switchroom 0.19.22 → 0.19.23

package/telegram-plugin/gateway/captured-answer-resume.ts

@@ -14,8 +14,8 @@
  *
  * ── The fix (design-of-record §2.2) ─────────────────────────────────────────
  * Make the re-present a *byte-identical captured-answer resume* of ONLY the
- * not-yet-`landed-confirmed` tail — never a regeneration — so a chunk that
- * already reached the chat is provably never re-posted:
+ * not-yet-LANDED tail — never a regeneration — so a chunk that already reached
+ * the chat is provably never re-posted:
  *
  *   1. On a partial (`!delivered`) turn-flush, persist a {@link
  *      CapturedDeliverySnapshot} (the split chunks + each landed chunk's ids and
@@ -25,9 +25,9 @@
  *   2. The obligation sweep's `represent` branch becomes source-aware: when the
  *      obligation carries a captured-delivery snapshot it drives THIS resume
  *      (re-run `runBackstopDelivery` for the SAME `turnId` and the SAME captured
- *      chunks, resuming at the first non-`landed-confirmed` index) instead of
- *      pushing a fresh-generation inbound. No snapshot ⇒ the genuine "model wrote
- *      nothing / never fired a backstop" case falls through to fresh generation
+ *      chunks, resuming at the first UNSENT index) instead of pushing a
+ *      fresh-generation inbound. No snapshot ⇒ the genuine "model wrote nothing
+ *      / never fired a backstop" case falls through to fresh generation
  *      unchanged.
  *   3. The in-memory ledger is rehydrated from the snapshot AND reconciled against
  *      the durable outbound-text oracle (`hasOutboundWithText`), so a chunk that
@@ -39,9 +39,29 @@
  * chunks (not a regenerated answer). #3278's per-chunk state machine
  * (`unsent → pending → landed-unconfirmed → {landed-confirmed | unsent}`) binds
  * here too: the resume re-PROBES `landed-unconfirmed` chunks (never re-sends
- * them) and re-SENDS only `unsent` ones, so a confirmed chunk is never duplicated
+ * them) and re-SENDS only `unsent` ones, so a landed chunk is never duplicated
  * by either the in-fire retry OR the cross-represent resume.
  *
+ * ── The CLOSE condition is LANDED, not confirmed (#3702) ────────────────────
+ * `runBackstopDelivery`'s verdict is evidence-based: every chunk landed a
+ * message id and at least one is a fresh non-card id. An inconclusive read-back
+ * does not lower it (only a POSITIVE `absent`, which demotes the chunk back to
+ * `unsent`, does). So a resume over a snapshot whose chunks ALL landed but were
+ * never corroborated closes the obligation having sent NOTHING — the re-probe
+ * ran, resolved nothing, and the landed-id evidence stood.
+ *
+ * That is deliberate, not an oversight. The alternative — keep the obligation
+ * OPEN because nothing corroborated the ids — has no corrective action
+ * available: the resume never re-sends a LANDED chunk, so every subsequent
+ * represent would re-run the same shed probe, send zero messages, and burn
+ * represent budget until the cap escalates a false "the agent never answered
+ * you" nudge to the operator. Representing cannot deliver anything the first
+ * delivery did not; the only thing it can produce is noise. When the durable
+ * outbound-text oracle CAN corroborate (history enabled + the row present) it
+ * confirms the chunk at hydration and the same close happens by the older
+ * `hasOutboundWithText` route — this path is the same decision when that oracle
+ * is unavailable.
+ *
  * This module is PURE state + orchestration over injected effects — no Telegram,
  * no SQLite, no gateway module state — so the resume decision is unit-testable
  * (see tests/captured-answer-resume.test.ts). The gateway owns the real
@@ -55,10 +75,10 @@ import type { CapturedDeliverySnapshot, Obligation } from './obligation-ledger.j
 /**
  * Build the durable {@link CapturedDeliverySnapshot} from the live per-chunk
  * ledger after a partial `runBackstopDelivery`. Captures every LANDED chunk's
- * message ids + confirmed flag so the resume can (a) never re-send a confirmed
- * chunk and (b) re-PROBE a landed-unconfirmed chunk instead of blindly re-sending
- * it. Chunks that never landed (send threw) are simply absent → the resume treats
- * them as `unsent` and re-sends them. Pure.
+ * message ids + confirmed flag so the resume can (a) never re-send a chunk that
+ * already landed and (b) re-PROBE a landed-unconfirmed chunk instead of blindly
+ * re-sending it. Chunks that never landed (send threw) are simply absent → the
+ * resume treats them as `unsent` and re-sends them. Pure.
  */
 export function buildCapturedDeliverySnapshot(
   ledger: BackstopDeliveryLedger,
@@ -165,9 +185,13 @@ export interface CapturedResumeDispatcher {
  * The obligation-sweep's captured-answer resume driver. Owns the in-flight guard
  * + the deliver→close/leave-open orchestration so the gateway sweep stays a
  * two-line dispatch. On each dispatch it consumes one represent-budget unit
- * (bounding the ladder → escalate), re-delivers only the non-confirmed tail, and:
+ * (bounding the ladder → escalate), re-delivers only the UNSENT tail (a landed
+ * chunk is re-probed, never re-sent), and:
  *   - fully delivered ⇒ record the supersede tail, close the obligation, GC the
- *     ledger (the represent ladder stops);
+ *     ledger (the represent ladder stops). Since #3702 "delivered" means every
+ *     chunk LANDED — so a snapshot that is already fully landed closes here
+ *     having sent nothing (see the module header for why that is the right
+ *     call, and why leaving it OPEN would only manufacture a false escalation);
  *   - still partial / error ⇒ leave the obligation OPEN so the next eligible
  *     sweep (after the per-represent grace) retries, until the represent cap
  *     escalates it to the operator nudge — no infinite loop.
@@ -176,7 +200,7 @@ export function createCapturedResumeDispatcher(ports: CapturedResumePorts): Capt
   const stderr = ports.stderr ?? (() => {})
   const inFlight = new Set<string>()
 
