switchroom 0.13.42 → 0.13.44

package/dist/cli/switchroom.js

@@ -27303,8 +27303,15 @@ function checkAclByAgent(config, agentName, key) {
       return { allow: true };
     }
   }
-  const mcpServers = agentConfig.mcp_servers ?? {};
-  for (const mcpEntry of Object.values(mcpServers)) {
+  const cfgWithProfiles = config;
+  const profileName = agentConfig.extends;
+  const profileMcp = profileName != null && profileName.length > 0 ? cfgWithProfiles.profiles?.[profileName]?.mcp_servers ?? {} : {};
+  const effectiveMcp = {
+    ...cfgWithProfiles.defaults?.mcp_servers ?? {},
+    ...profileMcp,
+    ...agentConfig.mcp_servers ?? {}
+  };
+  for (const mcpEntry of Object.values(effectiveMcp)) {
     if (!mcpEntry || typeof mcpEntry !== "object")
       continue;
     const declared = mcpEntry.secrets;
@@ -47756,8 +47763,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.42";
-var COMMIT_SHA = "915bf972";
+var VERSION = "0.13.44";
+var COMMIT_SHA = "fa99d4de";
 
 // src/cli/agent.ts
 init_source();

package/dist/vault/broker/server.js

@@ -13055,8 +13055,15 @@ function checkAclByAgent(config, agentName, key) {
       return { allow: true };
     }
   }
-  const mcpServers = agentConfig.mcp_servers ?? {};
-  for (const mcpEntry of Object.values(mcpServers)) {
+  const cfgWithProfiles = config;
+  const profileName = agentConfig.extends;
+  const profileMcp = profileName != null && profileName.length > 0 ? cfgWithProfiles.profiles?.[profileName]?.mcp_servers ?? {} : {};
+  const effectiveMcp = {
+    ...cfgWithProfiles.defaults?.mcp_servers ?? {},
+    ...profileMcp,
+    ...agentConfig.mcp_servers ?? {}
+  };
+  for (const mcpEntry of Object.values(effectiveMcp)) {
     if (!mcpEntry || typeof mcpEntry !== "object")
       continue;
     const declared = mcpEntry.secrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.13.42",
+  "version": "0.13.44",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/answer-stream.ts

@@ -92,6 +92,22 @@ export interface AnswerStreamConfig {
       message_thread_id?: number
       link_preview_options?: { is_disabled: boolean }
       reply_parameters?: { message_id: number }
+      /**
+       * Distinguishes a streaming open (`'stream'` — silent edits-in-place
+       * preview, default) from the turn-end materialize (`'materialize'` —
+       * the user-facing final answer that should ping the device exactly
+       * once, matching beat-5 of the conversational-pacing contract).
+       *
+       * Used by the gateway wrapper in `gateway.ts` to set
+       * `disable_notification: true` for 'stream' purpose only —
+       * materialize lets the platform default (notify) through. Without
+       * this distinction, either every send pings (the original #1672
+       * bug, two device pings per multi-step turn — see
+       * `over-ping-safety-net.ts`) or none does (the over-correction
+       * where text-only short turns silently land and the user has no
+       * notification to know the answer arrived).
+       */
+      purpose?: 'stream' | 'materialize'
     },
   ) => Promise<{ message_id: number }>
   editMessageText: (
@@ -344,10 +360,14 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
         throw err
       }
     } else {
-      // First send — capture message_id; check generation for supersession
+      // First send — capture message_id; check generation for supersession.
+      // purpose: 'stream' tells the gateway wrapper this is the visible
+      // preview opener — silent (no device ping). The turn-end materialize
+      // path uses 'materialize' to allow the platform-default ping.
       const sendParams: Parameters<typeof sendMessage>[2] = {
         parse_mode: 'HTML',
         link_preview_options: { is_disabled: true },
+        purpose: 'stream',
       }
       if (threadId != null) sendParams.message_thread_id = threadId
       if (replyToMessageId != null) sendParams.reply_parameters = { message_id: replyToMessageId }
@@ -495,10 +515,16 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
         return undefined
       }
 
