switchroom 0.13.16 → 0.13.18

package/dist/cli/switchroom.js

@@ -47331,8 +47331,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.16";
-var COMMIT_SHA = "6c71b36b";
+var VERSION = "0.13.18";
+var COMMIT_SHA = "847c860e";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.13.16",
+  "version": "0.13.18",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -37034,6 +37034,56 @@ function emitRuntimeMetric(event) {
   captureEvent(event.kind, { ...event, ts: wrapped.ts });
 }
 
+// over-ping-safety-net.ts
+function decideOverPing(input) {
+  if (!input.modelRequestedPing) {
+    return { suppress: false, claimSlot: false, sinceFirstPingMs: null };
+  }
+  if (input.firstPingAt != null) {
+    return {
+      suppress: true,
+      claimSlot: false,
+      sinceFirstPingMs: input.nowMs - input.firstPingAt
+    };
+  }
+  return { suppress: false, claimSlot: true, sinceFirstPingMs: null };
+}
+
+// silent-reply-anchor.ts
+var TELEGRAM_MSG_CAP = 4000;
+function enabled2() {
+  const v = process.env.SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT;
+  return !(v === "1" || v === "true");
+}
+function decideSilentReplyAnchor(input) {
+  if (!enabled2()) {
+    return { kind: "fresh", becomesAnchor: false };
+  }
+  if (!input.effectivelySilent) {
+    return { kind: "fresh", becomesAnchor: false };
+  }
+  if (input.hasFiles || input.hasButtons) {
+    return { kind: "fresh", becomesAnchor: false };
+  }
+  if (input.newReplyText.trim().length === 0) {
+    return { kind: "fresh", becomesAnchor: false };
+  }
+  if (input.anchorMessageId == null) {
+    return { kind: "fresh", becomesAnchor: true };
+  }
+  const merged = `${input.anchorText}
+
+${input.newReplyText}`;
+  if (merged.length > TELEGRAM_MSG_CAP) {
+    return { kind: "fresh", becomesAnchor: true };
+  }
+  return {
+    kind: "edit-anchor",
+    messageId: input.anchorMessageId,
+    mergedText: merged
+  };
+}
+
 // inbound-classifier.ts
 var STATUS_QUERY_PATTERNS = [
   /^\?+$/,
@@ -37300,12 +37350,12 @@ function startTimer(deps) {
 var EDIT_INTERVAL_MS = 60000;
 var POLL_INTERVAL_MS = 5000;
 var MAX_LIFETIME_MS = 30 * 60000;
-var TELEGRAM_MSG_CAP = 4000;
+var TELEGRAM_MSG_CAP2 = 4000;
 var SUFFIX_RE = /\n\n\u2014 still working \(\d+m\)$/;
 var stateByKey = new Map;
 var timer2 = null;
 var activeDeps2 = null;
-function enabled2() {
+function enabled3() {
   const v = process.env.SWITCHROOM_DISABLE_PENDING_PROGRESS;
   return !(v === "1" || v === "true");
 }
@@ -37327,19 +37377,19 @@ function ensure(key) {
   return s;
 }
 function noteAsyncDispatch(key) {
-  if (!enabled2())
+  if (!enabled3())
     return;
   ensure(key).pending = true;
 }
 function noteOutbound3(key, opts) {
-  if (!enabled2())
+  if (!enabled3())
     return;
   const s = ensure(key);
   s.anchorMessageId = opts.messageId;
   s.anchorOriginalText = opts.text.replace(SUFFIX_RE, "");
 }
 function noteTurnEnd(key) {
-  if (!enabled2())
+  if (!enabled3())
     return;
   const s = stateByKey.get(key);
   if (s == null)
@@ -37369,7 +37419,7 @@ function clearPending(key, reason) {
   });
 }
 function startTimer2(deps) {
-  if (!enabled2())
+  if (!enabled3())
     return;
   if (timer2 != null)
     return;
@@ -37409,7 +37459,7 @@ function tick2(now) {
 
 \u2014 still working (${minutes}m)`;
     const newText = s.anchorOriginalText + suffix;
-    if (newText.length > TELEGRAM_MSG_CAP) {
+    if (newText.length > TELEGRAM_MSG_CAP2) {
       s.lastEditAt = now;
       continue;
     }
@@ -44586,9 +44636,9 @@ function transition(state3, event) {
 
 // gateway/inbound-delivery-machine-shadow.ts
 var state3 = initialState();
-var enabled3 = process.env.SWITCHROOM_DELIVERY_MACHINE_SHADOW !== "0";
+var enabled4 = process.env.SWITCHROOM_DELIVERY_MACHINE_SHADOW !== "0";
 function shadowEmit(event) {
-  if (!enabled3)
+  if (!enabled4)
     return [];
   try {
     const result = transition(state3, event);
@@ -44646,12 +44696,12 @@ function redeliverBufferedInbound2(buffer, agent, send, spool) {
 }
 