-  /** Re-deliver the non-confirmed tail of `o`'s captured answer, byte-identical,
+  /** Re-deliver the UNSENT tail of `o`'s captured answer, byte-identical,
    *  by rehydrating the per-chunk ledger from the snapshot reconciled against the
    *  durable text oracle. Never regenerates. */
   function deliver(o: Obligation, snapshot: CapturedDeliverySnapshot): Promise<{ delivered: boolean; sentIds: number[] }> {
@@ -221,16 +245,21 @@ export function createCapturedResumeDispatcher(ports: CapturedResumePorts): Capt
       if (delivered) {
         ports.obligationLedger.close(o.originTurnId)
         ports.backstopDeliveryLedger.clear(o.originTurnId)
+        // `sentIds` is `ledger.sentIds()` — every LANDED id, which since #3702
+        // routinely includes ids no read-back corroborated. Say "landed", not
+        // "confirmed": claiming confirmation for an uncorroborated id is exactly
+        // the overstatement this PR removed from the delivery verdict.
         stderr(
           `telegram gateway: captured-answer resume delivered — origin=${o.originTurnId} ` +
-            `${sentIds.length} chunk(s) confirmed; obligation closed\n`,
+            `${sentIds.length} message id(s) landed; obligation closed\n`,
         )
       } else {
-        // Tail still not confirmed — leave the obligation OPEN for the next paced
-        // sweep / escalation (bounded by the represent cap).
+        // Not fully landed (a chunk never got an id, or a positive `absent`
+        // demoted one) — leave the obligation OPEN for the next paced sweep /
+        // escalation (bounded by the represent cap).
         stderr(
           `telegram gateway: captured-answer resume partial — origin=${o.originTurnId} ` +
-            `tail still not confirmed; left OPEN for retry\n`,
+            `tail still not landed; left OPEN for retry\n`,
         )
       }
     } catch (err) {

package/telegram-plugin/gateway/gateway.ts

@@ -718,7 +718,7 @@ import {
 import { CurrentTurnMap } from './current-turn-map.js'
 import { resolveAnswerThreadId } from './answer-thread-resolve.js'
 import { decideObligationTurnEnd } from './obligation-turn-end.js'
-import { maybeRotate } from './turns-jsonl-rotate.js'
+import { maybeRotate, resolveAgentStateDir, resolveTurnsJsonlPath } from './turns-jsonl-rotate.js'
 import {
   buildTurnRecord,
   finalizeBackstopSendGated,
@@ -1032,7 +1032,7 @@ const blockedApprovalStore = createBlockedApprovalStore(
   // Fallback: the agent's OWN state dir, which the scaffold chowns to the agent
   // uid, so a write there always succeeds. Guarantees the record can never be
   // silently lost when the shared dir isn't writable by this agent's uid.
-  process.env.SWITCHROOM_AGENT_STATE_DIR ?? '/state/agent',
+  resolveAgentStateDir(),
 )
 
