —
+  // the gateway flush then suppresses the narration structurally (its own
+  // `selectBackstopDelivery` returns null), so the turn ends silently (no leak,
+  // no nag loop). Only the DELIVERED text is narrowed by the coalescer.
   const trailingTextBlocks = undeliveredSlice.filter(
     (b) => b.kind === 'text' && typeof b.text === 'string' && b.text.length > 0,
   )
   const hasTrailingProse = trailingTextBlocks.length > 0
-  // Capture-divergence bridge (#duplicate-message fix): in the ZERO-reply
-  // case, persist the last trailing block even when no single block clears
-  // the 200-char substance floor. The gateway's flush normally delivers any
-  // non-empty captured text, but when the gateway's own capture diverged
-  // (captured empty) the captured-prose bridge is the only delivery machine
-  // left, and it reads `pendingText` — the gateway lowers `minChars` for
-  // exactly this corner (`capturedProseMinCharsFor`, silent-end.ts). The
-  // interim-ack case (`trailing-text-after-reply`) keeps the substantive
-  // floor unchanged — a short closer after a real reply is not a dropped
-  // answer.
-  //
-  // Multi-block corner (review item 3): a real answer split across ≥2
-  // individually-sub-200 blocks (e.g. two ~150-char paragraphs) would
-  // otherwise yield NO pendingText — and in the capture-divergence-empty
-  // corner (gateway `capturedText` empty → flush skips 'empty-text') the
-  // bridge would then have nothing to deliver and the hook already allowed the
-  // stop: a DROPPED ANSWER. `selectBridgePendingText` mirrors the flush's own
-  // `selectFlushDeliveryText` narration-strip/join, so the bridge delivers the
-  // joined prose (with the lowered `minChars`) instead of dropping. The #3228
-  // Finding 2 guard is preserved: a pure narration run still yields undefined.
-  const zeroReplyPendingText =
-    pendingText ?? selectBridgePendingText(trailingTextBlocks.map((b) => b.text))
+  // Zero-reply / capture-divergence corner: the coalesced terminal run is the
+  // deliverable prose regardless of the 200-char interim-ack floor — a real
+  // answer split across ≥2 individually-sub-200 terminal blocks is joined by
+  // `selectBackstopDelivery` (its terminal-run join has no floor), so the bridge
+  // delivers the joined prose instead of dropping. A pure narration run still
+  // yields `undefined` (the #3228 Finding 2 guard, now structural).
+  const zeroReplyPendingText = backstopText
 
