switchroom 0.19.39 → 0.19.40

package/telegram-plugin/dist/server.js

@@ -17627,6 +17627,14 @@ function projectTranscriptLine(line) {
       { kind: "turn_end", durationMs: obj.durationMs ?? 0 }
     ];
   }
+  if (type === "system" && obj.subtype === "compact_boundary") {
+    const meta = obj.compactMetadata;
+    return [{
+      kind: "compact_boundary",
+      trigger: typeof meta?.trigger === "string" ? meta.trigger : null,
+      compactDurationMs: typeof meta?.durationMs === "number" ? meta.durationMs : null
+    }];
+  }
   return [];
 }
 function projectSubagentLine(line, agentId, state) {

package/telegram-plugin/gateway/backstop-delivery.ts

@@ -322,6 +322,28 @@ export interface BackstopDeliveryDeps {
     messageIds: readonly number[],
     text: string,
   ) => Promise<ReadBackResult>
+  /**
+   * Exactly-once SEND-ACK claim (duplicate-message race fix). Fired EXACTLY ONCE,
+   * the first moment every chunk has landed a fresh non-card receipt — i.e. the
+   * same condition that makes {@link BackstopDeliveryResult.delivered} true — and
+   * crucially BEFORE the read-back probe (step 2 below) is awaited.
+   *
+   * Why before the probe: the probe is issued at COSMETIC priority and, when the
+   * edit-flood-fuse is deferring cosmetic edits, `await deps.readBack` can block
+   * ~30s. The caller's durable exactly-once claim (`journalExternalDelivery`)
+   * used to run only in its post-`await deliverAnswer` bookkeeping, i.e. AFTER
+   * that probe resolved. The out-of-band outbox sweep only waits `OUTBOX_QUIET_MS`
+   * (5s) before checking the delivered-keys journal, so during that 5–30s gap it
+   * saw no journal entry and sent a SECOND copy of the same answer. Claiming here,
+   * at send-ack, closes that window deterministically regardless of probe timing.
+   *
+   * A later `absent` read-back (positive silent-drop) is recovered by THIS
+   * orchestrator's own in-process re-send below — the nonce is NEVER reopened to
+   * the sweep, so a possibly-delivered answer is never handed to a second sender.
+   * `sentIds` is the landed fresh-receipt set at claim time. Best-effort; a throw
+   * is swallowed and never demotes the delivery.
+   */
+  onAckClaim?: (sentIds: number[]) => void
   /** Optional stderr sink for progress/resume logging. */
   stderr?: (s: string) => void
 }
@@ -406,6 +428,8 @@ export async function runBackstopDelivery(
   const stderr = deps.stderr ?? (() => {})
   const chunkCount = chunks.length
   let attempts = 0
+  // Fires the send-ack claim (see BackstopDeliveryDeps.onAckClaim) at most once.
+  let ackClaimed = false
 
   for (let attempt = 1; attempt <= Math.max(1, maxAttempts); attempt++) {
     attempts = attempt
@@ -437,6 +461,30 @@ export async function runBackstopDelivery(
       }
     }
 
+    // 1b. EXACTLY-ONCE SEND-ACK CLAIM (duplicate-message race fix). The instant
+    //     every chunk has landed a fresh non-card receipt, fire the caller's
+    //     claim — BEFORE the read-back probe below, which can be deferred ~30s
+    //     by the edit-flood-fuse (cosmetic priority). This is the same predicate
+    //     as the final `delivered` verdict (all-landed + fresh receipt); the only
+    //     way `delivered` can subsequently go false is a POSITIVE `absent` probe
+    //     demoting a chunk, which this orchestrator re-sends in-process (never
+    //     reopening the nonce to the out-of-band sweep). See onAckClaim.
+    if (!ackClaimed && deps.onAckClaim != null) {
+      const allLandedNow =
+        chunkCount > 0 && ledger.unsentIndices(turnId, chunkCount).length === 0
+      if (allLandedNow && backstopReceiptIds(ledger.sentIds(turnId), cardMessageId).length > 0) {
+        ackClaimed = true
+        try {
+          deps.onAckClaim(ledger.sentIds(turnId))
+        } catch (err) {
+          stderr(
+            `telegram gateway: backstop send-ack claim callback threw for turn ${turnId} ` +
+            `(non-fatal): ${err instanceof Error ? err.message : String(err)}\n`,
+          )
+        }
+      }
+    }
+
     // 2. CONFIRM landed-unconfirmed chunks via read-back (#3278). Without a probe
     //    wired, landing IS confirmation (pre-#3278) — the fresh-non-card receipt
     //    filter below still rejects a card-only "delivery".