-      // Always send a fresh message for push notification
+      // Always send a fresh message for push notification.
+      // purpose: 'materialize' tells the gateway wrapper to allow the
+      // platform-default device ping through (vs the 'stream' opener
+      // which is forced silent). materialize() is the turn-end final-
+      // answer surface — beat 5 of the conversational-pacing contract
+      // — and MUST ping so the user knows the answer landed.
       const sendParams: Parameters<typeof sendMessage>[2] = {
         parse_mode: 'HTML',
         link_preview_options: { is_disabled: true },
+        purpose: 'materialize',
       }
       if (threadId != null) sendParams.message_thread_id = threadId
       // Don't quote-reply on materialize — the draft stream already established

package/telegram-plugin/dist/gateway/gateway.js

@@ -37624,7 +37624,7 @@ function tick2(now) {
 import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync, mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname6, join as join6 } from "node:path";
 import { homedir as homedir2 } from "node:os";
-var SILENT_END_MAX_RETRIES = 1;
+var SILENT_END_MAX_RETRIES = 2;
 function resolveStateDir(deps) {
   if (deps?.stateDir != null)
     return deps.stateDir;
@@ -37862,7 +37862,8 @@ function createAnswerStream(config) {
     } else {
       const sendParams = {
         parse_mode: "HTML",
-        link_preview_options: { is_disabled: true }
+        link_preview_options: { is_disabled: true },
+        purpose: "stream"
       };
       if (threadId != null)
         sendParams.message_thread_id = threadId;
@@ -37978,7 +37979,8 @@ function createAnswerStream(config) {
       }
       const sendParams = {
         parse_mode: "HTML",
-        link_preview_options: { is_disabled: true }
+        link_preview_options: { is_disabled: true },
+        purpose: "materialize"
       };
       if (threadId != null)
         sendParams.message_thread_id = threadId;
@@ -48730,10 +48732,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.13.42";
-var COMMIT_SHA = "915bf972";
-var COMMIT_DATE = "2026-05-25T08:37:49Z";
-var LATEST_PR = 1808;
+var VERSION = "0.13.44";
+var COMMIT_SHA = "fa99d4de";
+var COMMIT_DATE = "2026-05-25T12:04:09Z";
+var LATEST_PR = 1816;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -50457,7 +50459,15 @@ var STREAM_THROTTLE_MS_OVERRIDE = (() => {
   return Number.isFinite(n) && n >= 0 ? n : undefined;
 })();
 var TURN_FLUSH_SAFETY_ENABLED = isTurnFlushSafetyEnabled();
-var ANSWER_STREAM_VISIBLE_ENABLED = process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM === "1" || process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM === "true";
+var ANSWER_STREAM_VISIBLE_ENABLED = (() => {
+  const raw = process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM;
+  if (raw == null)
+    return true;
+  const v = raw.trim().toLowerCase();
+  if (v === "0" || v === "false" || v === "off" || v === "no")
+    return false;
+  return true;
+})();
 var progressDriver = null;
 var unpinProgressCardForChat = null;
 var getPinnedProgressCardMessageId = null;
@@ -52662,14 +52672,16 @@ function handleSessionEvent(ev) {
             ...ANSWER_STREAM_VISIBLE_ENABLED ? { minInitialChars: 1 } : { sendMessageDraft: sendMessageDraftFn },
             sendMessage: async (chatId, text, params) => {
               const tid = params?.message_thread_id;
+              const silent = params?.purpose !== "materialize";
               const msg = await robustApiCall(() => bot.api.sendMessage(chatId, text, {
                 parse_mode: params?.parse_mode,
+                disable_notification: silent,
                 ...tid != null ? { message_thread_id: tid } : {},
                 ...params?.link_preview_options != null ? { link_preview_options: params.link_preview_options } : {},
                 ...params?.reply_parameters != null ? { reply_parameters: params.reply_parameters } : {}
               }), {
                 chat_id: chatId,
-                verb: "answer-stream.sendMessage",
+                verb: `answer-stream.sendMessage(${params?.purpose ?? "stream"})`,
                 ...tid != null ? { threadId: tid } : {}
               });
               return { message_id: msg.message_id };
@@ -52785,24 +52797,32 @@ function handleSessionEvent(ev) {
         const streamedFinalText = turn.capturedText.join("").trim();
         if (ANSWER_STREAM_VISIBLE_ENABLED && !turn.replyCalled && streamedMsgId != null && streamedFinalText.length > 0) {
           turn.answerStream = null;
-          stream.stop();
           streamFinalizedAsAnswer = true;
           turn.finalAnswerDelivered = true;
-          try {
-            outboundDedup.record(turn.sessionChatId, turn.sessionThreadId, streamedFinalText, Date.now(), turn.registryKey ?? null);
-          } catch {}
-          if (HISTORY_ENABLED) {
+          const oldStreamedMsgId = streamedMsgId;
+          (async () => {
+            let materializedId;
             try {
-              recordOutbound({
-                chat_id: turn.sessionChatId,
-                thread_id: turn.sessionThreadId ?? null,
-                message_ids: [streamedMsgId],
-                texts: [streamedFinalText]
-              });
-            } catch {}
-          }
-          process.stderr.write(`telegram gateway: answer-stream finalized as answer chat=${turn.sessionChatId} msg=${streamedMsgId} chars=${streamedFinalText.length}
+              materializedId = await stream.materialize();
+            } catch (err) {
+              process.stderr.write(`telegram gateway: answer-stream materialize failed: ${err instanceof Error ? err.message : String(err)}
+`);
+              return;
+            }
+            if (typeof materializedId !== "number" || !Number.isFinite(materializedId)) {
+              process.stderr.write(`telegram gateway: answer-stream materialize returned no msgId chat=${turn.sessionChatId} oldMsg=${oldStreamedMsgId} \u2014 ` + `preserving silent preview as the user's only copy
 `);
+              return;
+            }
+            try {
+              await bot.api.deleteMessage(turn.sessionChatId, oldStreamedMsgId);
+            } catch (delErr) {
+              process.stderr.write(`telegram gateway: answer-stream materialize-cleanup delete failed for msgId=${oldStreamedMsgId}: ${delErr instanceof Error ? delErr.message : String(delErr)}
+`);
+            }
+            process.stderr.write(`telegram gateway: answer-stream materialized as answer chat=${turn.sessionChatId} oldMsg=${oldStreamedMsgId} newMsg=${materializedId} chars=${streamedFinalText.length}
+`);
+          })();
         } else {
           turn.answerStream = null;
           stream.retract().catch((err) => {

