@llblab/pi-kit 0.30.1 → 0.31.1

package/node_modules/@llblab/pi-telegram/dist/lib/journal.js

@@ -10,7 +10,7 @@ import { chmodSync, closeSync, fstatSync, lstatSync, mkdirSync, opendirSync, ope
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { TELEGRAM_STRICT_READ_FLAGS, renameTelegramPathWithRetry, withTelegramFileTransaction, } from "./locks.js";
-import { decodeTelegramSessionDirectoryName, getTelegramProfilePathSuffix, TELEGRAM_DEFAULT_PROFILE_NAME, } from "./paths.js";
+import { decodeTelegramSessionDirectoryName, getTelegramProfilePathSuffix, resolveTelegramRuntimeDir, TELEGRAM_DEFAULT_PROFILE_NAME, } from "./paths.js";
 import { getTelegramProcessLiveness, } from "./process-identity.js";
 import { hasOnlyWireKeys as hasOnlyKeys, isNonEmptyWireString as isNonEmptyString, isWireRecord as isRecord, isNonNegativeWireInteger as isSafeNonNegativeInteger, } from "./wire.js";
 import { getTelegramWorkspaceAdmissionScopeKey, runWithTelegramWorkspaceAdmissions, } from "./workspace-admission.js";
@@ -2735,6 +2735,16 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
     };
     return runtime;
 }
+/**
+ * Journal-owned cross-family source serializer, lock-only and never authorization. Its guard lives
+ * in the runtime service directory, so journal work never touches `telegram.json` or its
+ * transaction. Acquire Workspace admission and any sender (config) admission first; never acquire
+ * owners inside it. Callbacks must be synchronous: a returned promise is unprotected after its
+ * synchronous prefix.
+ */
+export function createTelegramJournalSourceSerialization(getTransactionPath = () => join(resolveTelegramRuntimeDir(), "journals.transaction")) {
+    return (operation) => withTelegramFileTransaction(getTransactionPath(), operation);
+}
 export function createTelegramUpdateJournalStore(options) {
     return createJournalStoreCore(options).journal;
 }
@@ -3221,31 +3231,29 @@ function createJournalStoreCore(options, getInputContext) {
             return { file: reset, exists: true, serializedBytes };
         }
     };
+    const acquireSource = () => sourceAccess
+        ? acquireTelegramUpdateJournalFamily({
+            ...sourceAccess,
+            path,
+            profile,
+            botIdentity: expectedIdentity,
+        }, version)
+        : undefined;
+    const readAcquiredSource = (source) => {
+        const file = source.evidence.kind === "present" ? source.evidence.file : emptyFile();
+        return {
+            file,
+            exists: source.evidence.kind === "present",
+            serializedBytes: assertCapacity(file),
+            source,
+        };
+    };
     const runJournalTransaction = (operation) => {
         try {
             // Acquire before the transaction helper can create parents or staging names.
             // The config continuation excludes participating writers through consumption.
-            const source = sourceAccess
-                ? acquireTelegramUpdateJournalFamily({
-                    ...sourceAccess,
-                    path,
-                    profile,
-                    botIdentity: expectedIdentity,
-                }, version)
-                : undefined;
-            const readSource = () => {
-                if (!source)
-                    return readCurrent();
-                const file = source.evidence.kind === "present"
-                    ? source.evidence.file
-                    : emptyFile();
-                return {
-                    file,
-                    exists: source.evidence.kind === "present",
-                    serializedBytes: assertCapacity(file),
-                    source,
-                };
-            };
+            const source = acquireSource();
+            const readSource = () => source ? readAcquiredSource(source) : readCurrent();
             return withTelegramFileTransaction(`${path}.transaction`, () => operation(readSource));
         }
         catch (error) {
@@ -4091,16 +4099,31 @@ function createJournalStoreCore(options, getInputContext) {
         assertCurrent();
         return { issued, entries: result };
     });
+    const projectRead = (current) => ({
+        ...cloneFile(current.file),
+        exists: current.exists,
+        serializedBytes: current.serializedBytes,
+    });
     const journal = {
         read() {
-            return runMutation((readCurrent) => {
-                const current = readCurrent();
-                return {
-                    ...cloneFile(current.file),
-                    exists: current.exists,
-                    serializedBytes: current.serializedBytes,
-                };
-            });
+            // Atomic publication makes a repair-free read safe without serialization, so idle
+            // status and polling cursor reads create no guards. Any read that needs reconciliation,
+            // or races a compaction, falls back to the serialized path that owns repair.
+            const attempt = () => {
+                try {
+                    const source = acquireSource();
+                    return source ? readAcquiredSource(source) : readCurrentStrict(false);
+                }
+                catch {
+                    return undefined;
+                }
+            };
+            const current = options.withWriterAdmission
+                ? options.withWriterAdmission(attempt)
+                : attempt();
+            return current
+                ? projectRead(current)
+                : runMutation((readCurrent) => projectRead(readCurrent()));
         },
         appendBatch(updates, requestedAcceptedThroughUpdateId) {
             const canonicalUpdates = updates.map((update) => normalizeIncomingJournaledUpdate(update, path));
@@ -4206,18 +4229,20 @@ function createJournalStoreCore(options, getInputContext) {
                     serializedBytes: published.serializedBytes,
                 };
             });
+            // Sender admission is the outer config authority; journal serialization nests inside it.
+            const serializedAppend = (preApprovalExcluded) => withSourceSerialization
+                ? withSourceSerialization(() => appendWithEvidence(preApprovalExcluded))
+                : appendWithEvidence(preApprovalExcluded);
             const append = () => {
                 if (withPairedAdmission) {
-                    const result = withPairedAdmission(normalizedUpdates, () => appendWithEvidence());
+                    const result = withPairedAdmission(normalizedUpdates, () => serializedAppend());
                     if (!result.admitted)
                         throw createJournalError("sender-denied", path, "refused paired-only sender admission");
                     return result.value;
                 }
                 if (withPairingAdmission)
-                    return withPairingAdmission(appendWithEvidence);
-                return withSourceSerialization
-                    ? withSourceSerialization(() => appendWithEvidence())
-                    : appendWithEvidence();
+                    return withPairingAdmission(serializedAppend);
+                return serializedAppend();
             };
             const admittedAppend = () => {
                 if (!workspaceAdmission)