 /**
@@ -2456,9 +2456,9 @@ async function deliverAnswer(args: {
    *  the send alive if the user deleted their message. Null for synthesized
    *  turns (cron/handback) — those send bare, as before. */
   replyToMessageId: number | null
-  /** #3282 captured-answer RESUME (see captured-answer-resume.ts): re-deliver the SAME byte-identical chunks + pre-hydrate the ledger (non-confirmed tail only). */
+  /** #3282 captured-answer RESUME (see captured-answer-resume.ts): re-deliver the SAME byte-identical chunks + pre-hydrate the ledger (unsent tail only; a landed chunk is re-probed, never re-sent). */
   resume?: { snapshot: CapturedDeliverySnapshot; hydrate: (ledger: BackstopDeliveryLedger, turnId: string) => void }
-}): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean }> {
+}): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean; landedUnconfirmed: number }> {
   const { chatId, turnId } = args
   // Spacers into `\n\n` gaps then split (as executeReply); a resume re-delivers the EXACT captured chunks (byte-stable, no re-split).
   const chunks = args.resume
@@ -2594,6 +2594,7 @@ async function deliverAnswer(args: {
     chunkCount: result.chunkCount,
     delivered: result.delivered,
     exhausted: result.exhausted,
+    landedUnconfirmed: result.landedUnconfirmedIds.length, // #3702 — the caller stamps this on the turn record
   }
 }
 
@@ -3427,6 +3428,7 @@ export type CurrentTurn = {
   // turn-end paths (reply-tool tail, silent-marker, genuine no-reply), where
   // the legacy `finalAnswerDelivered` reading still applies unchanged.
   deliveryOutcome?: DeliveryOutcome
+  landedUnconfirmed?: number // #3702 — landed ids no read-back corroborated; emitted as `landed_unconfirmed` (rationale: turn-record-status.ts)
   // Feed-reopen-after-ack refinement — whether the reply that set
   // `finalAnswerDelivered` was a *substantive* final answer (stream
   // `done`, or ≥200 chars) as opposed to a short pinging interim ACK.
@@ -5012,7 +5014,7 @@ function snapshotContextOccupancy(): void {
     } catch {
       cap = null; // config unreadable → show occupancy without a ratio
     }
-    const stateDir = process.env.SWITCHROOM_AGENT_STATE_DIR ?? "/state/agent";
+    const stateDir = resolveAgentStateDir();
     writeContextOccupancySnapshot(
       stateDir,
       buildContextOccupancy(occupancy, cap, Date.now()),
@@ -5033,12 +5035,12 @@ function emitTurnRecord(turn: CurrentTurn, endedAt: number): void {
             toolCallCount: turn.toolCallCount ?? 0,
             turnId: turn.turnId,
             finalAnswerDelivered: turn.finalAnswerDelivered,
-            deliveryOutcome: turn.deliveryOutcome,
+            deliveryOutcome: turn.deliveryOutcome, landedUnconfirmed: turn.landedUnconfirmed,
           },
           endedAt,
         ),
       ) + '\n'
-    const turnsPath = '/state/agent/turns.jsonl'
+    const turnsPath = resolveTurnsJsonlPath() // honours SWITCHROOM_AGENT_STATE_DIR
     // Size-cap rotation: keep at most one rotated generation so the file can't
     // grow unbounded on a long-lived agent. Best-effort (never throws).
     maybeRotate(turnsPath, {

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -611,7 +611,14 @@ export function createBackstopReadBack(
     }
     try {
       const r = await w.gate(() => w.editMessageText(messageId, body, editApiOpts), gateOpts)
-      return w.isShed(r) ? 'ambiguous' : 'exists'
+      // A shed resolves the SEND_GATE_SHED sentinel; a gate no-op drop (the
+      // identical payload is already the last one sent for this message id) or
+      // an expired queue entry resolves `undefined`. In BOTH cases the edit
+      // never reached Telegram, so there is no evidence of existence —
+      // `ambiguous`, never a fabricated `exists`. Only a real API result
+      // (grammy resolves `true` or the edited Message) proves presence.
+      if (w.isShed(r) || r === undefined) return 'ambiguous'
+      return 'exists'
     } catch (err) {
       return classifyReadBackError(err)
     }

