switchroom 0.19.39 → 0.19.41

package/telegram-plugin/gateway/gateway.ts

@@ -35,6 +35,7 @@ import {
   type AskUserOutcome,
 } from '../ask-user.js'
 import { redactAskUserFields, redactChecklistFields } from '../outbound-field-redact.js'
+import { createChecklistStore, checklistStoreKey, performSendChecklist, performUpdateChecklist, sendChecklistToolText, updateChecklistToolText } from './checklist-fallback.js'
 import { parseInterruptMarker } from '../interrupt-marker.js'
 import {
   ToolFlightTracker,
@@ -1383,65 +1384,29 @@ let _rawEditMessageChecklist: unknown
 /** True when the connected Telegram Bot API supports native checklists. Set in initGatewayBot() (#2996 P0b). */
 let CHECKLIST_API_AVAILABLE = false
 
-/**
- * Send a native Telegram checklist message.
- * Wraps bot.api.raw.sendChecklist with string→number coercion (chat_id) and
- * a 30-task cap enforced before the API call.
- */
-async function rawSendChecklist(args: {
-  chat_id: string
-  title: string
-  tasks: Array<{ text: string; done?: boolean }>
-  message_thread_id?: number
-  reply_to_message_id?: number
-  protect_content?: boolean
-}): Promise<{ message_id: number }> {
-  if (!CHECKLIST_API_AVAILABLE) {
-    throw new Error('sendChecklist is not available in this grammY/Telegram Bot API version')
-  }
-  const MAX_TASKS = 30
-  if (args.tasks.length > MAX_TASKS) {
-    throw new Error(`checklist exceeds ${MAX_TASKS}-task limit (got ${args.tasks.length})`)
-  }
-  const result = await (_rawSendChecklist as (p: Record<string, unknown>) => Promise<{ message_id: number }>)({
-    chat_id: Number(args.chat_id),
-    title: args.title,
-    tasks: args.tasks.map(t => ({ text: t.text, ...(t.done != null ? { is_completed: t.done } : {}) })),
-    ...(args.message_thread_id != null ? { message_thread_id: args.message_thread_id } : {}),
-    ...(args.reply_to_message_id != null ? { reply_to_message_id: args.reply_to_message_id } : {}),
-    ...(args.protect_content === true ? { protect_content: true } : {}),
-  })
+/** bot.api.raw.sendChecklist with a payload pre-built by checklist-fallback.ts
+ *  (nested `checklist` object, per-task integer ids, business_connection_id —
+ *  the old flat shape got `400: parameter "checklist" is required`). */
+async function rawSendChecklist(payload: Record<string, unknown>): Promise<{ message_id: number }> {
+  if (!CHECKLIST_API_AVAILABLE) throw new Error('sendChecklist is not available in this grammY/Telegram Bot API version')
+  const result = await (_rawSendChecklist as (p: Record<string, unknown>) => Promise<{ message_id: number }>)(payload)
   return { message_id: result.message_id }
 }
 
-/**
- * Edit (patch) an existing Telegram checklist message.
- * Supports updating title, adding/removing tasks, and marking tasks done/undone.
- * Task objects with an `id` field target existing tasks; those without are added.
- */
-async function rawEditMessageChecklist(args: {
-  chat_id: string
-  message_id: string
-  title?: string
-  tasks?: Array<{ id?: string; text?: string; done?: boolean }>
-}): Promise<void> {
-  if (!CHECKLIST_API_AVAILABLE) {
-    throw new Error('editMessageChecklist is not available in this grammY/Telegram Bot API version')
-  }
-  await (_rawEditMessageChecklist as (p: Record<string, unknown>) => Promise<unknown>)({
-    chat_id: Number(args.chat_id),
-    message_id: Number(args.message_id),
-    ...(args.title != null ? { title: args.title } : {}),
-    ...(args.tasks != null
-      ? {
-          tasks: args.tasks.map(t => ({
-            ...(t.id != null ? { id: Number(t.id) } : {}),
-            ...(t.text != null ? { text: t.text } : {}),
-            ...(t.done != null ? { is_completed: t.done } : {}),
-          })),
-        }
-      : {}),
-  })
+/** bot.api.raw.editMessageChecklist with a pre-built payload (the native edit REPLACES the whole checklist, so checklist-fallback.ts sends full state). */
+async function rawEditMessageChecklist(payload: Record<string, unknown>): Promise<void> {
+  if (!CHECKLIST_API_AVAILABLE) throw new Error('editMessageChecklist is not available in this grammY/Telegram Bot API version')
+  await (_rawEditMessageChecklist as (p: Record<string, unknown>) => Promise<unknown>)(payload)
+}
+
+/** Per-message checklist state — update_checklist re-renders from it (process-local; post-restart updates degrade gracefully). */
+const checklistStore = createChecklistStore()
+
+/** Native checklists are Telegram-Business-only (sendChecklist REQUIRES a business_connection_id).
+ *  No fleet config plumbing exists yet; this env var is the opt-in — unset (the normal case) means text fallback. */
+function resolveBusinessConnectionId(): string | undefined {
+  const v = process.env.SWITCHROOM_TELEGRAM_BUSINESS_CONNECTION_ID?.trim()
+  return v ? v : undefined
 }
 
