switchroom 0.15.3 → 0.15.4

package/telegram-plugin/gateway/inbound-spool.ts

@@ -102,14 +102,31 @@ export function spoolId(msg: InboundMessage): string {
 }
 
 interface SpoolRecord {
-  t: 'put' | 'ack'
-  id: string
+  t: 'put' | 'ack' | 'esc'
+  /** Present on `put`/`ack` (spoolId). Absent on `esc`. */
+  id?: string
   /** Present only on `put`. The full inbound to replay. */
   msg?: InboundMessage
   /** Present only on `put`. Owning agent (replay re-pushes per agent). */
   agent?: string
   /** Present only on `put`. ms epoch first-spooled — drives escalation. */
   firstAt?: number
+  /** Present only on `esc` — the chat the give-up notice was/would be
+   *  posted to, and when. Durably records the per-chat escalation-notice
+   *  window so a burst of undeliverable inbounds (or a multi-restart
+   *  outage) produces ONE "couldn't deliver" notice per chat, not one
+   *  per dropped entry. */
+  chat?: string | number
+  thread?: string
+  at?: number
+}
+
+/** Stable per-(chat,thread) key for coalescing give-up notices. */
+function escChatKey(msg: InboundMessage): string {
+  const threadRaw = msg.meta?.threadId
+  const thread =
+    typeof threadRaw === 'string' && threadRaw.length > 0 ? threadRaw : '-'
+  return `${msg.chatId}:${thread}`
 }
 
 export interface InboundSpoolFsSeam {
@@ -134,6 +151,14 @@ export interface InboundSpoolOptions {
   escalateAfterMs?: number
   /** Rewrite-compact the JSONL once it exceeds this. Default 256 KiB. */
   compactAtBytes?: number
+  /** Coalescing window for the user-facing "couldn't deliver" notice,
+   *  per chat. The window SLIDES on every escalation attempt (posted or
+   *  suppressed), so a sustained burst posts exactly one notice and only
+   *  re-notifies after the burst goes quiet for this long. Must exceed
+   *  the rate at which undeliverable entries age out (the 15-min
+   *  `escalateAfterMs` here) or back-to-back attempts wouldn't coalesce.
+   *  Default 30 min. */
+  escalateNoticeCooldownMs?: number
 }
 
 export interface ReplayEntry {
@@ -165,10 +190,20 @@ export interface InboundSpool {
    *  finished could land on top of the handback turn. Tombstones the
    *  dropped entries durably. */
   dropMatching: (predicate: (id: string) => boolean) => number
-  /** Escalate+drop entries older than `escalateAfterMs`. Calls
-   *  `onEscalate` once per dropped entry (post the "couldn't deliver"
-   *  card there). Returns the count escalated. Safe to call on a timer. */
-  sweepEscalations: (onEscalate: (e: ReplayEntry) => void) => number
+  /** Escalate+drop entries older than `escalateAfterMs`. Every dropped
+   *  entry is tombstoned (the promise is retracted deterministically),
+   *  but the user-facing notice is COALESCED per chat: `onEscalate` is
+   *  called for every dropped entry with `postNotice` indicating whether
+   *  to actually post the "couldn't deliver" card. `postNotice` is true
+   *  only for the first escalation to a given chat within
+   *  `escalateNoticeCooldownMs` — a burst of undeliverable inbounds (e.g.
+   *  a synthetic re-created every 15 min while the agent is down, across
+   *  restarts) yields ONE notice, not one per entry. The window is
+   *  persisted, so it holds across a gateway restart. Returns the count
+   *  of entries dropped. Safe to call on a timer. */
+  sweepEscalations: (
+    onEscalate: (e: ReplayEntry, opts: { postNotice: boolean }) => void,
+  ) => number
   /** Test/observability: count of live (un-acked) ids. */
   liveCount: () => number
 }
@@ -179,11 +214,18 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   const log = opts.log ?? ((l: string) => process.stderr.write(l))
   const escalateAfterMs = opts.escalateAfterMs ?? 15 * 60 * 1000
   const compactAtBytes = opts.compactAtBytes ?? 256 * 1024
+  const escalateNoticeCooldownMs = opts.escalateNoticeCooldownMs ?? 30 * 60 * 1000
 
