switchroom 0.19.14 → 0.19.16

package/telegram-plugin/outbox.ts

@@ -122,11 +122,13 @@ export interface DeliveredEntry {
   tgMessageId?: number
   ts: number
   /**
-   * #3510 instrumentation: which machine delivered — the outbox sweep, or the
+   * #3510 instrumentation: which machine delivered — the outbox sweep, the
    * gateway reply-path machinery (reply/stream_reply send, silent-anchor edit,
-   * captured-prose bridge). Absent on pre-#3510 journal lines.
+   * captured-prose bridge), or the turn-end / answer-ready quiescence flush
+   * (`'flush'`, added in the #3513 exactly-once-among-backstops follow-up).
+   * Absent on pre-#3510 journal lines.
    */
-  deliverySource?: 'sweep' | 'reply-tool'
+  deliverySource?: 'sweep' | 'reply-tool' | 'flush'
   /** #3510 instrumentation: see `OutboxRecord.replyAlreadyDeliveredThisTurn`. */
   replyAlreadyDeliveredThisTurn?: boolean
 }
@@ -307,6 +309,59 @@ export function outboxAlreadyDelivered(nonce: string, stateDir?: string): boolea
   return readDeliveredNonces(stateDir).has(nonce)
 }
 
+/**
+ * True iff a journal entry is a prior BACKSTOP delivery (turn-flush E1/E2,
+ * captured-prose bridge E3, outbox sweep E4) — NOT an explicit E0 `reply` /
+ * `stream_reply` send (#3513 follow-up, MF2).
+ *
+ *   - `deliverySource === 'sweep'`  → E4 backstop.
+ *   - `deliverySource === 'flush'`  → E1/E2 backstop.
+ *   - `deliverySource === 'reply-tool'` AND `replyAlreadyDeliveredThisTurn ===
+ *     false` → E3 captured-prose bridge (a backstop; the bridge only fires when
+ *     NO genuine final answer was delivered this turn).
+ *   - `deliverySource === 'reply-tool'` AND `replyAlreadyDeliveredThisTurn ===
+ *     true` → an explicit E0 reply send — NOT a backstop. E0 replies are
+ *     ungated by design (a turn may send N of them), so they must NOT satisfy a
+ *     backstop's exactly-once guard (else the guard would eat a legitimate
+ *     #3510 trailing recap or a multi-reply turn's later bridge).
+ *
+ * A pre-#3510 line with no `deliverySource` is treated conservatively as NOT a
+ * backstop (fail open — never suppress a backstop on ambiguous provenance).
+ */
+export function isBackstopDeliveredEntry(e: DeliveredEntry): boolean {
+  if (e.deliverySource === 'sweep' || e.deliverySource === 'flush') return true
+  if (e.deliverySource === 'reply-tool' && e.replyAlreadyDeliveredThisTurn === false) return true
+  return false
+}
+
+/**
+ * True iff `nonce` already has a prior BACKSTOP delivery journaled (see
+ * `isBackstopDeliveredEntry`). This is the BACKSTOP-SCOPED exactly-once read the
+ * turn-flush (E1/E2) and captured-prose bridge (E3) consult before delivering —
+ * unlike `outboxAlreadyDelivered` (any journal line) it does NOT count an
+ * explicit E0 reply, so it can never suppress a legitimate second explicit
+ * message (#3513 follow-up, MF2).
+ */
+export function backstopAlreadyDelivered(nonce: string, stateDir?: string): boolean {
+  if (nonce == null || nonce === '') return false
+  const path = join(resolveOutboxDir(stateDir), JOURNAL_FILE)
+  if (!existsSync(path)) return false
+  try {
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+      if (!line) continue
+      try {
+        const e = JSON.parse(line) as DeliveredEntry
+        if (e.turnNonce === nonce && isBackstopDeliveredEntry(e)) return true
+      } catch {
+        /* skip corrupt line */
+      }
+    }
+  } catch {
+    /* best-effort */
+  }
+  return false
+}
+
 /**
  * Max delivered-keys kept in the journal. On exceeding `JOURNAL_ROTATE_AT` lines
  * the journal is compacted down to the newest `JOURNAL_KEEP` entries — bounding
@@ -378,6 +433,7 @@ export type OutboxSweepAction =
   | 'skip-quiet'
   | 'skip-dedup'
   | 'skip-unroutable'
+  | 'skip-ephemeral-shown'
 