package/node_modules/@llblab/pi-telegram/dist/lib/locks.d.ts

@@ -8,6 +8,8 @@ export declare const TELEGRAM_LOCK_KEY = "default";
 export declare const TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS = 8000;
 export declare const TELEGRAM_OWNERSHIP_CHECK_MS = 1000;
 export declare const TELEGRAM_OWNERSHIP_REFRESH_MS = 2000;
+/** Consecutive unverified ownership checks tolerated before standing down; a concurrent shared-state replacement must not stop an owned transport. */
+export declare const TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE = 2;
 /**
  * Resolve the extension-local owner slot for the active Telegram profile.
  * Default profile → default
@@ -60,6 +62,8 @@ interface TelegramLockAcquireOptions {
     force?: boolean;
     expectedOwner?: TelegramLockEntry;
     election?: boolean;
+    /** Bus-proven unresponsive owner: treated as stale only while it is still exactly the current owner. */
+    unresponsiveOwner?: TelegramLockEntry;
 }
 type TelegramLockAcquireResult = {
     ok: true;
@@ -213,6 +217,8 @@ export interface TelegramOwnedStatePublicationOptions extends TelegramRuntimeSta
 export declare function mutateTelegramRuntimeStateSection<T>(path: string, profile: string, section: TelegramRuntimeStateSection, mutate: TelegramRuntimeStateSectionReducer<T>, options: TelegramRuntimeStatePublicationOptions): T;
 export declare function writeLocks(path: string, locks: Record<string, unknown>): void;
 export declare function parseTelegramLockEntry(value: unknown): TelegramLockEntry | undefined;
+/** Exact owner identity (pid, cwd, instance, leader epoch, runtime generation); absent entries never match. */
+export declare function isSameTelegramLockOwner(current: TelegramLockEntry | undefined, expected: TelegramLockEntry | undefined): boolean;
 export declare function createTelegramLockRuntime<TContext extends TelegramLockContext>(options?: TelegramLockRuntimeOptions): TelegramLockRuntime<TContext>;
 export declare function createTelegramLockOwnershipGuard<TContext extends TelegramLockContext>(lock: TelegramLockRuntime<TContext>): TelegramLockOwnershipGuard<TContext>;
 export declare function createTelegramDirectDeliveryOwnershipChecker<TContext extends TelegramLockContext>(deps: {
@@ -225,6 +231,7 @@ interface TelegramLockedPollingStartOptions {
     requestedThreadName?: string;
     election?: {
         expectedOwner?: TelegramLockEntry;
+        unresponsive?: boolean;
     };
     onAcquired?: () => Promise<void> | void;
 }
@@ -270,6 +277,8 @@ interface TelegramLockedPollingRuntimeDeps<TContext extends TelegramLockContext>
     registerFollowerWithOwner?: (ctx: TContext, owner: TelegramLockEntry) => boolean | undefined | Promise<boolean | undefined>;
     restoreFollowerWithOwner?: (ctx: TContext, owner: TelegramLockEntry) => boolean | undefined | Promise<boolean | undefined>;
     stopFollowerRegistration?: () => void;
+    /** Threaded Mode takeover evidence after failed follower registration; replaces the retired file heartbeat. */
+    proveOwnerUnresponsive?: (owner: TelegramLockEntry) => Promise<boolean>;
     onTransportAvailabilityChanged?: () => void;
     transportMonitor?: {
         start: (ctx: TContext) => void;

