switchroom 0.19.22 → 0.19.23

package/skills/dev-protocol/SKILL.md

@@ -13,51 +13,14 @@ description: >
 
 # Development Protocol — the playbook
 
-The always-loaded CLAUDE.md "Development Protocol" section is the summary.
-This skill is the long-form procedure. Work through the five phases in order;
-they are checkpoints, not vibes.
-
-## 1. Orient — ground before you build
-
-Before forming any theory or plan:
-
-- **Read the real source.** The repo's source files at the current HEAD — not
-  build artifacts (`dist/`, generated files, caches), not your memory of the
-  code, not the task description's paraphrase. If a claim matters, open the
-  file.
-- **Verify the root cause, not the first plausible cause.** Reproduce or trace
-  the failure to a specific mechanism before fixing. "This line looks wrong"
-  is a lead; the fix ships only when you can say *why* it produced the
-  observed symptom.
-- **Report contradicting evidence.** If what you find contradicts the task
-  description, the ticket, or your own working theory — say so explicitly and
-  stop to re-plan. Never force-fit evidence to the plan you already had.
-- **Cite everything.** Claims about the codebase carry `file:line`, commit
-  hashes, or PR numbers. "The scaffold appends fragments at
-  `src/agents/scaffold.ts:4113`" is a claim; "the scaffold appends fragments
-  somewhere" is not.
-
-## 2. Clarify vs proceed
-
-- **Infer first.** Most questions are answerable from the codebase, git
-  history, existing tests, or docs. Exhaust those before asking.
-- **One question at a time.** If genuinely unsure after inferring, ask the
-  single question whose answer unblocks the most work. Phrase it as a
-  decision with a default: state what you found, the 2–3 viable options, which
-  you'd pick and why, and ask for confirmation — e.g. *"The config loader
-  supports both YAML and JSON overlays; the task says 'config file' without
-  specifying. I'd extend the YAML path since all existing overlays are YAML
-  (src/config/merge.ts:88) — confirm, or should JSON be covered too?"* Never
-  send a questionnaire.
-- **Phase discipline.** Clarify during *planning*. Once the plan is agreed,
-  execute autonomously: make the reasonable call on small ambiguities, record
-  the assumption in your report, and keep moving. Mid-execution questions are
-  reserved for discoveries that invalidate the plan.
-
-## 3. Design-align on larger tasks
-
-**Classify the task first.** Treat it as "larger" (design-align before
-implementing) when ANY of these hold:
+The always-loaded CLAUDE.md "Development Protocol" section carries the
+judgement criteria. This skill carries the parts that are *this fleet's
+specific opinion* — the ones you would get wrong by defaulting to generic
+good practice, because our answer differs from the obvious one.
+
+## 1. Is this a "larger" task? (decides whether you design-align first)
+
+Treat it as larger — design report before implementing — when ANY of these hold:
 
 - It changes a public interface, schema, config shape, or on-disk format.
 - It cuts across 3+ modules or touches a load-bearing invariant.
@@ -67,65 +30,85 @@ implementing) when ANY of these hold:
   ("add flag Y").
 - It will land as more than one PR.
 
