@llblab/pi-kit 0.30.0 → 0.31.0

package/BACKLOG.md

@@ -1,9 +1,10 @@
 # Backlog
 
-The 0.30.0 composition advances Telegram to 0.53.0; package pins, resource order and bundled runtime ownership remain authoritative in `package.json`. Release outcomes belong in [CHANGELOG.md](./CHANGELOG.md).
+The 0.31.0 composition advances Telegram to 0.54.2; package pins, resource order and bundled runtime ownership remain authoritative in `package.json`. Release outcomes belong in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Carried checks
 
+- **Installed 0.31.0 Telegram smoke (operator-owned):** After separately authorized installation/reload of every Pi process together (bus protocol v3), confirm an idle leader makes no periodic `state.json` or `telegram.json.transaction` writes, a frozen leader is replaced by its follower, and switching Threaded Mode off takes followers offline. Packed validation does not certify running clients.
 - **Installed 0.30.0 Telegram smoke (operator-owned):** After separately authorized installation/reload, confirm live Restore/rebinding in both roles, immediate temporary-tab removal after Cancel and, on Windows, Restore and follower delivery with disposable runtime storage. Packed validation does not certify running clients.
 - **Installed 0.29.2 continuity/recovery smoke (operator-owned):** After separately authorized installation/reload, use disposable sessions/storage to confirm idle Stop followed by native compaction preserves the summary and tool results through Passive reload/resume, without replaying effects. Confirm Telegram outage recovery and unconfirmed-disconnect reporting on a disposable setup. Packed validation does not certify running clients or authorize live fault injection.
 - **Installed 0.29.1 State Flow smoke (operator-owned):** After separately authorized installation/reload, use disposable storage to confirm new diagnostics use `tmp/pi-state-flow`, old `tmp/state-flow` logs and canonical memory stay untouched, and selected Telegram modes show 🟣 Off, 🟡 Passive and 🟢 Active. Packed validation does not certify installed clients.

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.31.0: Telegram Idle Runtime And Bus Liveness
+
+- `Telegram 0.54`: Advances the exact Telegram pin to `0.54.2`. Idle connected sessions make no periodic disk writes: the update journal no longer borrows the `telegram.json` lock and the leader proves liveness over the bus instead of a two-second `state.json` heartbeat. Bus protocol v3 requires updating every Pi process together.
+- `Telegram fixes`: Followers go offline instead of looping when Threaded Mode is switched off, unverifiable ownership checks are recorded and tolerated before standing down, and cancelled Generative App methods cannot leave processes behind. Other pins, package membership, resources and load order are unchanged.
+
+## 0.30.1: Telegram Text Reply Diagnostics
+
+- `Telegram Voice Artifacts`: Advances the exact Telegram pin to `0.53.1`. Plain text replies no longer record a false "every voice synthesis provider failed" delivery error when a reply carries no voice content; genuine voice failures still fall back to text. Other pins, package membership, resources and load order are unchanged.
+
 ## 0.30.0: Telegram Live Rebinding and Windows Support
 
 - `Telegram Live Rebinding`: Advances the exact Telegram pin to `0.53.0`. Restore moves a held prompt or supported command to another Pi through one same-session save/apply/release channel with bounded old-Thread cleanup. Temporary routing tabs are named 🚦 Routing, Cancel removes the tab and any All copy right away, and a restart revives a still-waiting chooser. Toasts are plain text and navigation answers silently.

package/README.md

@@ -18,7 +18,7 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.12.1` | Shared Codex quota/Business credit status and persistent priority Fast toggle, mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.26.4` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.53.0` | Telegram companion with live Thread rebinding, temporary routing tabs, Workspace Restore, follower Threads, Windows support, files, voice, and controls |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.54.2` | Telegram companion with live Thread rebinding, temporary routing tabs, Workspace Restore, follower Threads, Windows support, files, voice, and controls |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.