package/telegram-plugin/gateway/compaction-marker.ts

@@ -0,0 +1,84 @@
+/**
+ * Compaction-in-flight marker (#4058 — spurious 300s silence-fallback fire
+ * during mid-turn auto-compaction).
+ *
+ * The blind spot this closes: when Claude Code hits mid-turn auto-compaction
+ * (the session ran out of context and spends minutes summarizing), the model
+ * emits ZERO output and runs ZERO tools — the gateway sees pure silence, so
+ * the silence-poke 300s framework fallback fired on a perfectly healthy turn:
+ * a spurious "⚠️ no output for 5 min — the framework ended that stalled turn"
+ * card plus an obligation re-present, right before the turn completed
+ * normally. Observed live: ~1m50s of tools then ~3m25s compacting = 304s of
+ * "silence" → false fire.
+ *
+ * The signal problem: the transcript JSONL carries a compaction record ONLY
+ * at the END (`{"type":"system","subtype":"compact_boundary",...}` — it
+ * embeds the compaction's own durationMs, so it cannot exist before the
+ * compaction finishes). Nothing observable lands at the START from the
+ * stream. The START therefore comes from Claude Code's PreCompact hook
+ * (`hooks/compaction-marker-precompact.mjs`), which writes
+ * `<STATE_DIR>/compaction-in-flight.json` the moment compaction begins —
+ * the same sidecar-file pattern as `turn-active-marker.ts` and the
+ * tool-label sidecar (#783).
+ *
+ * Consumers:
+ *   - `liveness-wiring.ts` wires `isCompactionInFlight` into the silence-poke
+ *     deps: marker present AND younger than the fallback hard ceiling ⇒ the
+ *     300s fallback is DEFERRED via the exact same `underCeiling` mechanism
+ *     as the #1292/#3519 in-flight-tool defers — a genuinely-wedged
+ *     compaction still unwedges once silence crosses `fallbackHardCeiling`.
+ *   - `silence-poke-session-event.ts` removes the marker on the
+ *     `compact_boundary` session event (the deterministic END) and counts
+ *     the boundary as production, so the resumed turn gets a fresh 300s
+ *     window instead of firing on the very next tick.
+ *
+ * Staleness is double-bounded: the reader treats an old marker as absent
+ * (age bound supplied by the caller — the hard ceiling), so a marker leaked
+ * by a crash between compaction start and boundary can never defer a future
+ * genuine wedge for more than one ceiling window.
+ *
+ * Pure file I/O; clock injectable for tests; never throws.
+ */
+
+import { statSync, unlinkSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+export const COMPACTION_MARKER_FILE = 'compaction-in-flight.json'
+
+/**
+ * The gateway's state dir — same resolution as gateway.ts (`STATE_DIR`).
+ * Exported so `silence-poke-session-event.ts` (which is handed no stateDir)
+ * can clear the marker without widening its call signature.
+ */
+export function resolveTelegramStateDir(): string {
+  return process.env.TELEGRAM_STATE_DIR ?? join(homedir(), '.claude', 'channels', 'telegram')
+}
+
+/**
+ * Age (ms) of the compaction marker's mtime, or null when absent/unstattable.
+ * The PreCompact hook (re)writes the file at compaction start, so a small age
+ * means a compaction began recently and may still be running. Never throws.
+ */
+export function readCompactionMarkerAgeMs(stateDir: string, now?: number): number | null {
+  try {
+    const st = statSync(join(stateDir, COMPACTION_MARKER_FILE))
+    return (now ?? Date.now()) - st.mtimeMs
+  } catch {
+    return null // ENOENT / unstattable → no compaction in flight
+  }
+}
+
+/**
+ * Remove the marker — called on the `compact_boundary` session event (the
+ * compaction's deterministic END record in the transcript). Idempotent;
+ * ENOENT and any other unlink failure are swallowed (the age bound in the
+ * reader is the correctness backstop, removal is the fast path).
+ */
+export function removeCompactionMarker(stateDir: string): void {
+  try {
+    unlinkSync(join(stateDir, COMPACTION_MARKER_FILE))
+  } catch {
+    // best-effort — staleness bound in readCompactionMarkerAgeMs self-heals
+  }
+}

