@llblab/pi-kit 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.1.8 - 2026-08-23
+
+- `Telegram Releases`: Advances `@llblab/pi-telegram` to `0.37.1`, bringing journal-owned polling admission state from `0.37.0` plus the settings-manager compatibility hotfix for `/start`, model, and queue menus.
+- `Release Verification`: Allows up to ten minutes for Trusted Publisher releases to become publicly readable before package identity and bundled inventory verification, avoiding false failures from npm registry propagation delay.
+
 ## 0.1.7 - 2026-08-22
 
 - `Telegram Hotfix`: Advances `@llblab/pi-telegram` to `0.36.11`, bringing at-most-once durable prompt dispatch that prevents session or process replacement from automatically replaying an already-admitted Telegram prompt.

package/README.md

@@ -9,7 +9,7 @@
 | `@llblab/pi-actors` | `0.50.0` | Extension and Skills |
 | `@llblab/pi-codex-usage` | `0.9.3` | Extension |
 | `@llblab/pi-grow-loop` | `0.7.2` | Extension and Skills |
-| `@llblab/pi-telegram` | `0.36.11` | Extension and Skills |
+| `@llblab/pi-telegram` | `0.37.1` | Extension and Skills |
 
 Versions are exact by design. Updating an extension does not change an installed kit until this repository explicitly advances that dependency and publishes a new kit version.
 

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.37.1: Settings Manager Compatibility Hotfix
+
+- `Menu Compatibility`: Keeps `/start`, model, and queue menu rendering compatible with Pi settings-manager implementations that do not expose `reload()`. Hosts with reload retain explicit refresh behavior; other hosts use the freshly constructed settings snapshot instead of failing with `settingsManager.reload is not a function`.
+
+## 0.37.0: Journal-Owned Telegram Admission
+
+- `Configuration-Only State`: Moves the per-profile polling cursor out of `telegram.json` into atomic durable journal revisions, including cursor-only initial sync, compaction, reconstruction, and recovery. A journal-first one-shot cutover removes legacy config state idempotently, exact bot/profile fences remain enforced, status reads journal authority, and unsafe downgrade now fails closed.
+
 ## 0.36.11: At-Most-Once Prompt Dispatch Hotfix
 
 - `At-Most-Once Prompt Dispatch`: Commits each exact durable Telegram receipt synchronously before Pi model admission and blocks dispatch when that commit fails, closing the session/process-replacement replay window that could deliver an already-processed old prompt again; the narrow commit-before-admission crash boundary now favors no duplicate over retry.

package/node_modules/@llblab/pi-telegram/README.md

@@ -274,7 +274,7 @@ Stable public entrypoints are documented in [Public API](./docs/public-api.md),
 
 ## Safety Boundaries
 
-Durable inbound admission is a **process-crash recovery** guarantee. Atomic private-file replacement preserves acknowledged journal authority across ordinary process exit, crash, kill, and replacement, but the extension does not flush files or parent directories for host/kernel/filesystem/device/power-loss durability. Keep `~/.pi/agent` on appropriately managed storage and backups if that stronger operational guarantee is required. Before downgrading below `0.28.0`, run `node scripts/check-downgrade.mjs`; a blocked result means `0.28.x` must drain the retained journal first. See [Durable Admission And Recovery](./docs/architecture.md#durable-admission-and-recovery).
+Durable inbound admission is a **process-crash recovery** guarantee. Atomic private-file replacement preserves acknowledged journal authority and its journal-owned `acceptedThroughUpdateId` polling cursor across ordinary process exit, crash, kill, and replacement, but the extension does not flush files or parent directories for host/kernel/filesystem/device/power-loss durability. `telegram.json` contains configuration only. Keep `~/.pi/agent` on appropriately managed storage and backups if that stronger operational guarantee is required. Before downgrading below `0.37.0`, run `node scripts/check-downgrade.mjs`; any retained cursor-schema journal blocks downgrade because an older runtime could repoll admitted updates. See [Durable Admission And Recovery](./docs/architecture.md#durable-admission-and-recovery).
 
 `pi-telegram` intentionally does not:
 

package/node_modules/@llblab/pi-telegram/docs/architecture.md

@@ -116,9 +116,9 @@ Mirrored domain regressions live in `/tests/*.test.ts`. Shared test fixtures sho
 
 ## Configuration And Ownership
 
-Telegram configuration lives in `~/.pi/agent/telegram.json`. Bot/session identity (`botToken`, `botUsername`, `botId`, `allowedUserId`, `lastUpdateId`) persists only under `profiles.default` or `profiles.<name>`; shared handlers and assistant/voice/time settings stay top-level. Authoritative transport ownership lives separately in the pi-telegram-private `~/.pi/agent/tmp/telegram/owners.json` store. Its top-level slots are `default` and validated named profile names; unrelated extensions never read or write this file.
+Telegram configuration lives in `~/.pi/agent/telegram.json`. Bot/session identity (`botToken`, `botUsername`, `botId`, `allowedUserId`) persists only under `profiles.default` or `profiles.<name>`; shared handlers and assistant/voice/time settings stay top-level. Per-profile polling/admission state lives only in the durable update journal as `acceptedThroughUpdateId`. Authoritative transport ownership lives separately in the pi-telegram-private `~/.pi/agent/tmp/telegram/owners.json` store. Its top-level slots are `default` and validated named profile names; unrelated extensions never read or write this file.
 
-`telegram.json` is one global cross-instance configuration document. Ordinary reads rely on atomic publication and do not take the mutation guard. Every cooperating Pi instance persists only its recursive delta from the snapshot it loaded, merges that delta into the latest disk document inside `telegram.json.transaction`, and publishes atomically only when the semantic result differs; a no-op merge adopts the newer disk snapshot in memory without replacing the file. Unrelated global and profile changes therefore survive stale writers, while `lastUpdateId` additionally merges monotonically. Two serialized writers changing the same leaf use commit order, so the later local delta wins. A non-transactional external editor cannot participate in that conflict protocol: it should write through same-directory atomic replacement while Pi is idle, then let instances reload; an editor racing the transaction may lose its same-leaf change and must retry from the resulting file.
+`telegram.json` is one global cross-instance configuration document. Ordinary reads rely on atomic publication and do not take the mutation guard. Every cooperating Pi instance persists only its recursive delta from the snapshot it loaded, merges that delta into the latest disk document inside `telegram.json.transaction`, and publishes atomically only when the semantic result differs; a no-op merge adopts the newer disk snapshot in memory without replacing the file. Unrelated global and profile changes therefore survive stale writers. Two serialized writers changing the same leaf use commit order, so the later local delta wins. A non-transactional external editor cannot participate in that conflict protocol: it should write through same-directory atomic replacement while Pi is idle, then let instances reload; an editor racing the transaction may lose its same-leaf change and must retry from the resulting file.
 
 ### Setup Flow
 
@@ -161,9 +161,9 @@ Version `0.24.0` intentionally does not read or migrate the former agent-level `
 
 Telegram private-chat Threaded Mode is the public switch for multi-instance Telegram operation. Classic single-DM polling is the base mode. When Telegram private-chat threads are available for the bot, the bridge enables the local leader/follower bus automatically; when threads are unavailable or later disabled, the bridge returns to classic single-DM polling as a first-class mode. Before a non-owner `/telegram-connect` chooses follower registration or singleton takeover, it discards process-local status/capability projections and reads the current owner-published mode: `enabled` registers a follower without a takeover prompt, while `disabled` uses the classic confirmation flow.
 
