@llblab/pi-kit 0.31.2 → 0.33.0

package/BACKLOG.md

@@ -1,6 +1,6 @@
 # Backlog
 
-The 0.31.2 composition advances Telegram to 0.54.4; package pins, resource order and bundled runtime ownership remain authoritative in `package.json`. Release outcomes belong in [CHANGELOG.md](./CHANGELOG.md).
+The 0.33.0 composition advances Telegram to 0.55.0; package pins, resource order and bundled runtime ownership remain authoritative in `package.json`. Release outcomes belong in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Carried checks
 

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.33.0: Telegram Native Restore and Lifecycle Fences
+
+- `Telegram 0.55`: Advances the exact Telegram pin to `0.55.0`. Native Restore confirms its new binding and decides old-tab cleanup before retained input runs. All is input-only; preview, typing and reconnect reject stale lifecycle work. Exact Linux/macOS home displays as Home/home without changing routing identity. Compatible Restore capabilities are negotiated separately from bus protocol v3. Other pins, package membership, resources and load order are unchanged.
+
+## 0.32.0: OpenAI Subscription Quota Support
+
+- `OpenAI Subscription Support`: Advances Codex Usage to `0.13.0`. ChatGPT subscription OAuth under `openai` now fetches Codex quotas without the legacy `openai-codex` provider; ordinary API-key auth is skipped. Both providers support terminal and Telegram status plus `/fast`, with preferences isolated by provider/model. Other pins, package membership, resources and load order are unchanged.
+
 ## 0.31.2: Telegram Restore Flow
 
 - `Telegram Restore Flow`: Advances the exact Telegram pin to `0.54.4`. Restoring a Pi into a routing tab renames the tab to that Pi's Thread title and keeps the prompt it answers, since an input sent from `All` now moves into its routing tab on desktop and mobile alike. Routing menus disappear after every final choice, every client ends with one routing tab per `All` input, and the old tab is removed right after Pi answers. Other pins, package membership, resources and load order are unchanged.

package/README.md

@@ -15,10 +15,10 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.54.0` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
 | [`@llblab/pi-claude-usage`](https://github.com/llblab/pi-claude-usage) | `0.2.1` | Claude subscription quota status and shared per-model Fast toggle for Opus, mirrored in Telegram |
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.3.0` | Isolated nested Pi TUI with named npm extensions and compatible model selection |
-| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.12.1` | Shared Codex quota/Business credit status and persistent priority Fast toggle, mirrored in Telegram |
+| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.0` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.26.4` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.54.4` | Telegram companion with live Thread rebinding, temporary routing tabs, Workspace Restore, follower Threads, Windows support, files, voice, and controls |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.55.0` | Telegram companion with native pre-dispatch Restore, input-only All, fenced previews/typing/reconnect, follower Threads, Windows support, files, voice, and controls |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.
@@ -45,7 +45,9 @@ Prefer the kit instead of separately loading the same packages. If you already u
 