package/telegram-plugin/gateway/stream-render.ts

@@ -1856,6 +1856,12 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
             sentIds = delivery.sentIds
             chunkCount = delivery.chunkCount
             delivered = delivery.delivered
+            // #3702 — how many landed ids the read-back never corroborated.
+            // Stamped on the turn so `emitTurnRecord` writes `landed_unconfirmed`
+            // (omitted when 0): the fleet-visible counter for deliveries we call
+            // `complete` on the Bot API's ack alone, because the probe is
+            // inconclusive. Observational only — it never changes the status.
+            turn.landedUnconfirmed = delivery.landedUnconfirmed
 
             // #546 dedup: record what turn-flush just sent so a late-arriving
             // reply / stream_reply with the same content gets suppressed.

package/telegram-plugin/gateway/turn-record-status.ts

@@ -148,6 +148,20 @@ export interface TurnRecordRow {
   tools: number
   status: TurnStatus
   turn_id: string
+  /**
+   * How many landed message ids of this turn's backstop delivery the read-back
+   * probe never corroborated (`sentIds` minus the confirmed subset). OMITTED
+   * when zero, so an ordinary row is byte-identical to before.
+   *
+   * This is the measurable counterpart of the delivery verdict: since an
+   * inconclusive probe counts as delivered, a `complete` row carrying
+   * `landed_unconfirmed > 0` is a turn we called delivered on the Bot API's
+   * ack alone. Counting those is how the fleet can tell whether that optimism
+   * is ever wrong (a `landed_unconfirmed` turn followed by a "you never
+   * answered me" is the falsifying observation). It is NOT a failure signal and
+   * nothing escalates on it.
+   */
+  landed_unconfirmed?: number
 }
 
 /**
@@ -165,6 +179,7 @@ export function buildTurnRecord(
     turnId: string
     finalAnswerDelivered: boolean
     deliveryOutcome?: DeliveryOutcome
+    landedUnconfirmed?: number
   },
   endedAt: number,
 ): TurnRecordRow {
@@ -175,5 +190,9 @@ export function buildTurnRecord(
     tools: turn.toolCallCount ?? 0,
     status: computeTurnStatus(turn),
     turn_id: turn.turnId,
+    // Emitted ONLY when non-zero (see `TurnRecordRow.landed_unconfirmed`).
+    ...(turn.landedUnconfirmed != null && turn.landedUnconfirmed > 0
+      ? { landed_unconfirmed: turn.landedUnconfirmed }
+      : {}),
   }
 }

package/telegram-plugin/gateway/turns-jsonl-rotate.ts

@@ -13,6 +13,71 @@
  */
 export const TURNS_JSONL_MAX_BYTES = 5 * 1024 * 1024 // 5 MiB
 