package/telegram-plugin/gateway/gateway.ts

@@ -2463,7 +2463,7 @@ async function deliverAnswer(args: {
   replyToMessageId: number | null
   /** #3282 captured-answer RESUME (see captured-answer-resume.ts): re-deliver the SAME byte-identical chunks + pre-hydrate the ledger (unsent tail only; a landed chunk is re-probed, never re-sent). */
   resume?: { snapshot: CapturedDeliverySnapshot; hydrate: (ledger: BackstopDeliveryLedger, turnId: string) => void }
-}): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean; landedUnconfirmed: number }> {
+  /** Duplicate-message race fix — forwarded to `runBackstopDelivery` as `onAckClaim` (claims the nonce at send-ack, before the read-back probe; see backstop-delivery.ts). */ onAckClaim?: (sentIds: number[]) => void }): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean; landedUnconfirmed: number }> {
   const { chatId, turnId } = args
   // Spacers into `\n\n` gaps then split (as executeReply); a resume re-delivers the EXACT captured chunks (byte-stable, no re-split).
   const chunks = args.resume
@@ -2574,7 +2574,7 @@ async function deliverAnswer(args: {
     args.resume ? null : args.cardMessageId,
     {
       sendChunk,
-      readBack,
+      readBack, onAckClaim: args.onAckClaim,
       recordOutbound: HISTORY_ENABLED
         ? (messageIds, texts) => {
             try {
@@ -9838,7 +9838,7 @@ function runDeliveryConfirmSweep(): void {
 const _deliveryConfirmSweep = isGatewayMain ? setInterval(runDeliveryConfirmSweep, DELIVERY_CONFIRM_SWEEP_MS) : undefined
 _deliveryConfirmSweep?.unref?.()
 
-startOutboxSweep({ isGatewayMain, stateDir: STATE_DIR, getBot: () => bot, getTurnsDb: () => turnsDb, dedupCheck: (c, t, x) => outboundDedup.check(c, t, x, Date.now()) != null, resolveReplyMarkup: makeOutboxListenMarkupResolver({ resolveVoiceOutPlan: (t) => resolveVoiceOutPlan(loadAccess().voice_out, t), cachePut: (token, payload) => voiceOnDemandCache.put(token, payload), eagerVoiceEnabled, enqueuePreSynth: (j) => voicePreSynthQueue.enqueue(j) }), log: (l) => process.stderr.write(l) }) // outbox: single deliverer for Stop-hook prose; resolveReplyMarkup keeps the #3502 Listen button on net-delivered answers (../outbox.ts)
+startOutboxSweep({ isGatewayMain, stateDir: STATE_DIR, getBot: () => bot, getTurnsDb: () => turnsDb, dedupCheck: (c, t, x) => outboundDedup.check(c, t, x, Date.now()) != null, recordOutbound: HISTORY_ENABLED ? (chatId, threadId, message_ids, texts) => { try { recordOutbound({ chat_id: chatId, thread_id: threadId, message_ids, texts }) } catch { /* best-effort */ } } : undefined, resolveReplyMarkup: makeOutboxListenMarkupResolver({ resolveVoiceOutPlan: (t) => resolveVoiceOutPlan(loadAccess().voice_out, t), cachePut: (token, payload) => voiceOnDemandCache.put(token, payload), eagerVoiceEnabled, enqueuePreSynth: (j) => voicePreSynthQueue.enqueue(j) }), log: (l) => process.stderr.write(l) }) // outbox: single deliverer for Stop-hook prose; resolveReplyMarkup keeps the #3502 Listen button on net-delivered answers; recordOutbound persists the net-delivered answer to history.db (../outbox.ts)
 
