switchroom 0.19.22 → 0.19.24

package/telegram-plugin/gateway/backstop-delivery.ts

@@ -114,8 +114,10 @@ export class BackstopDeliveryLedger {
 
   /**
    * #3278 — transition a landed-unconfirmed chunk to `landed-confirmed` after a
-   * read-back probe proved the message exists in the chat. Only a confirmed
-   * chunk counts toward delivery / `complete`.
+   * read-back probe proved the message exists in the chat. Confirmation is the
+   * STRONGER of the two delivery states; the weaker `landed-unconfirmed` also
+   * counts as delivered (an inconclusive probe is not a failure — see
+   * `runBackstopDelivery`). Only a POSITIVE absence (`demoteChunk`) un-delivers.
    */
   confirmChunk(turnId: string, index: number): void {
     let set = this.confirmed.get(turnId)
@@ -164,8 +166,14 @@ export class BackstopDeliveryLedger {
     return true
   }
 
-  /** Landed message ids of CONFIRMED chunks only, in chunk-index order — the set
-   *  the delivery predicate counts (fresh non-card ids that are proven-present). */
+  /** Landed message ids of CONFIRMED chunks only, in chunk-index order — the
+   *  read-back view of the ledger (ids proven present in the chat). The delivery
+   *  predicate counts LANDED ids (`sentIds`), not these; this is the stronger
+   *  proven-present subset. Its production consumer is
+   *  {@link BackstopDeliveryResult.landedUnconfirmedIds} — `sentIds` minus these
+   *  is the landed-but-uncorroborated set that reaches `turns.jsonl` as
+   *  `landed_unconfirmed`, the counter that measures whether this module's
+   *  optimism about an inconclusive probe is ever wrong. */
   confirmedIds(turnId: string): number[] {
     const m = this.chunks.get(turnId)
     const set = this.confirmed.get(turnId)
@@ -226,9 +234,11 @@ export class BackstopDeliveryLedger {
  *                  `landed-confirmed` (counts toward delivery).
  *  - `absent`    — Telegram `400 message to edit not found` ⇒ positive absence
  *                  ⇒ demote to `unsent` (safe to re-send — it never landed).
- *  - `ambiguous` — 429 / 5xx / network / gate-shed / anything else ⇒ leave
- *                  `landed-unconfirmed`; NEVER re-send (a re-send would risk a
- *                  duplicate, and duplicate-risk beats missing-risk here).
+ *  - `ambiguous` — 429 / 5xx / network / gate-shed / gate no-op / anything else
+ *                  ⇒ leave `landed-unconfirmed`; NEVER re-send (a re-send would
+ *                  risk a duplicate, and duplicate-risk beats missing-risk
+ *                  here) and NEVER count it as a delivery failure either — the
+ *                  probe established nothing, so the landed-id evidence stands.
  *
  * NOTE (honest limitation, #3278 §1.4): a passing probe proves only that the
  * message EXISTS at that chat_id. It does NOT prove the human's client rendered
@@ -322,8 +332,36 @@ export interface BackstopDeliveryResult {
   sentIds: number[]
   /** Number of input chunks the answer was split into. */
   chunkCount: number
-  /** True IFF every chunk landed at least one fresh non-card id. */
+  /**
+   * True IFF every chunk landed at least one message id AND at least one of
+   * them is a fresh non-card chat id. This is the DELIVERY verdict the turn
+   * record, the obligation ledger and the status reaction key on.
+   *
+   * A read-back probe can only ever LOWER it, and only on POSITIVE absence: an
+   * `absent` verdict demotes the chunk back to `unsent`, so it stops counting as
+   * landed. An `ambiguous` probe carries no information and therefore does not
+   * move this flag — see {@link confirmed}.
+   */
   delivered: boolean
+  /**
+   * True IFF every chunk was read-back CONFIRMED (`exists`). Strictly stronger
+   * than {@link delivered} and purely observational — nothing keys a failure on
+   * it. `delivered && !confirmed` is the `landed-unconfirmed` state: the Bot API
+   * returned fresh ids for every chunk but the probe could not corroborate them.
+   */
+  confirmed: boolean
+  /**
+   * The landed message ids NO read-back corroborated — `sentIds` minus the
+   * confirmed subset, in chunk-index order. Empty when {@link confirmed}.
+   *
+   * This is the MEASURABLE form of this module's central bet: a landed id whose
+   * probe came back inconclusive is counted as delivered. Its count is stamped
+   * onto the turn record as `landed_unconfirmed` (see `buildTurnRecord`) so the
+   * fleet can tell how often that bet is being made — and, if a
+   * `landed_unconfirmed` turn is ever followed by a "you never answered me",
+   * that the bet was wrong. Purely observational: nothing keys a failure on it.
+   */
+  landedUnconfirmedIds: number[]
   /** How many attempts ran (1..maxAttempts). */
   attempts: number
   /** True when retries were exhausted without full delivery (terminal fail). */
@@ -345,9 +383,12 @@ export interface BackstopDeliveryResult {
  * is read-back-probed via `deps.readBack` (when provided): `exists` confirms it,
  * `absent` demotes it to `unsent` so the NEXT attempt re-sends only that chunk,
  * and `ambiguous` leaves it `landed-unconfirmed` — never re-sent (duplicate-risk
- * beats missing-risk). `delivered` now requires every chunk `landed-confirmed`,
- * so an API-ack'd-but-silently-dropped send (fresh id, absent on read-back) is
- * reported `delivered:false` and the caller leaves the obligation OPEN.
+ * beats missing-risk). An API-ack'd-but-silently-dropped send (fresh id, absent
+ * on read-back) is therefore reported `delivered:false` and the caller leaves
+ * the obligation OPEN — a correct mechanism that is INERT UNTIL #3703, because
+ * the probe is 100% shed in production and never resolves `absent`. An
+ * INCONCLUSIVE probe is not a failure: it leaves `delivered` alone and only
+ * clears `confirmed` (see `BackstopDeliveryResult`).
  *
  * `recordOutbound` (when provided) fires ONCE at the end with the full landed
  * set and a `texts` array ALIGNED to the actual sent ids (via `ledger.entries`).
@@ -449,12 +490,52 @@ export async function runBackstopDelivery(
   }
 