   // In-memory projection of the on-disk log, rebuilt from the file at
   // construction. `live` maps spoolId → the put record (insertion order
   // preserved via the Map). An `ack` deletes from `live`.
   const live = new Map<string, { agent: string; msg: InboundMessage; firstAt: number }>()
+  // Per-chat last escalation-ATTEMPT time (posted or suppressed). Drives
+  // the sliding coalescing window so a burst of give-up escalations posts
+  // one notice. Rebuilt from durable `esc` records at construction so the
+  // window survives a gateway restart (the actual 2026-06-09 spam: a
+  // synthetic re-aged into the bound every 15 min across many restarts).
+  const escAttemptByChat = new Map<string, number>()
 
   function parseLine(line: string): SpoolRecord | null {
     const s = line.trim()
@@ -196,7 +238,13 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
     }
     if (rec == null || typeof rec !== 'object') return null
     const r = rec as Record<string, unknown>
-    if (r.t !== 'put' && r.t !== 'ack') return null
+    if (r.t !== 'put' && r.t !== 'ack' && r.t !== 'esc') return null
+    if (r.t === 'esc') {
+      // esc records key on chat, not a spoolId.
+      if (typeof r.chat !== 'string' && typeof r.chat !== 'number') return null
+      if (typeof r.at !== 'number') return null
+      return r as unknown as SpoolRecord
+    }
     if (typeof r.id !== 'string' || r.id.length === 0) return null
     if (r.t === 'put') {
       if (r.msg == null || typeof r.msg !== 'object') return null
@@ -209,6 +257,7 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   // Rebuild `live` from the file. Tolerates a torn last line.
   function hydrate(): void {
     live.clear()
+    escAttemptByChat.clear()
     if (!fs.existsSync(path)) return
     let raw = ''
     try {
@@ -221,13 +270,17 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
       if (rec == null) continue
       if (rec.t === 'put') {
         // Last put for an id wins; an ack later removes it.
-        live.set(rec.id, {
+        live.set(rec.id as string, {
           agent: rec.agent as string,
           msg: rec.msg as InboundMessage,
           firstAt: rec.firstAt as number,
         })
+      } else if (rec.t === 'esc') {
+        // Last escalation-attempt time per chat wins (records are in
+        // append order). Restores the sliding window across a restart.
+        escAttemptByChat.set(`${rec.chat}:${rec.thread ?? '-'}`, rec.at as number)
       } else {
-        live.delete(rec.id)
+        live.delete(rec.id as string)
       }
     }
   }
@@ -269,6 +322,22 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
         JSON.stringify({ t: 'put', id, agent: e.agent, msg: e.msg, firstAt: e.firstAt } satisfies SpoolRecord),
       )
     }
+    // Preserve the latest escalation-attempt time per chat so the sliding
+    // coalescing window isn't reset by compaction (which would let the next
+    // burst re-spam). One record per chat — bounded by the chat count.
+    for (const [key, at] of escAttemptByChat) {
+      const sep = key.lastIndexOf(':')
+      const chat = key.slice(0, sep)
+      const thread = key.slice(sep + 1)
+      lines.push(
+        JSON.stringify({
+          t: 'esc',
+          chat,
+          ...(thread !== '-' ? { thread } : {}),
+          at,
+        } satisfies SpoolRecord),
+      )
+    }
     const tmp = path + '.compact.tmp'
     try {
       fs.writeFileSync(tmp, lines.length ? lines.join('\n') + '\n' : '')
@@ -328,24 +397,46 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
       return n
     },
     sweepEscalations(onEscalate) {
-      const cutoff = now() - escalateAfterMs
-      let n = 0
+      const tNow = now()
+      const cutoff = tNow - escalateAfterMs
+      let dropped = 0
+      let posted = 0
       for (const [id, e] of [...live.entries()]) {
         if (e.firstAt > cutoff) continue
         live.delete(id)
         appendRecord({ t: 'ack', id }) // tombstone — promise retracted
+        // Coalesce the user-facing notice per chat on a SLIDING window:
+        // post only when the last attempt to this chat was longer ago than
+        // the cooldown; every attempt (posted or not) slides the window, so
+        // a sustained burst stays quiet after the first notice and only
+        // re-notifies once the burst goes quiet. Durable via `esc` records.
+        const key = escChatKey(e.msg)
+        const lastAttempt = escAttemptByChat.get(key)
+        const postNotice =
+          lastAttempt === undefined || tNow - lastAttempt >= escalateNoticeCooldownMs
+        escAttemptByChat.set(key, tNow)
+        const threadRaw = e.msg.meta?.threadId
+        const thread =
+          typeof threadRaw === 'string' && threadRaw.length > 0 ? threadRaw : undefined
+        appendRecord({ t: 'esc', chat: e.msg.chatId, thread, at: tNow })
         try {
-          onEscalate({ agent: e.agent, msg: e.msg })
+          onEscalate({ agent: e.agent, msg: e.msg }, { postNotice })
         } catch (err) {
           log(`inbound-spool: onEscalate threw id=${id}: ${(err as Error).message}\n`)
         }
-        n++
+        if (postNotice) posted++
+        dropped++
       }
-      if (n > 0) {
-        log(`inbound-spool: escalated+dropped ${n} undelivered entr${n === 1 ? 'y' : 'ies'} (older than ${escalateAfterMs}ms)\n`)
+      if (dropped > 0) {
+        const suppressed = dropped - posted
+        log(
+          `inbound-spool: escalated+dropped ${dropped} undelivered entr${dropped === 1 ? 'y' : 'ies'} ` +
+          `(older than ${escalateAfterMs}ms; ${posted} notice${posted === 1 ? '' : 's'} posted` +
+          `${suppressed > 0 ? `, ${suppressed} coalesced` : ''})\n`,
+        )
         maybeCompact()
       }
-      return n
+      return dropped
     },
     liveCount() {
       return live.size