 export interface OutboxSweepDecision {
   action: OutboxSweepAction
@@ -408,6 +464,18 @@ export function decideOutboxSweep(input: {
   routePrefix?: string
   quietMs?: number
   maxAgeMs?: number
+  /**
+   * #3513 (correction 1): was this record's text marked ephemeral-shown on the
+   * progress card for its turnNonce (the durable shown-ledger)? A hit means the
+   * block was already assigned to the ephemeral surface — the single-surface
+   * invariant forbids ANY delivery machine, including this out-of-process late
+   * sweep, from ALSO delivering it to chat. The ledger only ever contains
+   * STRUCTURAL narration (correction 4: never a possibly-terminal answer), so
+   * this can never suppress a genuine answer. Checked here (in the backstop
+   * decision itself) rather than only at a send seam, because the sweep bypasses
+   * `normalizeOutboundBody` (it sends via `bot.api.sendMessage` directly).
+   */
+  shownLedgerHit?: boolean
 }): OutboxSweepDecision {
   const {
     record,
@@ -418,8 +486,10 @@ export function decideOutboxSweep(input: {
     routePrefix = '',
     quietMs = OUTBOX_QUIET_MS,
     maxAgeMs = OUTBOX_MAX_AGE_MS,
+    shownLedgerHit = false,
   } = input
   if (deliveredNonces.has(record.turnNonce)) return { action: 'skip-journaled' }
+  if (shownLedgerHit) return { action: 'skip-ephemeral-shown' }
   const age = now - record.createdAt
   if (age < quietMs) return { action: 'skip-quiet' }
   if (textAlreadyDelivered) return { action: 'skip-dedup' }

package/telegram-plugin/session-tail.ts

@@ -134,7 +134,23 @@ export type SessionEvent =
   // (naive summing across lines over-counts). Null messageId → un-dedupable,
   // counted as-is. Mirrors `sub_agent_usage` but for the parent's OWN tokens.
   | { kind: 'usage'; messageId: string | null; totalTokens: number }
-  | { kind: 'tool_result'; toolUseId: string; toolName: string | null; isError?: boolean; errorText?: string }
+  | { kind: 'tool_result'; toolUseId: string; toolName: string | null; isError?: boolean; errorText?: string
+      /**
+       * #3519 sharpen: the claude-CLI background-task id when THIS tool_result
+       * is the launch acknowledgement of a shell moved to the background (a
+       * foreground Bash that exceeded the CLI foreground window, or an explicit
+       * run_in_background:true). Sourced PRIMARILY from the structured
+       * top-level `toolUseResult.backgroundTaskId` field (version-robust), with
+       * a regex on the `content` string as a secondary. Absent on ordinary
+       * (completed-in-foreground) tool_results. Marks the shell ALIVE. */
+      backgroundTaskId?: string }
+  /**
+   * #3519 sharpen: a claude-CLI `<task-notification>` — the proactive
+   * completion signal the CLI enqueues when a backgrounded shell finishes
+   * (`<status>completed</status>`) or errors. Marks the shell DEAD, restoring
+   * ~300s wedge recovery once the launching bash is no longer running.
+   */
+  | { kind: 'task_notification'; taskId: string; status: string }
   // `reason` is set ONLY by an internal gateway-synthesized turn_end (never by
   // the JSONL projection). `answer-ready-quiescence` (PR A) marks the positive
   // deterministic quiescence-flush signal, which — unlike the orphaned-reply
@@ -259,6 +275,60 @@ function extractToolResultErrorText(content: unknown): string {
   return ''
 }
 