-Small, single-concern, obvious-approach changes skip straight to phase 4.
-
-For larger tasks:
-
-1. **Design report before code.** Send the user an evidence-grounded report:
-   what exists today (with citations), what will change, the chosen approach
-   and its rejected alternatives, and the PR staging plan. Get alignment
-   before implementation.
-2. **Red-team your own plan adversarially.** Review the design item by item.
-   Each item gets a verdict — `SOUND`, `RISK`, or `WRONG` — backed by
-   evidence (a file you read, a test you ran, a documented behavior), not
-   intuition. Fix every `WRONG` and address every `RISK` before starting.
-3. **Stage delivery as focused single-concern PRs.** One concern per PR:
-   reviewable in one sitting, revertable in one command. Never bundle a
-   refactor with a behavior change.
-
-## 4. Pipeline — how a change ships
-
-1. **Branch off fresh main.** `git fetch && git checkout -b <branch> origin/main`.
-2. **Implement with durable fixes.** Fix root causes. A workaround is
-   acceptable only with an explicit reason stated and a follow-up filed.
-   Prefer deterministic mechanisms (a check, a hook, a schema, a lint gate)
-   over model-dependent behavior — if code can enforce the guarantee, don't
-   leave it to prompt discipline.
-3. **Tests assert outcomes.** Every test must fail if the bug it guards
-   returns. A test that merely exercises the code path without asserting the
-   observable outcome is not a test.
-4. **Scoped tests + lint locally.** Run the test files covering what you
-   touched, plus the repo's lint gate. Local runs are a fast filter; **CI is
-   the full-suite authority** — never claim done off a local run alone.
-5. **Adversarial review of the diff.** Dispatch a reviewer (sub-agent or
-   fresh pass) with this structure:
-   - Input: the full diff, the task statement, and the design report if one
-     exists.
-   - Charge: *find reasons this change is wrong* — correctness, missed edge
-     cases, untested behavior, inconsistency with surrounding code, docs
-     drift, security/data-loss risk.
-   - Output: a findings list, each with severity (high/medium/low), the
-     evidence (`file:line`), and a concrete fix.
-6. **Fix ALL findings — including lows.** A low you skip is a bug you
-   shipped. If a finding is genuinely invalid, rebut it with evidence in
-   writing; silence is not a rebuttal.
-7. **Re-review the fix.** The re-review verdict must contain, per original
-   finding: the finding ID, what changed (`file:line` of the fix), whether it
-   fully resolves the finding (`RESOLVED` / `PARTIAL` / `REBUTTED` with
-   evidence), and whether the fix introduced anything new. A bare "fixed" is
-   not a verdict.
-8. **Merge only on CI green.** No exceptions. A red or flaky CI run is a
-   blocker to investigate, not to override.
-
-## 5. Communicate while you work
-
-- **Consolidated messages.** Batch related findings and results into one
-  substantive update; never send five fragments where one message serves.
-- **Always-visible progress.** Long-running work surfaces status the user can
-  see (progress card, interim edit, explicit "still running: X"). Never go
-  dark mid-task.
-- **No foreground watches over 30 seconds.** Anything longer — builds, CI
-  waits, deploys — runs in the background with a notification on completion.
-  Don't block a turn polling.
-- **Max 15 parallel sub-agents.** Fan out for genuinely parallel work
-  (independent reviews, independent modules), but cap the swarm at 15.
+Small, single-concern, obvious-approach changes skip straight to the pipeline.
+Design-aligning a one-liner is its own failure mode.
+
+## 2. Design report + red-team (larger tasks only)
+
+The report states what exists today **with citations**, what will change, the
+chosen approach, the alternatives you rejected and why, and the PR staging
+plan. Get alignment before implementing.
+
+Then red-team your own plan item by item. Each item gets a verdict —
+`SOUND`, `RISK`, or `WRONG` — backed by evidence you can point at (a file you
+read, a test you ran, documented behaviour), not intuition. Fix every `WRONG`
+and address every `RISK` before starting. A red-team that returns all-`SOUND`
+on a non-trivial plan is a red-team you didn't actually do.
+
+## 3. Ask one question, as a decision with a default
+
+If you're genuinely blocked after inferring from code and history, don't send
+a questionnaire. State what you found, the 2–3 viable options, which you'd
+pick and why, and ask for confirmation:
+
+> "The config loader supports both YAML and JSON overlays; the task says
+> 'config file' without specifying. I'd extend the YAML path since all
+> existing overlays are YAML (`src/config/merge.ts:88`) — confirm, or should
+> JSON be covered too?"
+
+Clarify during *planning*. Once the plan is agreed, execute autonomously:
+make the reasonable call on small ambiguities, record the assumption in your
+report, keep moving. Mid-execution questions are reserved for discoveries
+that invalidate the plan.
+
+## 4. Adversarial review — bounded on purpose
+
+Dispatch the review to a **fresh** pass or sub-agent; the coder cannot review
+its own work in-context. Structure it:
+
+- **Input:** the full diff, the task statement, and the design report if one exists.
+- **Charge:** *find reasons this change is wrong* — correctness, missed edge
+  cases, untested behaviour, inconsistency with surrounding code, docs drift,
+  security or data-loss risk.
+- **Output:** a findings list, each with a severity, the evidence (`file:line`),
+  and a concrete fix.
+
+**The severity gate — this is the fleet-specific part.** The old rule was
+"fix ALL findings including lows, then re-review". That is a loop generator by
+construction: an adversarial reviewer always surfaces lows (that is its job),
+fixing lows produces a new diff, and a new diff earned another re-review. It
+produced PRs going four rounds where the last round's only finding was an
+inaccurate doc comment. So:
+
+- **Blockers and mediums block the merge.** Fix them.
+- **Lows do NOT block.** Fix a low inline only if it's a genuine one-liner;
+  otherwise **file a follow-up issue and merge**. Filing is mandatory — an
+  unfiled low is a dropped bug, and there is no human team to catch it later.
+- **A re-review is earned only by a behavioural fix.** A docs-, comment-,
+  log-, or test-only fix commit does not earn another pass.
+- **Two rounds is the cap.** Prefix every commit answering a review round
+  `review-fix:` — `scripts/check-review-rounds.mjs` counts them and the
+  `review-rounds` check fails past two, unless a `review-cap-override` label
+  is on the PR.
+
+If a finding is genuinely invalid, rebut it with evidence in writing; silence
+is not a rebuttal.
+
+When you do re-review, the verdict states per original finding: the finding
+ID, what changed (`file:line` of the fix), whether it fully resolves the
+finding (`RESOLVED` / `PARTIAL` / `REBUTTED` with evidence), and whether the
+fix introduced anything new. A bare "fixed" is not a verdict.
+
+## 5. Non-obvious pipeline rules
+
+- **CI is the full-suite authority.** Local scoped tests are a fast filter,
+  never the merge evidence. Never claim done off a local run alone.
+- **A test that wouldn't fail on the bug it guards is not a test.** Assert the
+  observable outcome, not that the code path executed.
+- **Prefer a deterministic mechanism over prompt discipline.** If a check, a
+  hook, a schema, or a lint gate can enforce the guarantee, write that instead
+  of a convention — conventions demonstrably fail here.
+- **Never go dark, and never foreground-watch over 30 seconds.** Builds, CI
+  waits, and deploys run in the background with a notification. Batch related
+  findings into one substantive update rather than five fragments. Cap
+  parallel sub-agents at 15.

