switchroom 0.19.14 → 0.19.16

package/telegram-plugin/hooks/narration-classify.mjs

@@ -0,0 +1,210 @@
+/**
+ * narration-classify.mjs — the ONE shared trailing-text narration classifier
+ * (switchroom#3513).
+ *
+ * ## Why this file exists (correction 2)
+ * Before #3513 the narration heuristic existed as TWO hand-synced copies — the
+ * TS gateway side (`turn-flush-safety.ts` `NARRATION_OPENER` / `isNarrationBlock`
+ * / `selectFlushDeliveryText`) and the unbundled Stop-hook `.mjs` side
+ * (`silent-end-scan.mjs`, with a "MUST stay in sync" comment). Two independent
+ * classifiers judging the SAME trailing assistant text is exactly the drift
+ * hazard that let intent-narration ("Now checking the gateway logs…") leak into
+ * a delivered Telegram message. This module is the single source of truth,
+ * authored as a raw `.mjs` (JS + JSDoc types) so it can be imported by BOTH:
+ *   - the unbundled Stop-hook `.mjs` (which can only import sibling `.mjs` +
+ *     node builtins — see `silent-end-scan.mjs`), and
+ *   - the bundled gateway TS (`turn-flush-safety.ts`) via `.mjs` interop (the
+ *     same pattern `tool-activity-summary.ts` already uses to import
+ *     `hooks/tool-label-pretool.mjs`).
+ *
+ * ## The primary rule — STRUCTURAL, substance-gated (corrections 3 + 4)
+ * The wording heuristic (`isNarrationBlock`) is provably incomplete (this bug is
+ * its counterexample). The deterministic, wording-independent discriminator is
+ * STRUCTURAL: did a `tool_use` follow this text block in the model's message?
+ * A narration preamble is drafted, then the model ACTS (a tool follows it); a
+ * terminal answer is not followed by a tool. `followedByToolUse === true` is a
+ * DEMOTION signal, NOT an unconditional narration verdict — it is gated by the
+ * substantive floor / opener heuristic so a SUBSTANTIVE real answer that merely
+ * precedes a tool call (the model answers, then reacts / pins / edits) still
+ * delivers. Only a short OR narration-shaped block that a tool followed is
+ * treated as non-deliverable. `followedByToolUse !== true` (false or absent) is
+ * never structural narration here — the caller applies the opener heuristic as a
+ * residual tie-breaker where it has no provenance.
+ */
+
+import { createHash } from 'node:crypto'
+
+/**
+ * Substantive-answer floor (chars, trimmed). The same bar the codebase uses
+ * everywhere (`final-answer-detect.ts` `FINAL_ANSWER_MIN_CHARS`,
+ * `turn-flush-safety.ts` `FLUSH_SUBSTANTIVE_MIN_CHARS`) to recognise "this block
+ * is a real answer, not a short narration/closer".
+ */
+export const SUBSTANTIVE_MIN_CHARS = 200
+
+/**
+ * Narration heuristic: a block that OPENS with a first-person "about to do X"
+ * phrase the model emits BEFORE composing its real answer ("Let me check…",
+ * "I'll look it up…", "Now let me…"). Deliberately NOT length-based.
+ */
+export const NARRATION_OPENER =
+  /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i
+
+/**
+ * A NON-terminal progress line that opens with a gerund and trails into an
+ * ellipsis/colon: "Checking now…", "Pulling the numbers:". A single short line
+ * (under the substantive floor, no internal paragraph) ending in `…`/`...`/`:`.
+ */
+export const NARRATION_TRAILER = /(?:\.{3}|…|:)\s*$/
+
+/**
+ * @param {string} block
+ * @returns {boolean}