+/**
+ * #3519 sharpen — ALIVE marker (primary): read the claude-CLI background-task
+ * id off the structured, sibling top-level `toolUseResult.backgroundTaskId`
+ * field of a `type:"user"` transcript line. This is the version-robust source
+ * (a named JSON field, not prose). Real shape (carrie session
+ * a6d2d33a-…, v2.1.197, line 109):
+ *   "toolUseResult":{…,"backgroundTaskId":"bxa4sv3dq"}
+ * Returns the id, or null when the line carries no backgrounded shell.
+ */
+export function parseBackgroundTaskId(obj: Record<string, unknown>): string | null {
+  const tur = obj.toolUseResult
+  if (typeof tur === 'object' && tur != null) {
+    const id = (tur as Record<string, unknown>).backgroundTaskId
+    if (typeof id === 'string' && id.length > 0) return id
+  }
+  return null
+}
+
+/**
+ * #3519 sharpen — ALIVE marker (secondary): match the launch STRING in the
+ * tool_result `content` when the structured field is absent (older CLI, or a
+ * shape change that keeps the human string). Real bytes (same line 109):
+ *   "Command running in background with ID: bxa4sv3dq. Output is being written…"
+ * DELIBERATELY the fallback, not the primary — if BOTH miss (CLI changed the
+ * string too) the caller degrades to the 900s-bounded sawBash guard. Accepts
+ * the same string|content-block shapes as extractToolResultErrorText.
+ */
+export function parseBackgroundLaunchString(content: unknown): string | null {
+  const text = typeof content === 'string'
+    ? content
+    : extractToolResultErrorText(content)
+  const m = text.match(/Command running in background with ID: (\w+)/)
+  return m != null ? m[1] : null
+}
+
+/**
+ * #3519 sharpen — DEAD marker: parse a claude-CLI `<task-notification>` block.
+ * The CLI enqueues this proactively when a backgrounded shell finishes. Real
+ * bytes (carrie session a6d2d33a-…, v2.1.197, line 175 queue-operation enqueue
+ * content, and mirrored line 180 attachment):
+ *   "<task-notification>\n<task-id>bxa4sv3dq</task-id>\n…\n<status>completed</status>\n…"
+ * Returns {taskId,status} when both tags are present, else null (so an
+ * ordinary inbound enqueue falls through to the normal user-turn path).
+ */
+export function parseTaskNotification(
+  content: string,
+): { taskId: string; status: string } | null {
+  if (!content.includes('<task-notification>')) return null
+  const idM = content.match(/<task-id>([^<]+)<\/task-id>/)
+  const stM = content.match(/<status>([^<]+)<\/status>/)
+  if (idM == null || stM == null) return null
+  return { taskId: idM[1].trim(), status: stM[1].trim() }
+}
+
 /**
  * THE single text→narrative projection primitive. Both projectTranscriptLine
  * and projectSubagentLine derive their text events through this helper so
@@ -481,6 +551,15 @@ export function projectTranscriptLine(line: string): SessionEvent[] {
     const op = obj.operation as string | undefined
     if (op === 'enqueue') {
       const content = (obj.content as string | undefined) ?? ''
+      // #3519 sharpen: a `<task-notification>` is NOT a real inbound user
+      // turn — it is the claude CLI's proactive background-shell completion
+      // signal, enqueued as a synthetic command. Project it as the DEAD
+      // marker so the liveness registry can drop the shell (restoring ~300s
+      // wedge recovery) rather than mis-reading it as a user message.
+      const notif = parseTaskNotification(content)
+      if (notif != null) {
+        return [{ kind: 'task_notification', taskId: notif.taskId, status: notif.status }]
+      }
       const { chatId, messageId, threadId } = parseChannelMeta(content)
       return [{ kind: 'enqueue', chatId, messageId, threadId, rawContent: content }]
     }
@@ -578,6 +657,11 @@ export function projectTranscriptLine(line: string): SessionEvent[] {
     const message = obj.message as Record<string, unknown> | undefined
     const content = message?.content as Array<Record<string, unknown>> | undefined
     if (!Array.isArray(content)) return []
+    // #3519 sharpen: the background-launch id is a per-LINE fact carried on
+    // the sibling top-level `toolUseResult.backgroundTaskId` (version-robust
+    // structured field), with the launch STRING as a secondary. Parsed once
+    // and attached to this line's tool_result event to mark the shell ALIVE.
+    const backgroundTaskId = parseBackgroundTaskId(obj)
     const events: SessionEvent[] = []
     for (const c of content) {
       if (c.type === 'tool_result') {
@@ -588,6 +672,9 @@ export function projectTranscriptLine(line: string): SessionEvent[] {
           toolName: null,
           isError,
           errorText: isError ? extractToolResultErrorText(c.content) : undefined,
+          backgroundTaskId: backgroundTaskId
+            ?? parseBackgroundLaunchString(c.content)
+            ?? undefined,
         })
       }
     }