package/telegram-plugin/bunfig.toml

@@ -0,0 +1,10 @@
+# bun test configuration for runs whose CWD is telegram-plugin/ — CI's
+# `bun-test-run` job (scripts/bun-test-ci.sh) and `bun run --cwd telegram-plugin`.
+#
+# bun reads the bunfig.toml in its CWD only, so this file exists purely to load
+# the same state-dir hermeticity preload as the repo-root bunfig.toml. Keep the
+# two in sync; `npm run lint:agent-state-dir-hermeticity` fails if either stops
+# loading the guard. Rationale for the guard itself lives in
+# tests/vitest-setup/agent-state-dir-guard.mjs.
+[test]
+preload = ["../tests/vitest-setup/agent-state-dir-guard.mjs"]

package/telegram-plugin/dist/gateway/gateway.js

@@ -21051,7 +21051,8 @@ var init_schema = __esm(() => {
       retain: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `retain` LLM op (memory ingestion). Emits " + "`HINDSIGHT_API_RETAIN_LLM_*`. Absent \u2192 uses the global model/provider."),
       reflect: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `reflect` LLM op (synthesis / mental-model " + "refresh). Emits `HINDSIGHT_API_REFLECT_LLM_*`. Absent \u2192 uses global."),
       consolidation: HindsightPerOpLlmSchema.optional().describe("Per-op override for the `consolidation` LLM op (background memory " + "merge). Emits `HINDSIGHT_API_CONSOLIDATION_LLM_*`. Absent \u2192 global.")
-    }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults.")
+    }).optional().describe("LLM knob for the hindsight container. The flat `provider`/`model` set " + "the global default (backward-compatible); optional `retain`/`reflect`/" + "`consolidation` blocks override individual ops. All fields optional; " + "unset fields fall back to the hard-coded defaults."),
+    env: exports_external.record(exports_external.union([exports_external.string(), exports_external.number(), exports_external.boolean()])).optional().describe("Operator overrides for switchroom's capability-gated Hindsight " + "performance defaults. Only the keys switchroom actually manages are " + "honoured (`HINDSIGHT_PERF_ENV_KEYS` in " + "src/setup/hindsight-perf-defaults.ts: RERANKER_LOCAL_FP16, " + "LLM_MAX_CONCURRENT, RETAIN/CONSOLIDATION_LLM_MAX_CONCURRENT, " + "RECALL_MAX_CANDIDATES_PER_SOURCE, LINK_EXPANSION_PER_ENTITY_LIMIT, " + "LINK_EXPANSION_TIMEOUT, LLM_REASONING_EFFORT), plus the " + "embedded-PostgreSQL (pg0) sizing keys switchroom manages in " + "src/setup/hindsight-pg-defaults.ts (`HINDSIGHT_PG_ENV_KEYS`: " + "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE, " + "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS \u2014 a postgres size string such " + "as `4GB`, or the sentinel `off` to leave pg0's own default for that " + "one knob). A value set here " + "REPLACES switchroom's default and is emitted even when the gating " + "capability is absent, so an operator can always force a knob. Other " + "`HINDSIGHT_API_*` keys are deliberately IGNORED \u2014 a blanket " + "passthrough would collide with the vars startHindsight() derives " + "itself (HINDSIGHT_API_PORT, the retain token/deadline budget).")
   });
   MicrosoftWorkspaceConfigSchema = exports_external.object({
     microsoft_client_id: exports_external.string().min(1).optional().describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id'). OPTIONAL \u2014 omit it to use " + "switchroom's shipped default Microsoft app (zero-config). " + "Set it only to bring your own Entra app (BYO)."),
@@ -76376,7 +76377,9 @@ function createBackstopReadBack(w) {
     };
     try {
       const r = await w.gate(() => w.editMessageText(messageId, body, editApiOpts), gateOpts);
-      return w.isShed(r) ? "ambiguous" : "exists";
+      if (w.isShed(r) || r === undefined)
+        return "ambiguous";
+      return "exists";
     } catch (err) {
       return classifyReadBackError(err);
     }
@@ -79124,6 +79127,7 @@ function handleSessionEvent(deps, ev) {
               sentIds = delivery.sentIds;
               chunkCount = delivery.chunkCount;
               delivered = delivery.delivered;
+              turn.landedUnconfirmed = delivery.landedUnconfirmed;
               outboundDedup.record(backstopChatId, backstopThreadId, capturedText, Date.now(), getCurrentTurn()?.registryKey ?? null);
               if (sentIds.length > 0) {
                 flushedTurnSupersede.record(backstopChatId, backstopThreadId, { turnId: turn.turnId, messageIds: sentIds, text: capturedText }, Date.now());
@@ -83021,6 +83025,75 @@ function assertPositive(value, label) {
   }
 }
 