package/telegram-plugin/gateway/model-command.ts

@@ -279,6 +279,11 @@ export async function buildModelMenu(
     }
   }
 
+  // claude's ✔ marks the DEFAULT FOR NEW SESSIONS, which is a different axis
+  // from the model the agent is running right now (set via --model at launch
+  // or a prior session switch). Labelling the ✔ row "Now:" was misleading —
+  // it could read "Opus 4.8" while the live session is on Fable. Call it what
+  // it is, and tell the operator a switch applies to the live session.
   const current = discovered.options.find((o) => o.current)
   const lines: string[] = [`<b>Model — ${deps.escapeHtml(deps.getAgentName())}</b>`]
   if (discovered.dismissFailed) {
@@ -286,18 +291,33 @@ export async function buildModelMenu(
   }
   if (current) {
     const detail = current.detail ? ` · ${deps.escapeHtml(current.detail)}` : ''
-    lines.push(`Now: <b>${deps.escapeHtml(current.label)}</b>${detail}`)
+    lines.push(`Default (new sessions): <b>${deps.escapeHtml(current.label)}</b>${detail}`)
   } else {
-    lines.push('Now: <i>unknown (no ✔ row in picker)</i>')
+    lines.push('Default (new sessions): <i>unknown (no ✔ row in picker)</i>')
   }
   if (quota) lines.push(`Quota: ${deps.escapeHtml(quota)}`)
-  lines.push('', 'Tap to switch (applies to the live session):')
+  lines.push('', 'Tap a model to switch the <b>live session</b>:')
   lines.push(PERSIST_NOTE)
 
   return { text: lines.join('\n'), html: true, keyboard: menuKeyboard(discovered.options) }
 }
 