 // gateway/inbound-delivery-machine-dispatch.ts
-var enabled4 = process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER !== "0";
+var enabled5 = process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER !== "0";
 function isDispatchEnabled() {
-  return enabled4;
+  return enabled5;
 }
 function dispatchEffects(effects, ctx) {
-  if (!enabled4)
+  if (!enabled5)
     return;
   for (const effect of effects) {
     dispatchOne(effect, ctx);
@@ -48154,10 +48204,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.13.16";
-var COMMIT_SHA = "6c71b36b";
-var COMMIT_DATE = "2026-05-23T03:56:34Z";
-var LATEST_PR = 1675;
+var VERSION = "0.13.18";
+var COMMIT_SHA = "847c860e";
+var COMMIT_DATE = "2026-05-23T06:38:45Z";
+var LATEST_PR = 1680;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -50620,13 +50670,24 @@ async function executeReply(args) {
   let disableNotification = args.disable_notification === true;
   {
     const turn2 = currentTurn;
-    if (turn2 != null && !disableNotification) {
-      if (turn2.firstPingAt != null) {
-        process.stderr.write(`telegram gateway: reply over-ping safety net \u2014 ` + `downgrading disable_notification:false \u2192 true ` + `(chat=${chat_id} thread=${args.message_thread_id ?? "-"} firstPingAt=${turn2.firstPingAt} sinceFirstPing_ms=${Date.now() - turn2.firstPingAt})
+    if (turn2 != null) {
+      const now = Date.now();
+      const decision = decideOverPing({
+        modelRequestedPing: !disableNotification,
+        firstPingAt: turn2.firstPingAt,
+        nowMs: now
+      });
+      if (decision.suppress) {
+        process.stderr.write(`telegram gateway: reply over-ping safety net \u2014 ` + `downgrading disable_notification:false \u2192 true ` + `(chat=${chat_id} thread=${args.message_thread_id ?? "-"} firstPingAt=${turn2.firstPingAt} sinceFirstPing_ms=${decision.sinceFirstPingMs})
 `);
+        emitRuntimeMetric({
+          kind: "over_ping_suppressed",
+          key: statusKey(chat_id, args.message_thread_id != null ? Number(args.message_thread_id) : undefined),
+          sinceFirstPingMs: decision.sinceFirstPingMs ?? 0
+        });
         disableNotification = true;
-      } else {
-        turn2.firstPingAt = Date.now();
+      } else if (decision.claimSlot) {
+        turn2.firstPingAt = now;
       }
     }
   }
@@ -50723,6 +50784,81 @@ ${url}`;
     previewMessageId = null;
   }
   startTypingLoop(chat_id);
+  let silentAnchorEditDone = false;
+  {
+    const turn2 = currentTurn;
+    if (turn2 != null && chunks.length === 1) {
+      const decision = decideSilentReplyAnchor({
+        effectivelySilent: disableNotification,
+        anchorMessageId: turn2.silentAnchorMessageId,
+        anchorText: turn2.silentAnchorText,
+        newReplyText: effectiveText,
+        hasFiles: files.length > 0,
+        hasButtons: replyMarkup != null
+      });
+      if (decision.kind === "edit-anchor") {
+        const editParams = {
+          link_preview_options: { is_disabled: disableLinkPreview }
+        };
+        if (parseMode != null)
+          editParams.parse_mode = parseMode;
+        if (threadId != null)
+          editParams.message_thread_id = threadId;
+        try {
+          await robustApiCall(() => lockedBot.api.editMessageText(chat_id, decision.messageId, decision.mergedText, editParams), {
+            chat_id,
+            verb: "reply.silent-anchor-edit",
+            ...threadId != null ? { threadId } : {}
+          });
+          turn2.silentAnchorText = decision.mergedText;
+          sentIds.push(decision.messageId);
+          logOutbound("edit", chat_id, decision.messageId, decision.mergedText.length, "silent-anchor-merge");
+          process.stderr.write(`telegram gateway: silent-reply auto-edit \u2014 ` + `chat=${chat_id} anchor=${decision.messageId} merged_len=${decision.mergedText.length}
+`);
+          noteOutbound3(statusKey(chat_id, threadId), {
+            messageId: decision.messageId,
+            text: decision.mergedText
+          });
+          if (HISTORY_ENABLED) {
+            try {
+              recordOutbound({
+                chat_id,
+                thread_id: threadId ?? null,
+                message_ids: [decision.messageId],
+                texts: [decision.mergedText],
+                attachment_kinds: [null]
+              });
+            } catch (histErr) {
+              process.stderr.write(`telegram gateway: history recordOutbound (silent-anchor-edit) failed: ${histErr instanceof Error ? histErr.message : String(histErr)}
+`);
+            }
+          }
+          if (turn2 != null && isFinalAnswerReply({
+            text: decision.mergedText,
+            disableNotification
+          })) {
+            turn2.finalAnswerDelivered = true;
+          }
+          outboundDedup.record(chat_id, threadId, decision.mergedText, Date.now());
+          silentAnchorEditDone = true;
+        } catch (err) {
+          process.stderr.write(`telegram gateway: silent-reply auto-edit failed, falling back to fresh send: ${err instanceof Error ? err.message : String(err)}
+`);
+        }
+      }
+    }
+  }
+  if (silentAnchorEditDone) {
+    stopTypingLoop(chat_id);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `edited (id: ${sentIds[0]})`
+        }
+      ]
+    };
+  }
   try {
     for (let i = 0;i < chunks.length; i++) {
       const shouldReplyTo = reply_to != null && replyMode !== "off" && (replyMode === "all" || i === 0);
@@ -50824,6 +50960,13 @@ ${url}`;
       });
     }
   }
+  if (chunks.length === 1 && disableNotification && files.length === 0 && replyMarkup == null && sentIds.length === 1) {
+    const turn2 = currentTurn;
+    if (turn2 != null) {
+      turn2.silentAnchorMessageId = sentIds[0];
+      turn2.silentAnchorText = effectiveText;
+    }
+  }
   const allPhotos = files.length >= 2 && files.length <= 10 && files.every((f) => PHOTO_EXTS.has(extname(f).toLowerCase()));
   const replyParams = reply_to != null && replyMode !== "off" ? { reply_parameters: { message_id: reply_to } } : {};
   if (allPhotos) {
@@ -51779,6 +51922,8 @@ function handleSessionEvent(ev) {
           replyCalled: false,
           finalAnswerDelivered: false,
           firstPingAt: null,
+          silentAnchorMessageId: null,
+          silentAnchorText: "",
           capturedText: [],
           orphanedReplyTimeoutId: null,
           registryKey: null,