+// ../src/setup/host-capabilities.ts
+init_paths();
+
+// ../src/setup/hindsight-perf-defaults.ts
+var HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION = 150;
+var HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE = Math.ceil(HINDSIGHT_RERANKER_MAX_CANDIDATES_FOR_DERIVATION * 0.4);
+var HINDSIGHT_DEFAULT_LINK_EXPANSION_PER_ENTITY_LIMIT = 50;
+var HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S = 2;
+var HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT = "low";
+var HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT = 4;
+var HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT = 1;
+var HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT = 1;
+var HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16 = "true";
+var HINDSIGHT_PERF_DEFAULTS_UNGATED = [
+  [
+    "HINDSIGHT_API_RECALL_MAX_CANDIDATES_PER_SOURCE",
+    String(HINDSIGHT_DEFAULT_RECALL_MAX_CANDIDATES_PER_SOURCE)
+  ],
+  [
+    "HINDSIGHT_API_LINK_EXPANSION_PER_ENTITY_LIMIT",
+    String(HINDSIGHT_DEFAULT_LINK_EXPANSION_PER_ENTITY_LIMIT)
+  ],
+  [
+    "HINDSIGHT_API_LINK_EXPANSION_TIMEOUT",
+    String(HINDSIGHT_DEFAULT_LINK_EXPANSION_TIMEOUT_S)
+  ],
+  ["HINDSIGHT_API_LLM_REASONING_EFFORT", HINDSIGHT_DEFAULT_LLM_REASONING_EFFORT]
+];
+var HINDSIGHT_PERF_DEFAULTS_GPU = [
+  ["HINDSIGHT_API_RERANKER_LOCAL_FP16", HINDSIGHT_DEFAULT_RERANKER_LOCAL_FP16]
+];
+var HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM = [
+  ["HINDSIGHT_API_LLM_MAX_CONCURRENT", String(HINDSIGHT_DEFAULT_LLM_MAX_CONCURRENT)],
+  [
+    "HINDSIGHT_API_RETAIN_LLM_MAX_CONCURRENT",
+    String(HINDSIGHT_DEFAULT_RETAIN_LLM_MAX_CONCURRENT)
+  ],
+  [
+    "HINDSIGHT_API_CONSOLIDATION_LLM_MAX_CONCURRENT",
+    String(HINDSIGHT_DEFAULT_CONSOLIDATION_LLM_MAX_CONCURRENT)
+  ]
+];
+var HINDSIGHT_PERF_ENV_KEYS = new Set([
+  ...HINDSIGHT_PERF_DEFAULTS_UNGATED,
+  ...HINDSIGHT_PERF_DEFAULTS_GPU,
+  ...HINDSIGHT_PERF_DEFAULTS_LOCAL_LLM
+].map(([k]) => k));
+
+// ../src/setup/hindsight-pg-defaults.ts
+var HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION = 8 * 1024;
+var HINDSIGHT_PG_APP_ANON_MIB = 2560;
+var HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB = 2048;
+var HINDSIGHT_PG_SHARED_BUFFERS_BUDGET_MIB = HINDSIGHT_PG_MEM_LIMIT_MIB_FOR_DERIVATION - HINDSIGHT_PG_APP_ANON_MIB - HINDSIGHT_PG_PAGE_CACHE_FLOOR_MIB;
+var HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB = 1536;
+var HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB = 4096;
+function pgMib(mib) {
+  return `${mib}MB`;
+}
+var HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV = "SWITCHROOM_HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE";
+var HINDSIGHT_PG_SHARED_BUFFERS_ENV = "SWITCHROOM_HINDSIGHT_PG_SHARED_BUFFERS";
+var HINDSIGHT_PG_DEFAULTS = [
+  [
+    HINDSIGHT_PG_EFFECTIVE_CACHE_SIZE_ENV,
+    pgMib(HINDSIGHT_PG_DEFAULT_EFFECTIVE_CACHE_SIZE_MIB)
+  ],
+  [HINDSIGHT_PG_SHARED_BUFFERS_ENV, pgMib(HINDSIGHT_PG_DEFAULT_SHARED_BUFFERS_MIB)]
+];
+var HINDSIGHT_PG_ENV_KEYS = new Set(HINDSIGHT_PG_DEFAULTS.map(([k]) => k));
+
 // ../src/setup/hindsight.ts
 var HINDSIGHT_DEFAULT_API_PORT = 18888;
 var HINDSIGHT_DEFAULT_MCP_URL = `http://127.0.0.1:${HINDSIGHT_DEFAULT_API_PORT}/mcp/`;
@@ -87593,10 +87666,10 @@ function createCapturedResumeDispatcher(ports) {
       if (delivered) {
         ports.obligationLedger.close(o.originTurnId);
         ports.backstopDeliveryLedger.clear(o.originTurnId);
-        stderr(`telegram gateway: captured-answer resume delivered \u2014 origin=${o.originTurnId} ` + `${sentIds.length} chunk(s) confirmed; obligation closed
+        stderr(`telegram gateway: captured-answer resume delivered \u2014 origin=${o.originTurnId} ` + `${sentIds.length} message id(s) landed; obligation closed
 `);
       } else {
-        stderr(`telegram gateway: captured-answer resume partial \u2014 origin=${o.originTurnId} ` + `tail still not confirmed; left OPEN for retry
+        stderr(`telegram gateway: captured-answer resume partial \u2014 origin=${o.originTurnId} ` + `tail still not landed; left OPEN for retry
 `);
       }
     } catch (err) {
@@ -88469,6 +88542,14 @@ function resolveAnswerThreadId(input) {
 