   const sentIds = ledger.sentIds(turnId)
-  // #3278 — delivered IFF every chunk is `landed-confirmed` AND at least one
-  // confirmed id is a fresh non-card chat id (the receipt gate, guard 7).
+  const confirmed = ledger.allConfirmed(turnId, chunkCount)
+  // The delivery verdict is EVIDENCE-BASED, not confirmation-gated.
+  //
+  // #3278 originally required every chunk to be `landed-confirmed`, so an
+  // `ambiguous` probe — which by definition establishes nothing — produced
+  // `delivered:false`. That inverted the guard it was meant to be: the turn was
+  // recorded `send_failed`, the status reaction painted error, and the delivery
+  // obligation was left OPEN for a re-present, all for an answer the user had
+  // demonstrably received. In production the probe is ambiguous essentially
+  // always (it is issued at cosmetic priority in the same millisecond as the
+  // send it probes, so the per-chat token bucket sheds it), so this turned a
+  // successful backstop delivery into a logged failure ~146 times in two weeks.
+  //
+  // Absence of evidence is not evidence of absence. The verdict is therefore:
+  // every chunk LANDED (guard 6) and at least one landed id is a fresh non-card
+  // chat id (the receipt gate, guard 7). A probe can still lower it — an
+  // `absent` verdict demotes the chunk to `unsent` above, so it is no longer
+  // landed — which keeps #3278's real contribution (a positive absence is
+  // caught and re-sent) while an inconclusive probe changes nothing.
+  //
+  // Honesty about what that contribution is worth TODAY: it is INERT UNTIL
+  // #3703. The probe is issued at cosmetic priority in the same millisecond as
+  // the send it probes, so the per-chat token bucket sheds it 100% of the time
+  // (146 `ambiguous` / 0 `absent` across the live fleet) and the `absent` branch
+  // is structurally unreachable in production. The demote-and-re-send path below
+  // is a correct mechanism with no live trigger; #3703 is the change that wakes
+  // the probe (and must first fix its resplit-overwrite hazard). Do not read
+  // this block as "absence is still caught in production" — it is not, yet.
+  const allLanded = chunkCount > 0 && ledger.unsentIndices(turnId, chunkCount).length === 0
   const delivered =
-    ledger.allConfirmed(turnId, chunkCount) &&
-    backstopReceiptIds(ledger.confirmedIds(turnId), cardMessageId).length > 0
+    allLanded && backstopReceiptIds(sentIds, cardMessageId).length > 0
   const exhausted = !delivered
+  // The landed-but-uncorroborated set (L2/L5): `sentIds` minus the read-back
+  // confirmed subset. Surfaced on the result so the caller can stamp
+  // `landed_unconfirmed` on the turn record — the only way to measure whether
+  // counting an inconclusive probe as delivered is ever wrong.
+  const confirmedSet = new Set(ledger.confirmedIds(turnId))
+  const landedUnconfirmedIds = sentIds.filter(id => !confirmedSet.has(id))
+  if (delivered && !confirmed) {
+    stderr(
+      `telegram gateway: backstop delivery landed-unconfirmed for turn ${turnId} — ` +
+      `every chunk returned a fresh message id but the read-back probe was ` +
+      `inconclusive for ${landedUnconfirmedIds.length} of ${sentIds.length} landed ` +
+      `id(s); counting it delivered (an ambiguous probe is not a failure)\n`,
+    )
+  }
 