package/node_modules/@llblab/pi-telegram/dist/lib/locks.js

@@ -14,6 +14,8 @@ export const TELEGRAM_LOCK_KEY = "default";
 export const TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS = 8_000;
 export const TELEGRAM_OWNERSHIP_CHECK_MS = 1_000;
 export const TELEGRAM_OWNERSHIP_REFRESH_MS = 2_000;
+/** Consecutive unverified ownership checks tolerated before standing down; a concurrent shared-state replacement must not stop an owned transport. */
+export const TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE = 2;
 const TELEGRAM_LOCK_WRITE_RETRY_ATTEMPTS = 5;
 const TELEGRAM_LOCK_WRITE_RETRY_DELAY_MS = 25;
 const TELEGRAM_LOCK_TRANSACTION_ATTEMPTS = 80;
@@ -959,6 +961,10 @@ function hasSameLockOwner(current, expected) {
         current.leaderEpoch === expected.leaderEpoch &&
         current.runtimeGeneration === expected.runtimeGeneration);
 }
+/** Exact owner identity (pid, cwd, instance, leader epoch, runtime generation); absent entries never match. */
+export function isSameTelegramLockOwner(current, expected) {
+    return hasSameLockOwner(current, expected);
+}
 function canSupersedeSameProcessOwner(current, pid, ctx, instanceId, runtimeGeneration) {
     if (current.pid !== pid ||
         (current.cwd !== undefined && current.cwd !== ctx.cwd) ||
@@ -973,9 +979,7 @@ function createLockEntry(pid, ctx, options) {
     if (options.journalPath)
         lock.journalPath = options.journalPath;
     if (options.instanceId) {
-        const nowMs = options.getNowMs?.();
         lock.instanceId = options.instanceId;
-        lock.heartbeatMs = nowMs;
         lock.leaderEpoch = options.mintLeaderEpoch?.() ?? randomUUID();
         lock.runtimeGeneration = options.runtimeGeneration;
     }
@@ -1053,16 +1057,20 @@ export function createTelegramLockRuntime(options = {}) {
         if (!statePath)
             return readLocks(locksPath);
         // Read-only ownership queries fail closed (no owner); acquisition/publication still refuse malformed state.
-        try {
-            const transports = Object.fromEntries(Object.entries(readTelegramRuntimeState(statePath).profiles)
-                .filter(([, value]) => Object.hasOwn(value, "transport"))
-                .map(([profile, value]) => [profile, value.transport]));
-            assertTelegramStateTransport(transports[resolveEffectiveKey()]);
-            return transports;
-        }
-        catch {
-            return {};
+        // A strict read racing a concurrent atomic replace fails transiently, so retry before failing closed.
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            try {
+                const transports = Object.fromEntries(Object.entries(readTelegramRuntimeState(statePath).profiles)
+                    .filter(([, value]) => Object.hasOwn(value, "transport"))
+                    .map(([profile, value]) => [profile, value.transport]));
+                assertTelegramStateTransport(transports[resolveEffectiveKey()]);
+                return transports;
+            }
+            catch {
+                // Retry; a persistent failure falls through to no owner.
+            }
         }
+        return {};
     };
     const transactOwners = (mutate) => {
         if (!statePath)
@@ -1144,7 +1152,11 @@ export function createTelegramLockRuntime(options = {}) {
                     changed: false,
                 };
             const current = parseTelegramLockEntry(locks[effectiveKey]);
-            const state = getLockState(current, pid, isAlive, stateOptions());
+            const observedState = getLockState(current, pid, isAlive, stateOptions());
+            const state = observedState.kind === "active-elsewhere" &&
+                hasSameLockOwner(current, acquireOptions.unresponsiveOwner)
+                ? { kind: "stale", lock: observedState.lock }
+                : observedState;
             const expectedOwned = adoptCompatibleOwnedLock(effectiveKey, current, ctx);
             if (state.kind === "active-here" &&
                 hasSameLockOwner(current, expectedOwned) &&
@@ -1191,7 +1203,6 @@ export function createTelegramLockRuntime(options = {}) {
                 instanceId: options.instanceId,
                 busSocketPath: options.busSocketPath,
                 busSecret: options.busSecret,
-                getNowMs,
                 mintLeaderEpoch: options.mintLeaderEpoch,
                 runtimeGeneration,
             });
@@ -1299,9 +1310,36 @@ export function createTelegramLockRuntime(options = {}) {
                 };
             }, { ...publication, isCurrent });
         },
-        refresh: (ctx) => !deliveryRevoked &&
-            transactOwners((locks) => {
-                const effectiveKey = resolveEffectiveKey();