package/telegram-plugin/shown-ledger.ts

@@ -0,0 +1,145 @@
+/**
+ * shown-ledger.ts — the durable "this block was surfaced on the ephemeral
+ * progress card, never deliver it to chat" mark (switchroom#3513 §4).
+ *
+ * ## Role in the single-surface invariant
+ * Every trailing plain-text block a turn produces is assigned to exactly one
+ * surface: the delivered chat answer, the ephemeral progress card, or
+ * suppression. In-process (E1/E2 turn-flush, the card) that assignment is made
+ * once by the shared structural classifier (`hooks/narration-classify.mjs`).
+ * But the out-of-process backstops — the Stop-hook captured-prose bridge (E3)
+ * and the durable outbox heartbeat sweep (E4) — run in a separate process / on
+ * a later tick and cannot share an in-memory decision. So the component that
+ * paints a block as ephemeral narration appends `{turnNonce, hash}` here, and
+ * E3/E4 treat a ledger hit exactly like a silent marker: not deliverable.
+ *
+ * ## Correction 4 — only structural narration is ever marked
+ * The writer (the mid-turn narrative paint in `gateway/narrative-lane.ts`) marks
+ * ONLY blocks that are provably followed by more turn activity (a new narrative
+ * block or a tool call), i.e. structural narration — NEVER a possibly-terminal
+ * block (the timer-paint / turn-end paint that could turn out to be the real
+ * answer). This keeps the invariant fail-open for answers: a genuine unsent
+ * answer is never in the ledger, so a ledger check can never suppress it (a drop
+ * is worse than a duplicate). The structural rule, not the ledger, is the sole
+ * guard for the answer path.
+ *
+ * ## Envelope-bearing-only (documented should-fix, #3513 §8)
+ * The ledger is keyed by the turnNonce (`deriveTurnId` → `${chatKey}#${msgId}`),
+ * which is reachable-matching ONLY for envelope-bearing turns — `deriveTurnId`
+ * returns null without a message_id (`gateway/derive-turn-id.ts`), and the
+ * outbox falls back to a sha nonce. So the ledger is a best-effort belt for
+ * envelope-bearing turns (the common Telegram-inbound shape); for envelope-less
+ * turns (handback / background / cron) the structural classifier is the sole
+ * guard. The writer skips a null turnId; the readers simply miss and fall
+ * through to the structural rule — never a false suppression.
+ *
+ * Best-effort throughout: a missing / unwritable ledger degrades to the
+ * structural-rule-only behaviour (leak possible, drop impossible).
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+  appendFileSync,
+} from 'node:fs'
+import { join } from 'node:path'
+import { resolveOutboxDir } from './outbox.js'
+import { ledgerHashHex } from './hooks/narration-classify.mjs'
+
+const SHOWN_LEDGER_FILE = 'shown-ledger.jsonl'
+
+/** Bounded growth — compact to the newest KEEP entries past ROTATE_AT lines. */
+export const SHOWN_LEDGER_KEEP = 2_000
+export const SHOWN_LEDGER_ROTATE_AT = 4_000
+