 // #1445 cross-turn pending-async ambient. When a turn ends after the
 // model dispatched background async work (Agent / Task / Bash run-in-

package/telegram-plugin/gateway/liveness-wiring.ts

@@ -25,6 +25,7 @@ import { logStreamingEvent } from '../streaming-metrics.js'
 import { clearSilentEndState } from '../silent-end.js'
 import { purgeStaleTurnsForChat } from './turn-state-purge.js'
 import { removeTurnActiveMarker, readTurnActiveMarkerAgeMs } from './turn-active-marker.js'
+import { readCompactionMarkerAgeMs } from './compaction-marker.js'
 import { decideHangRestart } from './hang-restart-decision.js'
 import { recordTurnEnd } from '../registry/turns-schema.js'
 import { hostdGetStatusOnce } from './hostd-dispatch.js'
@@ -70,6 +71,20 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
   thresholdsMs: { fallback: SILENCE_FALLBACK_MS, fallbackHardCeiling: SILENCE_FALLBACK_HARD_MS, floor: SILENCE_FLOOR_MS },
   deferFallbackWhileToolInFlight: SILENCE_DEFER_INFLIGHT_TOOLS,
   isLegitimatelyWorking: (key) => isLegitimatelyWorking(key),
+  // #4058 — mid-turn auto-compaction defer. The PreCompact hook writes the
+  // compaction marker at compaction START (the transcript only records the
+  // END, via `compact_boundary`); while the marker is present AND younger
+  // than the fallback hard ceiling, silence-poke defers the 300s fallback the
+  // same way it does for an in-flight tool. The age bound makes a marker
+  // leaked by a crash (boundary never observed) self-heal: it can never hold
+  // a future genuine wedge past one ceiling window. The marker is process-
+  // wide, not keyed — the gateway runs ONE Claude session, so a compaction
+  // belongs to whichever turn is live (same accepted trade-off as
+  // `toolFlightTracker` in gateway.ts `isLegitimatelyWorking`).
+  isCompactionInFlight: () => {
+    const ageMs = readCompactionMarkerAgeMs(STATE_DIR)
+    return ageMs != null && ageMs >= 0 && ageMs < SILENCE_FALLBACK_HARD_MS
+  },
   // #3552 — orphan-state reaper predicate. Deliberately the SAME condition the
   // `onFrameworkFallback` late-fire guard below uses: no `activeTurnStartedAt`
   // entry AND no current turn ⇒ the turn this state belongs to is over. Note

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -2663,6 +2663,8 @@ export async function deliverCapturedProse(
     const plainChunks = splitMarkdownChunks(plain, RICH_MESSAGE_MAX_CHARS)
     try {
       let liveThreadId: number | undefined = threadId
+      const plainSentIds: number[] = []
+      const plainSentTexts: string[] = []
       for (const c of plainChunks) {
         // Plain sendMessage — NO parse_mode / rich rendering — so a markdown
         // construct that made sendRichMessage 400 is sent verbatim instead.
@@ -2676,6 +2678,8 @@ export async function deliverCapturedProse(
             ),
           { threadId: liveThreadId, chat_id: chatId, verb: 'captured-prose-plain-fallback.sendMessage' },
         )
+        const sentId = (sent as { message_id?: number }).message_id
+        if (sentId != null) { plainSentIds.push(sentId); plainSentTexts.push(c) }
         if (liveThreadId != null && (sent as { message_thread_id?: number }).message_thread_id == null) {
           liveThreadId = undefined
         }
@@ -2683,6 +2687,22 @@ export async function deliverCapturedProse(
       // The real answer reached the user via plain text — record it so a late
       // reply-tool retry with the same content is deduped at its send site.
       outboundDedup.record(chatId, threadId, text, Date.now(), registryKey)
+      // Persist parity: the recovered answer reached the user, so it must land in
+      // history.db too (mirrors the canonical persist above at the recordOutbound
+      // reply site). Without this the plain-text-recovered answer is silently
+      // absent from get_recent_messages / handoff briefings / the represent
+      // guard's outbound counting. Best-effort — the delivery already succeeded.
+      if (HISTORY_ENABLED && plainSentIds.length > 0) {
+        try {
+          recordOutbound({ chat_id: chatId, thread_id: threadId ?? null, message_ids: plainSentIds, texts: plainSentTexts })
+        } catch (histErr) {
+          process.stderr.write(
+            `telegram gateway: history recordOutbound (captured-prose plain fallback) failed: ${
+              histErr instanceof Error ? histErr.message : String(histErr)
+            }\n`,
+          )
+        }
+      }
       process.stderr.write(
         `telegram gateway: captured-prose recovered via plain-text fallback ` +
           `(chat=${chatId} origin=${originTurnId})\n`,

package/telegram-plugin/gateway/outbox-sweep.ts

@@ -43,6 +43,8 @@ import {
   type OutboxRecord,
 } from '../outbox.js'
 import { isShownBlock } from '../shown-ledger.js'
+import { richMessage, isParseEntitiesError } from '../rich-send.js'
+import { splitMarkdownChunks } from '../format.js'
 import { resolveSubagentOriginTurnKey } from '../registry/subagents-schema.js'
 import { createRetryApiCall, retryWithThreadFallback } from '../retry-api-call.js'
 import {
@@ -51,13 +53,46 @@ import {
   makeFloodWaitRecorder,
 } from '../flood-circuit-breaker.js'
 