 const chatLock = createChatLock()
@@ -2463,7 +2428,7 @@ async function deliverAnswer(args: {
   replyToMessageId: number | null
   /** #3282 captured-answer RESUME (see captured-answer-resume.ts): re-deliver the SAME byte-identical chunks + pre-hydrate the ledger (unsent tail only; a landed chunk is re-probed, never re-sent). */
   resume?: { snapshot: CapturedDeliverySnapshot; hydrate: (ledger: BackstopDeliveryLedger, turnId: string) => void }
-}): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean; landedUnconfirmed: number }> {
+  /** Duplicate-message race fix — forwarded to `runBackstopDelivery` as `onAckClaim` (claims the nonce at send-ack, before the read-back probe; see backstop-delivery.ts). */ onAckClaim?: (sentIds: number[]) => void }): Promise<{ sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean; landedUnconfirmed: number }> {
   const { chatId, turnId } = args
   // Spacers into `\n\n` gaps then split (as executeReply); a resume re-delivers the EXACT captured chunks (byte-stable, no re-split).
   const chunks = args.resume
@@ -2574,7 +2539,7 @@ async function deliverAnswer(args: {
     args.resume ? null : args.cardMessageId,
     {
       sendChunk,
-      readBack,
+      readBack, onAckClaim: args.onAckClaim,
       recordOutbound: HISTORY_ENABLED
         ? (messageIds, texts) => {
             try {
@@ -5038,7 +5003,7 @@ function emitTurnRecord(turn: CurrentTurn, endedAt: number): void {
             startedAt: turn.startedAt,
             toolCallCount: turn.toolCallCount ?? 0,
             turnId: turn.turnId,
-            finalAnswerDelivered: turn.finalAnswerDelivered,
+            finalAnswerDelivered: turn.finalAnswerDelivered, replyCalled: turn.replyCalled, // replyCalled: honest delivery-route signal (turn-record-status.ts computeTurnRoute)
             deliveryOutcome: turn.deliveryOutcome, landedUnconfirmed: turn.landedUnconfirmed,
           },
           endedAt,
@@ -9838,7 +9803,7 @@ function runDeliveryConfirmSweep(): void {
 const _deliveryConfirmSweep = isGatewayMain ? setInterval(runDeliveryConfirmSweep, DELIVERY_CONFIRM_SWEEP_MS) : undefined
 _deliveryConfirmSweep?.unref?.()
 