@@ -45,7 +45,7 @@ Prefer the kit instead of separately loading the same packages. If you already u
 
 ## Development
 
-The `0.30.0` composition advances Telegram to `0.53.0`: same-session live Thread rebinding for prompts and supported commands, temporary routing tabs that disappear right after Cancel, and full Windows support for Restore, live rebinding and cleanup through the same strict journal reads. State Flow stays at `0.26.4`; all other pins, resources and load order remain unchanged. Telegram runtime storage stays in `tmp/pi-telegram`. Drain the prompt queue or accept losing waiting work before reload/restart; damaged-state reset discards all profiles' runtime continuity. `npm run validate` checks exact installed pins, declared resources, dependency audit and bundled inventory. It does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
+The `0.31.0` composition advances Telegram to `0.54.2`: an idle connected session no longer writes to disk periodically (the update journal has its own lock instead of the `telegram.json` guard, the leader proves liveness over the bus instead of a two-second `state.json` heartbeat), followers go offline instead of looping when Threaded Mode is switched off, unverifiable ownership checks are recorded and tolerated, and cancelled Generative App methods cannot leave processes behind. Telegram 0.54 uses bus protocol v3: update every Pi process that runs pi-telegram together, because a 0.53.x follower cannot register with a 0.54 leader. State Flow stays at `0.26.4`; all other pins, resources and load order remain unchanged. Telegram runtime storage stays in `tmp/pi-telegram`. Drain the prompt queue or accept losing waiting work before reload/restart; damaged-state reset discards all profiles' runtime continuity. `npm run validate` checks exact installed pins, declared resources, dependency audit and bundled inventory. It does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
 
 ```bash
 npm install

package/node_modules/@llblab/pi-telegram/AGENTS.md

@@ -76,7 +76,7 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 - Runtime files live under `<agent-dir>/tmp/pi-telegram` (releases before 0.52.0 used `tmp/telegram`, which a new release never writes, migrates or deletes). The older `owners.json` is read-only evidence: a live fresh owner there blocks acquisition so two release generations never poll one bot, and only its identity is exposed, never its bus endpoint or secret. Only `state.json` and `logs.jsonl` are persistent root files: the per-profile `transport` section of `state.json` is the sole transport-owner authority, `workspace` owns canonical Workspace/Restore evidence and `admission` its leases; the `runtime` section and `logs.jsonl` never grant routing authority. Each section changes only through the shared transaction under its own domain authority (nonleader admission remains process/birth-owned, not transport-owned); Workspace/runtime publication captures exact session authority, and acquisition, refresh, release, takeover, and irreversible leader work fence the exact owner/epoch. Ordinary reads and section mutations still refuse a damaged shared envelope without repair. Only a non-election leader start (`/telegram-connect` or session auto-start) runs the operator-approved optimistic reset: under the shared transaction guard it replaces damaged envelope/transport/Workspace/admission evidence with an empty envelope, accepting loss of every profile's runtime continuity; filesystem access errors still refuse (see [Damaged-State Reset](./docs/architecture.md#damaged-state-reset-operator-approved)). Use the [session journal contract](./docs/multi-instance-bus.md#session-owned-journal-storage) for owners-named polling continuity and the explicitly approved optimistic session-family sweep; that sweep is not Thread deletion or receipt settlement.
 - Threaded Mode has exactly one live leader per bot profile. Followers are real operator-started Pi processes and must authenticate/register over local IPC; Telegram never spawns hidden Pi processes. A live but unreachable owner does not authorize split-brain polling.
 - Local IPC is a trust boundary, not merely a private socket. Unknown, stale, mismatched-generation, or unauthorized requests must not inject prompts, callbacks, API sends, artifacts, liveness, or bindings. Follower registration identity may prepare a binding, but inbound generation authority is published only after successful preparation for the same generation and current context; pending or failed startup cannot append into a retained old journal. Readiness also binds the active Pi context and supplied session generation. Same-session refresh awaits binding preparation without re-registering; a changed session ID cannot publish readiness until its exact leader registration is acknowledged. Reusing a context object cannot carry readiness across a session-generation or ID change. Registration requests capture session authority before asynchronous startup and fence every publication/finalization against the current attempt. Stop or supersession invalidates that attempt; obsolete cleanup cannot erase a newer registration or a refreshed context.
-- Protocol compatibility is independent from package version. Registration negotiates protocol version, runtime build, and canonical capabilities before target provisioning or live publication. `durable-follower-admission-v1` gates source forwarding; `queue-handoff-v1` independently gates semantic queue transfer for every participant and is advertised only with exact source/recipient journal-binding composition. `follower.register` and capability-gated restore-only `follower.restoreWorkspace` are bootstrap requests; other requests require exact live-registry generation authority, and `bus.ack` is response-only. `thread-display-mode-v1` gates follower display-setting requests; the leader owns their serialized profile preference and title application.
+- Protocol compatibility is independent from package version. Registration negotiates protocol version, runtime build, and canonical capabilities before target provisioning or live publication. `durable-follower-admission-v1` gates source forwarding; `queue-handoff-v1` independently gates semantic queue transfer for every participant and is advertised only with exact source/recipient journal-binding composition. `follower.register`, capability-gated restore-only `follower.restoreWorkspace` and side-effect-free liveness `bus.probe` are bootstrap requests; other requests require exact live-registry generation authority, and `bus.ack` is response-only. `thread-display-mode-v1` gates follower display-setting requests; the leader owns their serialized profile preference and title application.