-Named Telegram profiles are orthogonal to Threaded Mode. The selected profile chooses the bot/session slice (`botToken`, `botId`, `botUsername`, `allowedUserId`, `lastUpdateId`) and scopes the `owners.json` slot, diagnostics logs, state files, thread/bus ownership, and leader/follower IPC endpoints; it must not change the Threaded Mode rules. Within one selected profile, leader/follower election, bus transport, thread provisioning, routing, ownership forwarding, cleanup, and runtime diagnostics behave exactly as they do for the `default` slot. A different selected profile is a parallel bot runtime: its owner slot, `tmp/telegram/state.<profile>.json`, `tmp/telegram/logs.<profile>.jsonl`, `tmp/telegram/logs.<profile>._prev.jsonl`, thread bindings, Unix sockets, and Windows named pipes are isolated from the default profile and other named profiles while shared bridge settings remain top-level/global.
+Named Telegram profiles are orthogonal to Threaded Mode. The selected profile chooses the bot/session slice (`botToken`, `botId`, `botUsername`, `allowedUserId`) and scopes its durable journal cursor, the `owners.json` slot, diagnostics logs, state files, thread/bus ownership, and leader/follower IPC endpoints; it must not change the Threaded Mode rules. Within one selected profile, leader/follower election, bus transport, thread provisioning, routing, ownership forwarding, cleanup, and runtime diagnostics behave exactly as they do for the `default` slot. A different selected profile is a parallel bot runtime: its owner slot, `tmp/telegram/state.<profile>.json`, `tmp/telegram/logs.<profile>.jsonl`, `tmp/telegram/logs.<profile>._prev.jsonl`, thread bindings, Unix sockets, and Windows named pipes are isolated from the default profile and other named profiles while shared bridge settings remain top-level/global.
 
-Profile reality follows three explicit storage classes. `telegram.json` shared settings and extension registries are process-global platform configuration; `profiles.default` and `profiles.<name>` bot/session fields plus observable transport/routing authority are profile-scoped; queues, active turns, ownership caches, menu state, and runtime controllers are session-local memory. Config persistence serializes cross-process writers and applies each recursive mutation delta to the latest disk snapshot, so named-profile offsets and unrelated global/profile updates do not stale-replace one another. Polling publishes only its monotonic `lastUpdateId` into the current config-store snapshot; it never persists the detached full config object captured at poll start, which would interpret newer Settings fields as deletions. Runtime profile switching follows stop-old/commit-new ordering: reload keeps the selected identity stable, old polling/lock/bus teardown finishes while all dynamic resolvers still point at the old profile, and only then may activation expose the new token, lock key, state path, target namespace, and IPC endpoint. Downloaded attachments use UUID-prefixed names in the shared Telegram scratch directory and are session artifacts rather than identity or routing authority, so cross-profile cleanup recognizes only those UUID-prefixed scratch files. It never age-deletes journals, ownership, state, logs, or other top-level runtime files and therefore cannot redirect live traffic or orphan immutable journal segments.
+Profile reality follows three explicit storage classes. `telegram.json` shared settings and extension registries are process-global platform configuration; `profiles.default` and `profiles.<name>` bot/session fields plus observable transport/routing authority are profile-scoped; queues, active turns, ownership caches, menu state, and runtime controllers are session-local memory. Config persistence serializes cross-process writers and applies each recursive mutation delta to the latest disk snapshot, so unrelated global/profile updates do not stale-replace one another. Each profile's journal transaction independently publishes its monotonic admission cursor together with admitted work; polling never writes runtime state through config persistence. Runtime profile switching follows stop-old/commit-new ordering: reload keeps the selected identity stable, old polling/lock/bus teardown finishes while all dynamic resolvers still point at the old profile, and only then may activation expose the new token, lock key, state path, target namespace, and IPC endpoint. Downloaded attachments use UUID-prefixed names in the shared Telegram scratch directory and are session artifacts rather than identity or routing authority, so cross-profile cleanup recognizes only those UUID-prefixed scratch files. It never age-deletes journals, ownership, state, logs, or other top-level runtime files and therefore cannot redirect live traffic or orphan immutable journal segments.
 
 When Threaded Mode is active, the current polling owner is also the Telegram bus leader. The leader owns the local bus endpoint (Unix-domain socket on Unix-like platforms, named pipe on native Windows), polls `getUpdates`, performs direct Bot API calls, records follower heartbeats, prunes stale followers, and provisions Telegram UI thread targets through live runtime/bus state. Follower liveness is intentionally fast because heartbeat traffic is local IPC: followers heartbeat every `1s`, the leader treats them as stale after `2s`, and the prune loop runs every `1s` so stopped followers are detected promptly while active forwarded updates/API calls still refresh liveness. Heartbeat pruning is silent liveness bookkeeping and does not send a Telegram-visible disconnected notice, because the common cause may be leader reload or IPC handoff rather than a dead follower. Pruning alone preserves the binding; when Thread cleanup is enabled, only a subsequent OS check that confirms the exact registered PID absent may create fenced cleanup intent, and that cleanup serializes ahead of replacement registration. Successful follower target reuse refreshes the binding's recovery timestamp. Absent follower bindings remain durable restoration hints until explicit stale, deleted, offline, or reconciliation evidence invalidates them; process absence and heartbeat pruning alone do not remove them. If an authenticated live follower carries an exact target that is absent from current bindings, the leader recovers it only behind a synchronous visibility probe: success activates it, explicit stale evidence provisions a replacement, and ambiguous failure rejects registration. A carried slot is restored only when it is not already occupied. `tmp/telegram/logs.jsonl` is a session-local redacted runtime evidence stream for race debugging; it resets on extension start and runtime scope changes, and must not become routing/provisioning authority. `tmp/telegram/state.json` is an extension+bot observable/debug snapshot aligned with status diagnostics: `source: "snapshot"` and `writtenAtMs` mark it as observational, not authoritative. All instances on one Telegram profile read the same snapshot, but only the active transport lock owner persists it; followers become writers only after promotion. Status-only persistence reloads current disk bindings before serialization, preventing a stale follower/status view from erasing newer leader-owned targets. Fresh capability observations may skip redundant startup probes, but stale snapshots re-probe before suppressing bus/thread behavior. Top-level `bot` mirrors bot-wide capabilities such as thread mode, `runtime` describes process role/status, `liveRoster` mirrors followers/current targets/reservations, `diagnostics` mirrors recent status/debug signals including the latest thread-reconciler phase/counts, `threads` stores current routeable bindings, TTL-bounded reservations explain short-lived slot collision guards, and TTL-pruned `pendingProvisions` protects in-flight topic creation slots from cleanup/allocation races. Fresh provisioning writes pending state before the Bot API create call, adds the returned target to the pending record, persists a `starting` binding, then promotes it to `active` and clears pending state. If final binding persistence fails after Telegram returns a thread id, the targeted pending provision remains as cleanup/retry evidence. Once targeted pending provisions expire, they are retained for `thread-reconciler` close/delete cleanup and pending scratchpad removal after a successful cleanup apply; untargeted expired pending records can prune without cleanup because no Telegram thread id exists. Runtime events coalesce status-snapshot writes so transient bus/API/update failures remain inspectable even when the operator has not opened `/telegram-status`. The bridge must not keep a durable `telegram-targets.json` target history; stale/offline/failed thread observations are pruned instead of reused. Previous-process leader bindings that still probe alive become reservations/collision guards, not routeable active threads, so a reloaded leader can take the next free slot without duplicating the same visible tab name. The thread chat is always the private bot DM with the paired owner (`allowedUserId`). In Telegram private-chat Threaded Mode, the leader creates/reuses its own thread before polling — it is a real bound instance, not a dispatcher. Followers authenticate bus envelopes with the leader-minted capability secret stored in the active lock entry. Bot capability monitoring does not probe through the bus until the process either owns that direct lock or has completed authenticated follower registration. Leader lock entries also carry a stable `leaderEpoch` minted on acquisition and preserved across heartbeat refreshes; leader-owned cleanup/provisioning plans stamp that epoch, and Thread Reconciler apply skips destructive work if leadership has moved on before side effects run. Followers own their own Pi session state, queue, active turns, previews, menus, and lifecycle hooks, but route allowlisted, target-scoped Telegram API calls through the leader. When a follower promotes after heartbeat loss, status/state diagnostics expose only the transient `electing` lifecycle phase; stable `leader`/`follower` identity stays in the bus role so diagnostics do not duplicate role state. The TUI status bar and `/telegram-status` report `leader` or `follower` role so a registered follower is not shown as generically disconnected. Terminal status identity and the `[telegram|thread:name]` prompt label use the same target-aware current-instance resolver: registered local metadata wins over a stale shared binding for the matching target, while the binding remains a fallback for partial metadata.
 
