Problem

Agent-level (model-layer) progress beacons and delivery tracking are structurally unreliable. During sustained tool-call chains, the model cannot pause to evaluate its own silence duration — it proceeds to the next tool call. This means:

1. Mid-turn silence: The agent is actively working (making tool calls, reasoning) but the operator sees nothing for 1–5 minutes. Model-layer beacon rules ("remember to send a progress message") fail because the model is synchronously occupied.

2. End-of-turn delivery loss: The agent finishes its turn and generates a response, but transport failure (rate limit, timeout, API error) causes the response to never reach the operator. The model has already ended its turn and cannot detect or retry the failure.

Both failure modes produce the same operator experience: silence with no indication of whether the agent is working, finished, or broken.

Proposed Solution — Two Companion Subsystems

A. Silence Watchdog (mid-turn protection)

A gateway-level mechanical timer that fires a generic beacon when no operator-visible output has been delivered for a configurable threshold during an active agent turn.

Key properties:

• Runs inside the gateway process, outside the model execution context
• Cannot be forgotten, skipped, or overridden by model behavior
• Resets only on operator-visible output delivery (outbound message confirmed by channel, or operator-visible streaming output delivered to channel)
• Does NOT reset on: tool calls, internal processing, typing indicators, provider-internal streaming that never reaches the operator
• Default threshold: 45 seconds
• Default beacon: 🧠 Working… (generic — watchdog cannot know what the model is doing)
• Max 5 beacons per turn, then one escalation message, then stops
• Per-channel configurable

Suggested config:

silenceWatchdog:
  enabled: true
  thresholdSeconds: 45
  maxBeacons: 5
  message: "🧠 Working…"
  escalationMessage: "⚠️ Extended processing — still working. Response may be delayed."
  resetOnStreaming: true        # operator-visible streaming output resets timer
  resetOnTypingOnly: false      # typing indicator alone does NOT reset

Required hooks: turn.start, message.delivered (operator-visible only), turn.end

B. Response Delivery Confirmation (end-of-turn protection)

Gateway-level tracking of whether each outbound response was actually delivered to the channel, with automatic retry and operator alerting on failure.

Delivery state model:

TURN_STARTED → RESPONSE_GENERATED → RESPONSE_DELIVERED ✅
                                  → DELIVERY_FAILED → retry (1x) → DELIVERED or FAILED_FINAL → alert
             → NO_RESPONSE_DETECTED → alert

Delivery Correlation ID: Each outbound message is assigned a turn_id + response_id (UUID) pair. Retries carry the same response_id, allowing the gateway to suppress duplicates when a delayed original ACK arrives after a successful retry.

Key properties:

• Authoritative signal: channel provider ACK (e.g., Telegram returns message_id)
• Automatic retry: 1x after 3s delay with identical content and same response_id
• On final failure: alert operator + preserve response for re-delivery on next inbound
• No-response detection: if operator-triggered turn ends with zero outbound, alert operator
• Both inline response path and message.send tool path equally protected
• Chunked delivery: each chunk tracked independently
• Per-channel configurable

Suggested config:

responseDelivery:
  enabled: true
  retryCount: 1
  retryDelayMs: 3000
  alertOnFailure: true
  alertOnNoResponse: true
  preserveUndelivered: true

Required hooks: turn.start, response.outbound, delivery.result, turn.end

Implementation Scope

Both subsystems are gateway-native, channel-agnostic in principle:

• Silence Watchdog: ~50–80 lines (timer + 3 hooks)
• Delivery Confirmation: ~100–150 lines (state tracker + retry + alerts + 4 hooks)
• No model/agent changes required
• No prompt changes required
• Default enabled (safety feature)
• Backward compatible (additive — no existing behavior changed)

Operator Visibility Guarantee

Together, these two subsystems close every gap:

Operator sends message
  → Agent working, no output → Silence Watchdog fires at 45s
  → Agent sends output → Delivery Confirmation tracks receipt
  → Agent finishes, response delivered → ✅
  → Agent finishes, delivery fails → retry → alert
  → Agent finishes, no response → alert
  → Operator never wonders

No model-layer dependency. No behavioral rules to forget. Pure runtime enforcement.