 // gateway/turns-jsonl-rotate.ts
 var TURNS_JSONL_MAX_BYTES = 5 * 1024 * 1024;
+var DEFAULT_AGENT_STATE_DIR = "/state/agent";
+function resolveAgentStateDir(env = process.env) {
+  const dir = env.SWITCHROOM_AGENT_STATE_DIR?.trim();
+  return dir != null && dir !== "" ? dir.replace(/\/+$/, "") : DEFAULT_AGENT_STATE_DIR;
+}
+function resolveTurnsJsonlPath(env = process.env) {
+  return `${resolveAgentStateDir(env)}/turns.jsonl`;
+}
 function maybeRotate(path3, fs3, maxBytes = TURNS_JSONL_MAX_BYTES) {
   const size = fs3.statSize(path3);
   if (size == null || size < maxBytes)
@@ -88497,7 +88578,8 @@ function buildTurnRecord(turn, endedAt) {
     duration_ms: turn.startedAt > 0 ? endedAt - turn.startedAt : 0,
     tools: turn.toolCallCount ?? 0,
     status: computeTurnStatus(turn),
-    turn_id: turn.turnId
+    turn_id: turn.turnId,
+    ...turn.landedUnconfirmed != null && turn.landedUnconfirmed > 0 ? { landed_unconfirmed: turn.landedUnconfirmed } : {}
   };
 }
 