 export interface ModelCallbackOutcome {
+  /**
+   * When true, the caller should ONLY show the toast (`answer`) and leave
+   * the existing menu message untouched — used for the mid-turn refusal so
+   * the menu keeps its buttons and the operator can simply tap again when
+   * the agent goes idle, instead of the menu collapsing to a button-less
+   * "try again" line (which read as "nothing happened").
+   */
+  toastOnly?: boolean
+  /**
+   * On a successful session switch, the live model name now running (parsed
+   * from claude's confirmation, e.g. "Fable 5"). The gateway records this as
+   * the session-model override so `/status` reflects what's actually running.
+   * Absent on every non-switch outcome.
+   */
+  selectedModel?: string
   /** Short toast for answerCallbackQuery. */
   answer: string
   /** Replacement dashboard (message edit). */
@@ -321,19 +341,30 @@ export async function handleModelMenuCallback(
   if (!data.startsWith(MODEL_CALLBACK_SELECT)) {
     return { answer: 'Unknown action', reply: await buildModelMenu(deps) }
   }
+  // Mid-turn: refuse WITHOUT touching the message. Driving the picker types
+  // into claude's input box, which mid-turn would queue "/model" as user
+  // text. toastOnly keeps the menu (and its buttons) exactly as-is so the
+  // operator just taps again when the agent is idle — no button-less
+  // "try again" line that read as a dead menu.
   if (deps.isBusy()) {
-    return { answer: 'Agent is mid-turn — try again shortly', reply: busyReply(deps) }
+    return {
+      answer: '⏳ Agent is mid-turn — tap again when it’s idle',
+      reply: busyReply(deps),
+      toastOnly: true,
+    }
   }
 
   const tag = data.slice(MODEL_CALLBACK_SELECT.length)
   const discovered = await deps.discover(deps.getAgentName())
   if (!discovered.ok) {
+    // Keep the menu interactive: re-render (falls back to v1 text if even
+    // the show path can't discover) with the failure as a banner.
     return {
       answer: 'Picker unavailable',
-      reply: {
-        text: `❌ Could not open the model picker: ${deps.escapeHtml(discovered.reason)}`,
-        html: true,
-      },
+      reply: await menuWithBanner(
+        deps,
+        `❌ Could not open the model picker: ${deps.escapeHtml(discovered.reason)}`,
+      ),
     }
   }
   const target = discovered.options.find((o) => labelTag(o.label) === tag)
@@ -342,27 +373,64 @@ export async function handleModelMenuCallback(
     const fresh = await buildModelMenu(deps)
     return { answer: 'Model list changed — menu refreshed', reply: fresh }
   }
-  if (target.current) {
-    const fresh = await buildModelMenu(deps)
-    return { answer: `Already on ${target.label}`, reply: fresh }
-  }
-
+  // NOTE: do NOT short-circuit when target.current is set. The picker's ✔
+  // marks claude's DEFAULT FOR NEW SESSIONS, which is a DIFFERENT axis from
+  // the model the live session is running (set by --model at launch). Tapping
+  // the ✔ row to apply that model to the live session is a legitimate switch
+  // — e.g. an agent launched on Fable tapping "Default (Opus)". Skipping it
+  // here was the "tapped Default, nothing happened" bug. Always drive the
+  // selection; claude harmlessly answers "Kept model as X" if it's already
+  // the session model.
   const result = await deps.select(deps.getAgentName(), target.label)
   if (!result.ok) {
+    // Switch failed but the agent is reachable — keep the menu so the
+    // operator can retry, with the reason as a banner.
     return {
-      answer: 'Switch failed',
-      reply: {
-        text: `❌ Switch to <b>${deps.escapeHtml(target.label)}</b> failed: ${deps.escapeHtml(result.reason)}`,
-        html: true,
-      },
+      answer: 'Switch failed — see the menu',
+      reply: await menuWithBanner(
+        deps,
+        `❌ Switch to <b>${deps.escapeHtml(target.label)}</b> failed: ${deps.escapeHtml(result.reason)}`,
+      ),
     }
   }
 