+/**
+ * What a sweep `send` reports back. The primary (last) landed message id is the
+ * journal's `tgMessageId`; the per-chunk `chunks` are what {@link sweepOutbox}
+ * hands to `recordOutbound` so the history row is aligned to the ACTUAL sends
+ * (a markdown-aware split can land >1 chunk), exactly like the backstop uses
+ * `ledger.entries` (`backstop-delivery.ts`).
+ */
+export interface OutboxSendResult {
+  /** Primary (last) landed message id, or `undefined` when nothing was sent. */
+  messageId: number | undefined
+  /** Every landed chunk in delivery order: its message id + the delivered text. */
+  chunks: Array<{ messageId: number; text: string }>
+}
+
 export interface OutboxSweepDeps {
-  /** Deliver `text` to the chat. Resolves to the primary message id (best-effort). */
+  /**
+   * Deliver `text` to the chat. Resolves to the landed message id(s) + their
+   * texts (best-effort) — see {@link OutboxSendResult}. A long body is chunked
+   * inside the sender, so more than one message may land.
+   */
   send: (
     chatId: string,
     threadId: number | null,
     text: string,
-  ) => Promise<number | undefined>
+  ) => Promise<OutboxSendResult>
+  /**
+   * Persist the sweep-delivered final answer to history (role='assistant'),
+   * the SAME `recordOutbound` the reply path (`outbound-send-path.ts`) and the
+   * turn-flush backstop (`backstop-delivery.ts`) call. Without it every
+   * net-delivered handback / task-notification answer is silently absent from
+   * `history.db`, degrading `get_recent_messages`, the handoff briefing, and the
+   * represent-guard's outbound counting. OPTIONAL and called DEFENSIVELY (a
+   * missing recorder or a throw never breaks the safety-net delivery).
+   */
+  recordOutbound?: (
+    chatId: string,
+    threadId: number | null,
+    messageIds: number[],
+    texts: string[],
+  ) => void
   /** Has this exact text already been delivered to this chat/thread recently? */
   textAlreadyDelivered: (chatId: string, threadId: number | null, text: string) => boolean
   /**
@@ -241,7 +276,7 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
     const resolvedChat = resolved! // routable implies non-null
 
     try {
-      const messageId = await deps.send(
+      const sendResult = await deps.send(
         resolvedChat.chatId,
         resolvedChat.threadId,
         decision.text ?? record.text,
@@ -250,7 +285,7 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
         {
           turnNonce: record.turnNonce,
           textSha256: record.textSha256,
-          tgMessageId: messageId,
+          tgMessageId: sendResult.messageId,
           ts: now,
           // #3510 instrumentation: a sweep delivery journals its machine and the
           // record's capture-time reply-already-delivered flag, so a duplicate
@@ -261,6 +296,22 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
         },
         deps.stateDir,
       )
+      // Persist parity (mirrors outbound-send-path.ts + backstop-delivery.ts):
+      // record the delivered chunk ids + texts to history so a net-delivered
+      // answer is not silently absent from history.db. Best-effort — a missing
+      // recorder or a throw must never break this safety-net delivery.
+      if (deps.recordOutbound != null && sendResult.chunks.length > 0) {
+        try {
+          deps.recordOutbound(
+            resolvedChat.chatId,
+            resolvedChat.threadId,
+            sendResult.chunks.map((c) => c.messageId),
+            sendResult.chunks.map((c) => c.text),
+          )
+        } catch {
+          /* best-effort — the delivery already landed; never throw here */
+        }
+      }
       removeClaimed(record.turnNonce, deps.stateDir)
       summary.delivered++
       log(
@@ -380,7 +431,9 @@ export type OutboxDeliveryMarkup = {
   inline_keyboard: Array<Array<{ text: string; callback_data: string }>>
 }
 