-startOutboxSweep({ isGatewayMain, stateDir: STATE_DIR, getBot: () => bot, getTurnsDb: () => turnsDb, dedupCheck: (c, t, x) => outboundDedup.check(c, t, x, Date.now()) != null, resolveReplyMarkup: makeOutboxListenMarkupResolver({ resolveVoiceOutPlan: (t) => resolveVoiceOutPlan(loadAccess().voice_out, t), cachePut: (token, payload) => voiceOnDemandCache.put(token, payload), eagerVoiceEnabled, enqueuePreSynth: (j) => voicePreSynthQueue.enqueue(j) }), log: (l) => process.stderr.write(l) }) // outbox: single deliverer for Stop-hook prose; resolveReplyMarkup keeps the #3502 Listen button on net-delivered answers (../outbox.ts)
+startOutboxSweep({ isGatewayMain, stateDir: STATE_DIR, getBot: () => bot, getTurnsDb: () => turnsDb, dedupCheck: (c, t, x) => outboundDedup.check(c, t, x, Date.now()) != null, recordOutbound: HISTORY_ENABLED ? (chatId, threadId, message_ids, texts) => { try { recordOutbound({ chat_id: chatId, thread_id: threadId, message_ids, texts }) } catch { /* best-effort */ } } : undefined, resolveReplyMarkup: makeOutboxListenMarkupResolver({ resolveVoiceOutPlan: (t) => resolveVoiceOutPlan(loadAccess().voice_out, t), cachePut: (token, payload) => voiceOnDemandCache.put(token, payload), eagerVoiceEnabled, enqueuePreSynth: (j) => voicePreSynthQueue.enqueue(j) }), log: (l) => process.stderr.write(l) }) // outbox: single deliverer for Stop-hook prose; resolveReplyMarkup keeps the #3502 Listen button on net-delivered answers; recordOutbound persists the net-delivered answer to history.db (../outbox.ts)
 
 // #1445 cross-turn pending-async ambient. When a turn ends after the
 // model dispatched background async work (Agent / Task / Bash run-in-
@@ -12083,17 +12048,35 @@ async function executeSendChecklist(args: Record<string, unknown>): Promise<{ co
     (t) => redactOutboundText(t, 'send_checklist'),
   )
 
-  const sent = await rawSendChecklist({
-    chat_id,
-    title: redactedTitle!,
-    tasks: redactedTasks!,
+  // Graceful degradation: native sendChecklist is Business-account-only, so
+  // ordinary chats (the fleet norm) get a formatted text render instead of a
+  // raw Telegram 400 (rationale + orchestration in checklist-fallback.ts).
+  const literal = (loadAccess().parseMode ?? 'html') === 'text'
+  const sendOpts = {
     ...(threadId != null ? { message_thread_id: threadId } : {}),
-    ...(replyTo != null ? { reply_to_message_id: replyTo } : {}),
+    ...(replyTo != null ? { reply_parameters: { message_id: replyTo } } : {}),
     ...(protectContent ? { protect_content: true } : {}),
-  })
+  }
+  const result = await performSendChecklist({
+    businessConnectionId: resolveBusinessConnectionId(),
+    nativeAvailable: CHECKLIST_API_AVAILABLE,
+    sendNative: rawSendChecklist,
+    sendText: (text) => robustApiCall(
+      (): Promise<{ message_id: number }> =>
+        literal
+          // allow-raw-bot-api: literal checklist text-fallback send routed through robustApiCall
+          ? lockedBot.api.sendMessage(chat_id, text, sendOpts as never)
+          // allow-raw-bot-api: checklist text-fallback send routed through robustApiCall
+          : lockedBot.api.sendRichMessage(chat_id, richMessage(text), sendOpts as never),
+      { verb: 'sendMessage', chat_id, threadId },
+    ),
+    literalText: literal,
+    log: (l) => process.stderr.write(`telegram gateway: ${l}`),
+  }, { title: redactedTitle!, tasks: redactedTasks!, chatId: Number(chat_id), replyToMessageId: replyTo, protectContent })
 
-  process.stderr.write(`telegram gateway: send_checklist: sent chatId=${chat_id} messageId=${sent.message_id} tasks=${tasks.length}\n`)
-  return { content: [{ type: 'text', text: `checklist sent (id: ${sent.message_id})` }] }
+  checklistStore.set(checklistStoreKey(chat_id, result.message_id), result.state)
+  process.stderr.write(`telegram gateway: send_checklist: sent chatId=${chat_id} messageId=${result.message_id} tasks=${tasks.length} mode=${result.mode}\n`)
+  return { content: [{ type: 'text', text: sendChecklistToolText(result) }] }
 }
 
 /**
@@ -12180,10 +12163,27 @@ async function executeUpdateChecklist(args: Record<string, unknown>): Promise<{
     (t) => redactOutboundText(t, 'update_checklist'),
   )
 