 - Long-lived timers, pollers, watchers, receivers, heartbeats, background delivery, and deferred dispatch are session-bound. Shutdown cancels/drains diagnostics publications and fences deferred status reads before they can acquire guards or repair files. Replacement stops stale activity and makes late work inert; teardown must recheck the captured session generation even when context identity is reused. Same-process handoff may preserve exact profile/target identity but never stale Pi context or cross-profile authority. Follower heartbeat and leader-to-follower Restore/live-rebind control reply deadlines align with the eight-second leader stale-liveness window rather than the generic one-second local-RPC default; an ordinary multi-second Pi/TUI event-loop stall or a slower Windows named pipe is not registration or recipient loss. Participating source observations must hold a reference for the actual read, including pending-mutation/count queries against a stopped worker's retained source; a scoped observation never restores receipt readiness or execution authority. A donor cancellation resumed after remote handoff awaits must also hold a source reference; only the existing exact journal CAS may cancel, never undo accepted recipient custody. Stable source keys do not certify captured callable lifetimes: snapshot prepared worker capabilities at construction and replace them on source-handle renewal without replaying unsettled input. Aborting a durable update generation does not release that `update_id`: replacement replay waits for its actual handler settlement, and effectful handlers use the shared execution fence immediately before commit and after awaited delegation. Admission also rechecks that fence after the default handler returns, before its outcome can settle custody; a stopped handler's ordinary return is not completion authority. Internal clones explicitly carry the hidden fence; reroute forwarding, thread-store mutation, cleanup, and Bot API boundaries retain the originating generation.
 - Runtime state is event-driven reconciliation of local assumptions against Telegram signals, not a complete bot read-model and not permission to query Telegram on every action. Destructive thread cleanup goes through `thread-reconciler` with current proof and leader fencing. Fresh Workspace Thread creation derives its initial Bot API title from the active display mode before issuance; the stable generated `threadName` remains separate from the acknowledged `displayTitle`.
 

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -4,6 +4,30 @@
 
 ## Unreleased
 
+## 0.54.2: Diagnosable ownership checks and safe app cancellation
+
+- `Ownership checks`: An ownership check that cannot be verified no longer silently stops a live transport. Each such miss is recorded (`ownership-check-failed`) and polling stands down only after two consecutive tolerated misses; a confirmed loss is recorded as `ownership-lost` and stands down at once (#319).
+- `Generative Apps`: A cancelled app method can no longer start a process: an abort that arrives before the method calls `run` previously let the worker spawn a child that its own termination could orphan.
+
+## 0.54.1: Followers go offline when Threaded Mode is turned off
+
+- `Threaded Mode downgrade`: Turning Threaded Mode off in BotFather now takes followers offline instead of looping between `electing` and `disconnected` (and filling the log) against a leader that switched to classic polling; reconnect with `/telegram-connect` after turning it back on. `/telegram-disconnect` on a follower without a live leader now disconnects locally and reports the Thread as kept, and a pending recovery retry no longer re-registers a disconnected follower.
+- `Ownership reads`: A lock-free ownership check that races a concurrent `state.json` replacement is now retried and confirmed through the serialized path before the leader stops polling, so a transient read miss (seen on slow Windows runners) is no longer mistaken for lost ownership. The integration test for a revoked follower provisioning now waits for its asynchronous lease release.
+
+## 0.54.0: No periodic disk writes while idle
+
+- `Journal serialization`: The update journal no longer borrows the `telegram.json` lock. Journal operations serialize on their own `tmp/pi-telegram/runtime/journals.transaction`, so receiving messages and repairing journals never touch the config file or its guard; only config writes and sender admission still take it. Bus protocol moves to v3 so 0.53.x peers, which serialize on the old lock, cannot register alongside 0.54 writers.
+- `Idle status writes`: The persisted runtime status no longer stores poll-cycle timestamps, so an idle connected session stops rewriting `state.json` after every long-poll response.
+- `Leader liveness`: The leader no longer rewrites `state.json` every two seconds. A dead PID is taken over at once; a live but frozen Threaded Mode leader is replaced only after an authenticated `bus.probe` proves it unresponsive, bound to that exact owner. Classic mode never takes over a live PID silently: `/telegram-connect` asks first. An idle connected session now makes no periodic disk writes.
+
+## 0.53.2: Idle runtime without lock churn
+
+- `Idle disk load`: Polling-cursor and status reads of the update journal no longer open config and journal transactions, so a connected idle session stops creating `telegram.json.transaction.staged.*` and `inbox.json.transaction.staged.*` guard folders; only reads that need repair take the serialized path. Unchanged runtime status snapshots are compared before locking and skip their `state.json` transaction.
+
+## 0.53.1: Text replies without false voice errors
+
+- `Voice artifacts`: A reply plan without voice content no longer reaches outbound voice artifact delivery, so plain text replies stop recording "every voice synthesis provider failed" delivery errors; explicit `telegram_voice` markup and genuine synthesis failures keep their existing fallback behavior (#318).