   if (deps.recordOutbound && sentIds.length > 0) {
     const texts: string[] = []
@@ -468,5 +549,5 @@ export async function runBackstopDelivery(
     deps.recordOutbound(ids, texts)
   }
 
-  return { sentIds, chunkCount, delivered, attempts, exhausted }
+  return { sentIds, chunkCount, delivered, confirmed, landedUnconfirmedIds, attempts, exhausted }
 }

package/telegram-plugin/gateway/captured-answer-resume.ts

@@ -14,8 +14,8 @@
  *
  * ── The fix (design-of-record §2.2) ─────────────────────────────────────────
  * Make the re-present a *byte-identical captured-answer resume* of ONLY the
- * not-yet-`landed-confirmed` tail — never a regeneration — so a chunk that
- * already reached the chat is provably never re-posted:
+ * not-yet-LANDED tail — never a regeneration — so a chunk that already reached
+ * the chat is provably never re-posted:
  *
  *   1. On a partial (`!delivered`) turn-flush, persist a {@link
  *      CapturedDeliverySnapshot} (the split chunks + each landed chunk's ids and
@@ -25,9 +25,9 @@
  *   2. The obligation sweep's `represent` branch becomes source-aware: when the
  *      obligation carries a captured-delivery snapshot it drives THIS resume
  *      (re-run `runBackstopDelivery` for the SAME `turnId` and the SAME captured
- *      chunks, resuming at the first non-`landed-confirmed` index) instead of
- *      pushing a fresh-generation inbound. No snapshot ⇒ the genuine "model wrote
- *      nothing / never fired a backstop" case falls through to fresh generation
+ *      chunks, resuming at the first UNSENT index) instead of pushing a
+ *      fresh-generation inbound. No snapshot ⇒ the genuine "model wrote nothing
+ *      / never fired a backstop" case falls through to fresh generation
  *      unchanged.
  *   3. The in-memory ledger is rehydrated from the snapshot AND reconciled against
  *      the durable outbound-text oracle (`hasOutboundWithText`), so a chunk that
@@ -39,9 +39,29 @@
  * chunks (not a regenerated answer). #3278's per-chunk state machine
  * (`unsent → pending → landed-unconfirmed → {landed-confirmed | unsent}`) binds
  * here too: the resume re-PROBES `landed-unconfirmed` chunks (never re-sends
- * them) and re-SENDS only `unsent` ones, so a confirmed chunk is never duplicated
+ * them) and re-SENDS only `unsent` ones, so a landed chunk is never duplicated
  * by either the in-fire retry OR the cross-represent resume.
  *
+ * ── The CLOSE condition is LANDED, not confirmed (#3702) ────────────────────
+ * `runBackstopDelivery`'s verdict is evidence-based: every chunk landed a
+ * message id and at least one is a fresh non-card id. An inconclusive read-back
+ * does not lower it (only a POSITIVE `absent`, which demotes the chunk back to
+ * `unsent`, does). So a resume over a snapshot whose chunks ALL landed but were
+ * never corroborated closes the obligation having sent NOTHING — the re-probe
+ * ran, resolved nothing, and the landed-id evidence stood.
+ *
+ * That is deliberate, not an oversight. The alternative — keep the obligation
+ * OPEN because nothing corroborated the ids — has no corrective action
+ * available: the resume never re-sends a LANDED chunk, so every subsequent