   if (lastAllowBlockIdx === -1) {
     // No qualifying delivery/silence event anywhere in the turn.
@@ -894,7 +917,7 @@ function resolveSessionOriginChat(lines) {
  *
  * @param {string} jsonl
  * @param {number} [now]
- * @returns {{ capture: false, reason: string } | { capture: true, text: string, turnNonce: string, chatId: string|null, threadId: number|null, source: string, anchorContent: string }}
+ * @returns {{ capture: false, reason: string } | { capture: true, text: string, turnNonce: string, chatId: string|null, threadId: number|null, source: string, anchorContent: string, replyAlreadyDeliveredThisTurn: boolean, deliveredReplySha256: string|null }}
  */
 export function scanForOutboxCapture(jsonl, now = Date.now()) {
   const lines = jsonl.split('\n')
@@ -911,13 +934,17 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
     if (obj?.type !== 'assistant') continue
     const content = obj?.message?.content
     if (!Array.isArray(content)) continue
-    for (const c of content) {
+    for (let ci = 0; ci < content.length; ci++) {
+      const c = content[ci]
       if (c?.type === 'text') {
         const raw = String(c.text ?? '')
         // H6: strip a trailing bare marker; if substantive non-narration prose
         // remains, it is a genuine (undelivered) answer — capture it. If nothing
         // but the marker (or narration) remains, the block is a silence event.
         const { prose, hadMarker } = stripTrailingSilentMarker(raw)
+        // #3513 follow-up (MF1): `followedByToolUse` is filled by the PER-TURN
+        // two-pass below (a turn-continuing tool_use later ANYWHERE in the turn),
+        // not per-message — the cross-message shape needs the whole-turn view.
         if (hadMarker) {
           // H6: a block ending "…real answer…\nNO_REPLY" carries a genuine
           // answer — capture the prose and do NOT treat the block as a silence
@@ -928,15 +955,22 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
           // last-delivery cursor past that prose and mask it (multi-block H6).
           // A bare/narration marker is simply not a delivery — push nothing.
           if (prose.length > 0 && !isNarrationBlock(prose)) {
-            blocks.push({ kind: 'text', chars: prose.length, text: prose })
+            blocks.push({ kind: 'text', chars: prose.length, text: prose, followedByToolUse: false })
           }
         } else if (prose.length > 0) {
-          blocks.push({ kind: 'text', chars: prose.length, text: prose })
+          blocks.push({ kind: 'text', chars: prose.length, text: prose, followedByToolUse: false })
         }
         continue
       }
       if (c?.type !== 'tool_use') continue
-      if (!REPLY_TOOLS.has(c.name)) continue
+      if (!REPLY_TOOLS.has(c.name)) {
+        // #3513 follow-up (MF1): record a turn-continuing (non-ephemeral,
+        // non-reply) tool_use as an ordered provenance marker for the two-pass.
+        if (!isEphemeralTool(c.name)) {
+          blocks.push({ kind: 'work-tool' })
+        }
+        continue
+      }
       const input = c.input ?? {}
       const text = String(input.text ?? '')
       if (SILENT_MARKER_RE.test(text.trim()) || endsWithSilentMarker(text)) {
@@ -948,24 +982,74 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
         disableNotification: input.disable_notification === true,
         done: input.done === true,
       })) {
-        blocks.push({ kind: 'deliver', reason: 'final-reply' })
+        // #3510: keep the delivered reply's text so the caller can log its
+        // sha256 next to the captured trailing prose's sha256 — a double-send
+        // becomes provable from logs alone, without transcript reconstruction.
+        blocks.push({ kind: 'deliver', reason: 'final-reply', text })
       }
       // interim ack — neither delivery nor undelivered prose.
     }
   }
 