+/** One appended shown-block entry. */
+export interface ShownLedgerEntry {
+  turnNonce: string
+  hash: string
+  ts: number
+}
+
+export function shownLedgerPath(stateDir?: string): string {
+  return join(resolveOutboxDir(stateDir), SHOWN_LEDGER_FILE)
+}
+
+/**
+ * Mark a block as ephemeral-shown for `turnNonce`. Correction 4: callers MUST
+ * only pass blocks that are structural narration (followed by more turn
+ * activity), never a possibly-terminal block. A null/empty turnNonce is ignored
+ * (envelope-less turn — the structural rule is the sole guard there).
+ * Best-effort; never throws.
+ */
+export function appendShownBlock(
+  turnNonce: string | null,
+  text: string,
+  stateDir?: string,
+  now: number = Date.now(),
+): void {
+  if (turnNonce == null || turnNonce === '') return
+  const trimmed = typeof text === 'string' ? text.trim() : ''
+  if (trimmed.length === 0) return
+  const dir = resolveOutboxDir(stateDir)
+  const path = shownLedgerPath(stateDir)
+  try {
+    mkdirSync(dir, { recursive: true })
+    const entry: ShownLedgerEntry = { turnNonce, hash: ledgerHashHex(trimmed), ts: now }
+    appendFileSync(path, JSON.stringify(entry) + '\n', { mode: 0o600 })
+    compactIfLarge(path)
+  } catch {
+    /* best-effort */
+  }
+}
+
+/** The set of block hashes marked ephemeral-shown for `turnNonce`. */
+export function readShownHashes(turnNonce: string | null, stateDir?: string): Set<string> {
+  const set = new Set<string>()
+  if (turnNonce == null || turnNonce === '') return set
+  const path = shownLedgerPath(stateDir)
+  if (!existsSync(path)) return set
+  try {
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+      if (!line) continue
+      try {
+        const e = JSON.parse(line) as ShownLedgerEntry
+        if (e.turnNonce === turnNonce && typeof e.hash === 'string') set.add(e.hash)
+      } catch {
+        /* skip corrupt line */
+      }
+    }
+  } catch {
+    /* best-effort */
+  }
+  return set
+}
+
+/**
+ * Was `text` marked ephemeral-shown for `turnNonce`? The out-of-process
+ * suppression check consumed by the E3 captured-prose decision and the E4 sweep.
+ */
+export function isShownBlock(
+  turnNonce: string | null,
+  text: string,
+  stateDir?: string,
+): boolean {
+  if (turnNonce == null || turnNonce === '') return false
+  const trimmed = typeof text === 'string' ? text.trim() : ''
+  if (trimmed.length === 0) return false
+  return readShownHashes(turnNonce, stateDir).has(ledgerHashHex(trimmed))
+}
+
+function compactIfLarge(path: string): void {
+  try {
+    const lines = readFileSync(path, 'utf8').split('\n').filter((l) => l.length > 0)
+    if (lines.length <= SHOWN_LEDGER_ROTATE_AT) return
+    const kept = lines.slice(lines.length - SHOWN_LEDGER_KEEP)
+    const tmp = `${path}.${process.pid}.compact`
+    writeFileSync(tmp, kept.join('\n') + '\n', { mode: 0o600 })
+    renameSync(tmp, path)
+  } catch {
+    /* best-effort */
+  }
+}