@@ -88679,8 +88761,16 @@ async function runBackstopDelivery(ledger, turnId, chunks, cardMessageId, deps,
       break;
   }
   const sentIds = ledger.sentIds(turnId);
-  const delivered = ledger.allConfirmed(turnId, chunkCount) && backstopReceiptIds(ledger.confirmedIds(turnId), cardMessageId).length > 0;
+  const confirmed = ledger.allConfirmed(turnId, chunkCount);
+  const allLanded = chunkCount > 0 && ledger.unsentIndices(turnId, chunkCount).length === 0;
+  const delivered = allLanded && backstopReceiptIds(sentIds, cardMessageId).length > 0;
   const exhausted = !delivered;
+  const confirmedSet = new Set(ledger.confirmedIds(turnId));
+  const landedUnconfirmedIds = sentIds.filter((id) => !confirmedSet.has(id));
+  if (delivered && !confirmed) {
+    stderr(`telegram gateway: backstop delivery landed-unconfirmed for turn ${turnId} \u2014 ` + `every chunk returned a fresh message id but the read-back probe was ` + `inconclusive for ${landedUnconfirmedIds.length} of ${sentIds.length} landed ` + `id(s); counting it delivered (an ambiguous probe is not a failure)
+`);
+  }
   if (deps.recordOutbound && sentIds.length > 0) {
     const texts = [];
     const ids = [];
@@ -88692,7 +88782,7 @@ async function runBackstopDelivery(ledger, turnId, chunks, cardMessageId, deps,
     }
     deps.recordOutbound(ids, texts);
   }
-  return { sentIds, chunkCount, delivered, attempts, exhausted };
+  return { sentIds, chunkCount, delivered, confirmed, landedUnconfirmedIds, attempts, exhausted };
 }
 
 // gateway/inbound-delivery-confirm.ts
@@ -96331,10 +96421,10 @@ function startOutboxSweep(deps) {
 }
 
 // ../src/build-info.ts
-var VERSION2 = "0.19.22";
-var COMMIT_SHA = "50ef9fb5";
-var COMMIT_DATE = "2026-07-26T06:22:32Z";
-var LATEST_PR = 3696;
+var VERSION2 = "0.19.23";
+var COMMIT_SHA = "56e3c01e";
+var COMMIT_DATE = "2026-07-26T13:24:39Z";
+var LATEST_PR = 3711;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -98194,7 +98284,7 @@ var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join65(homedir19(), ".claude",
 var permCardStore = createPermissionCardStore(STATE_DIR);
 var BLOCKED_APPROVALS_DIR = process.env.SWITCHROOM_BLOCKED_APPROVALS_DIR ?? "/state/blocked-approvals";
 var AGENT_NAME = process.env.SWITCHROOM_AGENT_NAME ?? "agent";
-var blockedApprovalStore = createBlockedApprovalStore(BLOCKED_APPROVALS_DIR, AGENT_NAME, process.env.SWITCHROOM_AGENT_STATE_DIR ?? "/state/agent");
+var blockedApprovalStore = createBlockedApprovalStore(BLOCKED_APPROVALS_DIR, AGENT_NAME, resolveAgentStateDir());
 function reconcileBlockedApprovals() {
   const oldest = selectOldestHeld(pendingPermissions);
   if (oldest == null) {
@@ -98975,7 +99065,8 @@ async function deliverAnswer(args) {
     sentIds: result.sentIds,
     chunkCount: result.chunkCount,
     delivered: result.delivered,
-    exhausted: result.exhausted
+    exhausted: result.exhausted,
+    landedUnconfirmed: result.landedUnconfirmedIds.length
   };
 }
 var chatAvailableReactions = new Map;
@@ -99802,7 +99893,7 @@ function snapshotContextOccupancy() {
     } catch {
       cap = null;
     }
-    const stateDir = process.env.SWITCHROOM_AGENT_STATE_DIR ?? "/state/agent";
+    const stateDir = resolveAgentStateDir();
     writeContextOccupancySnapshot(stateDir, buildContextOccupancy(occupancy, cap, Date.now()));
   } catch {}
 }
@@ -99814,10 +99905,11 @@ function emitTurnRecord(turn, endedAt) {
       toolCallCount: turn.toolCallCount ?? 0,
       turnId: turn.turnId,
       finalAnswerDelivered: turn.finalAnswerDelivered,
-      deliveryOutcome: turn.deliveryOutcome
+      deliveryOutcome: turn.deliveryOutcome,
+      landedUnconfirmed: turn.landedUnconfirmed
     }, endedAt)) + `
 `;
-    const turnsPath = "/state/agent/turns.jsonl";
+    const turnsPath = resolveTurnsJsonlPath();
     maybeRotate(turnsPath, {
       statSize: (p) => {
         try {

package/telegram-plugin/gateway/backstop-delivery.ts

@@ -114,8 +114,10 @@ export class BackstopDeliveryLedger {
 
   /**
    * #3278 — transition a landed-unconfirmed chunk to `landed-confirmed` after a
-   * read-back probe proved the message exists in the chat. Only a confirmed
-   * chunk counts toward delivery / `complete`.
+   * read-back probe proved the message exists in the chat. Confirmation is the
+   * STRONGER of the two delivery states; the weaker `landed-unconfirmed` also
+   * counts as delivered (an inconclusive probe is not a failure — see
+   * `runBackstopDelivery`). Only a POSITIVE absence (`demoteChunk`) un-delivers.
    */
   confirmChunk(turnId: string, index: number): void {
     let set = this.confirmed.get(turnId)
@@ -164,8 +166,14 @@ export class BackstopDeliveryLedger {
     return true
   }
 