+ * represent would re-run the same shed probe, send zero messages, and burn
+ * represent budget until the cap escalates a false "the agent never answered
+ * you" nudge to the operator. Representing cannot deliver anything the first
+ * delivery did not; the only thing it can produce is noise. When the durable
+ * outbound-text oracle CAN corroborate (history enabled + the row present) it
+ * confirms the chunk at hydration and the same close happens by the older
+ * `hasOutboundWithText` route — this path is the same decision when that oracle
+ * is unavailable.
+ *
  * This module is PURE state + orchestration over injected effects — no Telegram,
  * no SQLite, no gateway module state — so the resume decision is unit-testable
  * (see tests/captured-answer-resume.test.ts). The gateway owns the real
@@ -55,10 +75,10 @@ import type { CapturedDeliverySnapshot, Obligation } from './obligation-ledger.j
 /**
  * Build the durable {@link CapturedDeliverySnapshot} from the live per-chunk
  * ledger after a partial `runBackstopDelivery`. Captures every LANDED chunk's
- * message ids + confirmed flag so the resume can (a) never re-send a confirmed
- * chunk and (b) re-PROBE a landed-unconfirmed chunk instead of blindly re-sending
- * it. Chunks that never landed (send threw) are simply absent → the resume treats
- * them as `unsent` and re-sends them. Pure.
+ * message ids + confirmed flag so the resume can (a) never re-send a chunk that
+ * already landed and (b) re-PROBE a landed-unconfirmed chunk instead of blindly
+ * re-sending it. Chunks that never landed (send threw) are simply absent → the
+ * resume treats them as `unsent` and re-sends them. Pure.
  */
 export function buildCapturedDeliverySnapshot(
   ledger: BackstopDeliveryLedger,
@@ -165,9 +185,13 @@ export interface CapturedResumeDispatcher {
  * The obligation-sweep's captured-answer resume driver. Owns the in-flight guard
  * + the deliver→close/leave-open orchestration so the gateway sweep stays a
  * two-line dispatch. On each dispatch it consumes one represent-budget unit
- * (bounding the ladder → escalate), re-delivers only the non-confirmed tail, and:
+ * (bounding the ladder → escalate), re-delivers only the UNSENT tail (a landed
+ * chunk is re-probed, never re-sent), and:
  *   - fully delivered ⇒ record the supersede tail, close the obligation, GC the
- *     ledger (the represent ladder stops);
+ *     ledger (the represent ladder stops). Since #3702 "delivered" means every
+ *     chunk LANDED — so a snapshot that is already fully landed closes here
+ *     having sent nothing (see the module header for why that is the right
+ *     call, and why leaving it OPEN would only manufacture a false escalation);
  *   - still partial / error ⇒ leave the obligation OPEN so the next eligible
  *     sweep (after the per-represent grace) retries, until the represent cap
  *     escalates it to the operator nudge — no infinite loop.
@@ -176,7 +200,7 @@ export function createCapturedResumeDispatcher(ports: CapturedResumePorts): Capt
   const stderr = ports.stderr ?? (() => {})
   const inFlight = new Set<string>()
 