-  await rawEditMessageChecklist({ chat_id, message_id, title: redactedTitle, tasks: redactedTasks })
-
-  process.stderr.write(`telegram gateway: update_checklist: updated chatId=${chat_id} messageId=${message_id}\n`)
-  return { content: [{ type: 'text', text: `checklist updated (id: ${message_id})` }] }
+  // Graceful degradation (checklist-fallback.ts): the patch is applied to the
+  // stored per-message state and the message re-rendered in the mode it was
+  // sent in. Failures come back structured, never as a raw Telegram 400.
+  const literal = (loadAccess().parseMode ?? 'html') === 'text'
+  const key = checklistStoreKey(chat_id, message_id)
+  const result = await performUpdateChecklist({
+    state: checklistStore.get(key),
+    businessConnectionId: resolveBusinessConnectionId(),
+    nativeAvailable: CHECKLIST_API_AVAILABLE,
+    editNative: rawEditMessageChecklist,
+    // allow-raw-bot-api: checklist text-fallback edit routed through robustApiCall
+    editText: async (text) => { await robustApiCall(() => lockedBot.api.editMessageText(chat_id, Number(message_id), literal ? text : richMessage(text))) },
+    literalText: literal,
+    log: (l) => process.stderr.write(`telegram gateway: ${l}`),
+    chatId: Number(chat_id),
+    messageId: Number(message_id),
+  }, { title: redactedTitle, tasks: redactedTasks })
+
+  if (result.ok) checklistStore.set(key, result.state)
+  process.stderr.write(`telegram gateway: update_checklist: ${result.ok ? `updated mode=${result.mode}` : `failed reason=${result.reason}`} chatId=${chat_id} messageId=${message_id}\n`)
+  return { content: [{ type: 'text', text: updateChecklistToolText(result, Number(message_id)) }] }
 }
 
 /**

package/telegram-plugin/gateway/liveness-wiring.ts

@@ -25,6 +25,7 @@ import { logStreamingEvent } from '../streaming-metrics.js'
 import { clearSilentEndState } from '../silent-end.js'
 import { purgeStaleTurnsForChat } from './turn-state-purge.js'
 import { removeTurnActiveMarker, readTurnActiveMarkerAgeMs } from './turn-active-marker.js'
+import { readCompactionMarkerAgeMs } from './compaction-marker.js'
 import { decideHangRestart } from './hang-restart-decision.js'
 import { recordTurnEnd } from '../registry/turns-schema.js'
 import { hostdGetStatusOnce } from './hostd-dispatch.js'
@@ -70,6 +71,20 @@ export function buildSilencePokeOptions(deps: LivenessWiringDeps): Parameters<ty
   thresholdsMs: { fallback: SILENCE_FALLBACK_MS, fallbackHardCeiling: SILENCE_FALLBACK_HARD_MS, floor: SILENCE_FLOOR_MS },
   deferFallbackWhileToolInFlight: SILENCE_DEFER_INFLIGHT_TOOLS,
   isLegitimatelyWorking: (key) => isLegitimatelyWorking(key),
+  // #4058 — mid-turn auto-compaction defer. The PreCompact hook writes the
+  // compaction marker at compaction START (the transcript only records the
+  // END, via `compact_boundary`); while the marker is present AND younger
+  // than the fallback hard ceiling, silence-poke defers the 300s fallback the
+  // same way it does for an in-flight tool. The age bound makes a marker
+  // leaked by a crash (boundary never observed) self-heal: it can never hold
+  // a future genuine wedge past one ceiling window. The marker is process-
+  // wide, not keyed — the gateway runs ONE Claude session, so a compaction
+  // belongs to whichever turn is live (same accepted trade-off as
+  // `toolFlightTracker` in gateway.ts `isLegitimatelyWorking`).
+  isCompactionInFlight: () => {
+    const ageMs = readCompactionMarkerAgeMs(STATE_DIR)
+    return ageMs != null && ageMs >= 0 && ageMs < SILENCE_FALLBACK_HARD_MS
+  },
   // #3552 — orphan-state reaper predicate. Deliberately the SAME condition the
   // `onFrameworkFallback` late-fire guard below uses: no `activeTurnStartedAt`
   // entry AND no current turn ⇒ the turn this state belongs to is over. Note