+        refresh: (ctx) => {
+            if (deliveryRevoked)
+                return false;
+            // Owner fields only, never a timestamp: liveness is proven over the bus, so an exact owner needs no write.
+            const refreshedEntry = (lock) => {
+                const busSecret = options.busSecret ?? lock.busSecret;
+                return {
+                    pid: lock.pid,
+                    ...(lock.cwd ? { cwd: lock.cwd } : {}),
+                    instanceId: options.instanceId,
+                    leaderEpoch: lock.leaderEpoch ?? options.mintLeaderEpoch?.() ?? randomUUID(),
+                    runtimeGeneration: lock.runtimeGeneration ?? runtimeGeneration,
+                    ...(options.busSocketPath
+                        ? { busSocketPath: options.busSocketPath }
+                        : {}),
+                    ...(busSecret !== undefined ? { busSecret } : {}),
+                    ...(lock.journalPath ? { journalPath: lock.journalPath } : {}),
+                };
+            };
+            // Parsed entries carry explicit `undefined` fields; compare only the published ones.
+            const isCurrentEntry = (lock) => lock.leaderEpoch !== undefined &&
+                isDeepStrictEqual(Object.fromEntries(Object.entries(lock).filter(([, value]) => value !== undefined)), refreshedEntry(lock));
+            const effectiveKey = resolveEffectiveKey();
+            const observed = readLock();
+            if (observed &&
+                hasSameLockOwner(observed, adoptCompatibleOwnedLock(effectiveKey, observed, ctx)) &&
+                (!options.instanceId || isCurrentEntry(observed))) {
+                return true;
+            }
+            return transactOwners((locks) => {
                 const lock = parseTelegramLockEntry(locks[effectiveKey]);
                 const expectedOwner = adoptCompatibleOwnedLock(effectiveKey, lock, ctx);
                 if (!lock || !hasSameLockOwner(lock, expectedOwner)) {
@@ -1313,24 +1351,15 @@ export function createTelegramLockRuntime(options = {}) {
                 }
                 if (!options.instanceId)
                     return { result: true, changed: false };
-                const refreshedLock = {
-                    pid: lock.pid,
-                    ...(lock.cwd ? { cwd: lock.cwd } : {}),
-                    instanceId: options.instanceId,
-                    heartbeatMs: getNowMs(),
-                    leaderEpoch: lock.leaderEpoch ?? options.mintLeaderEpoch?.() ?? randomUUID(),
-                    runtimeGeneration: lock.runtimeGeneration ?? runtimeGeneration,
-                    ...(options.busSocketPath
-                        ? { busSocketPath: options.busSocketPath }
-                        : {}),
-                    busSecret: options.busSecret ?? lock.busSecret,
-                    ...(lock.journalPath ? { journalPath: lock.journalPath } : {}),
-                };
+                if (isCurrentEntry(lock))
+                    return { result: true, changed: false };
+                const refreshedLock = refreshedEntry(lock);
                 locks[effectiveKey] = refreshedLock;
                 ownedLockKey = effectiveKey;
                 ownedLock = refreshedLock;
                 return { result: true, changed: true };
-            }),
+            });
+        },
     };
 }
 export function createTelegramLockOwnershipGuard(lock) {
@@ -1352,6 +1381,7 @@ export function createTelegramLockedPollingRuntime(deps) {
     let ownershipRefreshInterval;
     let ownershipStop;
     let activeContext;
+    let ownershipCheckFailures = 0;
     let takeoverCandidate;
     let sessionAutoStartRun;
     let pollingGeneration = 0;
@@ -1415,25 +1445,42 @@ export function createTelegramLockedPollingRuntime(deps) {
     const startOwnershipWatcher = (ctx) => {
         const owner = snapshotLockContext(ctx);
         stopOwnershipWatcher();
-        ownershipCheckInterval = setInterval(() => {
+        ownershipCheckFailures = 0;
+        // A serialized "not the owner" answer is definitive and stands down at once; only an observation that
+        // cannot be verified at all (both reads failed) counts toward the bounded tolerance.
+        const verifyOwnership = (observe) => {
+            let owned;
+            let failure;
             try {
-                if (deps.lock.owns(owner))
-                    return;
+                owned = observe();
             }
             catch (error) {
-                deps.recordRuntimeEvent?.("lock", error, { phase: "check" });
+                failure = error;
             }
-            stopAfterOwnershipLoss();
-        }, ownershipCheckMs);
-        ownershipRefreshInterval = setInterval(() => {