+
 ## 0.53.0: Live Thread rebinding, routing tabs and Windows support
 
 - `Live-rebind state`: Atomic same-session Workspace binding/operation publication, fenced recipient application and bounded one-shot cleanup scheduling. Failed/unknown cleanup keeps the new binding without blocking the next attempt; chooser retirement keeps saved inputs. Shared-state retries recheck captured authority before every rename, so a revoked grant cannot overwrite retained state.

package/node_modules/@llblab/pi-telegram/dist/lib/bus-follower.d.ts

@@ -179,6 +179,8 @@ export declare function createTelegramManualFollowerProfileKeyResolver(input: {
 }): () => string;
 export interface TelegramBusFollowerElection {
     expectedOwner?: TelegramLockEntry;
+    /** The expected owner is bus-proven unresponsive; the lock CAS still requires it to be the current owner. */
+    unresponsive?: boolean;
 }
 export type TelegramBusFollowerPromotionHandler<TContext> = (ctx: TContext, binding: TelegramBusFollowerPromotedBinding, election: TelegramBusFollowerElection) => Promise<boolean>;
 type TelegramBusFollowerWorkspaceAdmissionDeps = {
@@ -227,6 +229,10 @@ export interface TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext> {
     scheduleRetry?: (retry: () => void, delayMs: number) => void;
     getActiveContext?: () => TContext | undefined;
     promotionGraceMs?: number;
+    /** Bus liveness proof for a live-PID leader that no longer answers; replaces the retired file heartbeat. */
+    proveLeaderUnresponsive?: (owner: TelegramLockEntry) => Promise<boolean>;
+    /** Shared bot state says Threaded Mode is off: followers cannot exist, so recovery goes offline instead. */
+    isThreadModeDisabled?: () => boolean | Promise<boolean>;
     recordRuntimeEvent: (category: string, error: unknown, details?: Record<string, unknown>) => void;
 }
 export interface TelegramBusForwardedUpdateReceiverRuntimeDeps<TContext> {
@@ -415,7 +421,12 @@ export declare function createTelegramBusFollowerControlState(): TelegramBusFoll
 export declare function createTelegramBusFollowerRegistrationState(options?: {
     onAvailabilityChanged?: () => void;
 }): TelegramBusFollowerRegistrationState;
-export declare function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(deps: TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext>): (error: unknown, ctx: TContext) => Promise<void>;
+/** Heartbeat-failure recovery that a deliberate local stop halts until the next deliberate registration. */
+export type TelegramBusFollowerHeartbeatRecoveryHandler<TContext> = ((error: unknown, ctx: TContext) => Promise<void>) & {
+    halt: () => void;
+    resume: () => void;
+};
+export declare function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(deps: TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext>): TelegramBusFollowerHeartbeatRecoveryHandler<TContext>;
 export declare function createTelegramBusFollowerRegistrationRuntime<TContext extends {
     cwd?: string;
 }>(deps: TelegramBusFollowerRegistrationRuntimeDeps<TContext>): TelegramBusFollowerRegistrationRuntime<TContext>;

package/node_modules/@llblab/pi-telegram/dist/lib/bus-follower.js

@@ -190,7 +190,7 @@ export function createTelegramBusFollowerRuntimeAssembly(ports) {
         ...ports.recovery,
         registrationState: ports.registrationState,
         recordRuntimeEvent: ports.recordRuntimeEvent,
-        getRegistrationRuntime: () => registration,
+        getRegistrationRuntime: () => baseRegistration,
     });
     registration = createTelegramBusFollowerRegistrationRuntime({
         ...ports.registration,
@@ -203,6 +203,15 @@ export function createTelegramBusFollowerRuntimeAssembly(ports) {
     const baseRegistration = registration;
     registration = {
         ...baseRegistration,
+        // Public stop is deliberate (disconnect, suspension); recovery keeps the base stop for promotion.
+        stop() {
+            recovery.halt();
+            baseRegistration.stop();
+        },
+        registerWithLeader(ctx, leader, options) {
+            recovery.resume();
+            return baseRegistration.registerWithLeader(ctx, leader, options);
+        },
         async setContext(ctx) {
             const sessionGeneration = ports.registration.getSessionGeneration?.();
             if (ports.registration.isContextActive?.(ctx) === false)
@@ -1214,6 +1223,9 @@ export function createTelegramBusFollowerRegistrationState(options = {}) {
     };
 }
 export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
+    // Promotion stops registration internally and must keep retrying; only an operator stop or a confirmed
+    // switch to classic mode halts recovery, so it never re-registers behind a disconnect.
+    let halted = false;
     const promotionGraceMs = deps.promotionGraceMs ?? TELEGRAM_BUS_FOLLOWER_PROMOTION_GRACE_MS;
     const sleep = deps.sleep ??
         ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -1246,6 +1258,10 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
                 .registerWithLeader(ctx, leader, binding?.target ? { target: binding.target } : undefined);
             if (!restored)
                 return false;
+            if (halted) {
+                deps.getRegistrationRuntime().stop();
+                return false;
+            }
             deps.setLifecyclePhase(undefined);
             safeUpdateStatus(ctx);
             deps.recordRuntimeEvent("bus", "Telegram follower registration restored", {
@@ -1266,6 +1282,8 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
     });
     const scheduleRecovery = (reason, fallbackCtx, binding) => {
         const retry = () => {
+            if (halted)
+                return;
             const activeCtx = deps.getActiveContext
                 ? deps.getActiveContext()
                 : fallbackCtx;
@@ -1336,12 +1354,29 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
         });
     };
     const recover = async (error, ctx, carriedBinding) => {
-        if (promotionPending)
+        if (promotionPending || halted)
             return;
         promotionPending = true;
         deps.registrationState.beginRecovery();
         const initialBinding = carriedBinding ?? snapshotBinding();
         try {
+            let threadModeDisabled = false;
+            try {
+                threadModeDisabled = (await deps.isThreadModeDisabled?.()) === true;
+            }
+            catch (stateError) {
+                deps.recordRuntimeEvent("bus", stateError, {
+                    phase: "follower-thread-mode-read",
+                });
+            }
+            if (threadModeDisabled) {
+                halted = true;
+                deps.getRegistrationRuntime().stop();
+                deps.setLifecyclePhase(undefined);
+                safeUpdateStatus(ctx);
+                deps.recordRuntimeEvent("bus", "Telegram follower went offline: Threaded Mode is off. Run /telegram-connect after turning it back on.", { phase: "follower-thread-mode-disabled" });
+                return;
+            }
             const state = deps.getLeaderState();
             if (state.kind === "active-elsewhere") {
                 clearRegisteredState(ctx);
@@ -1357,6 +1392,13 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
                     if (await tryRegisterWithLeader(ctx, graceState.lock, "follower-register-restore-grace", initialBinding)) {
                         return;
                     }
+                    if (await deps.proveLeaderUnresponsive?.(graceState.lock)) {
+                        await promoteToLeader(error, ctx, initialBinding, {
+                            expectedOwner: graceState.lock,
+                            unresponsive: true,
+                        });
+                        return;
+                    }
                     deps.setLifecyclePhase(undefined);
                     safeUpdateStatus(ctx);
                     deps.recordRuntimeEvent("bus", "Telegram follower promotion blocked by live leader lease", {
@@ -1390,7 +1432,14 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
             promotionPending = false;
         }
     };
-    return recover;
+    return Object.assign(recover, {
+        halt() {
+            halted = true;
+        },
+        resume() {
+            halted = false;
+        },
+    });
 }
 export function createTelegramBusFollowerRegistrationRuntime(deps) {
     const getNowMs = deps.getNowMs ?? Date.now;

package/node_modules/@llblab/pi-telegram/dist/lib/bus-leader.js

@@ -2184,6 +2184,14 @@ export function createTelegramBusLeaderEnvelopeHandler(deps) {
             return createUnauthorizedBusAck(envelope.requestId);
         }
         switch (envelope.kind) {
+            case "bus.probe":
+                // Liveness only: no registry, routing, journal or Bot API effect.
+                return {
+                    kind: "bus.ack",
+                    requestId: envelope.requestId,
+                    ok: true,
+                    protocol: deps.protocolIdentity,
+                };
             case "follower.register":
             case "follower.restoreWorkspace": {
                 const compatibility = getTelegramBusProtocolCompatibility({

package/node_modules/@llblab/pi-telegram/dist/lib/bus.d.ts

@@ -6,6 +6,7 @@
  */
 import { type TelegramBusEndpointLayout, type TelegramBusTransportEventRecorder, type TelegramBusTransportRetryPolicy } from "./bus-transport.ts";
 import type { TelegramThreadDisplayMode } from "./config.ts";
+import { type TelegramLockEntry, type TelegramLockState } from "./locks.ts";
 import { type TelegramQueueHandoffPayload } from "./queue.ts";
 import { type TelegramTarget } from "./target.ts";
 import { type TelegramSessionReplacementIntent } from "./threads.ts";
@@ -525,6 +526,10 @@ export type TelegramBusEnvelope = ({
     method: string;
     args: unknown[];
     sentAtMs: number;
+} | {
+    /** Side-effect-free leader liveness probe; any acknowledgement proves a responsive event loop. */
+    kind: "bus.probe";
+    requestId: string;
 } | {
     kind: "bus.ack";
     requestId: string;
@@ -558,6 +563,36 @@ export declare function createTelegramBusRequestId(input: {
 export declare function createTelegramBusRequestIdFactory(instanceId: string): () => string;
 export declare function encodeTelegramBusEnvelope(envelope: TelegramBusEnvelope): string;
 export declare function parseTelegramBusEnvelope(line: string): TelegramBusEnvelope | undefined;
+/**
+ * One leader liveness observation. `silent` (connected or connecting, no answer within the window) and
+ * `unreachable` (an endpoint that refuses connections: nobody listens) can support a takeover. A missing endpoint is
+ * `unknown`: a live classic-mode leader has no socket at all. Any bytes or an orderly close prove the peer's event
+ * loop handled the connection, so even an older leader rejecting the unknown kind is `responsive`.