+ */
+export function isTrailingNarrationLine(block) {
+  const t = typeof block === 'string' ? block.trim() : ''
+  if (t.length === 0 || t.length >= SUBSTANTIVE_MIN_CHARS) return false
+  if (t.includes('\n')) return false
+  return NARRATION_TRAILER.test(t)
+}
+
+/**
+ * The wording heuristic (residual tie-breaker for provenance-less callers).
+ * @param {string} block
+ * @returns {boolean}
+ */
+export function isNarrationBlock(block) {
+  const s = typeof block === 'string' ? block : ''
+  return NARRATION_OPENER.test(s.trimStart()) || isTrailingNarrationLine(s)
+}
+
+/**
+ * The #3513 PRIMARY rule: is this block structural intra-turn narration?
+ *
+ * TRUE only when a `tool_use` followed the block in the model's message
+ * (`followedByToolUse === true`) AND the block also reads as narration OR falls
+ * below the substantive floor. This preserves the #3237 asymmetry:
+ *   - `followedByToolUse === true`  → demotion, GATED by substance/heuristic
+ *     (a substantive non-narration block followed by react/pin/typing/edit is
+ *     NOT structural narration → still delivers).
+ *   - `followedByToolUse === false` → never structural narration (a terminal
+ *     block; nothing followed it).
+ *   - `followedByToolUse` absent    → never structural narration here; the
+ *     caller applies `isNarrationBlock` as a residual tie-breaker.
+ *
+ * @param {string} text
+ * @param {boolean | undefined} followedByToolUse
+ * @returns {boolean}
+ */
+export function isStructuralNarration(text, followedByToolUse) {
+  if (followedByToolUse !== true) return false
+  const t = typeof text === 'string' ? text.trim() : ''
+  if (t.length === 0) return true
+  return isNarrationBlock(t) || t.length < SUBSTANTIVE_MIN_CHARS
+}
+
+/**
+ * Ephemeral (non-turn-continuing) Telegram surface tools (switchroom#3513
+ * follow-up, MF4). A text block followed ONLY by tools in this set is still the
+ * TERMINAL answer for backstop-coalescing purposes — these tools carry no
+ * model-authored answer text and are the only ones plausibly fired AFTER a
+ * terminal answer (answer, then react / pin / typing / edit). Everything NOT in
+ * this set — work / deliverable tools (download_attachment, get_recent_messages,
+ * send_checklist, ask_user, …) and every non-telegram tool (retain / read /
+ * bash / web / …) — is turn-CONTINUING: a text block a real tool followed is
+ * intra-turn narration, never the terminal answer.
+ *
+ * Authoritative source: `bridge/bridge.ts` TOOL_SCHEMAS. `reply` / `stream_reply`
+ * are deliberately absent — they are handled by the `replyCalled` gate, not this
+ * list. `progress_update` is NOT a bridge tool (it is a runtime-metrics /
+ * sub-agent parent-card send site) and never appears as a turn `tool_use`, so it
+ * is intentionally excluded.
+ */
+export const EPHEMERAL_TOOLS = new Set([
+  'react',
+  'send_typing',
+  'pin_message',
+  'delete_message',
+  'edit_message',
+])
+
+/**
+ * True iff `name` is an ephemeral Telegram surface tool (see EPHEMERAL_TOOLS).
+ * Strips the host-chosen `mcp__<key>__` MCP prefix (matching `tool-names.ts`'s
+ * `stripPrefix`) so it works regardless of the registration key
+ * (`switchroom-telegram`, `clerk-telegram`, a fork's custom key).
+ *
+ * @param {string | null | undefined} name
+ * @returns {boolean}
+ */