-            try {
-                if (deps.lock.refresh(owner))
-                    return;
+            if (owned === true) {
+                ownershipCheckFailures = 0;
+                return;
             }
-            catch (error) {
-                deps.recordRuntimeEvent?.("lock", error, { phase: "refresh" });
+            if (owned === false) {
+                deps.recordRuntimeEvent?.("lock", new Error("Telegram bridge ownership moved away from this instance."), { phase: "ownership-lost" });
+                stopAfterOwnershipLoss();
+                return;
             }
-            stopAfterOwnershipLoss();
+            ownershipCheckFailures += 1;
+            deps.recordRuntimeEvent?.("lock", failure, {
+                phase: "ownership-check-failed",
+                consecutiveFailures: ownershipCheckFailures,
+                tolerance: TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE,
+            });
+            if (ownershipCheckFailures > TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE)
+                stopAfterOwnershipLoss();
+        };
+        ownershipCheckInterval = setInterval(() => {
+            // A lock-free miss can be a strict read racing an atomic replace; refresh confirms through the serialized path.
+            verifyOwnership(() => deps.lock.owns(owner) || deps.lock.refresh(owner));
+        }, ownershipCheckMs);
+        ownershipRefreshInterval = setInterval(() => {
+            verifyOwnership(() => deps.lock.refresh(owner));
         }, ownershipRefreshMs);
         ownershipCheckInterval.unref?.();
         ownershipRefreshInterval.unref?.();
@@ -1551,6 +1598,9 @@ export function createTelegramLockedPollingRuntime(deps) {
                 expectedOwner: options.election?.expectedOwner ??
                     (options.force ? takeoverCandidate : undefined),
                 election: options.election !== undefined,
+                unresponsiveOwner: options.election?.unresponsive
+                    ? options.election.expectedOwner
+                    : undefined,
             });
             if (!acquired.ok && !options.election) {
                 const currentState = deps.lock.getState();
@@ -1593,22 +1643,33 @@ export function createTelegramLockedPollingRuntime(deps) {
                         });
                     }
                     if (failureMessage) {
-                        const owner = formatTelegramLockEntry(acquired.lock);
-                        return {
-                            ok: false,
-                            canTakeover: false,
-                            owner,
-                            message: `Telegram bridge is active in another Pi instance (${owner}); follower registration failed: ${formatTelegramFollowerRegistrationFailure(failureMessage)}.`,
-                        };
+                        const unresponsiveOwner = acquired.lock;
+                        if (deps.proveOwnerUnresponsive &&
+                            (await deps.proveOwnerUnresponsive(unresponsiveOwner))) {
+                            if (!isCurrent())
+                                return cancelled;
+                            acquired = deps.lock.acquire(ctx, { unresponsiveOwner });
+                        }
+                        if (!acquired.ok) {
+                            const owner = formatTelegramLockEntry(acquired.lock);
+                            return {
+                                ok: false,
+                                canTakeover: false,
+                                owner,
+                                message: `Telegram bridge is active in another Pi instance (${owner}); follower registration failed: ${formatTelegramFollowerRegistrationFailure(failureMessage)}.`,
+                            };
+                        }
                     }
                 }
-                const owner = formatTelegramLockEntry(acquired.lock);
-                return {
-                    ok: false,
-                    canTakeover: true,
-                    owner,
-                    message: `Telegram bridge is active in another Pi instance (${owner}).`,
-                };
+                if (!acquired.ok) {
+                    const owner = formatTelegramLockEntry(acquired.lock);
+                    return {
+                        ok: false,
+                        canTakeover: true,
+                        owner,
+                        message: `Telegram bridge is active in another Pi instance (${owner}).`,
+                    };
+                }
             }
             takeoverCandidate = undefined;
             if (!(await runOwnedPollingStart(ctx, options, isCurrent))) {