+/** The agent state dir inside a switchroom agent container (bind-mounted to
+ *  `~/.switchroom/agents/<name>/` on the host). */
+export const DEFAULT_AGENT_STATE_DIR = '/state/agent'
+
+/**
+ * Resolve the agent state dir from the environment — the ONE reader for
+ * `SWITCHROOM_AGENT_STATE_DIR` that every writer into that dir must use.
+ *
+ * Normalisation is the point. The gateway had two writers into this dir a few
+ * lines apart (the context-occupancy snapshot and the turn record) reading the
+ * env var with two different expressions: a bare
+ * `process.env.SWITCHROOM_AGENT_STATE_DIR ?? '/state/agent'` and this one. For
+ * a value like `"/x/ "` or `"/x/"` those resolve to DIFFERENT directories, so
+ * the two artifacts of the same turn would land in two places — exactly the
+ * kind of split-brain state that made the turn-record leak hard to see. Both
+ * call sites now share this function.
+ *
+ * Blank/whitespace-only is treated as unset (a compose file that renders an
+ * empty value must not send state to `/turns.jsonl` at the filesystem root),
+ * and a trailing slash is stripped so joins never double it.
+ */
+export function resolveAgentStateDir(
+  env: Record<string, string | undefined> = process.env,
+): string {
+  const dir = env.SWITCHROOM_AGENT_STATE_DIR?.trim()
+  return dir != null && dir !== '' ? dir.replace(/\/+$/, '') : DEFAULT_AGENT_STATE_DIR
+}
+
+/**
+ * Resolve the turn-record path from the environment.
+ *
+ * `emitTurnRecord` used to hard-code `/state/agent/turns.jsonl`, ignoring
+ * `SWITCHROOM_AGENT_STATE_DIR` — which the sibling context-occupancy writer a
+ * few lines above it in `gateway.ts` already honours. Inside an agent container
+ * that path is the bind-mounted PRODUCTION `~/.switchroom/agents/<name>/
+ * turns.jsonl`, so any test that drove the real turn-end funnel while running
+ * in an agent container appended its synthetic rows straight into that agent's
+ * production turn record — even when the test had pointed every state-dir env
+ * var at a tmpdir. Those rows are then read back by the fleet-health L0 sensor
+ * (`src/fleet-health/scan.ts`) as that agent's real production turns.
+ *
+ * Honouring the env var is the root-cause fix: production containers do not set
+ * it (default unchanged), and a test that isolates its state dir now isolates
+ * its turn records with it.
+ *
+ * ── Operator coupling: setting this var RELOCATES the fleet-health input ──
+ *
+ * `agent.env` in `switchroom.yaml` is propagated verbatim into the container
+ * (`src/agents/compose.ts` `userEnv`), so an operator CAN set
+ * `SWITCHROOM_AGENT_STATE_DIR` on an agent. If they point it anywhere other
+ * than the bind-mounted `/state/agent`, this file moves with it — but the
+ * fleet-health L0 sensor reads `~/.switchroom/agents/<name>/turns.jsonl` at a
+ * FIXED host path (`src/fleet-health/scan.ts`). That agent then presents no
+ * turns artifact, lands in the scan's `skipped[]`, and goes quiet on the health
+ * board: no findings, no ledger entries, indistinguishable from a healthy
+ * agent. Do not set this var in production `agent.env`; it exists so tests (and
+ * the vitest `agent-state-dir-guard` setup file) can isolate agent state into a
+ * tmpdir.
+ */
+export function resolveTurnsJsonlPath(
+  env: Record<string, string | undefined> = process.env,
+): string {
+  return `${resolveAgentStateDir(env)}/turns.jsonl`
+}
+
 export interface RotateFs {
   statSize: (path: string) => number | undefined // undefined ⇒ file absent
   rename: (from: string, to: string) => void

package/telegram-plugin/tests/agent-state-dir-preload.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'bun:test'
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+
+/**
+ * Runtime alarm for the BUN half of the state-dir hermeticity guard.
+ *
+ * vitest loads `tests/vitest-setup/agent-state-dir-guard.mjs` via
+ * `test.setupFiles`; `bun test` loads the same file via `[test] preload` in
+ * bunfig.toml (repo root) and telegram-plugin/bunfig.toml (CI's bun-test-run
+ * has `working-directory: telegram-plugin`, and bun reads the bunfig in its CWD
+ * only). Without the bun half, ~75 bun-run test files still default every agent
+ * state writer to `/state/agent` — inside an agent container that is a LIVE
+ * agent's bind-mounted state dir, which is exactly how 356 synthetic turn rows
+ * ended up in production `turns.jsonl` files and were scored as real drift by
+ * the fleet-health sensor.
+ *
+ * `npm run lint:agent-state-dir-hermeticity` pins the WIRING statically; this
+ * pins the EFFECT, so a bunfig that is present but no longer loading the guard
+ * (wrong relative path, bun config-discovery change) fails a test rather than
+ * silently un-protecting the runner.
+ */
+describe('bun test runs with the agent state dir redirected', () => {
+  for (const k of ['SWITCHROOM_AGENT_STATE_DIR', 'SWITCHROOM_RUNTIME_STATE_DIR']) {
+    it(`${k} points at a tmp dir, not a live agent state dir`, () => {
+      const v = process.env[k]
+      expect(v, `${k} unset — bunfig.toml \`[test] preload\` did not run`).toBeTruthy()
+      expect(v).not.toBe('/state/agent')
+      expect(v!.startsWith(tmpdir())).toBe(true)
+      expect(existsSync(v!)).toBe(true)
+    })
+  }
+})

package/telegram-plugin/tests/backstop-delivery.test.ts

@@ -10,6 +10,7 @@ import {
 } from '../gateway/backstop-delivery.js'
 import {
   backstopSendOutcomeGated,
+  buildTurnRecord,
   finalizeBackstopSendGated,
   computeTurnStatus,
 } from '../gateway/turn-record-status.js'
@@ -348,25 +349,29 @@ describe('#3278 runBackstopDelivery — read-back drives the delivery outcome',
     expect(ledger.hasConfirmedChunk('#drop', 0)).toBe(true)
   })
 