-/** Minimal bot-api surface the sweep needs to deliver text. */
+/** Minimal bot-api surface the sweep needs to deliver text. `sendRichMessage`
+ *  is the canonical rendered path (raw GFM markdown → entities); `sendMessage`
+ *  is the plain parse-reject fallback. */
 type OutboxSendBot = {
   api: {
     sendMessage: (
@@ -388,6 +441,40 @@ type OutboxSendBot = {
       text: string,
       opts: object,
     ) => Promise<{ message_id?: number }>
+    sendRichMessage: (
+      chatId: string,
+      body: { markdown: string },
+      opts: object,
+    ) => Promise<{ message_id?: number }>
+  }
+}
+
+/**
+ * Send ONE chunk with RENDER PARITY: ship raw GFM markdown through the shared
+ * `richMessage` → `sendRichMessage` path — the SAME renderer the reply path
+ * uses (`outbound-send-path.ts`) — so a net-delivered answer is formatted
+ * identically to a normally-delivered one (no more literal `**bold**`). On a
+ * markdown PARSE-REJECT, resend the same chunk as PLAIN text (the raw markdown
+ * source is itself readable prose), mirroring the reply path's plaintext
+ * fallback (`outbound-send-path.ts`). A length / thread / flood error is NOT
+ * caught here — it propagates so `retryWithThreadFallback` and the sweep's
+ * claim-release retry handle it, exactly as before.
+ */
+async function sendChunkRich(
+  bot: OutboxSendBot,
+  chatId: string,
+  chunk: string,
+  opts: object,
+): Promise<{ message_id?: number }> {
+  try {
+    // allow-raw-bot-api: caller (createOutboxSend) invokes this inside retryWithThreadFallback + createRetryApiCall
+    return await bot.api.sendRichMessage(chatId, richMessage(chunk), opts)
+  } catch (err) {
+    if (isParseEntitiesError(err)) {
+      // allow-raw-bot-api: parse-reject plain fallback, still inside the sweep's retryWithThreadFallback wrapper
+      return await bot.api.sendMessage(chatId, chunk, opts)
+    }
+    throw err
   }
 }
 
@@ -419,19 +506,21 @@ export function createOutboxSend(deps: {
     // so sending one chunk of '' would throw every tick and wedge the sweep in
     // a permanent retry (the record never journals → never clears). Return
     // early, matching the pre-refactor loop's zero-chunk behaviour.
-    if (text.length === 0) return undefined
+    if (text.length === 0) return { messageId: undefined, chunks: [] }
     // Resolve the Listen button / keyboard ONCE from the full answer text; it
     // rides only on the final chunk below.
     const replyMarkup = deps.resolveReplyMarkup?.(chatId, threadId, text)
-    // Chunk to Telegram's 4096-char ceiling; each chunk goes through the
-    // standard retry / flood-wait / thread-fallback wrapper. A thrown send
-    // propagates so the sweep releases the claim and retries next tick (the
-    // record is never journaled → never lost).
-    let lastId: number | undefined
-    const chunkCount = Math.ceil(text.length / 4000)
-    for (let i = 0, idx = 0; i < text.length; i += 4000, idx++) {
-      const chunk = text.slice(i, i + 4000)
-      const isLast = idx === chunkCount - 1
+    // Chunk with the markdown-boundary-aware splitter the reply path uses
+    // (`splitMarkdownChunks`), NOT a blind fixed-char slice — a raw slice can
+    // bisect an inline entity (`**bold**`) and force a parse-reject. Each chunk
+    // goes through the standard retry / flood-wait / thread-fallback wrapper. A
+    // thrown send propagates so the sweep releases the claim and retries next
+    // tick (the record is never journaled → never lost).
+    const landed: Array<{ messageId: number; text: string }> = []
+    const chunks = splitMarkdownChunks(text)
+    for (let idx = 0; idx < chunks.length; idx++) {
+      const chunk = chunks[idx]
+      const isLast = idx === chunks.length - 1
       const res = await retryWithThreadFallback(
         deps.retry,
         (tid) => {
@@ -439,13 +528,17 @@ export function createOutboxSend(deps: {
           // Button on the LAST chunk only (final visible message).
           const opts =
             isLast && replyMarkup != null ? { ...base, reply_markup: replyMarkup } : base
-          return bot.api.sendMessage(chatId, chunk, opts)
+          return sendChunkRich(bot, chatId, chunk, opts)
         },
         { threadId: threadId ?? undefined, chat_id: chatId, verb: 'outbox-sweep.sendMessage' },
       )
-      lastId = res?.message_id
+      const id = res?.message_id
+      if (id != null) landed.push({ messageId: id, text: chunk })
+    }
+    return {
+      messageId: landed.length > 0 ? landed[landed.length - 1]!.messageId : undefined,
+      chunks: landed,
     }
-    return lastId
   }
 }
 