package/node_modules/@llblab/pi-telegram/dist/lib/routing.js

@@ -910,6 +910,8 @@ export const TELEGRAM_ALL_TAB_COMMAND_MAX_AGE_MS = 60 * 60_000;
 export const TELEGRAM_ROUTING_CHOICE_EXPIRED = "Routing choice expired";
 /** Every temporary routing tab carries this name, whether the bot created it or adopted Telegram's native tab. */
 const TELEGRAM_TEMPORARY_THREAD_NAME = "🚦 Routing";
+/** A mobile client's native tab creation precedes the All input it is named after by about a second. */
+const TELEGRAM_IMPLICIT_ALL_INPUT_WINDOW_SEC = 10;
 export function isTelegramAllTabCommandExpired(message, nowMs = Date.now()) {
     return (message.message_thread_id === undefined &&
         typeof message.date === "number" &&
@@ -6854,6 +6856,30 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         return undefined;
     };
+    /** A fresh implicit native tab whose name the All input starts with, observed just before it in the same exact scope. */
+    const findImplicitCreationForAllInput = (message, updateId, cap, ctx) => {
+        const text = (message.text ?? message.caption ?? "").trim();
+        let match;
+        for (const [key, implicit] of implicitThreadCreations) {
+            if (implicit.name &&
+                text.startsWith(implicit.name) &&
+                implicit.updateId < updateId &&
+                implicit.createdAtSec > 0 &&
+                message.date !== undefined &&
+                message.date >= implicit.createdAtSec &&
+                message.date - implicit.createdAtSec <=
+                    TELEGRAM_IMPLICIT_ALL_INPUT_WINDOW_SEC &&
+                implicit.ctx === ctx &&
+                implicit.operatorUserId === cap.operatorUserId &&
+                implicit.journalBindingKey === cap.journalBindingKey &&
+                isDeepStrictEqual(implicit.executor, cap.authority.executor) &&
+                implicit.generation === deps.getSessionGeneration?.() &&
+                implicit.scope === deps.getAdmissionScope?.() &&
+                (!match || implicit.updateId > match.implicit.updateId))
+                match = { key, implicit };
+        }
+        return match;
+    };
     /**
      * An All input gets one source-bound tab. The original stays deferred in All until explicit routing,
      * and an existing entry is reused on replay, so restart never creates a second tab or retries an unknown one.
@@ -6893,6 +6919,34 @@ export function createTelegramInboundRouteRuntime(deps) {
                 entry = found;
                 return;
             }
+            // Mobile clients sending from All first create a native tab named after the input, then deliver
+            // the input itself to All: adopt that tab rather than leaving it behind next to a second one.
+            const native = findImplicitCreationForAllInput(message, updateId, cap, ctx);
+            if (native) {
+                const adopted = store.registerImplicitTemporaryThread({ journalBindingKey, updateIds: [updateId] }, native.implicit.target, randomBytes(16).toString("hex"), {
+                    ...authority,
+                    isCurrent: () => current() &&
+                        implicitThreadCreations.get(native.key) === native.implicit,
+                });
+                if (adopted && current()) {
+                    implicitThreadCreations.delete(native.key);
+                    entry = adopted;
+                    // Adopted native tabs share the routing name; a failed rename never blocks routing.
+                    try {
+                        await deps.callApi("editForumTopic", {
+                            chat_id: native.implicit.target.chatId,
+                            message_thread_id: native.implicit.target.threadId,
+                            name: TELEGRAM_TEMPORARY_THREAD_NAME,
+                        });
+                    }
+                    catch (error) {
+                        deps.recordRuntimeEvent?.("routing", error, {
+                            phase: "temporary-thread-name",
+                        });
+                    }
+                    return;
+                }
+            }
             const reservation = store.reserveTemporaryThread(source, randomBytes(16).toString("hex"), authority);
             entry = reservation?.entry;
             if (!reservation?.reserved || !current())
@@ -7253,6 +7307,12 @@ export function createTelegramInboundRouteRuntime(deps) {
                 executor: structuredClone(cap.authority.executor),
                 generation: deps.getSessionGeneration?.(),
                 scope: deps.getAdmissionScope?.(),
+                target: {
+                    chatId: lifecycle.target.chatId,
+                    threadId: lifecycle.target.threadId,
+                },
+                name: "name" in created && typeof created.name === "string" ? created.name : "",
+                createdAtSec: message.date ?? 0,
             });
         }
         else