package/telegram-plugin/silence-poke.ts

@@ -93,6 +93,34 @@ export interface SilencePokeState {
    * clock — the design choice in this module's header is preserved.
    * We only enrich the fallback TEXT, not the timing. */
   inFlightTools: Map<string, { name: string; startedAt: number; label: string | null }>
+  /**
+   * #3519: true once ANY `Bash` tool_use has been observed in this turn.
+   * A foreground `Bash` that exceeds the claude-CLI foreground window is
+   * auto-moved to the background: its `tool_result` returns to the model
+   * (so `inFlightTools` empties and `isLegitimatelyWorking()`'s foreground
+   * / async-dispatch checks all go false), yet the process keeps running
+   * and the model sits silent waiting on it. That silent gap is invisible
+   * to every existing "still working" signal, so the 300s fallback fired
+   * mid-work — nulling `currentTurn`, tearing down the pinned progress
+   * card, and letting the next tool burst mint a BRAND-NEW card (the
+   * stacked-cards bug). Arming this flag on the first Bash of the turn lets
+   * the fallback defer such gaps. Turn-scoped (set here, only cleared by a
+   * fresh `startTurn`); bounded by `fallbackHardCeiling` so a genuinely
+   * wedged bash-turn still unwedges at the ceiling. Does NOT reset the
+   * silence clock — a real reply / feed edit still does that; this only
+   * gates the terminal teardown. */
+  sawBashThisTurn: boolean
+  /**
+   * #3519 sharpen: claude-CLI background shells PROVEN alive right now. A
+   * shell is added on its launch marker (structured `backgroundTaskId`, via
+   * `noteBackgroundShellAlive`) and removed when the CLI proactively reports
+   * it done (`<task-notification>` completed/failed) or the model `KillShell`s
+   * it (via `noteBackgroundShellDead`). Non-empty ⇒ a process is running, so
+   * defer the 300s teardown. Empty ⇒ nothing running, so a FINISHED bash no
+   * longer defers — restoring ~300s wedge recovery that the coarse
+   * `sawBashThisTurn` guard held to 900s. Turn-scoped (cleared by startTurn),
+   * bounded by `fallbackHardCeiling` like every other defer. */
+  aliveShells: Set<string>
 }
 
 export interface ThresholdsMs {
@@ -217,6 +245,21 @@ const state = new Map<string, SilencePokeState>()
 let timer: ReturnType<typeof setInterval> | null = null
 let activeDeps: SilencePokeDeps | null = null
 
+/**
+ * #3519 sharpen — deterministic SAFE-DEGRADATION latch (process-scoped).
+ * Flipped true the first time `noteBackgroundShellAlive` fires, i.e. the
+ * moment the session-tail marker parser resolves a real `backgroundTaskId`
+ * against the live claude CLI. Its purpose is to distinguish two look-alike
+ * states that both present as "a Bash ran but no shell is registered alive":
+ *   • CLI markers work, the bash simply FINISHED  → trust the empty alive-set,
+ *     let the 300s fallback fire (fast wedge recovery restored); and
+ *   • CLI changed its markers so the parser never matches → we CANNOT tell a
+ *     live auto-backgrounded bash from a finished one, so fall back to the
+ *     coarse 900s-bounded `sawBashThisTurn` guard (never stack, never hang).
+ * Once ANY marker has parsed, the CLI is proven compatible and the alive-set
+ * is authoritative. Never seen ⇒ stay conservative. Reset by tests only. */
+let bgMarkerParserConfirmed = false
+
 /**
  * True iff the kill switch is OFF. Re-read every call so tests can
  * toggle process.env without reloading the module.
@@ -238,9 +281,40 @@ export function startTurn(key: string, now: number): void {
     fallbackFired: false,
     floorFired: false,
     inFlightTools: new Map(),
+    sawBashThisTurn: false,
+    aliveShells: new Set(),
   })
 }
 
+/**
+ * #3519 sharpen: register a claude-CLI background shell as ALIVE for `key`.
+ * Called by the gateway when session-tail resolves a `backgroundTaskId` on a
+ * tool_result (a foreground Bash auto-moved to the background, or an explicit
+ * run_in_background:true). Flips the process-scoped parser-confirmed latch so
+ * the safe-degradation path knows the CLI markers are compatible. No-op when
+ * the key has no live turn (the launch outlived its turn — the cross-turn
+ * ambient owns that case, not the 300s teardown).
+ */
+export function noteBackgroundShellAlive(key: string, shellId: string): void {
+  bgMarkerParserConfirmed = true
+  const s = state.get(key)
+  if (s == null) return
+  s.aliveShells.add(shellId)
+}
+
+/**
+ * #3519 sharpen: mark a background shell DEAD for `key`. Called by the gateway
+ * on a `<task-notification>` (completed/failed) or a `KillShell`. Idempotent —
+ * removing an unknown id (already cleared, or launched in a prior turn) is a
+ * no-op. Once the set empties, a subsequent >300s silence is a real wedge and
+ * the fallback fires at ~300s.
+ */
+export function noteBackgroundShellDead(key: string, shellId: string): void {
+  const s = state.get(key)
+  if (s == null) return
+  s.aliveShells.delete(shellId)
+}
+
 /**
  * Record a fresh user-visible outbound message (reply or stream_reply
  * first-emit). Resets the silence clock so the 300s fallback is measured
@@ -313,6 +387,14 @@ export function noteToolStart(
   const s = state.get(key)
   if (s == null) return
   s.inFlightTools.set(toolUseId, { name, startedAt: now, label })
+  // #3519: arm the background-bash defer on the first Bash of the turn.
+  // A foreground Bash can be auto-moved to the background by the claude CLI
+  // once it crosses the foreground window; its tool_result then returns
+  // (draining inFlightTools) while the process keeps running and the model
+  // goes silent waiting on it. That gap is invisible to every other "still
+  // working" signal, so without this the 300s fallback tore down the pinned
+  // card mid-work and the next burst minted a fresh one (stacked cards).
+  if (name === 'Bash') s.sawBashThisTurn = true
 }
 