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -2663,6 +2663,8 @@ export async function deliverCapturedProse(
     const plainChunks = splitMarkdownChunks(plain, RICH_MESSAGE_MAX_CHARS)
     try {
       let liveThreadId: number | undefined = threadId
+      const plainSentIds: number[] = []
+      const plainSentTexts: string[] = []
       for (const c of plainChunks) {
         // Plain sendMessage — NO parse_mode / rich rendering — so a markdown
         // construct that made sendRichMessage 400 is sent verbatim instead.
@@ -2676,6 +2678,8 @@ export async function deliverCapturedProse(
             ),
           { threadId: liveThreadId, chat_id: chatId, verb: 'captured-prose-plain-fallback.sendMessage' },
         )
+        const sentId = (sent as { message_id?: number }).message_id
+        if (sentId != null) { plainSentIds.push(sentId); plainSentTexts.push(c) }
         if (liveThreadId != null && (sent as { message_thread_id?: number }).message_thread_id == null) {
           liveThreadId = undefined
         }
@@ -2683,6 +2687,22 @@ export async function deliverCapturedProse(
       // The real answer reached the user via plain text — record it so a late
       // reply-tool retry with the same content is deduped at its send site.
       outboundDedup.record(chatId, threadId, text, Date.now(), registryKey)
+      // Persist parity: the recovered answer reached the user, so it must land in
+      // history.db too (mirrors the canonical persist above at the recordOutbound
+      // reply site). Without this the plain-text-recovered answer is silently
+      // absent from get_recent_messages / handoff briefings / the represent
+      // guard's outbound counting. Best-effort — the delivery already succeeded.
+      if (HISTORY_ENABLED && plainSentIds.length > 0) {
+        try {
+          recordOutbound({ chat_id: chatId, thread_id: threadId ?? null, message_ids: plainSentIds, texts: plainSentTexts })
+        } catch (histErr) {
+          process.stderr.write(
+            `telegram gateway: history recordOutbound (captured-prose plain fallback) failed: ${
+              histErr instanceof Error ? histErr.message : String(histErr)
+            }\n`,
+          )
+        }
+      }
       process.stderr.write(
         `telegram gateway: captured-prose recovered via plain-text fallback ` +
           `(chat=${chatId} origin=${originTurnId})\n`,

package/telegram-plugin/gateway/outbox-sweep.ts

@@ -43,6 +43,8 @@ import {
   type OutboxRecord,
 } from '../outbox.js'
 import { isShownBlock } from '../shown-ledger.js'
+import { richMessage, isParseEntitiesError } from '../rich-send.js'
+import { splitMarkdownChunks } from '../format.js'
 import { resolveSubagentOriginTurnKey } from '../registry/subagents-schema.js'
 import { createRetryApiCall, retryWithThreadFallback } from '../retry-api-call.js'
 import {
@@ -51,13 +53,46 @@ import {
   makeFloodWaitRecorder,
 } from '../flood-circuit-breaker.js'
 
+/**
+ * What a sweep `send` reports back. The primary (last) landed message id is the
+ * journal's `tgMessageId`; the per-chunk `chunks` are what {@link sweepOutbox}
+ * hands to `recordOutbound` so the history row is aligned to the ACTUAL sends
+ * (a markdown-aware split can land >1 chunk), exactly like the backstop uses
+ * `ledger.entries` (`backstop-delivery.ts`).
+ */
+export interface OutboxSendResult {
+  /** Primary (last) landed message id, or `undefined` when nothing was sent. */
+  messageId: number | undefined
+  /** Every landed chunk in delivery order: its message id + the delivered text. */
+  chunks: Array<{ messageId: number; text: string }>
+}
+
 export interface OutboxSweepDeps {
-  /** Deliver `text` to the chat. Resolves to the primary message id (best-effort). */
+  /**
+   * Deliver `text` to the chat. Resolves to the landed message id(s) + their
+   * texts (best-effort) — see {@link OutboxSendResult}. A long body is chunked
+   * inside the sender, so more than one message may land.
+   */
   send: (
     chatId: string,
     threadId: number | null,
     text: string,
-  ) => Promise<number | undefined>
+  ) => Promise<OutboxSendResult>
+  /**
+   * Persist the sweep-delivered final answer to history (role='assistant'),
+   * the SAME `recordOutbound` the reply path (`outbound-send-path.ts`) and the
+   * turn-flush backstop (`backstop-delivery.ts`) call. Without it every
+   * net-delivered handback / task-notification answer is silently absent from
+   * `history.db`, degrading `get_recent_messages`, the handoff briefing, and the
+   * represent-guard's outbound counting. OPTIONAL and called DEFENSIVELY (a
+   * missing recorder or a throw never breaks the safety-net delivery).
+   */
+  recordOutbound?: (
+    chatId: string,
+    threadId: number | null,
+    messageIds: number[],
+    texts: string[],
+  ) => void
   /** Has this exact text already been delivered to this chat/thread recently? */
   textAlreadyDelivered: (chatId: string, threadId: number | null, text: string) => boolean
   /**
@@ -241,7 +276,7 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
     const resolvedChat = resolved! // routable implies non-null
 