-  /** Re-deliver the non-confirmed tail of `o`'s captured answer, byte-identical,
+  /** Re-deliver the UNSENT tail of `o`'s captured answer, byte-identical,
    *  by rehydrating the per-chunk ledger from the snapshot reconciled against the
    *  durable text oracle. Never regenerates. */
   function deliver(o: Obligation, snapshot: CapturedDeliverySnapshot): Promise<{ delivered: boolean; sentIds: number[] }> {
@@ -221,16 +245,21 @@ export function createCapturedResumeDispatcher(ports: CapturedResumePorts): Capt
       if (delivered) {
         ports.obligationLedger.close(o.originTurnId)
         ports.backstopDeliveryLedger.clear(o.originTurnId)
+        // `sentIds` is `ledger.sentIds()` — every LANDED id, which since #3702
+        // routinely includes ids no read-back corroborated. Say "landed", not
+        // "confirmed": claiming confirmation for an uncorroborated id is exactly
+        // the overstatement this PR removed from the delivery verdict.
         stderr(
           `telegram gateway: captured-answer resume delivered — origin=${o.originTurnId} ` +
-            `${sentIds.length} chunk(s) confirmed; obligation closed\n`,
+            `${sentIds.length} message id(s) landed; obligation closed\n`,
         )
       } else {
-        // Tail still not confirmed — leave the obligation OPEN for the next paced
-        // sweep / escalation (bounded by the represent cap).
+        // Not fully landed (a chunk never got an id, or a positive `absent`
+        // demoted one) — leave the obligation OPEN for the next paced sweep /
+        // escalation (bounded by the represent cap).
         stderr(
           `telegram gateway: captured-answer resume partial — origin=${o.originTurnId} ` +
-            `tail still not confirmed; left OPEN for retry\n`,
+            `tail still not landed; left OPEN for retry\n`,
         )
       }
     } catch (err) {

package/telegram-plugin/gateway/gateway.ts

@@ -489,7 +489,7 @@ import {
 import {
   resolveReplyOwnerTurnId,
   resolveReplyOwnerTier,
-  type ReplyOwnerTier,
+  type ReplyOwnerTier, type ReplyOwnerCandidates,
   type AnswerDeliveredLatch,
 } from '../reply-owner-resolve.js'
 import { SubagentHandbackMarker } from './subagent-handback-marker.js'
@@ -717,8 +717,9 @@ import {
 } from './emission-authority.js'
 import { CurrentTurnMap } from './current-turn-map.js'
 import { resolveAnswerThreadId } from './answer-thread-resolve.js'
+import { latestTurnForChat } from './latest-turn-lookup.js'
 import { decideObligationTurnEnd } from './obligation-turn-end.js'
-import { maybeRotate } from './turns-jsonl-rotate.js'
+import { maybeRotate, resolveAgentStateDir, resolveTurnsJsonlPath } from './turns-jsonl-rotate.js'
 import {
   buildTurnRecord,
   finalizeBackstopSendGated,
@@ -1032,7 +1033,7 @@ const blockedApprovalStore = createBlockedApprovalStore(
   // Fallback: the agent's OWN state dir, which the scaffold chowns to the agent
   // uid, so a write there always succeeds. Guarantees the record can never be
   // silently lost when the shared dir isn't writable by this agent's uid.
-  process.env.SWITCHROOM_AGENT_STATE_DIR ?? '/state/agent',
+  resolveAgentStateDir(),
 )
 
 /**
@@ -2456,9 +2457,9 @@ async function deliverAnswer(args: {
    *  the send alive if the user deleted their message. Null for synthesized
    *  turns (cron/handback) — those send bare, as before. */
   replyToMessageId: number | null
-  /** #3282 captured-answer RESUME (see captured-answer-resume.ts): re-deliver the SAME byte-identical chunks + pre-hydrate the ledger (non-confirmed tail only). */
+  /** #3282 captured-answer RESUME (see captured-answer-resume.ts): re-deliver the SAME byte-identical chunks + pre-hydrate the ledger (unsent tail only; a landed chunk is re-probed, never re-sent). */
   resume?: { snapshot: CapturedDeliverySnapshot; hydrate: (ledger: BackstopDeliveryLedger, turnId: string) => void }
-}): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean }> {
+}): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean; landedUnconfirmed: number }> {
   const { chatId, turnId } = args
   // Spacers into `\n\n` gaps then split (as executeReply); a resume re-delivers the EXACT captured chunks (byte-stable, no re-split).
   const chunks = args.resume
@@ -2594,6 +2595,7 @@ async function deliverAnswer(args: {
     chunkCount: result.chunkCount,
     delivered: result.delivered,
     exhausted: result.exhausted,
+    landedUnconfirmed: result.landedUnconfirmedIds.length, // #3702 — the caller stamps this on the turn record
   }
 }
 