package/telegram-plugin/gateway/gateway.ts

@@ -74,6 +74,8 @@ import {
   shutdownAnalytics,
 } from '../analytics-posthog.js'
 import { emitRuntimeMetric } from '../runtime-metrics.js'
+import { decideOverPing } from '../over-ping-safety-net.js'
+import { decideSilentReplyAnchor } from '../silent-reply-anchor.js'
 import { classifyInbound } from '../inbound-classifier.js'
 import * as silencePoke from '../silence-poke.js'
 import * as pendingProgress from '../pending-work-progress.js'
@@ -1217,6 +1219,16 @@ type CurrentTurn = {
   // the framework. Null until the first ping lands. Reset on every
   // fresh-turn enqueue.
   firstPingAt: number | null
+  // #1677 silent-reply auto-edit. The first silent reply of a turn
+  // captures `silentAnchorMessageId` + `silentAnchorText`; subsequent
+  // silent replies in the SAME turn editMessageText that anchor
+  // (appending with paragraph-break separator). Net visual: one
+  // growing silent bubble instead of N stacked silent bubbles.
+  // Cleared by turn-atom replacement on enqueue. See
+  // `telegram-plugin/silent-reply-anchor.ts` for the pure
+  // `decideSilentReplyAnchor` predicate.
+  silentAnchorMessageId: number | null
+  silentAnchorText: string
   capturedText: string[]
   orphanedReplyTimeoutId: ReturnType<typeof setTimeout> | null
   registryKey: string | null
@@ -4242,17 +4254,32 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   // send — races concurrent reply calls).
   {
     const turn = currentTurn
-    if (turn != null && !disableNotification) {
-      if (turn.firstPingAt != null) {
+    if (turn != null) {
+      const now = Date.now()
+      const decision = decideOverPing({
+        modelRequestedPing: !disableNotification,
+        firstPingAt: turn.firstPingAt,
+        nowMs: now,
+      })
+      if (decision.suppress) {
         process.stderr.write(
           `telegram gateway: reply over-ping safety net — ` +
           `downgrading disable_notification:false → true ` +
           `(chat=${chat_id} thread=${args.message_thread_id ?? '-'} ` +
-          `firstPingAt=${turn.firstPingAt} sinceFirstPing_ms=${Date.now() - turn.firstPingAt})\n`,
+          `firstPingAt=${turn.firstPingAt} sinceFirstPing_ms=${decision.sinceFirstPingMs})\n`,
         )
+        // Observability: surface to the unified runtime-metrics
+        // fan-out so the cadence dashboard can track fleet-wide
+        // over-ping rate (leading indicator of model pacing drift).
+        emitRuntimeMetric({
+          kind: 'over_ping_suppressed',
+          key: statusKey(chat_id, args.message_thread_id != null
+            ? Number(args.message_thread_id) : undefined),
+          sinceFirstPingMs: decision.sinceFirstPingMs ?? 0,
+        })
         disableNotification = true
-      } else {
-        turn.firstPingAt = Date.now()
+      } else if (decision.claimSlot) {
+        turn.firstPingAt = now
       }
     }
   }
@@ -4401,6 +4428,140 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
 
   startTypingLoop(chat_id)
 