package/telegram-plugin/gateway/gateway.ts

@@ -3024,10 +3024,24 @@ const TURN_FLUSH_SAFETY_ENABLED = isTurnFlushSafetyEnabled()
 // shape — they see the answer materialise live. For longer waits,
 // the cross-turn pending-progress system (#1445/#1669) is the
 // canonical surface and DOES ping at the appropriate boundaries.
-// Default OFF; flip per-agent via env to canary the new behaviour.
-const ANSWER_STREAM_VISIBLE_ENABLED =
-  process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM === '1'
-  || process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM === 'true'
+//
+// 2026-05-25: default flipped ON after fleet-log audit showed
+// framework-fallback rate at ~19% of inbounds (target per
+// `reference/conversational-pacing.md`: <0.5%). Streaming the
+// model's text events live into the chat closes the
+// catastrophic-UX failure mode at the lane-of-first-defense level.
+// Aligned with the "chat IS the artifact" sub-principle (the user
+// sees a normal chat message that grows — no chrome, no parallel
+// widget). Override with SWITCHROOM_VISIBLE_ANSWER_STREAM=0 to
+// disable, e.g. for an agent that needs the legacy draft-only
+// behaviour during debugging.
+const ANSWER_STREAM_VISIBLE_ENABLED = (() => {
+  const raw = process.env.SWITCHROOM_VISIBLE_ANSWER_STREAM
+  if (raw == null) return true
+  const v = raw.trim().toLowerCase()
+  if (v === '0' || v === 'false' || v === 'off' || v === 'no') return false
+  return true
+})()
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const progressDriver: any = null
 const unpinProgressCardForChat: ((chatId: string, threadId: number | undefined) => void) | null = null
@@ -6665,12 +6679,39 @@ function handleSessionEvent(ev: SessionEvent): void {
             // instead of crashing the answer-stream loop on a deleted
             // forum topic. answer-stream's own try/catch already
             // tolerates undefined returns from editMessageText.
+            //
+            // disable_notification gating by purpose (2026-05-25):
+            //
+            // - purpose='stream' (the live edit-in-place preview): SILENT.
+            //   Without disable_notification, the first text chunk that
+            //   opens the visible message device-pings, and then when the
+            //   model later calls the reply MCP tool, that reply pings
+            //   AGAIN (the over-ping safety net at gateway.ts:~4452 only
+            //   sees executeReply paths, not this direct sendMessage). Two
+            //   device pings per multi-step turn — the original Bug A.
+            //   Edits in place don't notify regardless (Telegram semantics).
+            //
+            // - purpose='materialize' (turn-end final-answer fresh send,
+            //   only fires for text-only turns where the stream IS the
+            //   answer): PING. The user reached for the agent and the
+            //   model produced an answer; per beat 5 of
+            //   `reference/conversational-pacing.md` the final answer MUST
+            //   ping the device exactly once. Without this carve-out, a
+            //   short text-only turn ("on it" being the whole response)
+            //   lands silently and the user has no notification to know
+            //   the answer arrived — the original over-correction.
+            //
+            // - purpose unset (defensive default): SILENT. Treat as
+            //   stream-purpose so we never accidentally fire a stray ping
+            //   from an unrecognised sendMessage callsite.
             sendMessage: async (chatId, text, params) => {
               const tid = params?.message_thread_id
+              const silent = params?.purpose !== 'materialize'
               const msg = await robustApiCall(
                 () =>
                   bot.api.sendMessage(chatId, text, {
                     parse_mode: params?.parse_mode,
+                    disable_notification: silent,
                     ...(tid != null ? { message_thread_id: tid } : {}),
                     ...(params?.link_preview_options != null