-  /** Landed message ids of CONFIRMED chunks only, in chunk-index order — the set
-   *  the delivery predicate counts (fresh non-card ids that are proven-present). */
+  /** Landed message ids of CONFIRMED chunks only, in chunk-index order — the
+   *  read-back view of the ledger (ids proven present in the chat). The delivery
+   *  predicate counts LANDED ids (`sentIds`), not these; this is the stronger
+   *  proven-present subset. Its production consumer is
+   *  {@link BackstopDeliveryResult.landedUnconfirmedIds} — `sentIds` minus these
+   *  is the landed-but-uncorroborated set that reaches `turns.jsonl` as
+   *  `landed_unconfirmed`, the counter that measures whether this module's
+   *  optimism about an inconclusive probe is ever wrong. */
   confirmedIds(turnId: string): number[] {
     const m = this.chunks.get(turnId)
     const set = this.confirmed.get(turnId)
@@ -226,9 +234,11 @@ export class BackstopDeliveryLedger {
  *                  `landed-confirmed` (counts toward delivery).
  *  - `absent`    — Telegram `400 message to edit not found` ⇒ positive absence
  *                  ⇒ demote to `unsent` (safe to re-send — it never landed).
- *  - `ambiguous` — 429 / 5xx / network / gate-shed / anything else ⇒ leave
- *                  `landed-unconfirmed`; NEVER re-send (a re-send would risk a
- *                  duplicate, and duplicate-risk beats missing-risk here).
+ *  - `ambiguous` — 429 / 5xx / network / gate-shed / gate no-op / anything else
+ *                  ⇒ leave `landed-unconfirmed`; NEVER re-send (a re-send would
+ *                  risk a duplicate, and duplicate-risk beats missing-risk
+ *                  here) and NEVER count it as a delivery failure either — the
+ *                  probe established nothing, so the landed-id evidence stands.
  *
  * NOTE (honest limitation, #3278 §1.4): a passing probe proves only that the
  * message EXISTS at that chat_id. It does NOT prove the human's client rendered
@@ -322,8 +332,36 @@ export interface BackstopDeliveryResult {
   sentIds: number[]
   /** Number of input chunks the answer was split into. */
   chunkCount: number
-  /** True IFF every chunk landed at least one fresh non-card id. */
+  /**
+   * True IFF every chunk landed at least one message id AND at least one of
+   * them is a fresh non-card chat id. This is the DELIVERY verdict the turn
+   * record, the obligation ledger and the status reaction key on.
+   *
+   * A read-back probe can only ever LOWER it, and only on POSITIVE absence: an
+   * `absent` verdict demotes the chunk back to `unsent`, so it stops counting as
+   * landed. An `ambiguous` probe carries no information and therefore does not
+   * move this flag — see {@link confirmed}.
+   */
   delivered: boolean
+  /**
+   * True IFF every chunk was read-back CONFIRMED (`exists`). Strictly stronger
+   * than {@link delivered} and purely observational — nothing keys a failure on
+   * it. `delivered && !confirmed` is the `landed-unconfirmed` state: the Bot API
+   * returned fresh ids for every chunk but the probe could not corroborate them.
+   */
+  confirmed: boolean
+  /**
+   * The landed message ids NO read-back corroborated — `sentIds` minus the
+   * confirmed subset, in chunk-index order. Empty when {@link confirmed}.
+   *
+   * This is the MEASURABLE form of this module's central bet: a landed id whose
+   * probe came back inconclusive is counted as delivered. Its count is stamped
+   * onto the turn record as `landed_unconfirmed` (see `buildTurnRecord`) so the
+   * fleet can tell how often that bet is being made — and, if a
+   * `landed_unconfirmed` turn is ever followed by a "you never answered me",
+   * that the bet was wrong. Purely observational: nothing keys a failure on it.
+   */
+  landedUnconfirmedIds: number[]
   /** How many attempts ran (1..maxAttempts). */
   attempts: number
   /** True when retries were exhausted without full delivery (terminal fail). */
@@ -345,9 +383,12 @@ export interface BackstopDeliveryResult {
  * is read-back-probed via `deps.readBack` (when provided): `exists` confirms it,
  * `absent` demotes it to `unsent` so the NEXT attempt re-sends only that chunk,
  * and `ambiguous` leaves it `landed-unconfirmed` — never re-sent (duplicate-risk
- * beats missing-risk). `delivered` now requires every chunk `landed-confirmed`,
- * so an API-ack'd-but-silently-dropped send (fresh id, absent on read-back) is
- * reported `delivered:false` and the caller leaves the obligation OPEN.
+ * beats missing-risk). An API-ack'd-but-silently-dropped send (fresh id, absent
+ * on read-back) is therefore reported `delivered:false` and the caller leaves
+ * the obligation OPEN — a correct mechanism that is INERT UNTIL #3703, because
+ * the probe is 100% shed in production and never resolves `absent`. An
+ * INCONCLUSIVE probe is not a failure: it leaves `delivered` alone and only
+ * clears `confirmed` (see `BackstopDeliveryResult`).
  *
  * `recordOutbound` (when provided) fires ONCE at the end with the full landed
  * set and a `texts` array ALIGNED to the actual sent ids (via `ledger.entries`).
@@ -449,12 +490,52 @@ export async function runBackstopDelivery(
   }
 