+export function isEphemeralTool(name) {
+  if (typeof name !== 'string') return false
+  const suffix = name.replace(/^mcp__[^_].*?telegram__/, '')
+  return EPHEMERAL_TOOLS.has(suffix)
+}
+
+/**
+ * The deterministic, model-discipline-free backstop coalescer (switchroom#3513
+ * follow-up). Selects the ONE text a per-turn backstop (turn-flush E1/E2,
+ * captured-prose bridge E3, outbox sweep E4) should deliver from all captured /
+ * scanned assistant text blocks of a turn.
+ *
+ * `blocks` is in source order; each `{ text, followedByToolUse }` carries the
+ * per-TURN structural provenance (`followedByToolUse === true` ⇔ a
+ * turn-CONTINUING tool_use — a non-ephemeral, non-reply tool — arrived after
+ * this block, ANYWHERE later in the turn, not only later in its own message).
+ * `undefined` = provenance unknown → treated as NOT followed (fail OPEN: deliver,
+ * never drop).
+ *
+ * Rules:
+ *  1. TERMINAL RUN — the maximal SUFFIX of non-empty blocks with
+ *     `followedByToolUse !== true`. Non-empty → return its `\n\n` join. A
+ *     legitimate multi-paragraph answer written as several consecutive terminal
+ *     blocks stays whole (no truncation; #3237/#2798 parity).
+ *  2. UNCONDITIONAL structural suppression — every block with
+ *     `followedByToolUse === true` is excluded from the terminal run, with NO
+ *     length gate and NO opener/wording heuristic. "A real tool followed" is a
+ *     hard structural fact the turn continued past this block.
+ *  3. EMPTY-TERMINAL corner — if the terminal run is empty (the LAST non-empty
+ *     block was itself tool-followed), return that last block IFF its trimmed
+ *     length ≥ SUBSTANTIVE_MIN_CHARS, else null. A short tool-followed fragment
+ *     is narration/a closer → null routes to the re-prompt ladder, never silence.
+ *
+ * @param {ReadonlyArray<{ text: string, followedByToolUse?: boolean }>} blocks
+ * @returns {{ text: string } | null}  null = nothing to deliver.
+ */
+export function selectBackstopDelivery(blocks) {
+  const nonEmpty = (Array.isArray(blocks) ? blocks : [])
+    .map((b) => ({
+      text: typeof b?.text === 'string' ? b.text.trim() : '',
+      followedByToolUse: b?.followedByToolUse,
+    }))
+    .filter((b) => b.text.length > 0)
+  if (nonEmpty.length === 0) return null
+
+  // Rule 1 + 2: the terminal SUFFIX run of non-tool-followed blocks.
+  const run = []
+  for (let i = nonEmpty.length - 1; i >= 0; i--) {
+    if (nonEmpty[i].followedByToolUse === true) break
+    run.unshift(nonEmpty[i].text)
+  }
+  if (run.length > 0) return { text: run.join('\n\n') }
+
+  // Rule 3: empty terminal — the last block was tool-followed. Deliver it only
+  // if it clears the substantive floor; otherwise it is a narration fragment.
+  const last = nonEmpty[nonEmpty.length - 1]
+  if (last.text.length >= SUBSTANTIVE_MIN_CHARS) return { text: last.text }
+  return null
+}
+
+/**
+ * The durable shown-ledger key for a block: sha256 of its trimmed text. Matches
+ * the hash both the ephemeral-paint writer and the backstop-delivery readers
+ * compute, so a marked block is recognised across processes (#3513 §4).
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function ledgerHashHex(text) {
+  return createHash('sha256').update(String(text ?? '').trim(), 'utf8').digest('hex')
+}