+  // #1677 silent-reply auto-edit. Consecutive silent replies within
+  // a turn edit a single anchor message instead of stacking new
+  // bubbles. We branch BEFORE the chunk loop so the single-chunk
+  // common case takes an editMessageText path; everything else
+  // (multi-chunk, ping, files, buttons) falls through to fresh send
+  // and either captures a new anchor or doesn't, per the predicate.
+  let silentAnchorEditDone = false
+  {
+    const turn = currentTurn
+    if (turn != null && chunks.length === 1) {
+      const decision = decideSilentReplyAnchor({
+        effectivelySilent: disableNotification,
+        anchorMessageId: turn.silentAnchorMessageId,
+        anchorText: turn.silentAnchorText,
+        newReplyText: effectiveText,
+        hasFiles: files.length > 0,
+        hasButtons: replyMarkup != null,
+      })
+      if (decision.kind === 'edit-anchor') {
+        const editParams: {
+          parse_mode?: 'HTML' | 'MarkdownV2'
+          message_thread_id?: number
+          link_preview_options?: { is_disabled: boolean }
+        } = {
+          link_preview_options: { is_disabled: disableLinkPreview },
+        }
+        if (parseMode != null) editParams.parse_mode = parseMode
+        if (threadId != null) editParams.message_thread_id = threadId
+        try {
+          await robustApiCall(
+            () =>
+              lockedBot.api.editMessageText(
+                chat_id,
+                decision.messageId,
+                decision.mergedText,
+                editParams,
+              ),
+            {
+              chat_id,
+              verb: 'reply.silent-anchor-edit',
+              ...(threadId != null ? { threadId } : {}),
+            },
+          )
+          turn.silentAnchorText = decision.mergedText
+          sentIds.push(decision.messageId)
+          logOutbound(
+            'edit',
+            chat_id,
+            decision.messageId,
+            decision.mergedText.length,
+            'silent-anchor-merge',
+          )
+          process.stderr.write(
+            `telegram gateway: silent-reply auto-edit — ` +
+            `chat=${chat_id} anchor=${decision.messageId} ` +
+            `merged_len=${decision.mergedText.length}\n`,
+          )
+
+          // #1679 — side effects the chunk-loop completion path runs.
+          // The edit-anchor branch returns early below, so these must
+          // be wired here too. Skipping them silently causes:
+          //   - cross-turn ambient (`pending-work-progress.ts`) holds
+          //     a stale anchor text and OVERWRITES the model's
+          //     accumulated silent content with `still working (Nm)`
+          //     when async work is in flight (this is the load-bearing
+          //     fix);
+          //   - SQLite history (`get_recent_messages`) misses the
+          //     silent-anchor content;
+          //   - #1664 silent-end re-prompt fires even when the
+          //     accumulated silent content qualifies as substantive;
+          //   - retries within the dedup window may double-send.
+          pendingProgress.noteOutbound(statusKey(chat_id, threadId), {
+            messageId: decision.messageId,
+            text: decision.mergedText,
+          })
+          if (HISTORY_ENABLED) {
+            try {
+              recordOutbound({
+                chat_id,
+                thread_id: threadId ?? null,
+                message_ids: [decision.messageId],
+                texts: [decision.mergedText],
+                attachment_kinds: [null],
+              })
+            } catch (histErr) {
+              process.stderr.write(
+                `telegram gateway: history recordOutbound (silent-anchor-edit) failed: ${histErr instanceof Error ? histErr.message : String(histErr)}\n`,
+              )
+            }
+          }
+          if (
+            turn != null
+            && isFinalAnswerReply({
+              text: decision.mergedText,
+              disableNotification,
+            })
+          ) {
+            turn.finalAnswerDelivered = true
+          }
+          outboundDedup.record(
+            chat_id,
+            threadId,
+            decision.mergedText,
+            Date.now(),
+          )
+
+          silentAnchorEditDone = true
+        } catch (err) {
+          // Edit failed (e.g. message deleted, rate limit exhausted,
+          // parse error). Fall through to fresh-send below — the
+          // anchor will be overwritten by whatever lands.
+          process.stderr.write(
+            `telegram gateway: silent-reply auto-edit failed, ` +
+            `falling back to fresh send: ${err instanceof Error ? err.message : String(err)}\n`,
+          )
+        }
+      }
+    }
+  }
+
+  if (silentAnchorEditDone) {
+    // Skip the chunk loop entirely — the anchor edit IS the send.
+    // Match the normal exit path: stop typing, then return.
+    stopTypingLoop(chat_id)
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `edited (id: ${sentIds[0]})`,
+        },
+      ],
+    }
+  }
+
   try {
     for (let i = 0; i < chunks.length; i++) {
       const shouldReplyTo =
@@ -4536,6 +4697,27 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
     }
   }
 