 /**
@@ -541,8 +623,13 @@ function tick(now: number): void {
       //   2. Legacy `deferFallbackWhileToolInFlight` boolean — covers only
       //      `inFlightTools.size > 0`; kept for test fixtures that set it
       //      directly without wiring the callback.
+      //   3. #3519 `sawBashThisTurn` — covers the claude-CLI-side background
+      //      bash gap the two paths above are blind to (foreground Bash moved
+      //      to background: tool_result returned, process still running, model
+      //      silent). Independent of the callback so it holds even when
+      //      `isLegitimatelyWorking()` returns false.
       //
-      // In both cases: `continue` WITHOUT setting fallbackFired so the next
+      // In all cases: `continue` WITHOUT setting fallbackFired so the next
       // tick re-checks. Once the work signal clears and the turn stays silent
       // past the base threshold, or the ceiling is crossed, the fallback fires.
       const ceiling = thresholds.fallbackHardCeiling ?? Number.POSITIVE_INFINITY
@@ -551,6 +638,30 @@ function tick(now: number): void {
         const forceDisable = process.env.SWITCHROOM_SILENCE_DEFER_INFLIGHT_TOOLS === '0'
         if (!forceDisable && activeDeps.isLegitimatelyWorking != null) {
           if (activeDeps.isLegitimatelyWorking(key)) continue
+          // #3519 sharpen: even when the callback reports "not working", a
+          // `Bash` earlier this turn may have been auto-moved to the CLI-side
+          // background (its tool_result returned, so every foreground /
+          // async-dispatch signal is false, yet the process is alive and the
+          // model sits silent on it) — the gap `isLegitimatelyWorking` is
+          // blind to by construction. Two-layer defer, sharp then safe:
+          //
+          //   (1) PROVEN-alive — a background shell registered from its
+          //       structured `backgroundTaskId` launch marker and not yet
+          //       reported dead (`<task-notification>` completed / KillShell).
+          //       A process is running RIGHT NOW, so defer. When it finishes,
+          //       the alive-set empties and the fallback fires at ~300s —
+          //       restoring fast wedge recovery the coarse guard held to 900s.
+          if (s.aliveShells.size > 0) continue
+          //   (2) SAFE DEGRADATION — only while the CLI markers have NEVER
+          //       parsed (`!bgMarkerParserConfirmed`): we cannot then tell a
+          //       live auto-backgrounded bash from a finished one, so fall
+          //       back to the coarse turn-scoped `sawBashThisTurn` guard —
+          //       900s-bounded by `fallbackHardCeiling` (never stacks, never
+          //       hangs). Once ANY marker has parsed, the CLI is proven
+          //       compatible, this layer switches off, and layer (1) alone
+          //       governs. Scoped to the modern callback-wired path so the
+          //       legacy defer-off / defer-bool fixtures keep their semantics.
+          if (!bgMarkerParserConfirmed && s.sawBashThisTurn) continue
         } else if (!forceDisable && activeDeps.deferFallbackWhileToolInFlight === true && s.inFlightTools.size > 0) {
           continue
         }
@@ -657,4 +768,10 @@ export function __getStateForTests(key: string): SilencePokeState | undefined {
 export function __resetAllForTests(): void {
   state.clear()
   stopTimer()
+  bgMarkerParserConfirmed = false
+}
+
+/** Test-only: peek at the process-scoped #3519 safe-degradation latch. */
+export function __bgMarkerParserConfirmedForTests(): boolean {
+  return bgMarkerParserConfirmed
 }