@@ -240,7 +240,7 @@ The canonical update transition contract is:
 
 The worker executes at most 64 eligible entries from one validated journal snapshot, commits ordinary completions through one journal transaction, then yields through a generation-checked event-loop boundary. Retry, queue, or prior-generation boundaries first flush completed ids and force a fresh snapshot, preserving exact state-transition atomicity without per-entry parse/rewrite churn. A deterministic 2,048-entry stress gate requires exactly 32 completion publications, 33 reads including the final empty snapshot, continued 1ms timer progress, and less than 250ms maximum observed heartbeat delay. Byte-capacity tests cover failed and retry-wait diagnostics, queue receipt/owner and handoff metadata, and operator dispositions; every rejected growth leaves the prior authority bytes unchanged. It still scans later independent entries after retry or terminal persistence. An unresolved reaction remains a queue-mutation dependency even in `retry-wait` or `failed`, but dispatch checks that dependency against the candidate queue item's exact chat and source message ids instead of globally blocking unrelated targets. Successful replay or an exact discard disposition releases the dependency. Worker state, debug status, state snapshots, and redacted runtime events expose journal depth, retry/terminal counts, the next retry, latest terminal identity, copyable operator commands, and the exact first foreign queued owner identity (instance, PID/birth, session, and acquisition) when semantic authority belongs to another process.
 
-Upgrades create journals lazily before the first post-upgrade offset advance. A bot/profile identity change with unresolved authority fails closed. Once reconstructed authority is empty, the next read atomically rebinds profile and bot identity under the journal transaction and removes redundant old-identity segments best-effort; stable-`botId` token rotation remains valid even with entries. Downgrading below `0.28.0` with a non-empty journal is unsafe because the older runtime cannot drain updates whose Telegram offsets already advanced. Run `node scripts/check-downgrade.mjs [agent-dir]`; a blocked result requires draining with a compatible `0.28.x` runtime, while a safe result confirms all reconstructed journal authority is empty before downgrade. Runtime state from an older release must recover without deleting `telegram.json`, ownership state, or journal authority.
+The journal is the sole polling/admission authority. Each atomic journal revision publishes the admitted batch and monotonic `acceptedThroughUpdateId` together; cursor-only initial synchronization uses an empty batch revision. Existing config cursors are transferred once before polling: journal publication precedes config removal, restart retries are idempotent, established journal authority never regresses, and an unprovable non-empty journal fails closed. Upgrades create journals lazily before the first post-upgrade offset advance. A bot/profile identity change with unresolved authority fails closed. Once reconstructed authority is empty, the next read atomically rebinds profile and bot identity under the journal transaction and removes redundant old-identity segments best-effort; stable-`botId` token rotation remains valid even with entries. Downgrading below `0.37.0` with a cursor-schema journal is unsafe because an older runtime cannot recover `acceptedThroughUpdateId` and could repoll admitted updates. Run `node scripts/check-downgrade.mjs [agent-dir]`; the conservative older-schema validator rejects that retained authority even when entries are drained. Runtime state from an older release must recover without deleting `telegram.json`, ownership state, or journal authority.
 
 Polling and inbound-worker diagnostics remain separate so an executing, deferred, locally queued, foreign-queued, or blocked journal head cannot masquerade as a stalled `getUpdates` request.
 

package/node_modules/@llblab/pi-telegram/docs/public-api.md

@@ -84,7 +84,6 @@ interface TelegramBotProfile {
   botUsername?: string; // runtime-managed
   botId?: number; // runtime-managed
   allowedUserId?: number;
-  lastUpdateId?: number; // runtime-managed
 }
 
 interface TelegramConfig {
@@ -114,7 +113,7 @@ interface TelegramConfig {
 
 Bot/session identity always persists under `profiles.<name>`. The ordinary setup path uses `profiles.default`; `/telegram-setup default` and `/telegram-connect default` are exact aliases for the bare commands. Named profiles use the same shape. Shared handlers plus `assistant`, `voice`, `time`, and `threads` remain top-level. On the first `0.24.0` load, unambiguous legacy root identity moves atomically into `profiles.default`; identical duplicates collapse, complementary fields merge, and conflicting values fail closed without modifying the file.
 
-The file is global across Pi instances. Cooperating instances serialize recursive delta merges through `telegram.json.transaction`, preserve unrelated global/profile changes from newer disk snapshots, and merge `lastUpdateId` monotonically. A semantically unchanged merge adopts the latest disk state in memory without replacing the file; later commits win when two deltas intentionally change the same leaf. Same-parent temp-file replacement retries bounded transient `EPERM`, `EACCES`, and `EBUSY` destination contention without deleting the live config or leaving transaction serialization. For manual edits, stop or idle the connected instances, publish a complete valid file atomically, and let them reload. A non-transactional editor racing Pi persistence has no same-leaf conflict guarantee.
+The file is global across Pi instances and contains configuration only. The per-profile polling/admission cursor is `acceptedThroughUpdateId` in that profile's private durable update journal; it is not a config key. On first connection after this cut, a legacy config cursor is transferred directly into the journal before polling and then removed from config. Journal publication failure preserves the legacy source; config publication failure leaves the journal authoritative so retry is idempotent. Cooperating instances serialize recursive config delta merges through `telegram.json.transaction` and preserve unrelated global/profile changes from newer disk snapshots. A semantically unchanged merge adopts the latest disk state in memory without replacing the file; later commits win when two deltas intentionally change the same leaf. Same-parent temp-file replacement retries bounded transient `EPERM`, `EACCES`, and `EBUSY` destination contention without deleting the live config or leaving transaction serialization. For manual edits, stop or idle the connected instances, publish a complete valid file atomically, and let them reload. A non-transactional editor racing Pi persistence has no same-leaf conflict guarantee.
 