+  // #1677 silent-reply auto-edit — anchor capture for the FIRST
+  // silent reply of a turn (or the silent reply that replaced the
+  // anchor on overflow). Only captures for the single-chunk,
+  // silent, no-files, no-buttons happy path; the edit-anchor path
+  // earlier in this function handles SUBSEQUENT silent replies by
+  // editing. The next silent reply this turn will see the captured
+  // anchor and edit it in place.
+  if (
+    chunks.length === 1
+    && disableNotification
+    && files.length === 0
+    && replyMarkup == null
+    && sentIds.length === 1
+  ) {
+    const turn = currentTurn
+    if (turn != null) {
+      turn.silentAnchorMessageId = sentIds[0]!
+      turn.silentAnchorText = effectiveText
+    }
+  }
+
   // #273: when files is 2-10 photos, batch them into a single
   // sendMediaGroup album rather than N separate sendPhoto calls. The
   // user's device fires one notification for the album instead of N
@@ -5925,6 +6107,8 @@ function handleSessionEvent(ev: SessionEvent): void {
           replyCalled: false,
           finalAnswerDelivered: false,
           firstPingAt: null,
+          silentAnchorMessageId: null,
+          silentAnchorText: '',
           capturedText: [],
           orphanedReplyTimeoutId: null,
           registryKey: null,

package/telegram-plugin/over-ping-safety-net.ts

@@ -0,0 +1,80 @@
+/**
+ * over-ping-safety-net.ts — pure decision predicate for #1674's
+ * "at-most-one device-ping per turn" framework safety net.
+ *
+ * Background. `reference/conversational-pacing.md` beat 5 is
+ * explicit: the model should deliver the answer as a fresh `reply`
+ * omitting `disable_notification` (i.e. pinging the device once).
+ * EXACTLY ONE ping per turn. The model occasionally violates this
+ * — fleet UAT 2026-05-23 reproduced a substantive Step 3 answer
+ * pinged + a wrap-up "Delivered all three steps with a wrap-up
+ * summary." ALSO pinged, two device beeps for a turn that should
+ * have produced one.
+ *
+ * This module is the framework safety net. The IO live in the
+ * gateway's `executeReply` (mutate `turn.firstPingAt`, emit log +
+ * runtime-metric, override `disableNotification`); keeping the
+ * *decision* pure makes the predicate unit-testable without
+ * standing up a gateway.
+ *
+ * Contract:
+ *   - When the model requested a ping (`!disable_notification`) AND
+ *     the current turn already had a ping land (`firstPingAt != null`),
+ *     the decision says SUPPRESS — the caller downgrades to silent.
+ *   - When the model requested a ping AND no prior ping this turn,
+ *     the decision says CLAIM the slot — caller sets `firstPingAt`.
+ *   - When the model requested silent, this module is a no-op.
+ *
+ * The slot is claimed BEFORE the actual send (caller responsibility).
+ * Trade-off documented inline in `gateway.ts:executeReply`.
+ */
+
+export interface OverPingDecisionInput {
+  /** True iff the model requested a device ping
+   *  (`disable_notification:false` or omitted, since the default is to
+   *  ping per Telegram Bot API). The caller computes this from the
+   *  inbound `args.disable_notification === true` check. */
+  modelRequestedPing: boolean
+  /** Wall-clock ms of the FIRST ping this turn, or null if no ping
+   *  has landed yet. Caller threads this through from
+   *  `CurrentTurn.firstPingAt`. */
+  firstPingAt: number | null
+  /** Deterministic clock for tests; defaults to Date.now() in callers. */
+  nowMs: number
+}
+
+export interface OverPingDecision {
+  /** True iff the caller should override `disableNotification` to
+   *  `true` (i.e. send this reply silently). Implies a contract
+   *  violation by the model — caller should log + emit a metric. */
+  suppress: boolean
+  /** True iff the caller should claim the slot —
+   *  `turn.firstPingAt = nowMs`. Mutually exclusive with `suppress`. */
+  claimSlot: boolean
+  /** When `suppress` is true, how long the first ping has been
+   *  "active" (ms since `firstPingAt`). Caller surfaces this in the
+   *  log + metric for forensic analysis (e.g. tight rapid double-pings
+   *  vs delayed wrap-ups). Null otherwise. */
+  sinceFirstPingMs: number | null
+}
+
+/**
+ * Pure decision: should the framework suppress this reply's ping?
+ * No mutation, no IO, deterministic under a fixed `nowMs`.
+ */
+export function decideOverPing(input: OverPingDecisionInput): OverPingDecision {
+  if (!input.modelRequestedPing) {
+    // Model already chose silent — nothing for the safety net to do.
+    return { suppress: false, claimSlot: false, sinceFirstPingMs: null }
+  }
+  if (input.firstPingAt != null) {
+    // Slot already claimed by an earlier ping this turn — suppress.
+    return {
+      suppress: true,
+      claimSlot: false,
+      sinceFirstPingMs: input.nowMs - input.firstPingAt,
+    }
+  }
+  // First ping this turn — let it through and claim the slot.
+  return { suppress: false, claimSlot: true, sinceFirstPingMs: null }
+}

package/telegram-plugin/runtime-metrics.ts

@@ -124,6 +124,24 @@ export type RuntimeMetricEvent =
       elapsedMs?: number
       reason?: string
     }
+  /**
+   * #1674 over-ping safety net engaged. Fires when a `reply` call
+   * arrived with `disable_notification: false` AND the current turn
+   * already had a pinged reply land — the framework downgraded this
+   * call to silent to honour beat 5's "EXACTLY ONE ping per turn"
+   * contract. Each event is a model contract violation the safety
+   * net caught. A high rate per agent means the model is
+   * systematically over-pinging — prompt drift or training
+   * regression worth investigating.
+   *
+   *   key                 → `<chatId>:<threadIdOrEmpty>` (the statusKey shape)
+   *   sinceFirstPingMs    → time since the FIRST ping landed this turn
+   */
+  | {
+      kind: 'over_ping_suppressed'
+      key: string
+      sinceFirstPingMs: number
+    }
 