                       ? { link_preview_options: params.link_preview_options }
@@ -6681,7 +6722,7 @@ function handleSessionEvent(ev: SessionEvent): void {
                   }),
                 {
                   chat_id: chatId,
-                  verb: 'answer-stream.sendMessage',
+                  verb: `answer-stream.sendMessage(${params?.purpose ?? 'stream'})`,
                   ...(tid != null ? { threadId: tid } : {}),
                 },
               )
@@ -6872,13 +6913,30 @@ function handleSessionEvent(ev: SessionEvent): void {
       //
       // #869-Phase1 override: when `ANSWER_STREAM_VISIBLE_ENABLED` is
       // on, the stream is rendering a USER-VISIBLE message in the
-      // chat timeline. Retracting (delete) destroys content the user
-      // has been reading live — the worst possible UX flicker. So
-      // when the stream is the de-facto final answer (model never
-      // called reply, captured text is substantive) we instead call
-      // `stream.stop()` to freeze it as the final state, record the
-      // outbound for history + dedup, mark the turn answered, and
-      // suppress the turn-flush IIFE downstream.
+      // chat timeline. When the stream is the de-facto final answer
+      // (model never called reply, captured text is substantive), we
+      // need to:
+      //   1. Send a FRESH pinged message via `stream.materialize()`
+      //      so the user gets a device notification — beat 5 of the
+      //      conversational-pacing contract requires exactly one
+      //      ping per turn for the final answer. Without this,
+      //      text-only short turns ("on it" being the whole reply)
+      //      land silently and the user has no notification to know
+      //      the answer arrived (the failure caught by the
+      //      midturn-silent-dm UAT, 2026-05-25).
+      //   2. Delete the silent streamed preview message so the user
+      //      doesn't see a duplicate (the streamed message in place
+      //      + the fresh materialized ping). materialize() handles
+      //      the fresh send but leaves the old streamed message_id
+      //      orphaned by design — we delete it explicitly here.
+      //
+      // The previous behavior (just `stream.stop()` to freeze the
+      // streamed message in place) avoided the duplicate but also
+      // skipped the ping. Materialize-and-delete trades a brief
+      // visual "the streamed message is replaced by a fresh one"
+      // (often imperceptible for short turns where the streaming
+      // barely had time to register; mildly visible for longer
+      // turns) in exchange for an always-correct turn-end ping.
       let streamFinalizedAsAnswer = false
       if (turn?.answerStream != null) {
         const stream = turn.answerStream
@@ -6891,36 +6949,80 @@ function handleSessionEvent(ev: SessionEvent): void {
           && streamedFinalText.length > 0
         ) {
           turn.answerStream = null
-          stream.stop()
           streamFinalizedAsAnswer = true
           turn.finalAnswerDelivered = true
-          // Record as canonical outbound so retries dedup against it
-          // and the SQLite history can surface it. Mirrors the
-          // hooks turn-flush + reply both run.
-          try {
-            outboundDedup.record(
-              turn.sessionChatId,
-              turn.sessionThreadId,
-              streamedFinalText,
-              Date.now(),
-              turn.registryKey ?? null,
-            )
-          } catch { /* best-effort */ }
-          if (HISTORY_ENABLED) {
+          // Capture the old streamed message_id BEFORE materialize so
+          // we can delete it after the fresh ping send. materialize()
+          // overwrites `streamMsgId` internally with the new send's id;
+          // without capturing here we'd lose the reference.
+          const oldStreamedMsgId = streamedMsgId
+          // Fire-and-forget materialize-and-delete sequence.
+          //
+          // Bookkeeping (dedup + history): handled inside