-  it('429/ambiguous probe ⇒ NOT re-sent, stays landed-unconfirmed, delivered=false', async () => {
+  it('429/ambiguous probe ⇒ NOT re-sent, stays landed-unconfirmed, still DELIVERED', async () => {
     const ledger = new BackstopDeliveryLedger()
     const sendChunk = vi.fn(async () => [950])
     const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
     const res = await runBackstopDelivery(ledger, '#amb', ['answer'], null, { sendChunk, readBack }, 3)
     expect(sendChunk).toHaveBeenCalledTimes(1) // never re-sent on ambiguous
-    expect(res.delivered).toBe(false)
-    expect(res.exhausted).toBe(true)
+    // An inconclusive probe establishes nothing, so the landed-id evidence
+    // stands: the answer IS in the chat and the turn is not a failure.
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false) // landed-unconfirmed, honestly reported
+    expect(res.exhausted).toBe(false)
     expect(ledger.hasConfirmedChunk('#amb', 0)).toBe(false)
     expect(ledger.landedUnconfirmedIndices('#amb', 1)).toEqual([0]) // still landed-unconfirmed
   })
 
-  it('a read-back adapter THAT THROWS is treated as ambiguous — never re-sent', async () => {
+  it('a read-back adapter THAT THROWS is ambiguous — never re-sent, never a failure', async () => {
     const ledger = new BackstopDeliveryLedger()
     const sendChunk = vi.fn(async () => [951])
     const readBack = vi.fn(async () => { throw new Error('boom') })
     const res = await runBackstopDelivery(ledger, '#throw', ['answer'], null, { sendChunk, readBack }, 3)
     expect(sendChunk).toHaveBeenCalledTimes(1)
-    expect(res.delivered).toBe(false)
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false)
   })
 
   it('#3278 CORE: API-ack fresh id but read-back ABSENT ⇒ send_failed, NOT complete', async () => {
@@ -403,15 +408,207 @@ describe('#3278 runBackstopDelivery — read-back drives the delivery outcome',
     expect(ledger.hasConfirmedChunk('#noprobe', 0)).toBe(true)
   })
 