+  // #3513 follow-up (MF1) — PER-TURN two-pass structural provenance (same as
+  // scanTurnForFinalReply): mark each text block `followedByToolUse` iff a
+  // turn-continuing tool_use appears LATER anywhere in the turn.
+  {
+    let sawWorkToolLater = false
+    for (let i = blocks.length - 1; i >= 0; i--) {
+      const b = blocks[i]
+      if (b.kind === 'work-tool') {
+        sawWorkToolLater = true
+        continue
+      }
+      if (b.kind === 'text') b.followedByToolUse = sawWorkToolLater
+    }
+  }
+
   let lastDeliverIdx = -1
+  let lastFinalReplyBlock = null
   for (let i = 0; i < blocks.length; i++) {
-    if (blocks[i].kind === 'deliver') lastDeliverIdx = i
+    if (blocks[i].kind !== 'deliver') continue
+    lastDeliverIdx = i
+    if (blocks[i].reason === 'final-reply') lastFinalReplyBlock = blocks[i]
   }
-  const trailing = blocks
+  // #3510: single source of truth for BOTH the fix's branching and the
+  // instrumentation. When true, a genuine FINAL-ANSWER reply/stream_reply
+  // already went through the gateway THIS turn — so a gateway anchor provably
+  // exists (`turn.finalAnswerDelivered` is set by the SAME `isFinalAnswerReply`
+  // classifier at outbound-send-path.ts ~2293) and the single-writer election
+  // in the Stop hook is reachable and safe. The caller
+  // (silent-end-interrupt-stop.mjs) MUST NOT self-exit a capture in that case;
+  // doing so creates a third, uncoordinated delivery path that re-sends a
+  // trailing recap of the reply as a second message (the #3510 double-send).
+  //
+  // #3511 review finding 1: ONLY a `'final-reply'` deliver block counts. A
+  // `'silent-marker'` block (reply-tool NO_REPLY / HEARTBEAT_OK) delivered
+  // NOTHING to the user, and the gateway routes such turns to sentinel
+  // suppression (`decideTurnEndGate` → 'silent_end') BEFORE the captured-prose
+  // bridge ever runs — deferring to the election there would orphan the
+  // trailing answer (a drop). A silent marker still advances `lastDeliverIdx`
+  // (the trailing-prose CURSOR — H6 semantics: NO_REPLY intentionally silences
+  // what came BEFORE it), but it must keep the shape on the durable
+  // outbox/sweep path, never route it to the election.
+  const replyAlreadyDeliveredThisTurn = lastFinalReplyBlock != null
+  const deliveredReplySha256 =
+    lastFinalReplyBlock != null && typeof lastFinalReplyBlock.text === 'string'
+      ? createHash('sha256').update(lastFinalReplyBlock.text, 'utf8').digest('hex')
+      : null
+  // #3513 follow-up — the ONE shared coalescer selects the terminal delivery,
+  // UNCONDITIONALLY excluding any block a turn-continuing tool followed (no
+  // length/wording gate) and joining the terminal suffix run. The durable outbox
+  // never captures intra-turn narration for the sweep to deliver.
+  const trailingTextBlocks = blocks
     .slice(lastDeliverIdx + 1)
     .filter((b) => b.kind === 'text' && typeof b.text === 'string' && b.text.length > 0)
-    .map((b) => b.text)
-
-  const text = selectBridgePendingText(trailing)
+  const backstopSelected = selectBackstopDelivery(
+    trailingTextBlocks.map((b) => ({ text: b.text, followedByToolUse: b.followedByToolUse })),
+  )
+  const text = backstopSelected != null ? backstopSelected.text : null
   if (text == null || text.trim().length < FINAL_ANSWER_MIN_CHARS) {
-    return { capture: false, reason: trailing.length === 0 ? 'no-trailing-prose' : 'below-floor' }
+    return { capture: false, reason: trailingTextBlocks.length === 0 ? 'no-trailing-prose' : 'below-floor' }
   }
 
   const turnNonce = deriveTurnNonce({
@@ -995,5 +1079,7 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
     anchorContent: anchor.anchorContent,
     originChatId: origin.chatId,
     originThreadId: origin.threadId,
+    replyAlreadyDeliveredThisTurn,
+    deliveredReplySha256,
   }
 }

package/telegram-plugin/narrative-flush.ts

@@ -40,6 +40,7 @@
  */
 
 import { isReplyTool, isDraftOfReply } from './narrative-dedup.js'
+import { isStructuralNarration } from './hooks/narration-classify.mjs'
 
 /**
  * Time-box for the parked-narrative early-paint (the kernel's home for the
@@ -70,6 +71,18 @@ export interface NarrativeFlushEffects {
    * Caller removes it from the feed. No-op-safe if already gone.
    */
   retractShown(text: string): void
+  /**
+   * #3513 (correction 4): durably mark a block that has surfaced ONLY on the
+   * ephemeral card as structural narration, so the out-of-process turn-end
+   * backstops (E3 captured-prose bridge, E4 outbox sweep) refuse to re-emit it
+   * as a real chat message. Called ONLY from the mid-turn SHOW paths (`stage`,
+   * `resolveOnTool`), where the block is provably followed by more content
+   * (another text block / a tool_use) and is therefore structural narration —
+   * NEVER from `onTimerFire` (the timer paints the LAST/terminal block, which
+   * could still be the genuine unsent answer) nor from `flushAtTurnEnd`. The
+   * effect is optional; callers without a durable ledger omit it.
+   */
+  markDurableNarration?(text: string): void
 }
 