@@ -3427,6 +3429,7 @@ export type CurrentTurn = {
   // turn-end paths (reply-tool tail, silent-marker, genuine no-reply), where
   // the legacy `finalAnswerDelivered` reading still applies unchanged.
   deliveryOutcome?: DeliveryOutcome
+  landedUnconfirmed?: number // #3702 — landed ids no read-back corroborated; emitted as `landed_unconfirmed` (rationale: turn-record-status.ts)
   // Feed-reopen-after-ack refinement — whether the reply that set
   // `finalAnswerDelivered` was a *substantive* final answer (stream
   // `done`, or ≥200 chars) as opposed to a short pinging interim ACK.
@@ -3482,12 +3485,14 @@ export type CurrentTurn = {
   flushedAnswerText: string | null
   // 2026-07 double-reply-on-DM fix (F2 — recency bound). Wall-clock ms the turn
   // ENDED (stamped once by `endCurrentTurnAtomic`), or null while still live.
-  // The `findLatestEndedTurnForChat` supersede tier carries DESTRUCTIVE
-  // authority (it drives message deletion), so `resolveReplyOwnerTurn` only
-  // honours a latest-ended turn whose `endedAt` is within the supersede TTL —
+  // The `latest-ended` supersede tier carries DESTRUCTIVE authority (it drives
+  // message deletion), so `resolveReplyOwnerTurn` only honours a latest-ended
+  // turn whose `endedAt` is non-null (#3725 — the registry is populated at turn
+  // START, so the tail entry may still be RUNNING) AND within the supersede TTL —
   // otherwise a late reply belonging to an OLDER turn could resolve its owner to
-  // a NEWER turn sitting at the registry tail and delete that newer turn's legit
-  // answer. Unbounded routing use of `findLatestEndedTurnForChat` is unaffected.
+  // a NEWER turn at the registry tail and delete that turn's legit answer. The
+  // unbounded ROUTING use (`endedOnly: false`) is unaffected: it only picks a
+  // topic to deliver into and deletes nothing.
   endedAt: number | null
   // #1675 (over-ping safety net): wall-clock ms of the first reply
   // this turn that landed with `disable_notification: false` (a real
@@ -3997,21 +4002,18 @@ const LATE_REPLY_TOPIC_RECOVERY_ENABLED =
   process.env.SWITCHROOM_LATE_REPLY_TOPIC_RECOVERY !== '0'
 
 /**
- * The most-recently-started turn for a chat from the bounded recently-ended
- * registry — the deterministic fallback for a LATE answer reply when the model
- * echoed no `origin_turn_id` and `currentTurn` has already cleared. Iterates in
- * insertion order so the last match is the most recent turn for that chat.
- * Returns null when the chat has no remembered turn (so the caller keeps the
- * legacy result). NB: this is the chat's own most-recent TURN, not the
- * `chatThreadMap` last-seen-any-message heuristic that caused the wrong-topic
- * bug — a late reply almost always belongs to the turn that just ended.
+ * The most recent turn for a chat from the bounded recent-turn registry — the
+ * deterministic fallback for a LATE answer reply when the model echoed no
+ * `origin_turn_id` and `currentTurn` has already cleared. Returns null when the
+ * chat has no matching turn (so the caller keeps the legacy result). NB: this is
+ * the chat's own most-recent TURN, not the `chatThreadMap` last-seen-any-message
+ * heuristic that caused the wrong-topic bug. `endedOnly` selects the consumer's
+ * semantics — routing takes the tail entry even when that turn is still RUNNING;
+ * the destructive `latest-ended` owner tier takes only a genuinely ENDED turn,
+ * because the registry is populated at turn START (#3725; see the module).
  */
-function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
-  let latest: CurrentTurn | null = null
-  for (const t of recentTurnsById.values()) {
-    if (t.sessionChatId === chatId) latest = t
-  }
-  return latest
+function findLatestTurnForChat(chatId: string, opts: { endedOnly: boolean }): CurrentTurn | null {
+  return latestTurnForChat(recentTurnsById.values(), chatId, opts)
 }
 