 Hidden/default semantics are represented by absence:
 

package/node_modules/@llblab/pi-telegram/index.ts

@@ -302,11 +302,6 @@ export default function (pi: Pi.ExtensionAPI) {
       persist: configStore.persist,
       markConfigChange: telegramSyncStateRuntime.markConfigChange,
     });
-  const persistTelegramPollingOffset =
-    Config.createTelegramPollingOffsetPersister(
-      configStore,
-      persistTelegramConfigWithSync,
-    );
   const {
     current: currentInstanceThreadRuntime,
     status: threadStatusProjectionRuntime,
@@ -353,6 +348,10 @@ export default function (pi: Pi.ExtensionAPI) {
     getInboundWorkerState() {
       return updateAdmissionRuntimeBinding.getActive()?.getState();
     },
+    getAcceptedThroughUpdateId() {
+      return resolveTelegramUpdateJournalBinding()?.journal.read()
+        .acceptedThroughUpdateId;
+    },
     getActiveSourceMessageIds: activeTurnRuntime.getSourceMessageIds,
     hasActiveTurn: activeTurnRuntime.has,
     hasDispatchPending: lifecycle.hasDispatchPending,
@@ -1009,14 +1008,36 @@ export default function (pi: Pi.ExtensionAPI) {
       hasBotToken: configStore.hasBotToken,
       deleteWebhook,
       getUpdates,
-      persistConfig: persistTelegramPollingOffset,
+      persistConfig: persistTelegramConfigWithSync,
       prepareUpdateBatch: textGroupRuntime.prepareUpdateBatch,
       journal: {
-        appendBatch(updates) {
+        appendBatch(updates, acceptedThroughUpdateId) {
           return updateAdmissionLifecycleRuntime.appendBatch(
             updates as Journal.TelegramJournaledUpdate[],
+            acceptedThroughUpdateId,
           );
         },
+        getAcceptedThroughUpdateId() {
+          return resolveTelegramUpdateJournalBinding()?.journal.read()
+            .acceptedThroughUpdateId;
+        },
+        async prepareCursorCutover() {
+          const binding = resolveTelegramUpdateJournalBinding();
+          if (!binding) {
+            throw new Error("Telegram update journal binding is unavailable.");
+          }
+          await Polling.cutOverTelegramPollingCursor({
+            getLegacyCursor: configStore.getLegacyPollingCursor,
+            readJournal: binding.journal.read,
+            publishJournalCursor(acceptedThroughUpdateId) {
+              binding.journal.appendBatch([], acceptedThroughUpdateId);
+            },
+            async removeLegacyCursor() {
+              configStore.removeLegacyPollingCursor();
+              await persistTelegramConfigWithSync();
+            },
+          });
+        },
         getEntryCount: updateAdmissionLifecycleRuntime.getJournalEntryCount,
         signalWorker: updateAdmissionLifecycleRuntime.signal,
         getBootstrapEntryCount() {

package/node_modules/@llblab/pi-telegram/lib/config.ts

@@ -99,8 +99,6 @@ export interface TelegramConfig {
   botId?: number;
   /** @deprecated persisted identity belongs in profiles.default; retained for effective/legacy views */
   allowedUserId?: number;
-  /** @deprecated persisted identity belongs in profiles.default; retained for effective/legacy views */
-  lastUpdateId?: number;
   inboundHandlers?: TelegramInboundHandlerConfig[];
   attachmentHandlers?: TelegramInboundHandlerConfig[];
   outboundHandlers?: TelegramOutboundHandlerConfig[];
@@ -144,6 +142,9 @@ export interface TelegramBotProfile {
   botUsername?: string;
   botId?: number;
   allowedUserId?: number;
+}
+
+interface TelegramLegacyCursorCarrier {
   lastUpdateId?: number;
 }
 
@@ -177,6 +178,8 @@ export interface TelegramConfigStore {
   getBotToken: () => string | undefined;
   hasBotToken: () => boolean;
   getAllowedUserId: () => number | undefined;
+  getLegacyPollingCursor: () => number | undefined;
+  removeLegacyPollingCursor: () => void;
   getInboundHandlers: () => TelegramInboundHandlerConfig[] | undefined;
   getAttachmentHandlers: () => TelegramInboundHandlerConfig[] | undefined;
   getOutboundHandlers: () => TelegramOutboundHandlerConfig[] | undefined;
@@ -368,15 +371,7 @@ function mergeTelegramConfigDelta(
       continue;
     }
     if (!desiredHas) {
-      if (key !== "lastUpdateId") delete merged[key];
-      continue;
-    }
-    if (
-      key === "lastUpdateId" &&
-      typeof desiredValue === "number" &&
-      typeof merged[key] === "number"
-    ) {
-      merged[key] = Math.max(desiredValue, merged[key] as number);
+      delete merged[key];
       continue;
     }
     if (
@@ -433,6 +428,8 @@ export function getTelegramProfileFields(
 ): TelegramBotProfile | undefined {
   const token = config.botToken?.trim();
   if (!token) return undefined;
+  const legacyCursor = (config as TelegramConfig & TelegramLegacyCursorCarrier)
+    .lastUpdateId;
   return {
     botToken: token,
     ...(config.botUsername !== undefined
@@ -442,9 +439,7 @@ export function getTelegramProfileFields(
     ...(config.allowedUserId !== undefined
       ? { allowedUserId: config.allowedUserId }
       : {}),
-    ...(config.lastUpdateId !== undefined
-      ? { lastUpdateId: config.lastUpdateId }
-      : {}),
+    ...(legacyCursor !== undefined ? { lastUpdateId: legacyCursor } : {}),
   };
 }
 
@@ -456,7 +451,7 @@ function omitTelegramRootProfileFields(config: TelegramConfig): TelegramConfig {
     allowedUserId: _allowedUserId,
     lastUpdateId: _lastUpdateId,
     ...sharedConfig
-  } = config;
+  } = config as TelegramConfig & TelegramLegacyCursorCarrier;
   return sharedConfig;
 }
 
@@ -477,7 +472,8 @@ export function normalizeTelegramDefaultProfileConfig(config: TelegramConfig): {
   if (Object.hasOwn(config, "botToken") && !legacyToken) {
     throw new Error("Legacy Telegram default profile has no bot token");
   }
-  const legacyProfile: Partial<TelegramBotProfile> = {
+  const legacyProfile: Partial<TelegramBotProfile> &
+    TelegramLegacyCursorCarrier = {
     ...(legacyToken ? { botToken: legacyToken } : {}),
     ...(config.botUsername !== undefined
       ? { botUsername: config.botUsername }
@@ -486,8 +482,12 @@ export function normalizeTelegramDefaultProfileConfig(config: TelegramConfig): {
     ...(config.allowedUserId !== undefined
       ? { allowedUserId: config.allowedUserId }
       : {}),
-    ...(config.lastUpdateId !== undefined
-      ? { lastUpdateId: config.lastUpdateId }
+    ...((config as TelegramConfig & TelegramLegacyCursorCarrier)
+      .lastUpdateId !== undefined
+      ? {
+          lastUpdateId: (config as TelegramConfig & TelegramLegacyCursorCarrier)
+            .lastUpdateId,
+        }
       : {}),
   };
   if (!canonicalProfile && !legacyToken) {
@@ -609,6 +609,16 @@ export function createTelegramConfigStore(
     getBotToken: () => getEffectiveConfig().botToken,
     hasBotToken: () => !!getEffectiveConfig().botToken,
     getAllowedUserId: () => getEffectiveConfig().allowedUserId,
+    getLegacyPollingCursor: () =>
+      (getEffectiveConfig() as TelegramConfig & TelegramLegacyCursorCarrier)
+        .lastUpdateId,
+    removeLegacyPollingCursor: () => {
+      const next = {
+        ...(getEffectiveConfig() as TelegramConfig & TelegramLegacyCursorCarrier),
+      };
+      delete next.lastUpdateId;
+      setEffectiveConfig(next);
+    },
     getInboundHandlers: () => [
       ...(config.inboundHandlers ?? []),
       ...(config.attachmentHandlers ?? []),
@@ -703,27 +713,6 @@ export function createTelegramConfigStore(
   };
 }
 