@@ -463,6 +556,10 @@ export function startOutboxSweep(deps: {
     threadId: number | null,
     text: string,
   ) => OutboxDeliveryMarkup | undefined
+  /** Persist a sweep-delivered answer to history — forwarded to {@link sweepOutbox}
+   *  as {@link OutboxSweepDeps.recordOutbound}. Wired by the gateway to the shared
+   *  `recordOutbound` (history.ts). Absent → no history row (legacy behaviour). */
+  recordOutbound?: OutboxSweepDeps['recordOutbound']
   log?: (line: string) => void
   /** Test seam — override the flood probe (default: the persisted breaker). */
   floodWaitRemainingMs?: () => number
@@ -500,6 +597,7 @@ export function startOutboxSweep(deps: {
       stateDir: deps.stateDir,
       log: deps.log,
       send,
+      ...(deps.recordOutbound != null ? { recordOutbound: deps.recordOutbound } : {}),
       floodWaitRemainingMs: floodProbe,
       textAlreadyDelivered: (chatId, threadId, text) => deps.dedupCheck(chatId, threadId ?? undefined, text),
       registryChainLookup: (taskId) => {

package/telegram-plugin/gateway/silence-poke-session-event.ts

@@ -12,6 +12,7 @@ import type { SessionEvent } from '../session-tail.js'
 import { isTelegramSurfaceTool } from '../tool-names.js'
 import { toolLabel } from '../tool-labels.js'
 import { applyBackgroundShellLiveness } from './background-shell-liveness.js'
+import { removeCompactionMarker, resolveTelegramStateDir } from './compaction-marker.js'
 
 /** The silence-poke module namespace (kept as `typeof` so no surface drift). */
 type SilencePoke = typeof import('../silence-poke.js')
@@ -83,6 +84,18 @@ export function applySilencePokeSessionEvent(
     if (ev.toolUseId != null && ev.toolUseId.length > 0) {
       silencePoke.noteToolEnd(key, ev.toolUseId, Date.now())
     }
+  } else if (ev.kind === 'compact_boundary') {
+    // #4058 — mid-turn compaction ENDED (the transcript's compact_boundary
+    // record only exists once compaction is done). Two effects:
+    //   1. Clear the PreCompact marker so the compaction defer stops holding
+    //      the 300s fallback (a post-compaction wedge fires on schedule).
+    //   2. Count the boundary as PRODUCTION: the silence clock ran the whole
+    //      compaction, so without a reset the fallback would fire on the very
+    //      next tick — before the resumed model's first output can land. The
+    //      transcript resuming IS observable progress; a turn that stays
+    //      silent AFTER compaction still fires one full window later.
+    removeCompactionMarker(resolveTelegramStateDir())
+    silencePoke.noteProduction(key, Date.now())
   }
   // #3519 sharpen: feed background-shell liveness (ALIVE/DEAD) to silence-poke — see background-shell-liveness.ts.
   applyBackgroundShellLiveness(silencePoke, key, ev)