 /**
@@ -4027,7 +4029,7 @@ function findLatestEndedTurnForChat(chatId: string): CurrentTurn | null {
  *   1. the live `currentTurn` passed in (null once the flush nulled the atom);
  *   2. `findTurnByOriginId(origin_turn_id)` — the model echo;
  *   3. `findTurnByQuotedMessageId(chat_id, reply_to)` — framework-owned quote;
- *   4. `findLatestEndedTurnForChat(chat_id)` — the chat's last-ended turn.
+ *   4. `findLatestTurnForChat(chat_id, {endedOnly:true})` — last ENDED turn.
  * Returns the CurrentTurn for the winning id (so callers can read its
  * `answerDelivered` latch), or null when every lookup missed.
  */
@@ -4035,10 +4037,10 @@ function resolveReplyOwnerTurn(
   liveTurn: CurrentTurn | null,
   chatId: string,
   args: Record<string, unknown>,
-): { turn: CurrentTurn | null; tier: ReplyOwnerTier } {
+): { turn: CurrentTurn | null; tier: ReplyOwnerTier; candidates: ReplyOwnerCandidates } {
   const origin = findTurnByOriginId(args.origin_turn_id as string | undefined)
   const quoted = findTurnByQuotedMessageId(chatId, args.reply_to)
-  const latestEnded = findLatestEndedTurnForChat(chatId)
+  const latestEnded = findLatestTurnForChat(chatId, { endedOnly: true })
   const byId = new Map<string, CurrentTurn>()
   // Populate lowest-precedence first so a higher tier's turn wins the id slot
   // when two lookups resolve the same turn (they carry the same turnId anyway).
@@ -4047,12 +4049,12 @@ function resolveReplyOwnerTurn(
   }
   // F2 — bound the DESTRUCTIVE latest-ended tier to the supersede TTL so a stale
   // latest-ended turn can't inherit deletion authority over a newer turn's flush
-  // record. `endedAt` is null only for a turn still resolvable but not yet ended
-  // (not a supersede risk); leave the age unset then (unbounded) rather than
-  // fabricate one.
+  // record. #3725: the lookup above is `endedOnly`, so `endedAt` is non-null here
+  // and the age is ALWAYS a real number — a not-yet-ended turn is no longer a
+  // candidate at all, and an explicit null age now fails CLOSED downstream.
   const latestEndedAgeMs =
     latestEnded?.endedAt != null ? Date.now() - latestEnded.endedAt : null
-  const candidates = {
+  const candidates: ReplyOwnerCandidates = {
     liveTurnId: liveTurn?.turnId ?? null,
     originTurnId: origin?.turnId ?? null,
     quotedTurnId: quoted?.turnId ?? null,
@@ -4060,15 +4062,14 @@ function resolveReplyOwnerTurn(
     latestEndedAgeMs,
     latestEndedTtlMs: DEFAULT_SUPERSEDE_TTL_MS,
   }
-  // #3429 — the WINNING tier travels with the turn. A positive tier
-  // (live/origin/quoted) means the reply is this turn's own answer and the
-  // supersede fires regardless of text; the ambiguous `latest-ended` fallback
-  // keeps the content gate (it cannot tell a late own-reply from an async
-  // sub-agent handback). Both derive from the SAME candidates, so the id and the
-  // tier can never disagree.
+  // #3429 — the winning tier AND the candidate set it came from travel with the
+  // turn. Tier alone no longer decides the content-gate bypass: the
+  // model-steerable `origin`/`quoted` tiers must be CORROBORATED against the
+  // framework-derived `latestEndedTurnId` (`decideContentGateBypass`). All three
+  // derive from these SAME candidates, so they can never disagree.
   const tier = resolveReplyOwnerTier(candidates)
   const winnerId = resolveReplyOwnerTurnId(candidates)
-  return { turn: winnerId != null ? (byId.get(winnerId) ?? null) : null, tier }
+  return { turn: winnerId != null ? (byId.get(winnerId) ?? null) : null, tier, candidates }
 }
 