 /**
  * The JSONL sink lives under the runtime state dir so it's per-agent

package/telegram-plugin/silent-reply-anchor.ts

@@ -0,0 +1,142 @@
+/**
+ * silent-reply-anchor.ts — pure decision predicate for the
+ * "consecutive silent replies edit one growing message" UX fix.
+ *
+ * Background. Modern Claude 2.1.x on this fleet implements
+ * conversational pacing (`reference/conversational-pacing.md` beats
+ * 1 + 3 + 5) by calling the `reply` MCP tool multiple times in a
+ * turn — a silent ack, silent per-step updates, and one pinged
+ * final answer. The over-ping safety net (#1674) caps the
+ * notifications at one. But the user still SEES N separate chat
+ * bubbles for the silent replies, which reads as visual spam even
+ * when no device pings. The operator's original complaint was
+ * exactly this shape:
+ *
+ *   "I would like more regular process updates, where it edits a
+ *    status message in place vs spamming multiple messages."
+ *
+ * Fix: consecutive silent replies within a turn EDIT a single
+ * anchor message instead of each sending a fresh bubble. The
+ * model's intent (silent mid-turn updates) is honoured; the
+ * framework controls the visual placement (one growing bubble,
+ * not many). Final pinged reply lands as a separate fresh bubble
+ * (it's the final answer; the silent anchor is the preamble).
+ *
+ * Net visual for a multi-step turn:
+ *   pre-fix:  4 bubbles (silent ack + 2 silent steps + 1 pinged final)
+ *   post-fix: 2 bubbles (1 silent anchor with all 3 thoughts + 1 pinged final)
+ *
+ * Pinged replies always fresh-send. Reply-tool calls with files
+ * or button keyboards bypass the anchor (fresh send) because the
+ * edit path can't merge those cleanly.
+ *
+ * Accumulation format: `${anchorText}\n\n${newReplyText}` —
+ * blank-line paragraph separator. Reads naturally as the model
+ * "thinking out loud" with paragraph breaks per thought.
+ *
+ * Kill switch: `SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT=1` — turns
+ * the safety net off; reverts to per-reply fresh send.
+ */
+
+/** Telegram caption / text limit. The accumulator stays under this. */
+export const TELEGRAM_MSG_CAP = 4000
+
+export interface SilentReplyAnchorDecisionInput {
+  /** True when the model passed `disable_notification: true` for
+   *  this reply (i.e. the model intends this to be silent — a
+   *  beat 1/3 update). The over-ping safety net coerces other
+   *  pings to silent; this predicate sees the EFFECTIVE flag, not
+   *  the raw model intent. */
+  effectivelySilent: boolean
+  /** Wall-clock ms of the current anchor's existence, or null when
+   *  no silent anchor has been set this turn. */
+  anchorMessageId: number | null
+  /** Text content of the current anchor (accumulated). Empty when
+   *  no anchor exists. */
+  anchorText: string
+  /** Text content of the incoming reply, BEFORE any anchor merge. */
+  newReplyText: string
+  /** True if the incoming reply has attached files (photos,
+   *  documents, etc). Anchor merge bypassed when true — edits
+   *  can't add media to an existing text message. */
+  hasFiles: boolean
+  /** True if the incoming reply has an inline keyboard. Anchor
+   *  merge bypassed when true — keyboard semantics across edits
+   *  are too easy to get wrong, and the markup is rare enough
+   *  that fresh-send is the safer default. */
+  hasButtons: boolean
+}
+
+/**
+ * What the caller should do with this reply.
+ *
+ *   - `kind: 'fresh'` — send a normal new message; if it should
+ *     become the next anchor (silent + no attachments), the caller
+ *     captures its message_id after send and sets the anchor.
+ *
+ *   - `kind: 'edit-anchor'` — DO NOT send; edit the existing
+ *     anchor message with `mergedText` as the new content. The
+ *     caller updates `anchor.text = mergedText` after a successful
+ *     edit. messageId is the anchor's existing id.
+ */
+export type SilentReplyAnchorDecision =
+  | { kind: 'fresh'; becomesAnchor: boolean }
+  | { kind: 'edit-anchor'; messageId: number; mergedText: string }
+
+function enabled(): boolean {
+  const v = process.env.SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT
+  return !(v === '1' || v === 'true')
+}
+
+/**
+ * Decide whether to merge this reply into an existing silent
+ * anchor or fresh-send. Pure: no IO, no mutation, kill-switch
+ * checked per call.
+ */
+export function decideSilentReplyAnchor(
+  input: SilentReplyAnchorDecisionInput,
+): SilentReplyAnchorDecision {
+  // Kill switch disengages the whole mechanism — every reply
+  // falls through to fresh-send with no anchor capture.
+  if (!enabled()) {
+    return { kind: 'fresh', becomesAnchor: false }
+  }
+
+  // Pinged replies never merge — they're the final answer bubble,
+  // semantically distinct from the silent preamble.
+  if (!input.effectivelySilent) {
+    return { kind: 'fresh', becomesAnchor: false }
+  }
+
+  // Files / buttons bypass the anchor — edit-text can't merge
+  // media, and keyboards across edits are a foot-gun.
+  if (input.hasFiles || input.hasButtons) {
+    return { kind: 'fresh', becomesAnchor: false }
+  }
+
+  // Empty body — let the caller's existing validation handle it.
+  // We treat as fresh-but-don't-anchor so a downstream "drop empty"
+  // doesn't leave a stale anchor pointer.
+  if (input.newReplyText.trim().length === 0) {
+    return { kind: 'fresh', becomesAnchor: false }
+  }
+
+  // No anchor yet this turn → this reply BECOMES the anchor.
+  if (input.anchorMessageId == null) {
+    return { kind: 'fresh', becomesAnchor: true }
+  }
+
+  // Anchor exists → try to merge. The merge format is paragraph-
+  // break separation. If the merged result would exceed the
+  // Telegram text cap, give up on the anchor and start fresh —
+  // the new reply becomes a new anchor.
+  const merged = `${input.anchorText}\n\n${input.newReplyText}`
+  if (merged.length > TELEGRAM_MSG_CAP) {
+    return { kind: 'fresh', becomesAnchor: true }
+  }
+  return {
+    kind: 'edit-anchor',
+    messageId: input.anchorMessageId,
+    mergedText: merged,
+  }
+}