 ## Development
 
-The `0.31.2` composition carries Telegram `0.54.4`, which moves an `All` input into its routing tab, renames a restored tab to its Pi's Thread title, keeps routing menus one-shot and removes the old tab right after Pi answers, and `0.54.3`, which keeps mobile Telegram to one routing tab per `All` input, on top of `0.54.2`: an idle connected session no longer writes to disk periodically (the update journal has its own lock instead of the `telegram.json` guard, the leader proves liveness over the bus instead of a two-second `state.json` heartbeat), followers go offline instead of looping when Threaded Mode is switched off, unverifiable ownership checks are recorded and tolerated, and cancelled Generative App methods cannot leave processes behind. Telegram 0.54 uses bus protocol v3: update every Pi process that runs pi-telegram together, because a 0.53.x follower cannot register with a 0.54 leader. State Flow stays at `0.26.4`; all other pins, resources and load order remain unchanged. Telegram runtime storage stays in `tmp/pi-telegram`. Drain the prompt queue or accept losing waiting work before reload/restart; damaged-state reset discards all profiles' runtime continuity. `npm run validate` checks exact installed pins, declared resources, dependency audit and bundled inventory. It does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
+The `0.33.0` composition advances Telegram to `0.55.0`: native Restore confirms the new binding, decides old-tab cleanup, then releases retained input through its original prompt, command or template owner. Threaded Mode `All` is input-only; text, voice, files and albums enter routing Threads without output fallback to All. Preview, typing and reconnect lifecycles reject stale context/generation work, and exact Linux/macOS home directories display as Home/home. Classic DM remains supported. Other pins, resource paths and load order are unchanged.
+
+Telegram keeps bus protocol v3: update every Pi process that runs pi-telegram together; 0.53.x followers cannot register with current leaders. Pre-dispatch Restore additionally negotiates compatible reader and execution capabilities; older supported paths remain distinct. Runtime storage stays in `tmp/pi-telegram`. Drain the prompt queue or accept losing waiting work before reload/restart; damaged-state reset discards all profiles' runtime continuity. `npm run validate` checks exact installed pins, declared resources, dependency audit and bundled inventory. It does not certify installed-client rendering; carried checks remain in [Backlog](./BACKLOG.md).
 
 ```bash
 npm install

package/node_modules/@llblab/pi-codex-usage/AGENTS.md

@@ -5,7 +5,8 @@
 - `Domain DAG`: `index.ts` only re-exports the extension and public contracts; `lib/extension.ts` composes the Pi extension. `lib/usage-store.ts` owns persistence/leadership, `lib/query.ts` owns quota I/O, `lib/usage.ts` owns normalized reports, `lib/status.ts` and `lib/status-format.ts` own local UI orchestration and formatting, `lib/telegram.ts` owns optional registration, and `lib/fast.ts` owns Codex Fast semantics/request adaptation. `@llblab/pi-command-fast` owns command arbitration and generic JSONC override editing. Keep dependency direction acyclic; do not import `index.ts` from `lib/` or mix Fast persistence into quota coordination. Place domain tests in `tests/<domain>.test.ts` (or a domain-prefixed focused integration test); use independent names such as `invariants.test.ts` only for cross-domain invariants.
 - `Statusline-first scope`: Own usage state + usage mode: keep quota reporting zero-configuration and the optional Fast toggle focused on the existing terminal status.
   - Trigger: Considering new commands, menus, persisted settings, or notification output.
-  - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, the optional `pi-telegram` `/start` status-line mirror, or the existing argument-free `/fast` command. Register the `openai-codex` provider handler through `registerFastProvider` on session_start and release on session_shutdown; never register `/fast` directly or filter Fast by model ID/auth. Fast persists solely as `serviceTier: "priority"` in the current model override; OFF deletes only that property. Preserve JSONC/unrelated settings, existing wire tiers, and usage refresh/Telegram. Apply lowercase ` fast` through the final terminal boundary; the optional Telegram row reads the active model's Fast preference at render time and appends plain-text ` fast` (or shows `fast` alone without quota). Toggle redraws without quota fetch or success notification. The library owns session WeakMap/reload arbitration, not Fast state. A Fast config read failure must not block usage status.