-export function createTelegramPollingOffsetPersister(
-  configStore: Pick<TelegramConfigStore, "get" | "set" | "persist">,
-  persist: () => Promise<void> = () => configStore.persist(),
-): (pollingConfig: { lastUpdateId?: number }) => Promise<void> {
-  return async (pollingConfig) => {
-    const nextOffset = pollingConfig.lastUpdateId;
-    if (typeof nextOffset === "number") {
-      const current = configStore.get();
-      const currentOffset = current.lastUpdateId;
-      configStore.set({
-        ...current,
-        lastUpdateId:
-          typeof currentOffset === "number"
-            ? Math.max(currentOffset, nextOffset)
-            : nextOffset,
-      });
-    }
-    await persist();
-  };
-}
-
 export function createTelegramProactivePushChecker(
   configStore: Pick<TelegramConfigStore, "get">,
 ): () => boolean {

package/node_modules/@llblab/pi-telegram/lib/journal.ts

@@ -157,6 +157,7 @@ export interface TelegramUpdateJournalEntry {
 export interface TelegramUpdateJournalFile {
   version: typeof TELEGRAM_UPDATE_JOURNAL_VERSION;
   revision?: number;
+  acceptedThroughUpdateId?: number;
   profile: string;
   botIdentity: TelegramUpdateJournalBotIdentity;
   entries: TelegramUpdateJournalEntry[];
@@ -312,6 +313,7 @@ export interface TelegramUpdateJournalStore {
   read(): TelegramUpdateJournalSnapshot;
   appendBatch<TUpdate extends TelegramUpdateJournalInput>(
     updates: readonly TUpdate[],
+    acceptedThroughUpdateId?: number,
   ): TelegramUpdateJournalAppendResult;
   markQueued(
     receipt: TelegramUpdateJournalQueueReceipt,
@@ -385,6 +387,7 @@ export interface TelegramUpdateJournalSegment {
   version: typeof TELEGRAM_UPDATE_JOURNAL_VERSION;
   revision: number;
   previousRevision: number;
+  acceptedThroughUpdateId?: number;
   profile: string;
   botIdentity: TelegramUpdateJournalBotIdentity;
   upsertedEntries: TelegramUpdateJournalEntry[];
@@ -975,6 +978,7 @@ function parseJournalFile(
     !hasOnlyKeys(value, [
       "version",
       "revision",
+      "acceptedThroughUpdateId",
       "profile",
       "botIdentity",
       "entries",
@@ -983,6 +987,8 @@ function parseJournalFile(
     !Number.isSafeInteger(value.version) ||
     (value.revision !== undefined &&
       (!isSafeNonNegativeInteger(value.revision) || value.revision === 0)) ||
+    (value.acceptedThroughUpdateId !== undefined &&
+      !isSafeNonNegativeInteger(value.acceptedThroughUpdateId)) ||
     !isNonEmptyString(value.profile) ||
     !Array.isArray(value.entries) ||
     (value.operatorDispositions !== undefined &&
@@ -1009,6 +1015,17 @@ function parseJournalFile(
       );
     }
   }
+  if (
+    entries.length > 0 &&
+    value.acceptedThroughUpdateId !== undefined &&
+    value.acceptedThroughUpdateId < entries.at(-1)!.updateId
+  ) {
+    throw createJournalError(
+      "invalid",
+      path,
+      "has an admission cursor behind its active entries",
+    );
+  }
   const queuedReceipts = new Map<
     string,
     {
@@ -1096,6 +1113,9 @@ function parseJournalFile(
     ...(value.revision !== undefined
       ? { revision: value.revision as number }
       : {}),
+    ...(value.acceptedThroughUpdateId !== undefined
+      ? { acceptedThroughUpdateId: value.acceptedThroughUpdateId as number }
+      : {}),
     profile: value.profile,
     botIdentity: validateBotIdentity(value.botIdentity, path),
     entries,
@@ -1113,6 +1133,7 @@ function parseJournalSegment(
       "version",
       "revision",
       "previousRevision",
+      "acceptedThroughUpdateId",
       "profile",
       "botIdentity",
       "upsertedEntries",
@@ -1122,6 +1143,8 @@ function parseJournalSegment(
     value.version !== TELEGRAM_UPDATE_JOURNAL_VERSION ||
     !isSafePositiveInteger(value.revision) ||
     !isSafeNonNegativeInteger(value.previousRevision) ||
+    (value.acceptedThroughUpdateId !== undefined &&
+      !isSafeNonNegativeInteger(value.acceptedThroughUpdateId)) ||
     !isNonEmptyString(value.profile) ||
     !Array.isArray(value.upsertedEntries) ||
     !Array.isArray(value.removedUpdateIds) ||
@@ -1140,6 +1163,18 @@ function parseJournalSegment(
     }
     upsertedIds.add(entry.updateId);
   }
+  if (
+    upsertedEntries.length > 0 &&
+    value.acceptedThroughUpdateId !== undefined &&
+    value.acceptedThroughUpdateId <
+      Math.max(...upsertedEntries.map((entry) => entry.updateId))
+  ) {
+    throw createJournalError(
+      "invalid",
+      path,
+      "has an admission cursor behind its segment upserts",
+    );
+  }
   const removedUpdateIds: number[] = [];
   const removedIds = new Set<number>();
   for (const updateId of value.removedUpdateIds) {
@@ -1162,6 +1197,9 @@ function parseJournalSegment(
     version: TELEGRAM_UPDATE_JOURNAL_VERSION,
     revision: value.revision,
     previousRevision: value.previousRevision,
+    ...(value.acceptedThroughUpdateId !== undefined
+      ? { acceptedThroughUpdateId: value.acceptedThroughUpdateId as number }
+      : {}),
     profile: value.profile,
     botIdentity: validateBotIdentity(value.botIdentity, path),
     upsertedEntries,
@@ -1190,6 +1228,9 @@ function cloneFile(file: TelegramUpdateJournalFile): TelegramUpdateJournalFile {
   return {
     version: TELEGRAM_UPDATE_JOURNAL_VERSION,
     ...(file.revision !== undefined ? { revision: file.revision } : {}),
+    ...(file.acceptedThroughUpdateId !== undefined
+      ? { acceptedThroughUpdateId: file.acceptedThroughUpdateId }
+      : {}),
     profile: file.profile,
     botIdentity: { ...file.botIdentity },
     entries: file.entries.map(cloneEntry),
@@ -1879,6 +1920,17 @@ export function createTelegramUpdateJournalStore(
           `has a revision gap after ${revision}`,
         );
       }
+      if (
+        segment.acceptedThroughUpdateId !== undefined &&
+        file.acceptedThroughUpdateId !== undefined &&
+        segment.acceptedThroughUpdateId < file.acceptedThroughUpdateId
+      ) {
+        throw createJournalError(
+          "invalid",
+          segmentPath,
+          "regresses the admission cursor",
+        );
+      }
       if (
         segment.profile !== storedProfile ||
         !identitiesMatch(segment.botIdentity, storedIdentity)
@@ -1907,6 +1959,11 @@ export function createTelegramUpdateJournalStore(
         {
           version: TELEGRAM_UPDATE_JOURNAL_VERSION,
           revision: segment.revision,
+          ...(segment.acceptedThroughUpdateId !== undefined
+            ? { acceptedThroughUpdateId: segment.acceptedThroughUpdateId }
+            : file.acceptedThroughUpdateId !== undefined
+              ? { acceptedThroughUpdateId: file.acceptedThroughUpdateId }
+              : {}),
           profile: storedProfile,
           botIdentity: mergeBotIdentity(file.botIdentity, segment.botIdentity),
           entries: [...entriesById.values()].sort(
@@ -2136,6 +2193,7 @@ export function createTelegramUpdateJournalStore(
     entries: TelegramUpdateJournalEntry[],
     contentChanged: boolean,
     operatorDispositions = current.file.operatorDispositions,
+    acceptedThroughUpdateId = current.file.acceptedThroughUpdateId,
   ): { file: TelegramUpdateJournalFile; serializedBytes: number } => {
     const botIdentity = mergeBotIdentity(
       current.file.botIdentity,
@@ -2147,7 +2205,8 @@ export function createTelegramUpdateJournalStore(
       isDeepStrictEqual(
         current.file.operatorDispositions ?? [],
         operatorDispositions ?? [],
-      )
+      ) &&
+      current.file.acceptedThroughUpdateId === acceptedThroughUpdateId
     ) {
       return { file: current.file, serializedBytes: current.serializedBytes };
     }
@@ -2156,6 +2215,9 @@ export function createTelegramUpdateJournalStore(
       profile,
       botIdentity,
       entries,
+      ...(acceptedThroughUpdateId !== undefined
+        ? { acceptedThroughUpdateId }
+        : {}),
       ...(operatorDispositions?.length
         ? { operatorDispositions }
         : {}),
@@ -2164,6 +2226,7 @@ export function createTelegramUpdateJournalStore(
     const serializedBytes = assertCapacity(file, serialized);
     const changed =
       contentChanged ||
+      current.file.acceptedThroughUpdateId !== acceptedThroughUpdateId ||
       !isDeepStrictEqual(current.file.botIdentity, file.botIdentity);
     if (!changed) {
       return { file, serializedBytes: current.serializedBytes };
@@ -2193,6 +2256,9 @@ export function createTelegramUpdateJournalStore(
       botIdentity: file.botIdentity,
       upsertedEntries,
       removedUpdateIds,
+      ...(acceptedThroughUpdateId !== undefined
+        ? { acceptedThroughUpdateId }
+        : {}),
       ...(!isDeepStrictEqual(
         current.file.operatorDispositions ?? [],
         operatorDispositions ?? [],
@@ -2260,8 +2326,18 @@ export function createTelegramUpdateJournalStore(
         };
       });
     },
-    appendBatch(updates) {
+    appendBatch(updates, requestedAcceptedThroughUpdateId) {
       return runMutation(() => {
+        if (
+          requestedAcceptedThroughUpdateId !== undefined &&
+          !isSafeNonNegativeInteger(requestedAcceptedThroughUpdateId)
+        ) {
+          throw createJournalError(
+            "invalid",
+            path,
+            "received an invalid admission cursor",
+          );
+        }
         const current = readCurrent();
         const normalizedUpdates: TelegramJournaledUpdate[] = [];
         for (const update of updates) {
@@ -2290,6 +2366,8 @@ export function createTelegramUpdateJournalStore(
         const entriesById = new Map(
           current.file.entries.map((entry) => [entry.updateId, entry]),
         );
+        const previousAcceptedThroughUpdateId =
+          current.file.acceptedThroughUpdateId;
         const discardedUpdateIds = new Set(
           (current.file.operatorDispositions ?? [])
             .filter((disposition) => disposition.action === "discard")
@@ -2335,6 +2413,31 @@ export function createTelegramUpdateJournalStore(
           addedUpdateIds.push(entry.updateId);
         }
 