+ */
+export type TelegramBusLeaderProbeResult = "responsive" | "silent" | "unreachable" | "unknown";
+export declare function probeTelegramBusLeader(input: {
+    socketPath: TelegramBusSocketPathSource;
+    secret?: string;
+    timeoutMs?: number;
+}): Promise<TelegramBusLeaderProbeResult>;
+/**
+ * Takeover evidence replacing the retired file heartbeat: a full silent window, or an unreachable endpoint
+ * confirmed again after one more window (a just-started leader binds its socket well within it). The owner must
+ * stay the same throughout; the lock acquisition then CAS-checks that exact owner.
+ */
+export declare function proveTelegramBusLeaderUnresponsive(input: {
+    probe: () => Promise<TelegramBusLeaderProbeResult>;
+    isSameOwner: () => boolean;
+    sleep: (ms: number) => Promise<void>;
+    windowMs?: number;
+}): Promise<boolean>;
+/** Composition-ready takeover proof for one profile's leader lock and endpoint. */
+export declare function createTelegramBusLeaderUnresponsivenessProof(deps: {
+    getLeaderState: () => TelegramLockState;
+    getLeaderSocketPath: () => string;
+    probe?: typeof probeTelegramBusLeader;
+    sleep?: (ms: number) => Promise<void>;
+}): (owner: TelegramLockEntry) => Promise<boolean>;
 interface TelegramBusLocalServer {
     start: () => Promise<void>;
     stop: () => Promise<void>;

package/node_modules/@llblab/pi-telegram/dist/lib/bus.js

@@ -12,7 +12,7 @@ import { platform as getPlatform, tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { classifyTelegramBusTransportError, createTelegramBusTransportTimeoutError, delayTelegramBusTransportRetry, getTelegramBusEndpointDiagnostics, getTelegramBusFollowerEndpoint, getTelegramBusLeaderEndpoint, getTelegramBusPipePath, getTelegramBusTransportRetryPolicy, isRetryableTelegramBusTransportError, isTelegramBusPipePath, probeTelegramBusEndpoint, TELEGRAM_BUS_MAX_DIRECT_UNIX_ENDPOINT_BYTES, } from "./bus-transport.js";
-import { TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS } from "./locks.js";
+import { isSameTelegramLockOwner, TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS, } from "./locks.js";
 import { resolveAgentDir } from "./paths.js";
 import { getTelegramProcessBirthIdentity } from "./process-identity.js";
 import { parseTelegramQueueHandoffPayload, TELEGRAM_QUEUE_HANDOFF_PAYLOAD_MAX_BYTES, } from "./queue.js";
@@ -46,7 +46,8 @@ export function createTelegramBusProcessRuntime(input) {
 export function createTelegramBusAuthSecret() {
     return randomBytes(32).toString("base64url");
 }
-const TELEGRAM_BUS_PROTOCOL_VERSION = 2;
+// v3: journal source serialization left the config transaction; mixed v2/v3 peers would not exclude each other.