+  - Action: Prefer deleting the surface unless it is required for the optimistic TUI status widget, the optional `pi-telegram` `/start` status-line mirror, or the existing argument-free `/fast` command. Register both `openai-codex` and `openai` provider handlers through `registerFastProvider` on session_start and release both on session_shutdown; never register `/fast` directly or filter Fast by model ID/auth. Fast persists solely as `serviceTier: "priority"` in the current provider/model override (never share preferences across providers with the same model ID); OFF deletes only that property. Preserve JSONC/unrelated settings, existing wire tiers, and usage refresh/Telegram. Apply lowercase ` fast` through the final terminal boundary; the optional Telegram row reads the active model's Fast preference at render time and appends plain-text ` fast` (or shows `fast` alone without quota). Toggle redraws without quota fetch or success notification. The library owns session WeakMap/reload arbitration, not Fast state. A Fast config read failure must not block usage status.
+- `OpenAI provider support`: Show the same Codex subscription quota for active `openai-codex` and `openai` models. Quota transport accepts `openai` subscription OAuth (guarded by `modelRegistry.isUsingOAuth`) and legacy `openai-codex` auth, with the Codex CLI fallback; never send `openai` API-key credentials to the ChatGPT quota endpoint or label Codex quotas as API billing limits.
 - `Optimistic refresh`: Preserve the last good statusline bar during refresh and transient failures.
   - Trigger: Updating quota polling or error handling.
   - Action: Do not collapse the bar while a request is in flight; only show `n/a` or `error` after repeated failures or no usable quota.

package/node_modules/@llblab/pi-codex-usage/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.13.0: OpenAI Subscription Provider Support
+
+- Added `openai` alongside `openai-codex` for `/fast`, request priority adaptation, terminal status and the optional Telegram row. Fast preferences remain isolated by provider/model, including identical model IDs. Both providers share the existing Codex subscription quota stream. Pi subscription OAuth under `openai` now fetches quota directly without requiring the legacy provider; `openai` API-key auth is skipped and the Codex CLI fallback is preserved.
+
 ## 0.12.1: Telegram Fast Status
 
 - The optional Telegram status row now appends lowercase ` fast` for the active Codex model, or shows `fast` alone when quota is unavailable. It rereads the per-model preference at menu render time, so toggles, model changes and manual edits do not wait for quota refresh. Quota polling, auth, request adaptation and terminal behavior are unchanged; isolated tests cover enabled/disabled state, model/provider changes and unreadable configuration.

package/node_modules/@llblab/pi-codex-usage/README.md

@@ -19,16 +19,16 @@ This repository is a minimal fork of [`narumiruna/pi-extensions/extensions/pi-co
 - Shows two counter-moving half-height markers in the statusline bar while Codex usage is loading, then keeps the bar fresh (the countdown ticks locally)
 - Keeps the last usable bar visible during ordinary refreshes instead of replacing known quota with a loading state
 - Statusline output adapts to the response: weekly-only limits show an explicit remaining percentage and reset countdown, while dual-window limits keep the compact themed bar
-- All Codex subscription models share the primary `codex` quota and status label
-- When `pi-telegram` is available, the same compact value appears as `codex: <value>` in the `/start` menu status text for active OpenAI Codex subscription models
+- Models under either `openai-codex` or `openai` show the same primary Codex subscription quota and `codex` status label (not OpenAI API billing limits)
+- When `pi-telegram` is available, the same compact value appears as `codex: <value>` in the `/start` menu status text for either supported provider
 - Additional returned quota buckets are ignored
-- Pi OpenAI Codex provider auth is used first
+- Pi subscription auth from `openai` or legacy `openai-codex` is used first
 - Codex CLI app-server remains available as a fallback
 - Missing auth, subscription, plan, or quota windows are shown as `n/a`, not as an error
 - Successful updates briefly redraw the bar only when a 5% segment changes
 - Network/provider failures keep the last good bar (up to an hour), then show `error`
 - Any number of Pi instances share one request stream, see [Shared Refresh](#shared-refresh)
-- Quota display requires no configuration; `/fast` optionally toggles priority service for the active native Codex model
+- Quota display requires no configuration; `/fast` optionally toggles priority service for the active `openai-codex` or `openai` model
 
 ## Install
 
@@ -59,7 +59,7 @@ For explicitly local library experiments, a temporary folder link reads the libr
 
 ## Fast mode
 
-`/fast` takes no arguments and dispatches by the current **provider**, not model names or OAuth eligibility. For any `openai-codex` model, it stores only `serviceTier: "priority"` in Pi's canonical `models.json` (honoring `PI_CODING_AGENT_DIR`):
+`/fast` takes no arguments and dispatches by the current **provider**, not model names or OAuth eligibility. For any `openai-codex` or `openai` model, it stores only `serviceTier: "priority"` in Pi's canonical `models.json` (honoring `PI_CODING_AGENT_DIR`):
 