package/telegram-plugin/hooks/silent-end-scan.mjs

@@ -58,12 +58,18 @@
 import { statSync } from 'node:fs'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
+import {
+  isNarrationBlock,
+  isEphemeralTool,
+  selectBackstopDelivery,
+  SUBSTANTIVE_MIN_CHARS,
+} from './narration-classify.mjs'
 
 const REPLY_TOOLS = new Set([
   'mcp__switchroom-telegram__reply',
   'mcp__switchroom-telegram__stream_reply',
 ])
-const FINAL_ANSWER_MIN_CHARS = 200
+const FINAL_ANSWER_MIN_CHARS = SUBSTANTIVE_MIN_CHARS
 // Match the gateway's silent-marker classifier (gateway.ts:6692 — the
 // `isSilentFlushMarker` helper accepts trailing punctuation + case
 // variants like "NO_REPLY." / "no_reply").
@@ -101,29 +107,13 @@ export function endsWithSilentMarker(text) {
   return SILENT_MARKER_RE.test(lines[lines.length - 1])
 }
 
-// ── Narration heuristics — ported from `turn-flush-safety.ts:198-274` ──
-//
-// Kept byte-parallel with `selectFlushDeliveryText` / `isNarrationBlock` so
-// the JOINED multi-block prose the scan persists as `pendingText` (for the
-// capture-divergence corner) matches what the gateway flush would itself have
-// delivered. The scan has no structural `followedByToolUse` provenance, so it
-// uses the opener/trailer heuristic fallback (the same branch the TS side
-// takes when the flag is absent). MUST stay in sync with the TS source; a
-// drift only affects the rare capture-empty corner, never the primary flush.
-const NARRATION_OPENER =
-  /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i
-const NARRATION_TRAILER = /(?:\.{3}|…|:)\s*$/
-
-function isTrailingNarrationLine(block) {
-  const t = block.trim()
-  if (t.length === 0 || t.length >= FINAL_ANSWER_MIN_CHARS) return false
-  if (t.includes('\n')) return false
-  return NARRATION_TRAILER.test(t)
-}
-
-function isNarrationBlock(block) {
-  return NARRATION_OPENER.test(block.trimStart()) || isTrailingNarrationLine(block)
-}
+// The narration heuristic (`isNarrationBlock`) and the STRUCTURAL rule
+// (`isStructuralNarration`) live in the ONE shared classifier
+// `./narration-classify.mjs`, imported at the top. Before switchroom#3513 this
+// `.mjs` carried a byte-parallel COPY of the TS heuristic with a "MUST stay in
+// sync" comment — the exact hand-synced drift that let intent-narration leak.
+// Both the bundled gateway TS (`turn-flush-safety.ts`) and this unbundled hook
+// now import the same module, so a single edit governs every classifier.
 
 /**
  * Choose the prose the captured-prose bridge should deliver from the trailing
@@ -403,7 +393,8 @@ export function scanTurnForFinalReply(jsonl) {
     if (obj?.type !== 'assistant') continue
     const content = obj?.message?.content
     if (!Array.isArray(content)) continue
-    for (const c of content) {
+    for (let ci = 0; ci < content.length; ci++) {
+      const c = content[ci]
       if (c?.type === 'text') {
         // Plain assistant text carve-out (#2053): a turn that ends with
         // a trailing bare NO_REPLY / HEARTBEAT_OK line — emitted as
@@ -428,16 +419,36 @@ export function scanTurnForFinalReply(jsonl) {
           // bridge): when this turn ends up blocked, the joined undelivered
           // text becomes `pendingText` so the gateway can deliver the model's
           // real answer directly. Trimmed per-block; joined below.
+          //
+          // #3513 follow-up (MF1): carry the block's text/length; the STRUCTURAL
+          // provenance `followedByToolUse` is NOT computed per-message here (the
+          // old `content.slice(ci+1)` only saw a tool later in this SAME message,
+          // missing the cross-message shape [text-only message] → [tool_use in the
+          // NEXT message]). It is filled by the PER-TURN two-pass below, which
+          // sees a turn-continuing tool_use ANYWHERE later in the turn.
           blocks.push({
             kind: 'text',
             chars: String(c.text ?? '').trim().length,
             text: String(c.text ?? '').trim(),
+            followedByToolUse: false,
           })
         }
         continue
       }
       if (c?.type !== 'tool_use') continue
-      if (!REPLY_TOOLS.has(c.name)) continue
+      if (!REPLY_TOOLS.has(c.name)) {
+        // #3513 follow-up (MF1): a turn-CONTINUING tool_use (any tool NOT in the
+        // ephemeral surface set and NOT a reply tool) is the deterministic signal
+        // that every PRIOR text block — including ones in earlier messages — was
+        // intra-turn narration. Record it as an ordered provenance marker so the
+        // two-pass below can retro-mark those blocks. Ephemeral surface tools
+        // (react / pin / typing / edit / delete) are NOT turn-continuing: a text
+        // block followed only by them is still the terminal answer.
+        if (!isEphemeralTool(c.name)) {
+          blocks.push({ kind: 'work-tool' })
+        }
+        continue
+      }
       const input = c.input ?? {}
       const text = String(input.text ?? '')
       // Silent-marker carve-out: the operator explicitly signaled
@@ -464,6 +475,28 @@ export function scanTurnForFinalReply(jsonl) {
     }
   }
 