-  it('partial: chunk 0 confirmed, chunk 1 ambiguous ⇒ delivered=false, chunk 0 not re-sent', async () => {
+  it('partial: chunk 0 confirmed, chunk 1 ambiguous ⇒ both landed ⇒ delivered, chunk 0 not re-sent', async () => {
     const ledger = new BackstopDeliveryLedger()
     const calls: number[] = []
     const sendChunk = vi.fn(async (i: number) => { calls.push(i); return [700 + i] })
     const readBack = vi.fn(async (i: number): Promise<ReadBackResult> => (i === 0 ? 'exists' : 'ambiguous'))
     const res = await runBackstopDelivery(ledger, '#part', ['c0', 'c1'], null, { sendChunk, readBack }, 3)
-    expect(res.delivered).toBe(false)
+    expect(res.delivered).toBe(true) // every chunk landed a fresh id
+    expect(res.confirmed).toBe(false) // ...but chunk 1 was never corroborated
     expect(calls.filter(i => i === 0)).toHaveLength(1) // confirmed chunk never re-sent
     expect(ledger.hasConfirmedChunk('#part', 0)).toBe(true)
     expect(ledger.hasConfirmedChunk('#part', 1)).toBe(false)
   })
+
+  // ── The measurement bug this PR fixes ────────────────────────────────────
+  //
+  // The probe is issued at cosmetic priority in the same millisecond as the
+  // send it probes, so the per-chat token bucket (1/sec, just consumed by that
+  // very send) sheds it: in production it resolved `ambiguous` 146 times in two
+  // weeks and `absent` ZERO times. Under the old confirmation-gated verdict each
+  // of those became `delivered:false` → `send_failed` on a turn whose answer the
+  // user had received, plus an error reaction and a still-OPEN obligation.
+  it('AMBIGUOUS probe ⇒ turn record `complete`, NOT send_failed (the fixed bug)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 500
+    const sendChunk = vi.fn(async () => [971]) // a fresh, non-card chat id
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#shed', ['answer'], cardId, { sendChunk, readBack }, 3)
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: cardId,
+    })
+    expect(computeTurnStatus(turn)).toBe('complete')
+  })
+
+  it('an ambiguous probe on a CARD-ONLY delivery is still send_failed (guard 7 holds)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const cardId = 501
+    // The only id that landed IS the progress card — swept ~60-90s later, so
+    // the user receives nothing. Ambiguity must not rescue this.
+    const sendChunk = vi.fn(async () => [cardId])
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#cardonly', ['answer'], cardId, { sendChunk, readBack }, 3)
+    expect(res.delivered).toBe(false)
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: cardId,
+    })
+    expect(computeTurnStatus(turn)).toBe('send_failed')
+  })
+
+  it('an ambiguous probe on a chunk that never landed is still NOT delivered', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    // chunk 0 lands; chunk 1 throws on every attempt → never landed.
+    const sendChunk = vi.fn(async (i: number) => {
+      if (i === 1) throw new Error('flood')
+      return [800 + i]
+    })
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => 'ambiguous')
+    const res = await runBackstopDelivery(ledger, '#gap', ['c0', 'c1'], null, { sendChunk, readBack }, 2)
+    expect(res.delivered).toBe(false)
+    expect(res.exhausted).toBe(true)
+  })
+
+  // Mixed sequence: the two probe states that MOVE the verdict, composed in one
+  // run. Chunk 0's first send is silently discarded (`absent` ⇒ demote ⇒
+  // re-send) and the probe on the RE-SEND is shed (`ambiguous`). Under the old
+  // confirmation-gated verdict the re-sent chunk was never `landed-confirmed`,
+  // so the whole turn came out `delivered:false` — a `send_failed` for an answer
+  // that had just been successfully re-sent. Demote-and-re-send and
+  // ambiguity-is-not-failure must compose.
+  it('absent ⇒ demote ⇒ re-send, then AMBIGUOUS on the re-send ⇒ delivered, sent exactly twice', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    let sends = 0
+    const sendChunk = vi.fn(async () => { sends++; return [990 + sends] })
+    let probes = 0
+    const readBack = vi.fn(async (): Promise<ReadBackResult> => {
+      probes++
+      return probes === 1 ? 'absent' : 'ambiguous'
+    })
+    const res = await runBackstopDelivery(ledger, '#mixed', ['answer'], null, { sendChunk, readBack }, 3)
+    expect(sendChunk).toHaveBeenCalledTimes(2) // initial + exactly one re-send
+    expect(readBack).toHaveBeenCalledTimes(2) // probed once per landing
+    expect(res.delivered).toBe(true) // the re-send landed a fresh id; ambiguity proves nothing
+    expect(res.confirmed).toBe(false) // ...and is honestly reported as uncorroborated
+    expect(res.sentIds).toEqual([992]) // the demoted first id is gone; the re-send's id stands
+    expect(res.landedUnconfirmedIds).toEqual([992])
+    // The outcome the user actually experiences: a `complete` turn record.
+    const turn: { finalAnswerDelivered: boolean; deliveryOutcome?: 'delivered' | 'failed' | 'suppressed' } = {
+      finalAnswerDelivered: true,
+    }
+    finalizeBackstopSendGated(turn, {