+          // `materialize()` itself — see `answer-stream.ts:~548-549`
+          // which calls the injected `recordDedup` + `recordOutbound`
+          // callbacks with the NEW (fresh-send) message_id only after a
+          // successful send. We deliberately do NOT pre-record here —
+          // doing so populates the same `outboundDedup` store that
+          // materialize's internal `checkDedup` consults at
+          // `answer-stream.ts:~510`, causing materialize to dedup-
+          // suppress its own send (return undefined, no ping fires) —
+          // the exact failure mode this PR exists to fix. Let
+          // materialize own the bookkeeping; gateway only sequences the
+          // operations.
+          //
+          // Delete gating: only run the cleanup `deleteMessage` if
+          // materialize actually sent (returned a numeric sentId). If
+          // it dedup-suppressed or threw, the streamed preview is the
+          // user's only copy of the answer and MUST be preserved.
+          void (async () => {
+            let materializedId: number | undefined
             try {
-              recordOutbound({
-                chat_id: turn.sessionChatId,
-                thread_id: turn.sessionThreadId ?? null,
-                message_ids: [streamedMsgId],
-                texts: [streamedFinalText],
-              })
-            } catch { /* best-effort */ }
-          }
-          process.stderr.write(
-            `telegram gateway: answer-stream finalized as answer ` +
-            `chat=${turn.sessionChatId} msg=${streamedMsgId} ` +
-            `chars=${streamedFinalText.length}\n`,
-          )
+              materializedId = await stream.materialize()
+            } catch (err) {
+              process.stderr.write(
+                `telegram gateway: answer-stream materialize failed: ${
+                  err instanceof Error ? err.message : String(err)
+                }\n`,
+              )
+              return
+            }
+            if (typeof materializedId !== 'number' || !Number.isFinite(materializedId)) {
+              // materialize() returned undefined — either pendingText
+              // was empty, the body was a silent marker (NO_REPLY /
+              // HEARTBEAT_OK), or `checkDedup` suppressed it. In every
+              // such case the streamed preview is the user's only copy
+              // of the content; don't delete it.
+              process.stderr.write(
+                `telegram gateway: answer-stream materialize returned no msgId ` +
+                `chat=${turn.sessionChatId} oldMsg=${oldStreamedMsgId} — ` +
+                `preserving silent preview as the user's only copy\n`,
+              )
+              return
+            }
+            // Materialize sent a fresh pinged message at materializedId.
+            // Delete the silent streamed preview so the chat shows one
+            // canonical message (the fresh pinged one) and not two with
+            // duplicate content. Best-effort; failures (already gone,
+            // permission denied) leave a brief visible duplicate which
+            // we accept rather than retry-storming.
+            try {
+              // allow-raw-bot-api: cleanup delete of silent streamed preview
+              await bot.api.deleteMessage(turn.sessionChatId, oldStreamedMsgId)
+            } catch (delErr) {
+              process.stderr.write(
+                `telegram gateway: answer-stream materialize-cleanup ` +
+                `delete failed for msgId=${oldStreamedMsgId}: ${
+                  delErr instanceof Error ? delErr.message : String(delErr)
+                }\n`,
+              )
+            }
+            process.stderr.write(
+              `telegram gateway: answer-stream materialized as answer ` +
+              `chat=${turn.sessionChatId} oldMsg=${oldStreamedMsgId} ` +
+              `newMsg=${materializedId} chars=${streamedFinalText.length}\n`,
+            )
+          })()
         } else {
           turn.answerStream = null
           void stream.retract().catch((err) => {