+        const batchLastUpdateId = normalizedUpdates.at(-1)?.update_id;
+        if (
+          requestedAcceptedThroughUpdateId !== undefined &&
+          batchLastUpdateId !== undefined &&
+          requestedAcceptedThroughUpdateId < batchLastUpdateId
+        ) {
+          throw createJournalError(
+            "invalid",
+            path,
+            "received an admission cursor behind its batch",
+          );
+        }
+        if (
+          requestedAcceptedThroughUpdateId !== undefined &&
+          previousAcceptedThroughUpdateId !== undefined &&
+          requestedAcceptedThroughUpdateId < previousAcceptedThroughUpdateId
+        ) {
+          throw createJournalError(
+            "conflict",
+            path,
+            "received a regressing admission cursor",
+          );
+        }
+        const acceptedThroughUpdateId =
+          requestedAcceptedThroughUpdateId ?? previousAcceptedThroughUpdateId;
         const contentChanged = addedUpdateIds.length > 0;
         const published = publishMutation(
           current,
@@ -2344,6 +2447,8 @@ export function createTelegramUpdateJournalStore(
               )
             : current.file.entries,
           contentChanged,
+          current.file.operatorDispositions,
+          acceptedThroughUpdateId,
         );
         return {
           addedUpdateIds,

package/node_modules/@llblab/pi-telegram/lib/menu-model.ts

@@ -103,7 +103,7 @@ export interface TelegramModelMenuRuntimeOptions<
 }
 
 export interface MenuSettingsManager {
-  reload: () => Promise<void>;
+  reload?: () => Promise<void>;
   flush?: () => Promise<void>;
   getEnabledModels: () => string[] | undefined;
   setEnabledModels?: (patterns: string[] | undefined) => void;
@@ -498,7 +498,9 @@ export function createTelegramModelMenuStateBuilder<
       threadId,
       activeModel: deps.getActiveModel(ctx),
       ctx,
-      reloadSettings: () => settingsManager.reload(),
+      reloadSettings: async () => {
+        await settingsManager.reload?.();
+      },
       getConfiguredScopedModelPatterns: () =>
         settingsManager.getEnabledModels(),
     });

package/node_modules/@llblab/pi-telegram/lib/polling.ts

@@ -8,7 +8,6 @@ type MaybePromise<T> = T | Promise<T>;
 
 export interface TelegramPollingConfig {
   botToken?: string;
-  lastUpdateId?: number;
 }
 
 export interface TelegramUpdate {
@@ -227,6 +226,7 @@ export interface TelegramPollingAdmissionRuntime<TContext> {
 