+const TELEGRAM_BUS_PROTOCOL_VERSION = 3;
 export const TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION = "durable-follower-admission-v1";
 export const TELEGRAM_BUS_CAPABILITY_QUEUE_HANDOFF = "queue-handoff-v1";
 export const TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE = "input-custody-reference-v1";
@@ -466,7 +467,8 @@ export function createTelegramBusFollowerSourceReferenceDeliveryIdentity(input)
 }
 export function getTelegramBusEnvelopeTrafficClass(envelope) {
     if (envelope.kind === "follower.register" ||
-        envelope.kind === "follower.restoreWorkspace")
+        envelope.kind === "follower.restoreWorkspace" ||
+        envelope.kind === "bus.probe")
         return "bootstrap";
     if (envelope.kind === "bus.ack")
         return "response";
@@ -718,6 +720,9 @@ export function parseTelegramBusEnvelope(line) {
         case "follower.callApi":
             envelope = parseCallApiEnvelope(value, requestId);
             break;
+        case "bus.probe":
+            envelope = { kind, requestId };
+            break;
         case "bus.ack":
             envelope = parseAckEnvelope(value, requestId);
             break;
@@ -729,6 +734,79 @@ export function parseTelegramBusEnvelope(line) {
         envelope.auth = auth;
     return envelope;
 }
+export function probeTelegramBusLeader(input) {
+    const timeoutMs = input.timeoutMs ?? TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS;
+    return new Promise((resolve) => {
+        let settled = false;
+        let socket;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket?.destroy();
+            resolve(result);
+        };
+        const timer = setTimeout(() => finish("silent"), timeoutMs);
+        let connected = false;
+        try {
+            socket = createConnection(resolveTelegramBusSocketPath(input.socketPath));
+        }
+        catch {
+            finish("unknown");
+            return;
+        }
+        socket.once("connect", () => {
+            connected = true;
+            socket.write(encodeTelegramBusEnvelope({
+                kind: "bus.probe",
+                requestId: `probe:${randomBytes(8).toString("hex")}`,
+                ...(input.secret ? { auth: input.secret } : {}),
+            }));
+        });
+        socket.once("data", () => finish("responsive"));
+        socket.once("end", () => finish("responsive"));
+        socket.once("error", (error) => {
+            const code = error.code;
+            finish(!connected && code === "ECONNREFUSED" ? "unreachable" : "unknown");
+        });
+    });
+}
+/**
+ * Takeover evidence replacing the retired file heartbeat: a full silent window, or an unreachable endpoint
+ * confirmed again after one more window (a just-started leader binds its socket well within it). The owner must
+ * stay the same throughout; the lock acquisition then CAS-checks that exact owner.
+ */
+export async function proveTelegramBusLeaderUnresponsive(input) {
+    const first = await input.probe();
+    if (first === "silent")
+        return input.isSameOwner();
+    if (first !== "unreachable")
+        return false;
+    await input.sleep(input.windowMs ?? TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS);
+    if (!input.isSameOwner())
+        return false;
+    const second = await input.probe();
+    return (second === "silent" || second === "unreachable") && input.isSameOwner();
+}
+/** Composition-ready takeover proof for one profile's leader lock and endpoint. */
+export function createTelegramBusLeaderUnresponsivenessProof(deps) {
+    const probe = deps.probe ?? probeTelegramBusLeader;
+    const sleep = deps.sleep ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    return (owner) => proveTelegramBusLeaderUnresponsive({
+        probe: () => probe({
+            socketPath: owner.busSocketPath ?? deps.getLeaderSocketPath(),
+            secret: owner.busSecret,
+        }),
+        isSameOwner: () => {
+            const state = deps.getLeaderState();
+            return (state.kind === "active-elsewhere" &&
+                isSameTelegramLockOwner(state.lock, owner));
+        },
+        sleep,
+    });
+}
 const TELEGRAM_ACTIVE_LOCAL_SERVERS = Symbol.for("@llblab/pi-telegram/active-local-servers");
 function getActiveTelegramBusLocalServers() {
     const root = globalThis;

package/node_modules/@llblab/pi-telegram/dist/lib/config.d.ts

@@ -116,12 +116,6 @@ export interface TelegramConfigStore {
     setAllowedUserId: (userId: number) => void;
     /** Publish an unpaired profile owner atomically; true only for the resulting exact owner. */
     persistAllowedUserId: (userId: number, assertExecutionCurrent?: () => void, commitIfOwned?: (commit: () => void) => boolean) => Promise<boolean>;
-    /** Lock-only serialization for trusted synchronous source operations, not authorization.
-     * Does not read/adopt config. Acquire required Workspace admission first; never
-     * acquire owners or nest config admission here. Do not pass async callbacks:
-     * returned promises are not protected after their synchronous prefix.
-     */
-    withSourceSerialization: <T>(operation: () => T) => T;
     /** Trusted synchronous publication only; caller acquires Workspace admission before this config transaction. */
     withPairingAdmission: <T>(profileName: string, tokenSha256: string, publish: (preApprovalExcluded: boolean) => T) => T;
     /** Observe an existing exact owner and refresh an unpaired cache; never create an owner. Callback must be synchronous. */

package/node_modules/@llblab/pi-telegram/dist/lib/config.js

@@ -449,7 +449,6 @@ export function createTelegramConfigStore(options = {}) {
             nextConfig.allowedUserId = userId;
             setEffectiveConfig(nextConfig);
         },
-        withSourceSerialization: (operation) => withTelegramFileTransaction(`${configPath}.transaction`, operation),
         withPairingAdmission: (profileName, tokenSha256, publish) => withPersistedPairingProfile(profileName, tokenSha256, (_latest, profile) => publish(profile.allowedUserId === undefined)),
         withPairedUserAdmission: (profileName, tokenSha256, userId, publish, assertExecutionCurrent) => {
             if (!Number.isSafeInteger(userId) || userId <= 0)

package/node_modules/@llblab/pi-telegram/dist/lib/extension.js

@@ -142,12 +142,13 @@ export default function (pi) {
         },
         getProfileName: configStore.getActiveProfileName,
     });
+    const withTelegramJournalSourceSerialization = Journal.createTelegramJournalSourceSerialization();
     const telegramJournalBindingRuntime = Journal.createTelegramUpdateJournalBindingRuntime({
         base: {
             getProfileName: configStore.getActiveProfileName,
             getBotToken: configStore.getBotToken,
             getBotId: getTelegramBotId,
-            withSourceSerialization: configStore.withSourceSerialization,
+            withSourceSerialization: withTelegramJournalSourceSerialization,
             onRecovery(event) {
                 recordRuntimeEvent("recovery", event.kind === "repaired"
                     ? "Telegram update journal was repaired automatically."