+  return {
+    answer: deps.escapeHtml(result.confirmation),
+    reply: await menuWithBanner(deps, `✅ ${deps.escapeHtml(result.confirmation)}`),
+    selectedModel: sessionModelFromConfirmation(result.confirmation) ?? target.label,
+  }
+}
+
+/**
+ * Pull the model NAME out of claude's session-switch confirmation so it can
+ * be shown in `/status` as the live session model. claude phrases it as
+ * "Set model to <name> for this session only" (or "Switched to <name>").
+ * Returns null when the confirmation doesn't carry a recognizable name (the
+ * caller falls back to the tapped picker label).
+ */
+export function sessionModelFromConfirmation(confirmation: string): string | null {
+  const m = /(?:Set model to|Switched to)\s+(.+?)(?:\s+for (?:this|the) session|\s*\(|\s*$)/i.exec(
+    confirmation.trim(),
+  )
+  const name = m?.[1]?.trim()
+  return name && name.length > 0 ? name : null
+}
+
+/**
+ * Re-render the live menu with a one-line banner on top. Used by every
+ * post-tap outcome (success, already-default, failure) so the menu ALWAYS
+ * keeps its buttons and the operator can act again — the consistent
+ * "status line + interactive menu" shape the other dashboards use. Falls
+ * back to the banner alone if the menu can't be rebuilt right now.
+ */
+async function menuWithBanner(
+  deps: ModelMenuDeps & ModelCommandDeps,
+  banner: string,
+): Promise<ModelMenuReply> {
   const fresh = await buildModelMenu(deps)
-  const confirmed: ModelMenuReply = {
-    text: [`✅ ${deps.escapeHtml(result.confirmation)}`, '', fresh.text].join('\n'),
+  return {
+    text: [banner, '', fresh.text].join('\n'),
     html: true,
     ...(fresh.keyboard ? { keyboard: fresh.keyboard } : {}),
   }
-  return { answer: result.confirmation, reply: confirmed }
 }

package/telegram-plugin/tests/inbound-spool.test.ts

@@ -285,6 +285,107 @@ describe('inbound-spool — bounded escalation (promise always resolved)', () =>
   })
 })
 