+      threw: !res.delivered, sentIds: res.sentIds, chunkCount: res.chunkCount, cardMessageId: null,
+    })
+    expect(computeTurnStatus(turn)).toBe('complete')
+  })
+})
+
+// ── The observability of the new optimism (#3702 L2/L5/L6a) ─────────────────
+//
+// Counting an inconclusive probe as delivered is a BET. These pin the two
+// artifacts that let the fleet find out if it is ever wrong: the per-delivery
+// stderr line, and the `landed_unconfirmed` field on the turns.jsonl row.
+describe('#3702 landed-unconfirmed is MEASURED, not silently assumed', () => {
+  it('a delivered-but-unconfirmed turn writes the diagnostic stderr line', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const lines: string[] = []
+    const res = await runBackstopDelivery(
+      ledger, '#obs', ['answer'], null,
+      {
+        sendChunk: async () => [1001],
+        readBack: async (): Promise<ReadBackResult> => 'ambiguous',
+        stderr: (s) => lines.push(s),
+      },
+      3,
+    )
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false)
+    const diag = lines.filter(l => l.includes('backstop delivery landed-unconfirmed'))
+    expect(diag).toHaveLength(1)
+    expect(diag[0]).toContain('#obs')
+    expect(diag[0]).toContain('1 of 1 landed id(s)') // the measured quantity, not just a warning
+  })
+
+  it('a fully CONFIRMED delivery writes NO landed-unconfirmed line (no false alarm)', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const lines: string[] = []
+    const res = await runBackstopDelivery(
+      ledger, '#conf', ['answer'], null,
+      {
+        sendChunk: async () => [1002],
+        readBack: async (): Promise<ReadBackResult> => 'exists',
+        stderr: (s) => lines.push(s),
+      },
+      3,
+    )
+    expect(res.confirmed).toBe(true)
+    expect(res.landedUnconfirmedIds).toEqual([])
+    expect(lines.filter(l => l.includes('backstop delivery landed-unconfirmed'))).toHaveLength(0)
+  })
+
+  it('landedUnconfirmedIds is exactly the uncorroborated subset of sentIds', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    // chunk 0 confirmed, chunk 1 landed-unconfirmed (shed probe).
+    const res = await runBackstopDelivery(
+      ledger, '#subset', ['c0', 'c1'], null,
+      {
+        sendChunk: async (i: number) => [1100 + i],
+        readBack: async (i: number): Promise<ReadBackResult> => (i === 0 ? 'exists' : 'ambiguous'),
+      },
+      3,
+    )
+    expect(res.sentIds).toEqual([1100, 1101])
+    expect(res.landedUnconfirmedIds).toEqual([1101]) // c0 is corroborated; c1 is the bet
+    expect(res.delivered).toBe(true)
+    expect(res.confirmed).toBe(false)
+  })
+
+  it('the count reaches turns.jsonl: a complete turn carries `landed_unconfirmed`', async () => {
+    const ledger = new BackstopDeliveryLedger()
+    const res = await runBackstopDelivery(
+      ledger, '#row', ['c0', 'c1'], null,
+      {
+        sendChunk: async (i: number) => [1200 + i],
+        readBack: async (): Promise<ReadBackResult> => 'ambiguous',
+      },
+      3,
+    )
+    const turn = {
+      agent: 'test-agent',
+      startedAt: 1_000_000,
+      toolCallCount: 0,
+      turnId: '#row',
+      finalAnswerDelivered: true,
+      deliveryOutcome: 'delivered' as const,
+      landedUnconfirmed: res.landedUnconfirmedIds.length,
+    }
+    const row = buildTurnRecord(turn, 1_002_000)
+    // The status is honest AND the bet is visible on the same row — that pairing
+    // is the point: a `complete` we could not corroborate is countable.
+    expect(row.status).toBe('complete')
+    expect(row.landed_unconfirmed).toBe(2)
+  })
+
+  it('an ordinary confirmed turn omits the field entirely (row shape unchanged)', () => {
+    const row = buildTurnRecord(
+      {
+        agent: 'test-agent',
+        startedAt: 1_000_000,
+        toolCallCount: 0,
+        turnId: '#plain',
+        finalAnswerDelivered: true,
+        deliveryOutcome: 'delivered',
+        landedUnconfirmed: 0,
+      },
+      1_002_000,
+    )
+    expect(row.status).toBe('complete')
+    expect('landed_unconfirmed' in row).toBe(false)
+  })
 })

package/telegram-plugin/tests/backstop-readback-probe.test.ts

@@ -141,4 +141,16 @@ describe('#3278 createBackstopReadBack — full gate+edit+classify wiring', () =
     const readBack = createBackstopReadBack(wiring({ gate, editMessageText }))
     expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
   })
+
+  test('gate NO-OP drop (resolves undefined) ⇒ ambiguous, NOT a false exists', async () => {
+    // The gate's edit path drops a repeat of the last payload it actually sent
+    // (`counters.dropped`) and drops an expired queue entry, resolving
+    // `undefined` in both cases. Nothing reached Telegram, so nothing was
+    // proven — classifying it `exists` would fabricate a confirmation from a
+    // call that never happened.
+    const gate = vi.fn(async () => undefined)
+    const editMessageText = vi.fn(async () => true)
+    const readBack = createBackstopReadBack(wiring({ gate, editMessageText }))
+    expect(await readBack(0, [55], 'answer')).toBe('ambiguous')
+  })
 })