     try {
-      const messageId = await deps.send(
+      const sendResult = await deps.send(
         resolvedChat.chatId,
         resolvedChat.threadId,
         decision.text ?? record.text,
@@ -250,7 +285,7 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
         {
           turnNonce: record.turnNonce,
           textSha256: record.textSha256,
-          tgMessageId: messageId,
+          tgMessageId: sendResult.messageId,
           ts: now,
           // #3510 instrumentation: a sweep delivery journals its machine and the
           // record's capture-time reply-already-delivered flag, so a duplicate
@@ -261,6 +296,22 @@ export async function sweepOutbox(deps: OutboxSweepDeps): Promise<OutboxSweepSum
         },
         deps.stateDir,
       )
+      // Persist parity (mirrors outbound-send-path.ts + backstop-delivery.ts):
+      // record the delivered chunk ids + texts to history so a net-delivered
+      // answer is not silently absent from history.db. Best-effort — a missing
+      // recorder or a throw must never break this safety-net delivery.
+      if (deps.recordOutbound != null && sendResult.chunks.length > 0) {
+        try {
+          deps.recordOutbound(
+            resolvedChat.chatId,
+            resolvedChat.threadId,
+            sendResult.chunks.map((c) => c.messageId),
+            sendResult.chunks.map((c) => c.text),
+          )
+        } catch {
+          /* best-effort — the delivery already landed; never throw here */
+        }
+      }
       removeClaimed(record.turnNonce, deps.stateDir)
       summary.delivered++
       log(
@@ -380,7 +431,9 @@ export type OutboxDeliveryMarkup = {
   inline_keyboard: Array<Array<{ text: string; callback_data: string }>>
 }
 
-/** Minimal bot-api surface the sweep needs to deliver text. */
+/** Minimal bot-api surface the sweep needs to deliver text. `sendRichMessage`
+ *  is the canonical rendered path (raw GFM markdown → entities); `sendMessage`
+ *  is the plain parse-reject fallback. */
 type OutboxSendBot = {
   api: {
     sendMessage: (
@@ -388,6 +441,40 @@ type OutboxSendBot = {
       text: string,
       opts: object,
     ) => Promise<{ message_id?: number }>
+    sendRichMessage: (
+      chatId: string,
+      body: { markdown: string },
+      opts: object,
+    ) => Promise<{ message_id?: number }>
+  }
+}
+
+/**
+ * Send ONE chunk with RENDER PARITY: ship raw GFM markdown through the shared
+ * `richMessage` → `sendRichMessage` path — the SAME renderer the reply path
+ * uses (`outbound-send-path.ts`) — so a net-delivered answer is formatted
+ * identically to a normally-delivered one (no more literal `**bold**`). On a
+ * markdown PARSE-REJECT, resend the same chunk as PLAIN text (the raw markdown
+ * source is itself readable prose), mirroring the reply path's plaintext
+ * fallback (`outbound-send-path.ts`). A length / thread / flood error is NOT
+ * caught here — it propagates so `retryWithThreadFallback` and the sweep's
+ * claim-release retry handle it, exactly as before.
+ */
+async function sendChunkRich(
+  bot: OutboxSendBot,
+  chatId: string,
+  chunk: string,
+  opts: object,
+): Promise<{ message_id?: number }> {
+  try {
+    // allow-raw-bot-api: caller (createOutboxSend) invokes this inside retryWithThreadFallback + createRetryApiCall
+    return await bot.api.sendRichMessage(chatId, richMessage(chunk), opts)
+  } catch (err) {
+    if (isParseEntitiesError(err)) {
+      // allow-raw-bot-api: parse-reject plain fallback, still inside the sweep's retryWithThreadFallback wrapper
+      return await bot.api.sendMessage(chatId, chunk, opts)
+    }
+    throw err
   }
 }
 