+describe('inbound-spool — give-up notice coalescing (2026-06-09 marko spam)', () => {
+  // Helper: drive a sweep, return the list of postNotice flags per dropped entry.
+  function sweepFlags(s: ReturnType<typeof createInboundSpool>): boolean[] {
+    const flags: boolean[] = []
+    s.sweepEscalations((_e, { postNotice }) => flags.push(postNotice))
+    return flags
+  }
+
+  it('a burst of undeliverable entries in one chat posts exactly ONE notice', () => {
+    const fs = fakeFs()
+    let t = 0
+    const s = createInboundSpool({
+      path: PATH, fs, now: () => t,
+      escalateAfterMs: 100, escalateNoticeCooldownMs: 10_000,
+    })
+    // Three synthetics, same chat, distinct ids (fresh ts → distinct spoolId,
+    // the exact churn shape that produced the spam).
+    s.put('marko', msg({ messageId: 0, ts: 1, meta: { source: 'cron' } }))
+    s.put('marko', msg({ messageId: 0, ts: 2, meta: { source: 'cron' } }))
+    s.put('marko', msg({ messageId: 0, ts: 3, meta: { source: 'cron' } }))
+    t = 1000 // all older than the 100ms bound
+    const flags = sweepFlags(s)
+    expect(flags.length).toBe(3) // all three dropped (promise retracted)
+    expect(flags.filter(Boolean).length).toBe(1) // ONE notice posted
+    expect(s.liveCount()).toBe(0)
+  })
+
+  it('distinct chats each get their own notice', () => {
+    const fs = fakeFs()
+    let t = 0
+    const s = createInboundSpool({ path: PATH, fs, now: () => t, escalateAfterMs: 100 })
+    s.put('marko', msg({ chatId: 'A', messageId: 1 }))
+    s.put('marko', msg({ chatId: 'B', messageId: 2 }))
+    t = 1000
+    expect(sweepFlags(s).filter(Boolean).length).toBe(2)
+  })
+
+  it('same chat, different forum topics are coalesced independently', () => {
+    const fs = fakeFs()
+    let t = 0
+    const s = createInboundSpool({ path: PATH, fs, now: () => t, escalateAfterMs: 100 })
+    s.put('marko', msg({ chatId: 'A', messageId: 1, meta: { threadId: '3' } }))
+    s.put('marko', msg({ chatId: 'A', messageId: 2, meta: { threadId: '4' } }))
+    t = 1000
+    expect(sweepFlags(s).filter(Boolean).length).toBe(2)
+  })
+
+  it('THE BUG: the coalescing window survives a restart — a re-aged synthetic does not re-spam', () => {
+    const fs = fakeFs()
+    let t = 0
+    const opts = { escalateAfterMs: 100, escalateNoticeCooldownMs: 60_000 }
+    // Boot 1: one synthetic ages out → posts the notice.
+    const s1 = createInboundSpool({ path: PATH, fs, now: () => t, ...opts })
+    s1.put('marko', msg({ messageId: 0, ts: 1, meta: { source: 'cron' } }))
+    t = 1000
+    expect(sweepFlags(s1)).toEqual([true])
+    // Restart. A NEW synthetic (fresh ts → fresh id) lands and ages out within
+    // the cooldown. Pre-fix this re-posted every cycle across restarts.
+    t = 5000
+    const s2 = createInboundSpool({ path: PATH, fs, now: () => t, ...opts })
+    s2.put('marko', msg({ messageId: 0, ts: 2, meta: { source: 'cron' } }))
+    t = 6000
+    expect(sweepFlags(s2)).toEqual([false]) // dropped, but notice SUPPRESSED
+  })
+
+  it('compaction preserves the coalescing window (a post-compaction restart does not re-spam)', () => {
+    const fs = fakeFs()
+    let t = 0
+    // Tiny compact threshold so the next append triggers a rewrite.
+    const opts = { escalateAfterMs: 100, escalateNoticeCooldownMs: 60_000, compactAtBytes: 1 }
+    const s1 = createInboundSpool({ path: PATH, fs, now: () => t, ...opts })
+    s1.put('marko', msg({ messageId: 0, ts: 1, meta: { source: 'cron' } }))
+    t = 1000
+    expect(sweepFlags(s1)).toEqual([true]) // posts + appends esc; compaction runs
+    // After compaction the file must still carry the esc record → a restart
+    // hydrates the window → a new re-aged synthetic stays suppressed.
+    t = 5000
+    const s2 = createInboundSpool({ path: PATH, fs, now: () => t, ...opts })
+    s2.put('marko', msg({ messageId: 0, ts: 2, meta: { source: 'cron' } }))
+    t = 6000
+    expect(sweepFlags(s2)).toEqual([false])
+  })
+
+  it('re-notifies after the burst goes quiet for longer than the cooldown', () => {
+    const fs = fakeFs()
+    let t = 0
+    const s = createInboundSpool({
+      path: PATH, fs, now: () => t,
+      escalateAfterMs: 100, escalateNoticeCooldownMs: 1000,
+    })
+    s.put('marko', msg({ messageId: 0, ts: 1, meta: { source: 'cron' } }))
+    t = 200
+    expect(sweepFlags(s)).toEqual([true]) // first notice
+    // Quiet gap longer than the cooldown, then a new stuck synthetic.
+    t = 5000
+    s.put('marko', msg({ messageId: 0, ts: 2, meta: { source: 'cron' } }))
+    t = 5200
+    expect(sweepFlags(s)).toEqual([true]) // genuinely new situation → re-notify
+  })
+})
+
 describe('inbound-spool — robustness', () => {
   it('a failing appendFileSync does not throw and keeps in-memory live state', () => {
     const fs = fakeFs()

package/telegram-plugin/tests/model-command.test.ts

@@ -212,6 +212,7 @@ import {
   buildModelMenu,
   handleModelMenuCallback,
   modelSelectCallbackData,
+  sessionModelFromConfirmation,
   MODEL_CALLBACK_REFRESH,
   type ModelMenuDeps,
 } from "../gateway/model-command.js";
@@ -316,27 +317,61 @@ describe("handleModelMenuCallback", () => {
     expect(out.reply.keyboard).toBeDefined();
   });
 