   const sentIds = ledger.sentIds(turnId)
-  // #3278 — delivered IFF every chunk is `landed-confirmed` AND at least one
-  // confirmed id is a fresh non-card chat id (the receipt gate, guard 7).
+  const confirmed = ledger.allConfirmed(turnId, chunkCount)
+  // The delivery verdict is EVIDENCE-BASED, not confirmation-gated.
+  //
+  // #3278 originally required every chunk to be `landed-confirmed`, so an
+  // `ambiguous` probe — which by definition establishes nothing — produced
+  // `delivered:false`. That inverted the guard it was meant to be: the turn was
+  // recorded `send_failed`, the status reaction painted error, and the delivery
+  // obligation was left OPEN for a re-present, all for an answer the user had
+  // demonstrably received. In production the probe is ambiguous essentially
+  // always (it is issued at cosmetic priority in the same millisecond as the
+  // send it probes, so the per-chat token bucket sheds it), so this turned a
+  // successful backstop delivery into a logged failure ~146 times in two weeks.
+  //
+  // Absence of evidence is not evidence of absence. The verdict is therefore:
+  // every chunk LANDED (guard 6) and at least one landed id is a fresh non-card
+  // chat id (the receipt gate, guard 7). A probe can still lower it — an
+  // `absent` verdict demotes the chunk to `unsent` above, so it is no longer
+  // landed — which keeps #3278's real contribution (a positive absence is
+  // caught and re-sent) while an inconclusive probe changes nothing.
+  //
+  // Honesty about what that contribution is worth TODAY: it is INERT UNTIL
+  // #3703. The probe is issued at cosmetic priority in the same millisecond as
+  // the send it probes, so the per-chat token bucket sheds it 100% of the time
+  // (146 `ambiguous` / 0 `absent` across the live fleet) and the `absent` branch
+  // is structurally unreachable in production. The demote-and-re-send path below
+  // is a correct mechanism with no live trigger; #3703 is the change that wakes
+  // the probe (and must first fix its resplit-overwrite hazard). Do not read
+  // this block as "absence is still caught in production" — it is not, yet.
+  const allLanded = chunkCount > 0 && ledger.unsentIndices(turnId, chunkCount).length === 0
   const delivered =
-    ledger.allConfirmed(turnId, chunkCount) &&
-    backstopReceiptIds(ledger.confirmedIds(turnId), cardMessageId).length > 0
+    allLanded && backstopReceiptIds(sentIds, cardMessageId).length > 0
   const exhausted = !delivered
+  // The landed-but-uncorroborated set (L2/L5): `sentIds` minus the read-back
+  // confirmed subset. Surfaced on the result so the caller can stamp
+  // `landed_unconfirmed` on the turn record — the only way to measure whether
+  // counting an inconclusive probe as delivered is ever wrong.
+  const confirmedSet = new Set(ledger.confirmedIds(turnId))
+  const landedUnconfirmedIds = sentIds.filter(id => !confirmedSet.has(id))
+  if (delivered && !confirmed) {
+    stderr(
+      `telegram gateway: backstop delivery landed-unconfirmed for turn ${turnId} — ` +
+      `every chunk returned a fresh message id but the read-back probe was ` +
+      `inconclusive for ${landedUnconfirmedIds.length} of ${sentIds.length} landed ` +
+      `id(s); counting it delivered (an ambiguous probe is not a failure)\n`,
+    )
+  }
 
   if (deps.recordOutbound && sentIds.length > 0) {
     const texts: string[] = []
@@ -468,5 +549,5 @@ export async function runBackstopDelivery(
     deps.recordOutbound(ids, texts)
   }
 
-  return { sentIds, chunkCount, delivered, attempts, exhausted }
+  return { sentIds, chunkCount, delivered, confirmed, landedUnconfirmedIds, attempts, exhausted }
 }