+  // 2b. #3513 follow-up (MF1) — PER-TURN two-pass structural provenance. Walk
+  //     the flattened blocks in REVERSE and mark each text block
+  //     `followedByToolUse` iff a turn-continuing tool_use (`kind:'work-tool'`,
+  //     recorded above for any non-ephemeral, non-reply tool) appears LATER
+  //     anywhere in the turn — not just later in its own message. This is the
+  //     root-cause fix: the per-message computation missed the cross-message
+  //     shape ([text-only message] → [tool_use in the NEXT message]), leaking
+  //     intra-turn narration to the bridge/sweep. A `deliver` (reply-tool) marker
+  //     does NOT reset the flag: reply provenance is handled by the deliver
+  //     cursor (lastAllowBlockIdx), not the structural mark.
+  {
+    let sawWorkToolLater = false
+    for (let i = blocks.length - 1; i >= 0; i--) {
+      const b = blocks[i]
+      if (b.kind === 'work-tool') {
+        sawWorkToolLater = true
+        continue
+      }
+      if (b.kind === 'text') b.followedByToolUse = sawWorkToolLater
+    }
+  }
+
   // 3. Find the LAST delivery event's position, then check whether any
   //    plain-text block appears strictly after it. This is the fix for
   //    the "at least once" bug: a naive scan that stops at the FIRST
@@ -478,60 +511,50 @@ export function scanTurnForFinalReply(jsonl) {
     }
   }
   const undeliveredSlice = blocks.slice(lastAllowBlockIdx + 1)
-  const sawUndeliveredTextAfterAllow = undeliveredSlice
-    .some((b) => b.kind === 'text' && (b.chars ?? 0) >= FINAL_ANSWER_MIN_CHARS)
+  // #3513 follow-up — the ONE shared backstop coalescer selects the terminal
+  // delivery from the trailing text blocks (in source order, carrying the
+  // per-TURN structural provenance filled by the two-pass above).
+  // `selectBackstopDelivery` UNCONDITIONALLY excludes any block a
+  // turn-continuing tool followed (no length/wording gate — the #3515 substance
+  // heuristic is gone on the backstop path) and joins the maximal terminal
+  // suffix run of non-tool-followed blocks. `null` ⇒ nothing deliverable
+  // (pure narration run, or an empty-terminal fragment below the floor).
+  const backstopBlocks = undeliveredSlice
+    .filter((b) => b.kind === 'text' && typeof b.text === 'string')
+    .map((b) => ({ text: b.text, followedByToolUse: b.followedByToolUse }))
+  const backstopSelected = selectBackstopDelivery(backstopBlocks)
+  const backstopText =
+    backstopSelected != null && typeof backstopSelected.text === 'string'
+      ? backstopSelected.text
+      : undefined
 