package/telegram-plugin/tests/over-ping-safety-net.test.ts

@@ -0,0 +1,96 @@
+/**
+ * Unit suite for #1674's over-ping safety net predicate.
+ * Pins the decision logic in isolation from the gateway's
+ * `executeReply` IO so a future refactor can't silently regress.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { decideOverPing } from '../over-ping-safety-net.js'
+
+describe('decideOverPing — at-most-one-ping-per-turn safety net', () => {
+  it('lets the FIRST ping through and tells caller to claim the slot', () => {
+    const d = decideOverPing({
+      modelRequestedPing: true,
+      firstPingAt: null,
+      nowMs: 1_000,
+    })
+    expect(d.suppress).toBe(false)
+    expect(d.claimSlot).toBe(true)
+    expect(d.sinceFirstPingMs).toBeNull()
+  })
+
+  it('SUPPRESSES subsequent ping in the same turn and reports elapsed', () => {
+    const d = decideOverPing({
+      modelRequestedPing: true,
+      firstPingAt: 1_000,
+      nowMs: 4_500,
+    })
+    expect(d.suppress).toBe(true)
+    expect(d.claimSlot).toBe(false)
+    expect(d.sinceFirstPingMs).toBe(3_500)
+  })
+
+  it('is a no-op when the model already requested silent (regardless of slot state)', () => {
+    // No prior ping
+    const d1 = decideOverPing({
+      modelRequestedPing: false,
+      firstPingAt: null,
+      nowMs: 1_000,
+    })
+    expect(d1).toEqual({ suppress: false, claimSlot: false, sinceFirstPingMs: null })
+
+    // Prior ping already landed — silent reply still no-op, NOT claimed
+    const d2 = decideOverPing({
+      modelRequestedPing: false,
+      firstPingAt: 1_000,
+      nowMs: 5_000,
+    })
+    expect(d2).toEqual({ suppress: false, claimSlot: false, sinceFirstPingMs: null })
+  })
+
+  it('handles the edge case where firstPingAt equals nowMs (instant double-call)', () => {
+    // Same-tick double-fire: the second call comes in with firstPingAt
+    // exactly at nowMs. Elapsed is 0; suppress fires.
+    const d = decideOverPing({
+      modelRequestedPing: true,
+      firstPingAt: 1_000,
+      nowMs: 1_000,
+    })
+    expect(d.suppress).toBe(true)
+    expect(d.claimSlot).toBe(false)
+    expect(d.sinceFirstPingMs).toBe(0)
+  })
+
+  it('reports large elapsed deltas honestly (late wrap-up after long work)', () => {
+    // Real-world reproducer pattern: substantive answer pings at +30s,
+    // wrap-up "Delivered all three steps…" pings at +36s. The safety
+    // net catches the second; sinceFirstPingMs reflects the 6s gap.
+    const d = decideOverPing({
+      modelRequestedPing: true,
+      firstPingAt: 30_000,
+      nowMs: 36_000,
+    })
+    expect(d.suppress).toBe(true)
+    expect(d.sinceFirstPingMs).toBe(6_000)
+  })
+
+  it('claim-vs-suppress is mutually exclusive', () => {
+    // Defensive invariant — no caller path should ever see both flags
+    // true at once.
+    const cases: Array<{
+      modelRequestedPing: boolean
+      firstPingAt: number | null
+      nowMs: number
+    }> = [
+      { modelRequestedPing: true, firstPingAt: null, nowMs: 100 },
+      { modelRequestedPing: true, firstPingAt: 50, nowMs: 100 },
+      { modelRequestedPing: false, firstPingAt: null, nowMs: 100 },
+      { modelRequestedPing: false, firstPingAt: 50, nowMs: 100 },
+    ]
+    for (const c of cases) {
+      const d = decideOverPing(c)
+      expect(d.suppress && d.claimSlot).toBe(false)
+    }
+  })
+})