 /**
@@ -4113,7 +4114,7 @@ function resolveAnswerThreadWithLog(
     explicitThreadId == null &&
     originTurn == null &&
     liveTurn == null
-      ? findLatestEndedTurnForChat(chatId)
+      ? findLatestTurnForChat(chatId, { endedOnly: false })
       : null
   const threadId = resolveAnswerThreadId({
     explicitThreadId,
@@ -5012,7 +5013,7 @@ function snapshotContextOccupancy(): void {
     } catch {
       cap = null; // config unreadable → show occupancy without a ratio
     }
-    const stateDir = process.env.SWITCHROOM_AGENT_STATE_DIR ?? "/state/agent";
+    const stateDir = resolveAgentStateDir();
     writeContextOccupancySnapshot(
       stateDir,
       buildContextOccupancy(occupancy, cap, Date.now()),
@@ -5033,12 +5034,12 @@ function emitTurnRecord(turn: CurrentTurn, endedAt: number): void {
             toolCallCount: turn.toolCallCount ?? 0,
             turnId: turn.turnId,
             finalAnswerDelivered: turn.finalAnswerDelivered,
-            deliveryOutcome: turn.deliveryOutcome,
+            deliveryOutcome: turn.deliveryOutcome, landedUnconfirmed: turn.landedUnconfirmed,
           },
           endedAt,
         ),
       ) + '\n'
-    const turnsPath = '/state/agent/turns.jsonl'
+    const turnsPath = resolveTurnsJsonlPath() // honours SWITCHROOM_AGENT_STATE_DIR
     // Size-cap rotation: keep at most one rotated generation so the file can't
     // grow unbounded on a long-lived agent. Best-effort (never throws).
     maybeRotate(turnsPath, {

package/telegram-plugin/gateway/latest-turn-lookup.ts

@@ -0,0 +1,60 @@
+/**
+ * The recently-seen-turn registry scan, extracted from `gateway.ts` as a pure
+ * function so its ENDED-ness contract is unit-testable (#3725; gateway.ts is not
+ * importable in tests — the repo's `decideTurnFlush` / `resolveReplyOwnerTurnId`
+ * pattern).
+ *
+ * ## Why `endedOnly` exists (#3725)
+ *
+ * `recentTurnsById` is populated at turn **start** (`rememberRecentTurn` fires
+ * from the `enqueue` lifecycle event in `stream-render.ts`), and the atom is
+ * built with `endedAt: null`; `endedAt` is stamped later, in `turn-end.ts`. So
+ * the registry's tail entry for a chat is the most-recently-STARTED turn, which
+ * may still be RUNNING. The registry is also chat-wide and thread-agnostic, so
+ * on a forum a turn running in ANOTHER topic sits at the tail.
+ *
+ * That distinction is load-bearing because the two consumers want different
+ * things:
+ *
+ *   - **Routing** (`resolveAnswerThreadWithLog`) wants the chat's most recent
+ *     turn whether or not it has ended — it only picks a topic to deliver into,
+ *     and a still-running turn's topic is a perfectly good (indeed better)
+ *     answer than falling back to General. `endedOnly: false`.
+ *   - **Owner resolution** (`resolveReplyOwnerTurn` → the `latest-ended`
+ *     supersede tier) wants a genuinely ENDED turn: that tier carries
+ *     DESTRUCTIVE authority (it drives message deletion) and is bounded by the
+ *     supersede TTL measured from `endedAt`. A turn with `endedAt == null` has
+ *     no age, so it could not be TTL-bounded at all — it was an unbounded
+ *     anchor for the corroborated content-gate bypass (#3725). A still-running
+ *     turn must be resolved by the `live` tier, never by this fallback.
+ *     `endedOnly: true`.
+ */
+
+/** The registry-atom shape this scan needs (structural — `CurrentTurn` in the
+ *  gateway satisfies it without importing the gateway's type). */
+export interface LatestTurnLookupAtom {
+  /** The chat the turn belongs to. */
+  sessionChatId: string
+  /** Wall-clock ms the turn ENDED, or null while it is still running. */
+  endedAt: number | null
+}
+
+/**
+ * The last turn for `chatId` in registry insertion order — i.e. the most recent
+ * one. With `endedOnly: true` the scan skips turns that have not ended yet, so
+ * the result is the most-recently-ended turn (which may NOT be the tail entry).
+ * Returns null when the chat has no matching turn.
+ */
+export function latestTurnForChat<T extends LatestTurnLookupAtom>(
+  turns: Iterable<T>,
+  chatId: string,
+  opts: { endedOnly: boolean },
+): T | null {
+  let latest: T | null = null
+  for (const t of turns) {
+    if (t.sessionChatId !== chatId) continue
+    if (opts.endedOnly && t.endedAt == null) continue
+    latest = t
+  }
+  return latest
+}