-  it("tapping the current model is a no-op refresh", async () => {
+  it("tapping the ✔ (default) row STILL drives a switch — ✔ is the new-session default, not the live session model", async () => {
+    // OPTIONS marks "Sonnet" current (the ✔). An agent launched on a
+    // different model must still be able to apply the ✔ row to its live
+    // session — skipping it was the "tapped Default, nothing happened" bug.
     const { deps, calls } = makeMenuDeps();
     const out = await handleModelMenuCallback(modelSelectCallbackData("Sonnet"), deps);
-    expect(calls.select).toEqual([]);
-    expect(out.answer).toContain("Already on Sonnet");
+    expect(calls.select).toEqual(["Sonnet"]);
+    expect(out.reply.text).toContain("✅");
+    expect(out.reply.keyboard).toBeDefined();
   });
 
-  it("busy agent → never selects", async () => {
+  it("busy agent → toastOnly refusal that leaves the menu untouched", async () => {
     const { deps, calls } = makeMenuDeps({ isBusy: () => true });
     const out = await handleModelMenuCallback(modelSelectCallbackData("Haiku"), deps);
     expect(calls.select).toEqual([]);
     expect(out.answer).toContain("mid-turn");
+    // toastOnly tells the gateway to NOT edit the menu — buttons survive.
+    expect(out.toastOnly).toBe(true);
   });
 
-  it("selection failure surfaces the reason", async () => {
+  it("selection failure surfaces the reason AND keeps the menu so the operator can retry", async () => {
     const { deps } = makeMenuDeps({
       select: async () => ({ ok: false as const, reason: "cursor verification failed" }),
     });
     const out = await handleModelMenuCallback(modelSelectCallbackData("Haiku"), deps);
-    expect(out.answer).toBe("Switch failed");
+    expect(out.answer).toContain("failed");
     expect(out.reply.text).toContain("cursor verification failed");
+    // The menu buttons are preserved — a failure no longer collapses the
+    // menu to a button-less error (the "nothing happened" bug).
+    expect(out.reply.keyboard).toBeDefined();
+  });
+
+  it("a successful switch banners the confirmation, keeps the menu, AND reports the live model for /status", async () => {
+    const { deps } = makeMenuDeps({
+      select: async () => ({ ok: true as const, confirmation: "Set model to Haiku 4.5 for this session only" }),
+    });
+    const out = await handleModelMenuCallback(modelSelectCallbackData("Haiku"), deps);
+    expect(out.answer).toContain("Haiku 4.5");
+    expect(out.reply.text).toContain("✅");
+    expect(out.reply.text).toContain("Set model to Haiku 4.5");
+    expect(out.reply.keyboard).toBeDefined();
+    // The gateway records this so /status reflects the live session model.
+    expect(out.selectedModel).toBe("Haiku 4.5");
+  });
+});
+
+describe("sessionModelFromConfirmation", () => {
+  it("pulls the model name from claude's session-switch confirmation", () => {
+    expect(sessionModelFromConfirmation("Set model to Fable 5 for this session only")).toBe("Fable 5");
+    expect(sessionModelFromConfirmation("Set model to Opus 4.8 (1M context) for this session only")).toBe("Opus 4.8");
+    expect(sessionModelFromConfirmation("Switched to Haiku 4.5")).toBe("Haiku 4.5");
+  });
+  it("returns null when no recognizable name is present", () => {
+    expect(sessionModelFromConfirmation("Kept model as Opus 4.8 (default)")).toBeNull();
+    expect(sessionModelFromConfirmation("")).toBeNull();
   });
 