package/telegram-plugin/hooks/silent-end-interrupt-stop.mjs

@@ -62,7 +62,8 @@ import { scanTurnForFinalReply } from './silent-end-scan.mjs'
 
 // MUST stay in sync with SILENT_END_MAX_RETRIES in telegram-plugin/silent-end.ts
 // (this hook is a standalone .mjs and can't import the TS module).
-const MAX_RETRIES = 1
+// Bumped 1 → 2 on 2026-05-25 — see the matching doc-comment in silent-end.ts.
+const MAX_RETRIES = 2
 
 function readStdin() {
   try {

package/telegram-plugin/silent-end.ts

@@ -56,8 +56,18 @@ export interface SilentEndDeps {
  * gives up. MUST stay in sync with `MAX_RETRIES` in the Stop hook
  * (`telegram-plugin/hooks/silent-end-interrupt-stop.mjs`) — the hook is a
  * standalone `.mjs` and can't import this module.
+ *
+ * 2026-05-25 bump from 1 → 2. With the original budget of 1, a model
+ * that stubbornly emitted `type:"text"` + `stop_reason:"end_turn"` twice
+ * in a row (instead of calling the reply tool) fell through to the
+ * gateway's 5-minute silence-poke framework-fallback. Second-retry
+ * cases now get a chance before the user-visible nudge fires. Memory:
+ * the Stop hook prompt itself is explicit ("only text sent through the
+ * reply tool is delivered. Send your final answer now"), so a second
+ * nudge isn't redundant — it's giving a different sample from the
+ * model under the same prompt.
  */
-export const SILENT_END_MAX_RETRIES = 1
+export const SILENT_END_MAX_RETRIES = 2
 
 function resolveStateDir(deps?: SilentEndDeps): string {
   if (deps?.stateDir != null) return deps.stateDir