 ```json
 {
@@ -73,6 +73,8 @@ For explicitly local library experiments, a temporary folder link reads the libr
 }
 ```
 
+For an `openai` model, the same override goes under `providers.openai.modelOverrides`. Preferences are isolated by provider and model ID, so identical IDs in the two providers do not share Fast state.
+
 OFF removes only `serviceTier`; it never writes `"default"`. JSONC comments and unrelated configuration survive. There is no separate Fast config or model allowlist. State follows provider/model selection and survives restart; manual edits are read on lifecycle refresh and each request.
 
 When this and Claude Usage are loaded, their shared library registers **one** `/fast`, in either load order, even with separate physical dependency copies. A session-scoped WeakMap avoids cross-session dispatch; shutdown releases registrations for reload (Pi retains the session manager). Unrelated providers receive a concise unsupported-provider message. Invalid arguments show `Usage: /fast`; success is silent.
@@ -155,22 +157,22 @@ Coordination assumes a local filesystem and cooperating instances on the same ma
 
 ## Telegram Status Menu
 
-If `@llblab/pi-telegram` is loaded with the public status-line provider API, this extension registers an optional `/start` menu status row. The row is shown only while the active model uses the OpenAI Codex subscription provider:
+If `@llblab/pi-telegram` is loaded with the public status-line provider API, this extension registers an optional `/start` menu status row. The row is shown only while the active model uses `openai-codex` or `openai`:
 