 /** Arms / disarms the real early-paint timer. Injected so tests can fake it. */
@@ -113,6 +126,10 @@ export class NarrativeFlushController {
     this.scheduler.disarm()
     if (this.pending != null) {
       this.effects.show(this.pending)
+      // The just-shown block is provably followed by MORE narration text (this
+      // new block is its lookahead) → structural narration. Mark it durably so
+      // the turn-end backstops never re-deliver it (#3513, correction 4).
+      this.markShown(this.pending)
     }
     this.pending = text
     this.scheduler.arm(() => this.onTimerFire(), this.flushMs)
@@ -146,6 +163,10 @@ export class NarrativeFlushController {
     this.pending = null
     if (replyText != null && isDraftOfReply(pending, replyText)) return // draft → SUPPRESS
     this.effects.show(pending)
+    // The just-shown block is provably followed by a tool_use (this lookahead) →
+    // structural narration. Mark it durably so the turn-end backstops never
+    // re-deliver it as a real chat message (#3513, correction 4).
+    this.markShown(pending)
   }
 
   /**
@@ -170,6 +191,20 @@ export class NarrativeFlushController {
     this.timerShown = null
   }
 
+  /**
+   * Durably mark a card-only block as narration — but ONLY when it is
+   * structurally narration under the shared classifier (substance-gated:
+   * `isNarrationBlock || < SUBSTANTIVE_MIN_CHARS`). This is the belt-and-braces
+   * guard: a substantive real message that happens to precede a non-delivering
+   * tool (react / pin / typing) is NOT marked, so it can still be delivered by a
+   * backstop if it was the genuine unsent answer (#3513, corrections 3 & 4).
+   */
+  private markShown(text: string): void {
+    if (this.effects.markDurableNarration == null) return
+    if (!isStructuralNarration(text, true)) return
+    this.effects.markDurableNarration(text)
+  }
+
   /** Retract the timer-painted block iff this reply is its draft-then-send. */
   private maybeRetract(replyText: string): void {
     const shown = this.timerShown

package/telegram-plugin/outbox.ts

@@ -104,6 +104,15 @@ export interface OutboxRecord {
   originChatId?: string | null
   /** Forum thread of the per-session origin chat (see `originChatId`). */
   originThreadId?: number | null
+  /**
+   * #3510 instrumentation: was a qualifying reply already delivered through
+   * the gateway in the turn that produced this record? Stamped by the Stop
+   * hook from the SAME boolean that gates its capture-vs-election branch.
+   * After #3510 this is always `false` for a written record (a `true` routes
+   * to the single-writer election instead of the outbox), so a `true` here —
+   * or in a sweep journal entry — is direct evidence of a regression.
+   */
+  replyAlreadyDeliveredThisTurn?: boolean
 }
 
 /** One line of the delivered-keys journal (`outbox/delivered.jsonl`). */
@@ -112,6 +121,16 @@ export interface DeliveredEntry {
   textSha256: string
   tgMessageId?: number
   ts: number
+  /**
+   * #3510 instrumentation: which machine delivered — the outbox sweep, the
+   * gateway reply-path machinery (reply/stream_reply send, silent-anchor edit,
+   * captured-prose bridge), or the turn-end / answer-ready quiescence flush
+   * (`'flush'`, added in the #3513 exactly-once-among-backstops follow-up).
+   * Absent on pre-#3510 journal lines.
+   */
+  deliverySource?: 'sweep' | 'reply-tool' | 'flush'
+  /** #3510 instrumentation: see `OutboxRecord.replyAlreadyDeliveredThisTurn`. */
+  replyAlreadyDeliveredThisTurn?: boolean
 }
 
 export function sha256Hex(s: string): string {
@@ -290,6 +309,59 @@ export function outboxAlreadyDelivered(nonce: string, stateDir?: string): boolea
   return readDeliveredNonces(stateDir).has(nonce)
 }
 