@@ -199,6 +200,10 @@ export default function (pi) {
             return telegramLeaderJournalPath.createJournalPath();
         },
     });
+    const proveTelegramLeaderUnresponsive = Bus.createTelegramBusLeaderUnresponsivenessProof({
+        getLeaderState: lockRuntime.getState,
+        getLeaderSocketPath: getTelegramBusSocketPath,
+    });
     const telegramSessionContextStore = Lifecycle.createTelegramSessionContextStore({
         getIdentity(ctx) {
             return ctx.sessionManager ?? ctx.cwd;
@@ -1069,7 +1074,7 @@ export default function (pi) {
                 botToken,
                 botId: getTelegramBotId(),
             });
-            return configStore.withSourceSerialization(function () {
+            return withTelegramJournalSourceSerialization(function () {
                 return Journal.isTelegramThreadCleanupJournalNamespaceClear({
                     directory: Paths.resolveTelegramTempDir(),
                     profile,
@@ -1554,6 +1559,11 @@ export default function (pi) {
         },
         recovery: {
             getLeaderState: lockRuntime.getState,
+            proveLeaderUnresponsive: proveTelegramLeaderUnresponsive,
+            async isThreadModeDisabled() {
+                await threadStore.refresh?.();
+                return threadStore.getBotState().threadMode === "disabled";
+            },
             setLifecyclePhase: telegramBusFollowerControlState.setLifecyclePhase,
             updateStatus,
             promoteToLeader: promoteTelegramBusFollowerToLeader,
@@ -1860,6 +1870,7 @@ export default function (pi) {
     const threadAwarePollingPorts = telegramThreadCapabilityRuntime.pollingPorts;
     const lockedPollingRuntime = Locks.createTelegramLockedPollingRuntime({
         lock: lockRuntime,
+        proveOwnerUnresponsive: proveTelegramLeaderUnresponsive,
         resetDamagedState() {
             return Locks.resetDamagedTelegramRuntimeState(Paths.resolveTelegramStatePath(), function (profile, sections) {
                 Threads.parseTelegramWorkspaceStateSection(sections.workspace, profile);

package/node_modules/@llblab/pi-telegram/dist/lib/generative-app-worker.mjs

@@ -22,6 +22,11 @@ parentPort.on("message", (message) => {
 });
 
 function runBoundedProcess(input) {
+  // After an abort the parent may terminate this worker before execFile's own abort kill runs, which
+  // would orphan a freshly spawned child; never start a process once cancelled.
+  if (controller.signal.aborted) {
+    return Promise.reject(new Error("Generative App method was cancelled."));
+  }
   if (!input || typeof input !== "object") {
     throw new Error("Generative App run input must be an object.");
   }

package/node_modules/@llblab/pi-telegram/dist/lib/journal.d.ts

@@ -860,6 +860,14 @@ export declare function createTelegramUpdateJournalBindingRuntime(deps: {
     getActiveFollowerSessionId?: () => string | undefined;
     isFollowerRegistered: () => boolean;
 }): TelegramUpdateJournalBindingRuntime;
+/**
+ * Journal-owned cross-family source serializer, lock-only and never authorization. Its guard lives
+ * in the runtime service directory, so journal work never touches `telegram.json` or its
+ * transaction. Acquire Workspace admission and any sender (config) admission first; never acquire
+ * owners inside it. Callbacks must be synchronous: a returned promise is unprotected after its
+ * synchronous prefix.
+ */
+export declare function createTelegramJournalSourceSerialization(getTransactionPath?: () => string): <T>(operation: () => T) => T;
 export declare function createTelegramUpdateJournalStore(options: TelegramUpdateJournalStoreOptions): TelegramUpdateJournalStore;
 /** Opt-in v3 only; does not migrate old files or expose legacy unowned mutation ports. */
 export declare function createTelegramInputJournalStore(options: TelegramInputJournalStoreOptions): TelegramInputJournalStore;