 export function createTelegramPollingAdmissionRuntime<TContext>(deps: {
   polling: TelegramPollingController<TContext>;
+  prepareStart?: () => MaybePromise<void>;
   validateStart?: () => void;
   worker: {
     onSessionStart: (ctx: TContext) => Promise<void>;
@@ -235,6 +235,7 @@ export function createTelegramPollingAdmissionRuntime<TContext>(deps: {
   return {
     isActive: deps.polling.isActive,
     async start(ctx) {
+      await deps.prepareStart?.();
       deps.validateStart?.();
       await deps.worker.onSessionStart(ctx);
       await deps.polling.start(ctx);
@@ -256,7 +257,12 @@ export type TelegramDurablePollingRuntimeAssemblyDeps<
   "appendUpdateBatch" | "getJournalEntryCount" | "signalUpdateWorker"
 > & {
   journal: {
-    appendBatch: (updates: readonly TUpdate[]) => MaybePromise<unknown>;
+    appendBatch: (
+      updates: readonly TUpdate[],
+      acceptedThroughUpdateId?: number,
+    ) => MaybePromise<unknown>;
+    getAcceptedThroughUpdateId: () => number | undefined;
+    prepareCursorCutover?: () => MaybePromise<void>;
     getEntryCount: () => number;
     signalWorker: () => void;
     getBootstrapEntryCount: () => number;
@@ -274,13 +280,15 @@ export function createTelegramDurablePollingRuntimeAssembly<
   const controller = createTelegramPollingControllerRuntime({
     ...deps,
     appendUpdateBatch: deps.journal.appendBatch,
+    getAcceptedThroughUpdateId: deps.journal.getAcceptedThroughUpdateId,
     getJournalEntryCount: deps.journal.getEntryCount,
     signalUpdateWorker: deps.journal.signalWorker,
   });
   const admission = createTelegramPollingAdmissionRuntime({
     polling: controller,
+    prepareStart: deps.journal.prepareCursorCutover,
     validateStart() {
-      if (deps.getConfig().lastUpdateId !== undefined) return;
+      if (deps.journal.getAcceptedThroughUpdateId() !== undefined) return;
       if (deps.journal.getBootstrapEntryCount() === 0) return;
       throw new TelegramPollingCursorBootstrapError(
         "Telegram polling cursor is missing while the durable update journal is non-empty.",
@@ -356,6 +364,7 @@ export function createTelegramPollingControllerRuntime<
       getUpdatesRequestBudgetMs: deps.getUpdatesRequestBudgetMs,
       persistConfig: deps.persistConfig,
       appendUpdateBatch: deps.appendUpdateBatch,
+      getAcceptedThroughUpdateId: deps.getAcceptedThroughUpdateId,
       getJournalEntryCount: deps.getJournalEntryCount,
       signalUpdateWorker: deps.signalUpdateWorker,
       prepareUpdateBatch: deps.prepareUpdateBatch,
@@ -1185,6 +1194,32 @@ export class TelegramPollingCursorBootstrapError extends Error {
   }
 }
 
+export interface TelegramPollingCursorCutoverDeps {
+  getLegacyCursor: () => number | undefined;
+  readJournal: () => {
+    acceptedThroughUpdateId?: number;
+    entries: readonly { updateId: number }[];
+  };
+  publishJournalCursor: (acceptedThroughUpdateId: number) => MaybePromise<void>;
+  removeLegacyCursor: () => MaybePromise<void>;
+}
+
+/** Transfer one legacy config cursor into journal authority before deleting it. */
+export async function cutOverTelegramPollingCursor(
+  deps: TelegramPollingCursorCutoverDeps,
+): Promise<void> {
+  const legacyCursor = deps.getLegacyCursor();
+  if (legacyCursor === undefined) return;
+  const snapshot = deps.readJournal();
+  if (snapshot.acceptedThroughUpdateId === undefined) {
+    const provenEntryCursor = snapshot.entries.at(-1)?.updateId;
+    await deps.publishJournalCursor(
+      Math.max(legacyCursor, provenEntryCursor ?? legacyCursor),
+    );
+  }
+  await deps.removeLegacyCursor();
+}
+
 export interface TelegramPollingBatchAdmissionResult {
   updateCount: number;
   latestUpdateId?: number;
@@ -1195,7 +1230,11 @@ export interface TelegramPollingBatchAdmissionDeps<
 > extends TelegramRuntimeEventRecorderPort {
   updates: readonly TUpdate[];
   config: TelegramPollingConfig;
-  appendBatch: (updates: readonly TUpdate[]) => MaybePromise<unknown>;
+  appendBatch: (
+    updates: readonly TUpdate[],
+    acceptedThroughUpdateId?: number,
+  ) => MaybePromise<unknown>;
+  getAcceptedThroughUpdateId?: () => number | undefined;
   persistConfig: (config: TelegramPollingConfig) => Promise<void>;
   signalWorker: () => void;
   onPhaseChange?: (
@@ -1229,7 +1268,8 @@ export async function admitTelegramPollingUpdateBatch<
   deps: TelegramPollingBatchAdmissionDeps<TUpdate>,
 ): Promise<TelegramPollingBatchAdmissionResult> {
   if (deps.updates.length === 0) return { updateCount: 0 };
-  validateTelegramPollingBatch(deps.updates, deps.config.lastUpdateId);
+  const acceptedThroughUpdateId = deps.getAcceptedThroughUpdateId?.();
+  validateTelegramPollingBatch(deps.updates, acceptedThroughUpdateId);
   const latestUpdateId = getLatestTelegramUpdateId(deps.updates);
   if (latestUpdateId === undefined) return { updateCount: 0 };
   reportTelegramPollingPhase(
@@ -1237,18 +1277,7 @@ export async function admitTelegramPollingUpdateBatch<
     "persisting-journal",
     deps.updates[0]?.update_id,
   );
-  await deps.appendBatch(deps.updates);
-  reportTelegramPollingPhase(deps, "persisting-offset", latestUpdateId);
-  const previousUpdateId = deps.config.lastUpdateId;
-  deps.config.lastUpdateId = latestUpdateId;
-  try {
-    await deps.persistConfig(deps.config);
-  } catch (error) {
-    if (deps.config.lastUpdateId === latestUpdateId) {
-      deps.config.lastUpdateId = previousUpdateId;
-    }
-    throw error;
-  }
+  await deps.appendBatch(deps.updates, latestUpdateId);
   try {
     deps.signalWorker();
   } catch (error) {
@@ -1275,7 +1304,11 @@ export interface TelegramPollLoopDeps<
   ) => Promise<TUpdate[]>;
   getUpdatesRequestBudgetMs?: (body: Record<string, unknown>) => number;
   persistConfig: (config: TelegramPollingConfig) => Promise<void>;
-  appendUpdateBatch: (updates: readonly TUpdate[]) => MaybePromise<unknown>;
+  appendUpdateBatch: (
+    updates: readonly TUpdate[],
+    acceptedThroughUpdateId?: number,
+  ) => MaybePromise<unknown>;
+  getAcceptedThroughUpdateId?: () => number | undefined;
   getJournalEntryCount: () => number;
   signalUpdateWorker: () => void;
   prepareUpdateBatch?: (updates: readonly TUpdate[]) => void;
@@ -1301,7 +1334,11 @@ export interface TelegramPollLoopRunnerDeps<
   ) => Promise<TUpdate[]>;
   getUpdatesRequestBudgetMs?: (body: Record<string, unknown>) => number;
   persistConfig: (config: TelegramPollingConfig) => Promise<void>;
-  appendUpdateBatch: (updates: readonly TUpdate[]) => MaybePromise<unknown>;
+  appendUpdateBatch: (
+    updates: readonly TUpdate[],
+    acceptedThroughUpdateId?: number,
+  ) => MaybePromise<unknown>;
+  getAcceptedThroughUpdateId?: () => number | undefined;
   getJournalEntryCount: () => number;
   signalUpdateWorker: () => void;
   prepareUpdateBatch?: (updates: readonly TUpdate[]) => void;
@@ -1356,6 +1393,7 @@ export function createTelegramPollLoopRunner<
       getUpdatesRequestBudgetMs: deps.getUpdatesRequestBudgetMs,
       persistConfig: deps.persistConfig,
       appendUpdateBatch: deps.appendUpdateBatch,
+      getAcceptedThroughUpdateId: deps.getAcceptedThroughUpdateId,
       getJournalEntryCount: deps.getJournalEntryCount,
       signalUpdateWorker: deps.signalUpdateWorker,
       prepareUpdateBatch: deps.prepareUpdateBatch,
@@ -1494,14 +1532,16 @@ export async function runTelegramPollLoop<
     // ignore
   }
   if (
-    deps.config.lastUpdateId === undefined &&
+    deps.getAcceptedThroughUpdateId?.() === undefined &&
     deps.getJournalEntryCount() > 0
   ) {
     throw new TelegramPollingCursorBootstrapError(
       "Telegram polling cursor is missing while the durable update journal is non-empty.",
     );
   }
-  if (deps.config.lastUpdateId === undefined) {
+  if (
+    deps.getAcceptedThroughUpdateId?.() === undefined
+  ) {
     try {
       const request = buildTelegramInitialSyncRequest();
       reportTelegramPollingPhase(deps, "long-poll");
@@ -1514,8 +1554,7 @@ export async function runTelegramPollLoop<
           "persisting-offset",
           lastUpdateId,
         );
-        deps.config.lastUpdateId = lastUpdateId;
-        await deps.persistConfig(deps.config);
+        await deps.appendUpdateBatch([], lastUpdateId);
         deps.recordRuntimeEvent?.(
           "polling",
           new Error("Initialized Telegram cursor without executing history."),
@@ -1538,7 +1577,9 @@ export async function runTelegramPollLoop<
   while (!deps.signal.aborted) {
     try {
       currentUpdateId = undefined;
-      const request = buildTelegramLongPollRequest(deps.config.lastUpdateId);
+      const request = buildTelegramLongPollRequest(
+        deps.getAcceptedThroughUpdateId?.(),
+      );
       reportTelegramPollingPhase(deps, "long-poll");
       const updates = await requestTelegramUpdatesWithinBudget(deps, request);
       reportTelegramPollingResponse(deps, updates.length);
@@ -1549,6 +1590,7 @@ export async function runTelegramPollLoop<
         updates,
         config: deps.config,
         appendBatch: deps.appendUpdateBatch,
+        getAcceptedThroughUpdateId: deps.getAcceptedThroughUpdateId,
         persistConfig: deps.persistConfig,
         signalWorker: deps.signalUpdateWorker,
         onPhaseChange: deps.onPhaseChange,