-  // Option A transcript-prose bridge: isolate the undelivered final-answer
-  // prose so the gateway can deliver it directly.
-  //
-  // Finding 2 (#3228): a real dropped answer is a SINGLE substantive block —
-  // NOT concatenated inter-tool narration ("Let me check…", "Still querying…")
-  // that only crosses the floor once joined. The old code joined ALL post-
-  // delivery text blocks and surfaced the join whenever the COMBINED length
-  // hit the floor, so a run of short narration masqueraded as a final answer
-  // (and in the zero-delivery case that join was every text block in the
-  // turn). Instead, deliver only the LAST block that CLEARS the substance
-  // floor ON ITS OWN. This mirrors the block decision itself
-  // (`sawUndeliveredTextAfterAllow`, which requires a single ≥floor block) and
-  // handles the "big answer then short closer" shape by delivering the answer,
-  // not the closer. When no single block clears the floor, `pendingText` stays
-  // undefined and the gateway falls through to the re-prompt / represent nets.
-  const substantiveBlocks = undeliveredSlice.filter(
-    (b) =>
-      b.kind === 'text' &&
-      typeof b.text === 'string' &&
-      (b.chars ?? 0) >= FINAL_ANSWER_MIN_CHARS,
-  )
+  // The interim-ack path (`trailing-text-after-reply`) keeps the 200-char
+  // substance floor: a short trailing closer after a real reply is not a
+  // dropped answer. A qualifying delivery already happened, so blocking here
+  // only re-nags for a genuine ≥floor dropped answer.
+  const sawUndeliveredTextAfterAllow =
+    backstopText != null && backstopText.trim().length >= FINAL_ANSWER_MIN_CHARS
   const pendingText =
-    substantiveBlocks.length > 0
-      ? substantiveBlocks[substantiveBlocks.length - 1].text
+    backstopText != null && backstopText.trim().length >= FINAL_ANSWER_MIN_CHARS
+      ? backstopText
       : undefined
+  // `hasTrailingProse` INTENTIONALLY still counts ANY non-empty trailing prose
+  // (narration included): in the zero-reply case it gates the single-writer
+  // election to ALLOW the stop (`flush-will-deliver`) rather than BLOCK+nag —
+  // the gateway flush then suppresses the narration structurally (its own
+  // `selectBackstopDelivery` returns null), so the turn ends silently (no leak,
+  // no nag loop). Only the DELIVERED text is narrowed by the coalescer.
   const trailingTextBlocks = undeliveredSlice.filter(
     (b) => b.kind === 'text' && typeof b.text === 'string' && b.text.length > 0,
   )
   const hasTrailingProse = trailingTextBlocks.length > 0
-  // Capture-divergence bridge (#duplicate-message fix): in the ZERO-reply
-  // case, persist the last trailing block even when no single block clears
-  // the 200-char substance floor. The gateway's flush normally delivers any
-  // non-empty captured text, but when the gateway's own capture diverged
-  // (captured empty) the captured-prose bridge is the only delivery machine
-  // left, and it reads `pendingText` — the gateway lowers `minChars` for
-  // exactly this corner (`capturedProseMinCharsFor`, silent-end.ts). The
-  // interim-ack case (`trailing-text-after-reply`) keeps the substantive
-  // floor unchanged — a short closer after a real reply is not a dropped
-  // answer.
-  //
-  // Multi-block corner (review item 3): a real answer split across ≥2
-  // individually-sub-200 blocks (e.g. two ~150-char paragraphs) would
-  // otherwise yield NO pendingText — and in the capture-divergence-empty
-  // corner (gateway `capturedText` empty → flush skips 'empty-text') the
-  // bridge would then have nothing to deliver and the hook already allowed the
-  // stop: a DROPPED ANSWER. `selectBridgePendingText` mirrors the flush's own
-  // `selectFlushDeliveryText` narration-strip/join, so the bridge delivers the
-  // joined prose (with the lowered `minChars`) instead of dropping. The #3228
-  // Finding 2 guard is preserved: a pure narration run still yields undefined.
-  const zeroReplyPendingText =
-    pendingText ?? selectBridgePendingText(trailingTextBlocks.map((b) => b.text))
+  // Zero-reply / capture-divergence corner: the coalesced terminal run is the
+  // deliverable prose regardless of the 200-char interim-ack floor — a real
+  // answer split across ≥2 individually-sub-200 terminal blocks is joined by
+  // `selectBackstopDelivery` (its terminal-run join has no floor), so the bridge
+  // delivers the joined prose instead of dropping. A pure narration run still
+  // yields `undefined` (the #3228 Finding 2 guard, now structural).
+  const zeroReplyPendingText = backstopText
 