+/**
+ * True iff a journal entry is a prior BACKSTOP delivery (turn-flush E1/E2,
+ * captured-prose bridge E3, outbox sweep E4) — NOT an explicit E0 `reply` /
+ * `stream_reply` send (#3513 follow-up, MF2).
+ *
+ *   - `deliverySource === 'sweep'`  → E4 backstop.
+ *   - `deliverySource === 'flush'`  → E1/E2 backstop.
+ *   - `deliverySource === 'reply-tool'` AND `replyAlreadyDeliveredThisTurn ===
+ *     false` → E3 captured-prose bridge (a backstop; the bridge only fires when
+ *     NO genuine final answer was delivered this turn).
+ *   - `deliverySource === 'reply-tool'` AND `replyAlreadyDeliveredThisTurn ===
+ *     true` → an explicit E0 reply send — NOT a backstop. E0 replies are
+ *     ungated by design (a turn may send N of them), so they must NOT satisfy a
+ *     backstop's exactly-once guard (else the guard would eat a legitimate
+ *     #3510 trailing recap or a multi-reply turn's later bridge).
+ *
+ * A pre-#3510 line with no `deliverySource` is treated conservatively as NOT a
+ * backstop (fail open — never suppress a backstop on ambiguous provenance).
+ */
+export function isBackstopDeliveredEntry(e: DeliveredEntry): boolean {
+  if (e.deliverySource === 'sweep' || e.deliverySource === 'flush') return true
+  if (e.deliverySource === 'reply-tool' && e.replyAlreadyDeliveredThisTurn === false) return true
+  return false
+}
+
+/**
+ * True iff `nonce` already has a prior BACKSTOP delivery journaled (see
+ * `isBackstopDeliveredEntry`). This is the BACKSTOP-SCOPED exactly-once read the
+ * turn-flush (E1/E2) and captured-prose bridge (E3) consult before delivering —
+ * unlike `outboxAlreadyDelivered` (any journal line) it does NOT count an
+ * explicit E0 reply, so it can never suppress a legitimate second explicit
+ * message (#3513 follow-up, MF2).
+ */
+export function backstopAlreadyDelivered(nonce: string, stateDir?: string): boolean {
+  if (nonce == null || nonce === '') return false
+  const path = join(resolveOutboxDir(stateDir), JOURNAL_FILE)
+  if (!existsSync(path)) return false
+  try {
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+      if (!line) continue
+      try {
+        const e = JSON.parse(line) as DeliveredEntry
+        if (e.turnNonce === nonce && isBackstopDeliveredEntry(e)) return true
+      } catch {
+        /* skip corrupt line */
+      }
+    }
+  } catch {
+    /* best-effort */
+  }
+  return false
+}
+
 /**
  * Max delivered-keys kept in the journal. On exceeding `JOURNAL_ROTATE_AT` lines
  * the journal is compacted down to the newest `JOURNAL_KEEP` entries — bounding
@@ -361,6 +433,7 @@ export type OutboxSweepAction =
   | 'skip-quiet'
   | 'skip-dedup'
   | 'skip-unroutable'
+  | 'skip-ephemeral-shown'
 
 export interface OutboxSweepDecision {
   action: OutboxSweepAction
@@ -391,6 +464,18 @@ export function decideOutboxSweep(input: {
   routePrefix?: string
   quietMs?: number
   maxAgeMs?: number
+  /**
+   * #3513 (correction 1): was this record's text marked ephemeral-shown on the
+   * progress card for its turnNonce (the durable shown-ledger)? A hit means the
+   * block was already assigned to the ephemeral surface — the single-surface
+   * invariant forbids ANY delivery machine, including this out-of-process late
+   * sweep, from ALSO delivering it to chat. The ledger only ever contains
+   * STRUCTURAL narration (correction 4: never a possibly-terminal answer), so
+   * this can never suppress a genuine answer. Checked here (in the backstop
+   * decision itself) rather than only at a send seam, because the sweep bypasses
+   * `normalizeOutboundBody` (it sends via `bot.api.sendMessage` directly).
+   */
+  shownLedgerHit?: boolean
 }): OutboxSweepDecision {
   const {
     record,
@@ -401,8 +486,10 @@ export function decideOutboxSweep(input: {
     routePrefix = '',
     quietMs = OUTBOX_QUIET_MS,
     maxAgeMs = OUTBOX_MAX_AGE_MS,
+    shownLedgerHit = false,
   } = input
   if (deliveredNonces.has(record.turnNonce)) return { action: 'skip-journaled' }
+  if (shownLedgerHit) return { action: 'skip-ephemeral-shown' }
   const age = now - record.createdAt
   if (age < quietMs) return { action: 'skip-quiet' }
   if (textAlreadyDelivered) return { action: 'skip-dedup' }