package/node_modules/@llblab/pi-telegram/dist/lib/status.js

@@ -433,16 +433,36 @@ export function createTelegramRuntimeProjectionStore(options) {
             if (!isRuntimeProjection({ ...semantic, writtenAtMs: 0 }))
                 throw new Error("Telegram runtime projection is malformed.");
             delete semantic.diagnostics.recentRuntimeEvents;
+            // Poll-cycle timestamps change on every response; live status renders them from memory,
+            // so persisting them would rewrite state.json each poll for no reader.
+            const polling = semantic.runtime.polling;
+            if (polling && typeof polling === "object" && !Array.isArray(polling)) {
+                const volatile = polling;
+                delete volatile.phaseStartedAtMs;
+                delete volatile.lastSuccessfulResponseAtMs;
+                delete volatile.lastSuccessfulResponseUpdateCount;
+            }
             const isCurrent = () => getPath() === path && getProfile() === profile && authority() === true;
+            const isUnchanged = (current) => {
+                if (!isRuntimeProjection(current))
+                    return false;
+                const { writtenAtMs: _writtenAtMs, ...existing } = current;
+                return isDeepStrictEqual(existing, semantic);
+            };
             const publication = publicationQueue.then(() => {
                 if (!isCurrent())
                     return false;
+                // Observational state needs no transaction when the published projection already matches.
+                try {
+                    if (isUnchanged(read({ path, profile })))
+                        return false;
+                }
+                catch {
+                    // An unreadable envelope stays with the transactional publisher's fail-closed path.
+                }
                 return (publish({ path, profile }, (current) => {
-                    if (isRuntimeProjection(current)) {
-                        const { writtenAtMs: _writtenAtMs, ...existing } = current;
-                        if (isDeepStrictEqual(existing, semantic))
-                            return { value: current, changed: false };
-                    }
+                    if (isUnchanged(current))
+                        return { value: current, changed: false };
                     const writtenAtMs = getNowMs();
                     if (!Number.isSafeInteger(writtenAtMs) || writtenAtMs < 0)
                         throw new Error("Telegram runtime projection timestamp is invalid.");

package/node_modules/@llblab/pi-telegram/dist/lib/sync.js

@@ -140,6 +140,7 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
         assertCurrent();
         const currentRecord = deps.getCurrentThreadRecord();
         let cleanupPending = false;
+        let followerThreadKept = false;
         if (currentRecord?.target.threadId) {
             const isManualFollower = currentRecord.owner?.kind === "manual-follower";
             const leaderEpoch = deps.getCurrentLeaderEpoch?.();
@@ -150,9 +151,8 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
                 if (deps.disconnectFollowerThread) {
                     const disconnected = await deps.disconnectFollowerThread();
                     assertCurrent();
-                    if (!disconnected) {
-                        throw new Error("Telegram follower thread deletion requires a live leader registration.");
-                    }
+                    // Without a live leader the Thread cannot be deleted; still stop locally and never claim deletion.
+                    followerThreadKept = !disconnected;
                 }
             }
             else {
@@ -223,6 +223,8 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
         }
         assertCurrent();
         const stopped = await deps.stopPolling();
+        if (followerThreadKept)
+            return "Telegram bridge disconnected. Thread kept: no live leader could delete it.";
         return cleanupPending
             ? `${stopped} Telegram thread cleanup remains pending for the next leader.`
             : stopped;

package/node_modules/@llblab/pi-telegram/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.53.1",
+  "version": "0.54.3",
   "private": false,
   "publishConfig": {
     "access": "public"