   if (lastAllowBlockIdx === -1) {
     // No qualifying delivery/silence event anywhere in the turn.
@@ -911,13 +934,17 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
     if (obj?.type !== 'assistant') continue
     const content = obj?.message?.content
     if (!Array.isArray(content)) continue
-    for (const c of content) {
+    for (let ci = 0; ci < content.length; ci++) {
+      const c = content[ci]
       if (c?.type === 'text') {
         const raw = String(c.text ?? '')
         // H6: strip a trailing bare marker; if substantive non-narration prose
         // remains, it is a genuine (undelivered) answer — capture it. If nothing
         // but the marker (or narration) remains, the block is a silence event.
         const { prose, hadMarker } = stripTrailingSilentMarker(raw)
+        // #3513 follow-up (MF1): `followedByToolUse` is filled by the PER-TURN
+        // two-pass below (a turn-continuing tool_use later ANYWHERE in the turn),
+        // not per-message — the cross-message shape needs the whole-turn view.
         if (hadMarker) {
           // H6: a block ending "…real answer…\nNO_REPLY" carries a genuine
           // answer — capture the prose and do NOT treat the block as a silence
@@ -928,15 +955,22 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
           // last-delivery cursor past that prose and mask it (multi-block H6).
           // A bare/narration marker is simply not a delivery — push nothing.
           if (prose.length > 0 && !isNarrationBlock(prose)) {
-            blocks.push({ kind: 'text', chars: prose.length, text: prose })
+            blocks.push({ kind: 'text', chars: prose.length, text: prose, followedByToolUse: false })
           }
         } else if (prose.length > 0) {
-          blocks.push({ kind: 'text', chars: prose.length, text: prose })
+          blocks.push({ kind: 'text', chars: prose.length, text: prose, followedByToolUse: false })
         }
         continue
       }
       if (c?.type !== 'tool_use') continue
-      if (!REPLY_TOOLS.has(c.name)) continue
+      if (!REPLY_TOOLS.has(c.name)) {
+        // #3513 follow-up (MF1): record a turn-continuing (non-ephemeral,
+        // non-reply) tool_use as an ordered provenance marker for the two-pass.
+        if (!isEphemeralTool(c.name)) {
+          blocks.push({ kind: 'work-tool' })
+        }
+        continue
+      }
       const input = c.input ?? {}
       const text = String(input.text ?? '')
       if (SILENT_MARKER_RE.test(text.trim()) || endsWithSilentMarker(text)) {
@@ -957,6 +991,21 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
     }
   }
 
+  // #3513 follow-up (MF1) — PER-TURN two-pass structural provenance (same as
+  // scanTurnForFinalReply): mark each text block `followedByToolUse` iff a
+  // turn-continuing tool_use appears LATER anywhere in the turn.
+  {
+    let sawWorkToolLater = false
+    for (let i = blocks.length - 1; i >= 0; i--) {
+      const b = blocks[i]
+      if (b.kind === 'work-tool') {
+        sawWorkToolLater = true
+        continue
+      }
+      if (b.kind === 'text') b.followedByToolUse = sawWorkToolLater
+    }
+  }
+
   let lastDeliverIdx = -1
   let lastFinalReplyBlock = null
   for (let i = 0; i < blocks.length; i++) {
@@ -988,14 +1037,19 @@ export function scanForOutboxCapture(jsonl, now = Date.now()) {
     lastFinalReplyBlock != null && typeof lastFinalReplyBlock.text === 'string'
       ? createHash('sha256').update(lastFinalReplyBlock.text, 'utf8').digest('hex')
       : null
-  const trailing = blocks
+  // #3513 follow-up — the ONE shared coalescer selects the terminal delivery,
+  // UNCONDITIONALLY excluding any block a turn-continuing tool followed (no
+  // length/wording gate) and joining the terminal suffix run. The durable outbox
+  // never captures intra-turn narration for the sweep to deliver.
+  const trailingTextBlocks = blocks
     .slice(lastDeliverIdx + 1)
     .filter((b) => b.kind === 'text' && typeof b.text === 'string' && b.text.length > 0)
-    .map((b) => b.text)
-
-  const text = selectBridgePendingText(trailing)
+  const backstopSelected = selectBackstopDelivery(
+    trailingTextBlocks.map((b) => ({ text: b.text, followedByToolUse: b.followedByToolUse })),
+  )
+  const text = backstopSelected != null ? backstopSelected.text : null
   if (text == null || text.trim().length < FINAL_ANSWER_MIN_CHARS) {
-    return { capture: false, reason: trailing.length === 0 ? 'no-trailing-prose' : 'below-floor' }
+    return { capture: false, reason: trailingTextBlocks.length === 0 ? 'no-trailing-prose' : 'below-floor' }
   }
 