@@ -419,19 +506,21 @@ export function createOutboxSend(deps: {
     // so sending one chunk of '' would throw every tick and wedge the sweep in
     // a permanent retry (the record never journals → never clears). Return
     // early, matching the pre-refactor loop's zero-chunk behaviour.
-    if (text.length === 0) return undefined
+    if (text.length === 0) return { messageId: undefined, chunks: [] }
     // Resolve the Listen button / keyboard ONCE from the full answer text; it
     // rides only on the final chunk below.
     const replyMarkup = deps.resolveReplyMarkup?.(chatId, threadId, text)
-    // Chunk to Telegram's 4096-char ceiling; each chunk goes through the
-    // standard retry / flood-wait / thread-fallback wrapper. A thrown send
-    // propagates so the sweep releases the claim and retries next tick (the
-    // record is never journaled → never lost).
-    let lastId: number | undefined
-    const chunkCount = Math.ceil(text.length / 4000)
-    for (let i = 0, idx = 0; i < text.length; i += 4000, idx++) {
-      const chunk = text.slice(i, i + 4000)
-      const isLast = idx === chunkCount - 1
+    // Chunk with the markdown-boundary-aware splitter the reply path uses
+    // (`splitMarkdownChunks`), NOT a blind fixed-char slice — a raw slice can
+    // bisect an inline entity (`**bold**`) and force a parse-reject. Each chunk
+    // goes through the standard retry / flood-wait / thread-fallback wrapper. A
+    // thrown send propagates so the sweep releases the claim and retries next
+    // tick (the record is never journaled → never lost).
+    const landed: Array<{ messageId: number; text: string }> = []
+    const chunks = splitMarkdownChunks(text)
+    for (let idx = 0; idx < chunks.length; idx++) {
+      const chunk = chunks[idx]
+      const isLast = idx === chunks.length - 1
       const res = await retryWithThreadFallback(
         deps.retry,
         (tid) => {
@@ -439,13 +528,17 @@ export function createOutboxSend(deps: {
           // Button on the LAST chunk only (final visible message).
           const opts =
             isLast && replyMarkup != null ? { ...base, reply_markup: replyMarkup } : base
-          return bot.api.sendMessage(chatId, chunk, opts)
+          return sendChunkRich(bot, chatId, chunk, opts)
         },
         { threadId: threadId ?? undefined, chat_id: chatId, verb: 'outbox-sweep.sendMessage' },
       )
-      lastId = res?.message_id
+      const id = res?.message_id
+      if (id != null) landed.push({ messageId: id, text: chunk })
+    }
+    return {
+      messageId: landed.length > 0 ? landed[landed.length - 1]!.messageId : undefined,
+      chunks: landed,
     }
-    return lastId
   }
 }
 
@@ -463,6 +556,10 @@ export function startOutboxSweep(deps: {
     threadId: number | null,
     text: string,
   ) => OutboxDeliveryMarkup | undefined
+  /** Persist a sweep-delivered answer to history — forwarded to {@link sweepOutbox}
+   *  as {@link OutboxSweepDeps.recordOutbound}. Wired by the gateway to the shared
+   *  `recordOutbound` (history.ts). Absent → no history row (legacy behaviour). */
+  recordOutbound?: OutboxSweepDeps['recordOutbound']
   log?: (line: string) => void
   /** Test seam — override the flood probe (default: the persisted breaker). */
   floodWaitRemainingMs?: () => number
@@ -500,6 +597,7 @@ export function startOutboxSweep(deps: {
       stateDir: deps.stateDir,
       log: deps.log,
       send,
+      ...(deps.recordOutbound != null ? { recordOutbound: deps.recordOutbound } : {}),
       floodWaitRemainingMs: floodProbe,
       textAlreadyDelivered: (chatId, threadId, text) => deps.dedupCheck(chatId, threadId ?? undefined, text),
       registryChainLookup: (taskId) => {

package/telegram-plugin/gateway/silence-poke-session-event.ts

@@ -12,6 +12,7 @@ import type { SessionEvent } from '../session-tail.js'
 import { isTelegramSurfaceTool } from '../tool-names.js'
 import { toolLabel } from '../tool-labels.js'
 import { applyBackgroundShellLiveness } from './background-shell-liveness.js'
+import { removeCompactionMarker, resolveTelegramStateDir } from './compaction-marker.js'
 