package/telegram-plugin/gateway/stream-render.ts

@@ -2312,6 +2312,10 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
           let sentIds: number[] = []
           let chunkCount = 0
           let delivered = false
+          // Set by the send-ack claim callback below once the durable
+          // delivered-keys journal has been written at ACK time — so the finally
+          // block does not journal the same nonce a second time.
+          let earlyJournaled = false
           try {
             // #3276 — the ONE delivery primitive. deliverAnswer routes through
             // `sendReplyChunks` (the same send core executeReply uses) and posts
@@ -2330,6 +2334,33 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               // S4 — anchor the flushed answer to the inbound it answers
               // (null for synthesized turns, which send bare as before).
               replyToMessageId: turn.sourceMessageId,
+              // Duplicate-message race fix — write the DURABLE delivered-keys
+              // journal at SEND-ACK, BEFORE deliverAnswer's read-back probe (which
+              // the cosmetic-edit flood-fuse can defer ~30s). Without this the
+              // journal write happened only in the finally below, AFTER `await
+              // deliverAnswer` returned, so the outbox sweep — which waits just
+              // OUTBOX_QUIET_MS (5s) before checking `deliveredNonces` — saw no
+              // entry and sent a SECOND copy of this answer. Journaling under the
+              // SAME nonce (turn.turnId == the Stop-hook record's turnNonce) makes
+              // the sweep skip-journaled and clears any captured record.
+              onAckClaim: (ackIds) => {
+                try {
+                  journalExternalDelivery(
+                    {
+                      turnNonce: turn.turnId,
+                      text: capturedText,
+                      tgMessageId: ackIds.length > 0 ? ackIds[0] : undefined,
+                      deliverySource: 'flush',
+                    },
+                    STATE_DIR,
+                  )
+                  earlyJournaled = true
+                } catch (err) {
+                  process.stderr.write(
+                    `telegram gateway: turn-flush send-ack journal write failed (non-fatal): ${(err as Error).message}\n`,
+                  )
+                }
+              },
             })
             sentIds = delivery.sentIds
             chunkCount = delivery.chunkCount
@@ -2433,7 +2464,14 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               // between this send and the next process's backstop. Journal ONLY on
               // a receipt-gated `delivered` success. Best-effort: a journal-write
               // failure must never demote the successful delivery.
-              if (delivered) {
+              //
+              // Duplicate-message race fix: skip when the send-ack claim
+              // (`onAckClaim`) already journaled this nonce at ACK time. That
+              // path is the primary writer now (it runs before the read-back
+              // probe); this finally write only covers the case where the claim
+              // never fired — e.g. a card-only delivery where every chunk landed
+              // but no fresh receipt gated the claim, yet `delivered` still held.
+              if (delivered && !earlyJournaled) {
                 try {
                   journalExternalDelivery(
                     {

package/telegram-plugin/hooks/compaction-marker-precompact.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+/**
+ * PreCompact hook — marks "compaction in flight" for the gateway (#4058).
+ *
+ * Claude Code PreCompact protocol:
+ *   Input:  JSON on stdin — { session_id, transcript_path, cwd,
+ *           hook_event_name: "PreCompact", trigger: "auto"|"manual",
+ *           custom_instructions }
+ *   Output: exit 0 + empty stdout → proceed. We NEVER block compaction and
+ *           NEVER exit non-zero.
+ *
+ * Side effect: writes (overwrites) ONE small JSON file
+ *   $TELEGRAM_STATE_DIR/compaction-in-flight.json
+ * with shape { ts, session_id, trigger }.
+ *
+ * Why: during mid-turn auto-compaction the model emits zero output and runs
+ * zero tools for minutes, so the gateway's silence-poke saw pure silence and
+ * fired its 300s "stalled turn" fallback on a healthy turn. The transcript
+ * only records compaction at its END (`system/compact_boundary` carries the
+ * compaction's own durationMs), so this hook is the one observable START
+ * signal. The gateway reads the marker's mtime (compaction-marker.ts) to
+ * DEFER the fallback — bounded by the same hard ceiling as the in-flight-tool
+ * defer — and removes it when the compact_boundary lands.
+ *
+ * If $TELEGRAM_STATE_DIR is unset → silent skip (dev / one-shot contexts;
+ * the fallback just keeps its pre-#4058 behaviour).
+ */
+
+import { readFileSync, mkdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8')
+  } catch {
+    return ''
+  }
+}
+
+function main() {
+  const stateDir = process.env.TELEGRAM_STATE_DIR
+  if (!stateDir) return
+
+  let payload = {}
+  try {
+    payload = JSON.parse(readStdin() || '{}')
+  } catch {
+    // Unparseable stdin — still write the marker: the mtime alone carries
+    // the load-bearing signal; the body fields are diagnostics.
+  }
+
+  try {
+    mkdirSync(stateDir, { recursive: true })
+    writeFileSync(
+      join(stateDir, 'compaction-in-flight.json'),
+      JSON.stringify({
+        ts: Date.now(),
+        session_id: typeof payload.session_id === 'string' ? payload.session_id : null,
+        trigger: typeof payload.trigger === 'string' ? payload.trigger : null,
+      }) + '\n',
+      { mode: 0o600 },
+    )
+  } catch {
+    // Best-effort: a missed marker just reverts one fallback decision to
+    // the pre-#4058 behaviour. Never fail the hook (never block compaction).
+  }
+}
+
+main()
+process.exit(0)