   const turnNonce = deriveTurnNonce({

package/telegram-plugin/narrative-flush.ts

@@ -40,6 +40,7 @@
  */
 
 import { isReplyTool, isDraftOfReply } from './narrative-dedup.js'
+import { isStructuralNarration } from './hooks/narration-classify.mjs'
 
 /**
  * Time-box for the parked-narrative early-paint (the kernel's home for the
@@ -70,6 +71,18 @@ export interface NarrativeFlushEffects {
    * Caller removes it from the feed. No-op-safe if already gone.
    */
   retractShown(text: string): void
+  /**
+   * #3513 (correction 4): durably mark a block that has surfaced ONLY on the
+   * ephemeral card as structural narration, so the out-of-process turn-end
+   * backstops (E3 captured-prose bridge, E4 outbox sweep) refuse to re-emit it
+   * as a real chat message. Called ONLY from the mid-turn SHOW paths (`stage`,
+   * `resolveOnTool`), where the block is provably followed by more content
+   * (another text block / a tool_use) and is therefore structural narration —
+   * NEVER from `onTimerFire` (the timer paints the LAST/terminal block, which
+   * could still be the genuine unsent answer) nor from `flushAtTurnEnd`. The
+   * effect is optional; callers without a durable ledger omit it.
+   */
+  markDurableNarration?(text: string): void
 }
 
 /** Arms / disarms the real early-paint timer. Injected so tests can fake it. */
@@ -113,6 +126,10 @@ export class NarrativeFlushController {
     this.scheduler.disarm()
     if (this.pending != null) {
       this.effects.show(this.pending)
+      // The just-shown block is provably followed by MORE narration text (this
+      // new block is its lookahead) → structural narration. Mark it durably so
+      // the turn-end backstops never re-deliver it (#3513, correction 4).
+      this.markShown(this.pending)
     }
     this.pending = text
     this.scheduler.arm(() => this.onTimerFire(), this.flushMs)
@@ -146,6 +163,10 @@ export class NarrativeFlushController {
     this.pending = null
     if (replyText != null && isDraftOfReply(pending, replyText)) return // draft → SUPPRESS
     this.effects.show(pending)
+    // The just-shown block is provably followed by a tool_use (this lookahead) →
+    // structural narration. Mark it durably so the turn-end backstops never
+    // re-deliver it as a real chat message (#3513, correction 4).
+    this.markShown(pending)
   }
 
   /**
@@ -170,6 +191,20 @@ export class NarrativeFlushController {
     this.timerShown = null
   }
 
+  /**
+   * Durably mark a card-only block as narration — but ONLY when it is
+   * structurally narration under the shared classifier (substance-gated:
+   * `isNarrationBlock || < SUBSTANTIVE_MIN_CHARS`). This is the belt-and-braces
+   * guard: a substantive real message that happens to precede a non-delivering
+   * tool (react / pin / typing) is NOT marked, so it can still be delivered by a
+   * backstop if it was the genuine unsent answer (#3513, corrections 3 & 4).
+   */
+  private markShown(text: string): void {
+    if (this.effects.markDurableNarration == null) return
+    if (!isStructuralNarration(text, true)) return
+    this.effects.markDurableNarration(text)
+  }
+
   /** Retract the timer-painted block iff this reply is its draft-then-send. */
   private maybeRetract(replyText: string): void {
     const shown = this.timerShown