package/telegram-plugin/silent-end.ts

@@ -86,6 +86,29 @@ export interface SilentEndDeps {
   hasOutboundDeliveredSince?: (chatId: string, sinceMs: number, threadId?: number | null) => boolean
   /** Wall-clock now, ms. Defaults to `Date.now`; injectable for tests. */
   now?: () => number
+  /**
+   * #3513 (correction 1): was `text` marked ephemeral-shown on the progress card
+   * for `turnNonce` (the durable shown-ledger)? Injected so the captured-prose
+   * bridge (E3) — which sends via `bot.api.sendMessage` directly, bypassing
+   * `normalizeOutboundBody` — refuses to deliver a block that was already
+   * assigned to the ephemeral surface. The ledger only ever holds STRUCTURAL
+   * narration (correction 4: never a possibly-terminal answer), so this can
+   * never suppress a genuine answer. Omitted → the check is skipped (the
+   * structural classifier remains the guard).
+   */
+  isBlockShown?: (turnNonce: string | null | undefined, text: string) => boolean
+  /**
+   * #3513 follow-up (MF2): has a prior BACKSTOP already delivered this turn's
+   * answer, per the durable delivered-keys journal? Injected so the captured-
+   * prose bridge (E3) enforces exactly-once-among-backstops DURABLY — if the
+   * turn-flush backstop (E1/E2, `deliverySource:'flush'`) or the outbox sweep
+   * (E4, `'sweep'`) already delivered this nonce, the bridge must NOT deliver a
+   * second copy, even across a process boundary the in-memory ledger can't see.
+   * This counts ONLY backstop deliveries (via `backstopAlreadyDelivered`), never
+   * an explicit E0 reply (#3510 recap), so a legitimate later explicit reply is
+   * unaffected. Omitted → the check is skipped (never suppress on doubt).
+   */
+  backstopDeliveredNonceHit?: (turnNonce: string | null | undefined) => boolean
 }
 
 /**
@@ -306,6 +329,8 @@ export interface CapturedProseDecision {
     | 'turnkey-mismatch'
     | 'turnid-mismatch'
     | 'no-substantive-prose'
+    | 'ephemeral-shown'
+    | 'already-delivered'
 }
 
 /**
@@ -352,6 +377,23 @@ export function decideCapturedProseDelivery(
   }
   const text = typeof state.pendingText === 'string' ? state.pendingText : ''
   if (text.trim().length < minChars) return { deliver: false, reason: 'no-substantive-prose' }
+  // #3513: the persisted prose was already surfaced on the ephemeral progress
+  // card for this turn (durable shown-ledger) — the single-surface invariant
+  // forbids the bridge from ALSO delivering it to chat. The ledger only holds
+  // structural narration (never a possibly-terminal answer), so this can never
+  // suppress a genuine answer.
+  if (deps?.isBlockShown?.(state.turnId, text) === true) {
+    return { deliver: false, reason: 'ephemeral-shown' }
+  }
+  // #3513 follow-up (MF2): exactly-once-among-backstops. If a prior backstop
+  // (turn-flush E1/E2 or the outbox sweep E4) already delivered THIS turn's
+  // answer per the durable journal, the bridge must not deliver a duplicate —
+  // even across the process boundary the in-memory dedup can't see. Counts only
+  // backstop deliveries, never an explicit E0 reply, so a genuine later explicit
+  // reply is never blocked here.
+  if (deps?.backstopDeliveredNonceHit?.(state.turnId) === true) {
+    return { deliver: false, reason: 'already-delivered' }
+  }
   return { deliver: true, text, reason: 'captured-prose' }
 }