   it("mdl:r re-renders the dashboard", async () => {

package/telegram-plugin/tests/welcome-text.test.ts

@@ -82,6 +82,17 @@ describe("formatAgentLine", () => {
     const out = formatAgentLine({ ...baseMeta, topicName: "Planning", topicEmoji: "🗓" });
     expect(out).toContain("topic: 🗓 Planning");
   });
+  it("shows the live session model alongside the configured model when a /model switch is active", () => {
+    const out = formatAgentLine({ ...baseMeta, model: "claude-fable-5[1m]", sessionModel: "Opus 4.8 (1M context)" });
+    // Both surfaces present + agree: configured AND what's actually running.
+    expect(out).toContain("<code>claude-fable-5[1m]</code>");
+    expect(out).toContain("live session: <code>Opus 4.8 (1M context)</code>");
+  });
+  it("omits the session line when no override is active", () => {
+    expect(formatAgentLine({ ...baseMeta, sessionModel: null })).not.toContain("live session");
+    expect(formatAgentLine({ ...baseMeta, sessionModel: "" })).not.toContain("live session");
+    expect(formatAgentLine(baseMeta)).not.toContain("live session");
+  });
   it("omits topic when only emoji is set", () => {
     // topicName null → no topic chunk. Keeps the line clean.
     expect(formatAgentLine({ ...baseMeta, topicEmoji: "🗓" })).not.toContain("topic");

package/telegram-plugin/welcome-text.ts

@@ -66,6 +66,14 @@ export type StatusProbeRow = {
 export type AgentMetadata = {
   agentName: string;
   model: string | null;
+  /**
+   * Live session-model override set via the `/model` picker (session-only,
+   * resets on restart). When present it's what the agent is ACTUALLY running
+   * right now, distinct from `model` (the persistent configured model). Null
+   * when no session switch is active — then `/status` just shows `model`.
+   * Surfaced so `/status` and `/model` never silently disagree.
+   */
+  sessionModel?: string | null;
   extendsProfile: string | null;
   topicName: string | null;
   topicEmoji: string | null;
@@ -122,7 +130,14 @@ export function formatAgentLine(meta: AgentMetadata): string {
   const topic = meta.topicName
     ? ` · topic: ${escapeHtml([meta.topicEmoji, meta.topicName].filter(Boolean).join(" "))}`
     : "";
-  return `<b>${escapeHtml(meta.agentName)}</b> · model: <code>${escapeHtml(m)}</code>${topic}`;
+  // A live `/model` session switch overrides what's running. Show it next to
+  // the configured model so the two surfaces agree (the override resets on
+  // restart, when the session reverts to the configured model).
+  const session =
+    meta.sessionModel && meta.sessionModel.length > 0
+      ? ` · live session: <code>${escapeHtml(meta.sessionModel)}</code>`
+      : "";
+  return `<b>${escapeHtml(meta.agentName)}</b> · model: <code>${escapeHtml(m)}</code>${session}${topic}`;
 }
 
 /**

package/profiles/default/workspace/HEARTBEAT.md.hbs

@@ -1,40 +0,0 @@
-# HEARTBEAT.md — Proactive Check-Ins
-
-This file is read on every turn (it's a dynamic workspace file). Edit it
-to tell yourself what to look for when someone (or something) prompts you
-with a bare "heartbeat" — a cron firing, a quiet-period nudge, or a
-scheduled check-in.
-
-## When this fires
-
-A heartbeat arrives as a user-role message with no real payload — often
-just "HEARTBEAT" or "heartbeat check". When that happens:
-
-1. Run through the bullets below in order.
-2. If anything needs action, respond normally (and take the action).
-3. If nothing needs action, respond with exactly `HEARTBEAT_OK` on its
-   own line. The plugin suppresses that as a silent reply — no Telegram
-   message gets sent, and the user isn't notified.
-
-## Things to check (customize per-agent)
-
-- **New emails / messages:** is there anything in the inbox or
-  connected channels that looks actionable?
-- **Upcoming calendar events:** anything in the next ~2 hours the user
-  should be reminded of?
-- **Long-running tasks:** any background work you kicked off earlier
-  that might have completed?
-- **Today's plan:** anything in `memory/YYYY-MM-DD.md` (today's
-  daily note, auto-loaded into context by the dynamic workspace hook)
-  that hasn't been touched?
-
-## Guidelines
-
-- **Respect quiet hours.** If it's late (local time 22:00–08:00),
-  default to `HEARTBEAT_OK` unless something is genuinely urgent.
-- **Don't spam.** If you messaged the user in the last 30 minutes,
-  `HEARTBEAT_OK` unless there's something new to add.
-- **Stay terse.** A heartbeat-initiated message should be one or two
-  lines, not a paragraph.
-
-Edit this file to narrow or broaden the check set for this agent.