 /** The silence-poke module namespace (kept as `typeof` so no surface drift). */
 type SilencePoke = typeof import('../silence-poke.js')
@@ -83,6 +84,18 @@ export function applySilencePokeSessionEvent(
     if (ev.toolUseId != null && ev.toolUseId.length > 0) {
       silencePoke.noteToolEnd(key, ev.toolUseId, Date.now())
     }
+  } else if (ev.kind === 'compact_boundary') {
+    // #4058 — mid-turn compaction ENDED (the transcript's compact_boundary
+    // record only exists once compaction is done). Two effects:
+    //   1. Clear the PreCompact marker so the compaction defer stops holding
+    //      the 300s fallback (a post-compaction wedge fires on schedule).
+    //   2. Count the boundary as PRODUCTION: the silence clock ran the whole
+    //      compaction, so without a reset the fallback would fire on the very
+    //      next tick — before the resumed model's first output can land. The
+    //      transcript resuming IS observable progress; a turn that stays
+    //      silent AFTER compaction still fires one full window later.
+    removeCompactionMarker(resolveTelegramStateDir())
+    silencePoke.noteProduction(key, Date.now())
   }
   // #3519 sharpen: feed background-shell liveness (ALIVE/DEAD) to silence-poke — see background-shell-liveness.ts.
   applyBackgroundShellLiveness(silencePoke, key, ev)

package/telegram-plugin/gateway/stream-render.ts

@@ -2312,6 +2312,10 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
           let sentIds: number[] = []
           let chunkCount = 0
           let delivered = false
+          // Set by the send-ack claim callback below once the durable
+          // delivered-keys journal has been written at ACK time — so the finally
+          // block does not journal the same nonce a second time.
+          let earlyJournaled = false
           try {
             // #3276 — the ONE delivery primitive. deliverAnswer routes through
             // `sendReplyChunks` (the same send core executeReply uses) and posts
@@ -2330,6 +2334,33 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               // S4 — anchor the flushed answer to the inbound it answers
               // (null for synthesized turns, which send bare as before).
               replyToMessageId: turn.sourceMessageId,
+              // Duplicate-message race fix — write the DURABLE delivered-keys
+              // journal at SEND-ACK, BEFORE deliverAnswer's read-back probe (which
+              // the cosmetic-edit flood-fuse can defer ~30s). Without this the
+              // journal write happened only in the finally below, AFTER `await
+              // deliverAnswer` returned, so the outbox sweep — which waits just
+              // OUTBOX_QUIET_MS (5s) before checking `deliveredNonces` — saw no
+              // entry and sent a SECOND copy of this answer. Journaling under the
+              // SAME nonce (turn.turnId == the Stop-hook record's turnNonce) makes
+              // the sweep skip-journaled and clears any captured record.
+              onAckClaim: (ackIds) => {
+                try {
+                  journalExternalDelivery(
+                    {
+                      turnNonce: turn.turnId,
+                      text: capturedText,
+                      tgMessageId: ackIds.length > 0 ? ackIds[0] : undefined,
+                      deliverySource: 'flush',
+                    },
+                    STATE_DIR,
+                  )
+                  earlyJournaled = true
+                } catch (err) {
+                  process.stderr.write(
+                    `telegram gateway: turn-flush send-ack journal write failed (non-fatal): ${(err as Error).message}\n`,
+                  )
+                }
+              },
             })
             sentIds = delivery.sentIds
             chunkCount = delivery.chunkCount
@@ -2433,7 +2464,14 @@ export function handleSessionEvent(deps: StreamRenderDeps, ev: SessionEvent): vo
               // between this send and the next process's backstop. Journal ONLY on
               // a receipt-gated `delivered` success. Best-effort: a journal-write
               // failure must never demote the successful delivery.
-              if (delivered) {
+              //
+              // Duplicate-message race fix: skip when the send-ack claim
+              // (`onAckClaim`) already journaled this nonce at ACK time. That
+              // path is the primary writer now (it runs before the read-back
+              // probe); this finally write only covers the case where the claim
+              // never fired — e.g. a card-only delivery where every chunk landed
+              // but no fresh receipt gated the claim, yet `delivered` still held.
+              if (delivered && !earlyJournaled) {
                 try {
                   journalExternalDelivery(
                     {