package/telegram-plugin/tests/silent-reply-anchor.test.ts

@@ -0,0 +1,178 @@
+/**
+ * Unit suite for #1677 silent-reply auto-edit predicate.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import {
+  TELEGRAM_MSG_CAP,
+  decideSilentReplyAnchor,
+} from '../silent-reply-anchor.js'
+
+describe('decideSilentReplyAnchor — silent replies edit a single growing anchor', () => {
+  beforeEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT
+  })
+  afterEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT
+  })
+
+  it('first silent reply this turn becomes the anchor (fresh send + capture)', () => {
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: null,
+      anchorText: '',
+      newReplyText: 'on it — checking the calendar',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: true })
+  })
+
+  it('subsequent silent reply edits the anchor with paragraph-break merge', () => {
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: 'on it — checking the calendar',
+      newReplyText: 'Step 1: hostname is example-host',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d).toEqual({
+      kind: 'edit-anchor',
+      messageId: 12345,
+      mergedText:
+        'on it — checking the calendar\n\nStep 1: hostname is example-host',
+    })
+  })
+
+  it('third and beyond silent replies keep accumulating onto the same anchor', () => {
+    // Simulate the multi-step pattern: ack → step1 → step2 → step3.
+    // After two prior accumulations the anchor reads as three paragraphs.
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: 'on it\n\nStep 1: hostname\n\nStep 2: OS family',
+      newReplyText: 'Step 3: CPU',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d.kind).toBe('edit-anchor')
+    if (d.kind === 'edit-anchor') {
+      expect(d.mergedText).toBe(
+        'on it\n\nStep 1: hostname\n\nStep 2: OS family\n\nStep 3: CPU',
+      )
+    }
+  })
+
+  it('pinged (effectivelySilent=false) reply NEVER merges — fresh send', () => {
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: false,
+      anchorMessageId: 12345,
+      anchorText: 'on it\n\nSteps done',
+      newReplyText: 'Final answer here',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+  })
+
+  it('files attached → fresh send (anchor cannot absorb media)', () => {
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: 'on it',
+      newReplyText: 'here is the chart',
+      hasFiles: true,
+      hasButtons: false,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+  })
+
+  it('button keyboard → fresh send (keyboard semantics across edits is a foot-gun)', () => {
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: 'on it',
+      newReplyText: 'choose one:',
+      hasFiles: false,
+      hasButtons: true,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+  })
+
+  it('empty reply body → fresh send + DO NOT become anchor', () => {
+    // The caller has its own empty-text validation; we just avoid
+    // leaving a dangling anchor pointer if the empty reply
+    // accidentally goes through.
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: null,
+      anchorText: '',
+      newReplyText: '   ',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+  })
+
+  it('overflow: merged text > TELEGRAM_MSG_CAP → fresh send + start new anchor', () => {
+    const huge = 'x'.repeat(TELEGRAM_MSG_CAP - 10)
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: huge,
+      newReplyText: 'short tail',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    // Merged would be huge + "\n\n" + "short tail" → exceeds cap.
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: true })
+  })
+
+  it('kill switch — `SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT=1` short-circuits to fresh send for every reply', () => {
+    process.env.SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT = '1'
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: 'on it',
+      newReplyText: 'Step 1',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+  })
+
+  it('kill switch accepts string "true" too', () => {
+    process.env.SWITCHROOM_DISABLE_SILENT_REPLY_AUTOEDIT = 'true'
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: null,
+      anchorText: '',
+      newReplyText: 'on it',
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+  })
+
+  it('borderline merge — exactly at the cap is accepted (boundary inclusive)', () => {
+    // Aim merged.length === TELEGRAM_MSG_CAP exactly.
+    // separator is "\n\n" (2 chars). anchor + separator + new === cap.
+    const newReplyText = 'tail'
+    const anchorLen = TELEGRAM_MSG_CAP - newReplyText.length - 2
+    const anchor = 'a'.repeat(anchorLen)
+    const d = decideSilentReplyAnchor({
+      effectivelySilent: true,
+      anchorMessageId: 12345,
+      anchorText: anchor,
+      newReplyText,
+      hasFiles: false,
+      hasButtons: false,
+    })
+    expect(d.kind).toBe('edit-anchor')
+    if (d.kind === 'edit-anchor') {
+      expect(d.mergedText.length).toBe(TELEGRAM_MSG_CAP)
+    }
+  })
+})