package/telegram-plugin/tests/silent-end-interrupt-stop-integration.test.ts

@@ -18,6 +18,7 @@
 
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
 import { spawnSync } from 'node:child_process'
+import { SILENT_END_MAX_RETRIES } from '../silent-end.js'
 import {
   mkdtempSync,
   mkdirSync,
@@ -172,7 +173,10 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
       reply('ack', { disable_notification: true }),
     ])
     const statePath = join(stateDir, 'silent-end-pending.json')
-    writeFileSync(statePath, JSON.stringify({ retryCount: 1, chatId: '111' }), 'utf8')
+    // Use the canonical ceiling so this test stays accurate as MAX_RETRIES evolves.
+    writeFileSync(statePath, JSON.stringify({
+      retryCount: SILENT_END_MAX_RETRIES, chatId: '111',
+    }), 'utf8')
 
     const r = runHook({
       event: { session_id: 's1', transcript_path: transcript },
@@ -183,7 +187,7 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
     expect(r.stderr).toMatch(/retry exhausted/)
     // State unchanged.
     const state = JSON.parse(readFileSync(statePath, 'utf8'))
-    expect(state.retryCount).toBe(1)
+    expect(state.retryCount).toBe(SILENT_END_MAX_RETRIES)
   })
 
   it('NO_REPLY in transcript → allow stop, no state file written', () => {

package/telegram-plugin/tests/silent-end.test.ts

@@ -226,10 +226,11 @@ describe('recordSilentTurnEnd — #1161 exhaustion detection', () => {
   it('full lifecycle: silent → re-prompt → still silent → exhausted', () => {
     // 1. Turn ends silent — first record.
     expect(recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' }).exhausted).toBe(false)
-    // 2. Stop hook blocks and increments retryCount (simulated).
+    // 2. Stop hook blocks and bumps retryCount up to the ceiling
+    //    (simulated; the hook does retryCount+1 each block until MAX).
     const path = join(stateDir, 'silent-end-pending.json')
     const s = readSilentEndState()!
-    writeFileSync(path, JSON.stringify({ ...s, retryCount: s.retryCount + 1 }))
+    writeFileSync(path, JSON.stringify({ ...s, retryCount: SILENT_END_MAX_RETRIES }))
     // 3. Re-prompted turn ends silent again — recovery exhausted.
     expect(recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' }).exhausted).toBe(true)
     expect(readSilentEndState()).toBeNull()
@@ -346,10 +347,11 @@ describe('recordUndeliveredTurnEnd — #1664 extended trigger', () => {
       [{ text: 'one sec', disableNotification: true }],
       'c:exhaust',
     ).rePromptEngaged).toBe(true)
-    // Stop hook blocks once and bumps retryCount (simulated).
+    // Stop hook blocks until retryCount hits the ceiling (simulated;
+    // the hook does retryCount+1 each block until SILENT_END_MAX_RETRIES).
     const path = join(stateDir, 'silent-end-pending.json')
     const s = readSilentEndState()!
-    writeFileSync(path, JSON.stringify({ ...s, retryCount: s.retryCount + 1 }))
+    writeFileSync(path, JSON.stringify({ ...s, retryCount: SILENT_END_MAX_RETRIES }))
     // Re-prompted turn STILL ends with only an interim ack → exhausted.
     const second = recordUndeliveredTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:exhaust' })
     expect(second.exhausted).toBe(true)
@@ -538,13 +540,14 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
     expect(readSilentEndState()!.retryCount).toBe(1)
   })
 
-  it('allows the stop when retryCount >= MAX_RETRIES (1), even if transcript still shows no reply', () => {
-    // Retry already spent — gateway will post the user-facing
+  it('allows the stop when retryCount >= MAX_RETRIES, even if transcript still shows no reply', () => {
+    // Retry budget already spent — gateway will post the user-facing
     // fallback so the user isn't left silent.
     const path = join(stateDir, 'silent-end-pending.json')
     mkdirSync(stateDir, { recursive: true })
     writeFileSync(path, JSON.stringify({
-      chatId: 'c', threadId: null, turnKey: 'c:_', retryCount: 1, timestamp: 0,
+      chatId: 'c', threadId: null, turnKey: 'c:_',
+      retryCount: SILENT_END_MAX_RETRIES, timestamp: 0,
     }))
     const transcript = writeTranscript([
       ENQUEUE,