package/node_modules/@llblab/pi-telegram/lib/setup.ts

@@ -9,7 +9,6 @@ export interface TelegramSetupConfig {
   botId?: number;
   botUsername?: string;
   allowedUserId?: number;
-  lastUpdateId?: number;
 }
 
 export interface TelegramBotTokenPromptSpec {

package/node_modules/@llblab/pi-telegram/lib/status.ts

@@ -321,7 +321,6 @@ export interface TelegramBridgeStatusConfig {
   botToken?: string;
   botUsername?: string;
   allowedUserId?: number;
-  lastUpdateId?: number;
 }
 
 export interface TelegramBridgeStatusRuntimeDeps<
@@ -337,6 +336,7 @@ export interface TelegramBridgeStatusRuntimeDeps<
   isPollingActive: () => boolean;
   getPollingState?: () => TelegramBridgePollingState;
   getInboundWorkerState?: () => TelegramBridgeInboundWorkerState | undefined;
+  getAcceptedThroughUpdateId?: () => number | undefined;
   getActiveSourceMessageIds: () => number[] | undefined;
   hasActiveTurn: () => boolean;
   hasDispatchPending: () => boolean;
@@ -717,7 +717,7 @@ export function createTelegramBridgeStatusRuntime<
         ...(deps.getInboundWorkerState
           ? { inboundWorker: deps.getInboundWorkerState() }
           : {}),
-        lastUpdateId: config.lastUpdateId,
+        lastUpdateId: deps.getAcceptedThroughUpdateId?.(),
         activeSourceMessageIds: deps.getActiveSourceMessageIds(),
         pendingDispatch: deps.hasDispatchPending(),
         compactionInProgress: deps.isCompactionInProgress(),

package/node_modules/@llblab/pi-telegram/lib/updates.ts

@@ -1685,6 +1685,7 @@ export interface TelegramUpdateWorkerStateSnapshot {
 }
 
 export interface TelegramUpdateWorkerJournalSnapshot {
+  acceptedThroughUpdateId?: number;
   entries: readonly {
     updateId: number;
     update: TelegramJournaledUpdate;
@@ -3669,7 +3670,10 @@ export interface TelegramUpdateAdmissionLifecycleJournalBinding {
   runtimeKey: string;
   recoveryKey: string;
   journal: TelegramUpdateWorkerJournalPort & {
-    appendBatch: (updates: readonly TelegramJournaledUpdate[]) => unknown;
+    appendBatch: (
+      updates: readonly TelegramJournaledUpdate[],
+      acceptedThroughUpdateId?: number,
+    ) => unknown;
     applyOperatorDisposition?: (
       input: TelegramUpdateJournalOperatorDispositionInput,
     ) => TelegramUpdateJournalOperatorDispositionResult;
@@ -4303,7 +4307,10 @@ export interface TelegramUpdateAdmissionLifecycleRuntime<TContext>
   onSessionStart: (ctx: TContext) => Promise<void>;
   onSessionShutdown: () => Promise<void>;
   onTransportChanged: (ctx?: TContext) => Promise<void>;
-  appendBatch: (updates: readonly TelegramJournaledUpdate[]) => unknown;
+  appendBatch: (
+    updates: readonly TelegramJournaledUpdate[],
+    acceptedThroughUpdateId?: number,
+  ) => unknown;
   discardQueueReceipt: (input: {
     queueKind: "prompt" | "control";
     receiptId: string;
@@ -4603,11 +4610,11 @@ export function createTelegramUpdateAdmissionLifecycleRuntime<TContext>(
         await stopCurrent(true);
         if (ctx !== undefined) await bind(ctx);
       }),
-    appendBatch(updates) {
+    appendBatch(updates, acceptedThroughUpdateId) {
       if (!journal || !worker) {
         throw new Error("Telegram update admission worker is not active.");
       }
-      return journal.appendBatch(updates);
+      return journal.appendBatch(updates, acceptedThroughUpdateId);
     },
     discardQueueReceipt(input) {
       if (!journal || !worker || !journal.discardQueued) {

package/node_modules/@llblab/pi-telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.36.11",
+  "version": "0.37.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-kit",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -43,7 +43,7 @@
     "@llblab/pi-actors": "0.50.0",
     "@llblab/pi-codex-usage": "0.9.3",
     "@llblab/pi-grow-loop": "0.7.2",
-    "@llblab/pi-telegram": "0.36.11"
+    "@llblab/pi-telegram": "0.37.1"
   },
   "bundledDependencies": [
     "@llblab/pi-actors",