 ```text
 codex: ██████▀▀▀▀ 6d
 ```
 
-The value is the same compact quota bar plus weekly reset countdown used by the terminal statusline, always with the `codex` label. When Fast is enabled for the active model, it appends plain-text ` fast`; without a usable quota report it shows `codex: fast`. The preference is reread when the menu is rendered, so toggles and model changes do not depend on a quota refresh. If `pi-telegram` is absent, older, or the active model is not a Codex subscription model, no Telegram row is added.
+The value is the same compact quota bar plus weekly reset countdown used by the terminal statusline, always with the `codex` label. When Fast is enabled for the active model, it appends plain-text ` fast`; without a usable quota report it shows `codex: fast`. The preference is reread when the menu is rendered, so toggles and model changes do not depend on a quota refresh. If `pi-telegram` is absent, older, or the active model uses another provider, no Telegram row is added.
 
 ## Auth
 
 The extension tries usage sources in this order:
 
-1. Pi's `openai-codex` provider auth
+1. Pi's subscription auth from `openai` or legacy `openai-codex` (active model first)
 2. `codex app-server --listen stdio://`
 
-OpenAI API keys are not ChatGPT Codex subscription auth and do not expose these quotas.
+Selecting an `openai` model enables the status and Fast toggle, and its ChatGPT subscription OAuth credentials can fetch the quota directly; a legacy `openai-codex` provider is not required. The extension uses Pi's resolved auth headers/token, checks `modelRegistry.isUsingOAuth` before using `openai` credentials, and keeps the Codex CLI fallback. OpenAI API keys are not ChatGPT subscription auth and do not expose these quotas; `openai` API-key credentials are skipped, not sent to the ChatGPT quota endpoint. Without subscription auth/quota, the quota status is `n/a` when both sources report an unavailable state. Fast works independently of subscription auth.
 
 ## License
 

package/node_modules/@llblab/pi-codex-usage/lib/extension.ts

@@ -3,23 +3,26 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerFastProvider } from "@llblab/pi-command-fast";
 import { applyFastToRequest, isFastEnabled, isFastEligibleModel, toggleFast } from "./fast.ts";
 import { createCodexUsageStatus } from "./status.ts";
+import { OPENAI_USAGE_PROVIDERS } from "./usage.ts";
 
 export default function codexUsage(pi: ExtensionAPI) {
-  let releaseFast: (() => void) | undefined;
+  let releaseFast: Array<() => void> = [];
   pi.on("session_start", (_event, ctx) => {
-    releaseFast = registerFastProvider(pi, ctx, {
-      provider: "openai-codex",
-      toggle(commandCtx) {
-        toggleFast(commandCtx.model!.id);
-        status.fastChanged(commandCtx, commandCtx.model!);
-      },
-    });
+    for (const provider of OPENAI_USAGE_PROVIDERS) {
+      releaseFast.push(registerFastProvider(pi, ctx, {
+        provider,
+        toggle(commandCtx) {
+          toggleFast(commandCtx.model!);
+          status.fastChanged(commandCtx, commandCtx.model!);
+        },
+      }));
+    }
   });
-  pi.on("session_shutdown", () => { releaseFast?.(); releaseFast = undefined; });
+  pi.on("session_shutdown", () => { releaseFast.forEach((release) => release()); releaseFast = []; });
   const status = createCodexUsageStatus(pi);
   pi.on("before_provider_request", (event, ctx) => {
     const model = ctx.model;
     if (!isFastEligibleModel(model)) return;
-    return applyFastToRequest(event.payload, model.id, isFastEnabled(model.id));
+    return applyFastToRequest(event.payload, model.id, isFastEnabled(model));
   });
 }

package/node_modules/@llblab/pi-codex-usage/lib/fast.ts

@@ -3,16 +3,17 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { isModelOverrideValue, toggleModelOverrideValue } from "@llblab/pi-command-fast";
 import { isOpenAICodexModel } from "./usage.ts";
 
-const target = (id: string) => ({ provider: "openai-codex", id, property: "serviceTier", enabledValue: "priority" });
+type FastModel = Pick<NonNullable<ExtensionContext["model"]>, "provider" | "id">;
+const target = (model: FastModel) => ({ provider: model.provider, id: model.id, property: "serviceTier", enabledValue: "priority" });
 
 export function isFastEligibleModel(model: ExtensionContext["model"]): model is NonNullable<ExtensionContext["model"]> {
   return !!model && isOpenAICodexModel(model);
 }
-export function isFastEnabled(modelId: string, path?: string): boolean {
-  return isModelOverrideValue(target(modelId), path);
+export function isFastEnabled(model: FastModel, path?: string): boolean {
+  return isModelOverrideValue(target(model), path);
 }
-export function toggleFast(modelId: string, path?: string): boolean {
-  return toggleModelOverrideValue(target(modelId), path);
+export function toggleFast(model: FastModel, path?: string): boolean {
+  return toggleModelOverrideValue(target(model), path);
 }
 
 export function applyFastToRequest(payload: unknown, modelId: string, enabled: boolean): unknown {

package/node_modules/@llblab/pi-codex-usage/lib/query.ts

@@ -2,8 +2,7 @@
 import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { assertObject, errorMessage, normalizeAppServerResponse, normalizeBackendPayload, parseJsonObject, selectUsageSnapshot, type AppServerRateLimitResponse, type CodexUsageModel, type CodexUsageReport, type RateLimitStatusPayload, type UsageQueryError } from "./usage.ts";
-const CODEX_PROVIDER_ID = "openai-codex";
+import { assertObject, errorMessage, isOpenAICodexModel, normalizeAppServerResponse, normalizeBackendPayload, parseJsonObject, selectUsageSnapshot, type AppServerRateLimitResponse, type CodexUsageModel, type CodexUsageReport, type RateLimitStatusPayload, type UsageQueryError } from "./usage.ts";
 const CODEX_USAGE_LIMIT_ID = "codex";
 const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
 const MAX_ERROR_BODY_CHARS = 600;
@@ -64,7 +63,7 @@ async function queryViaPiAuth(
   const auth = await resolvePiCodexAuth(ctx);
   if (!auth) {
     throw new Error(
-      "No Pi OpenAI Codex subscription auth was available. Use a Pi OpenAI Codex model or run /login for OpenAI ChatGPT Plus/Pro (Codex).",
+      "No Pi OpenAI Codex subscription auth was available. Use an openai or openai-codex subscription model or run /login for OpenAI ChatGPT.",
     );
   }
 
@@ -96,6 +95,7 @@ async function resolvePiCodexAuth(
   const errors: string[] = [];
 
   for (const model of models) {
+    if (model.provider === "openai" && !ctx.modelRegistry.isUsingOAuth(model)) continue;
     const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
     if (!auth.ok) {
       errors.push(auth.error);
@@ -127,7 +127,7 @@ function codexAuthCandidateModels(ctx: ExtensionContext): PiModel[] {
   const candidates: PiModel[] = [];
   const seen = new Set<string>();
   const add = (model: PiModel | undefined) => {
-    if (!model || model.provider !== CODEX_PROVIDER_ID) return;
+    if (!model || !isOpenAICodexModel(model)) return;
     const key = `${model.provider}/${model.id}`;
     if (seen.has(key)) return;
     seen.add(key);

package/node_modules/@llblab/pi-codex-usage/lib/status.ts

@@ -41,20 +41,20 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
   let statuslineRequestId = 0;
   let unregisterTelegramStatusLine: (() => void) | undefined;
   let telegramStatusLineRegistration: Promise<void> | undefined;
-  let fastModelId: string | undefined;
+  let fastModel: PiModel | undefined;
   let fastEnabled = false;
   let lastStatusText: string | undefined;
   let loadingModel: CodexUsageModel | undefined;
 
-  const syncFast = (model: PiModel | undefined, ctx: ExtensionContext) => {
-    fastModelId = isFastEligibleModel(model) ? model.id : undefined;
-    fastEnabled = fastModelId !== undefined && isFastEnabled(fastModelId);
+  const syncFast = (model: PiModel | undefined) => {
+    fastModel = isFastEligibleModel(model) ? model : undefined;
+    fastEnabled = fastModel !== undefined && isFastEnabled(fastModel);
   };
   const setCodexStatus = (ctx: ExtensionContext, text: string | undefined, model?: CodexUsageModel) => {
     lastStatusText = text;
     ctx.ui.setStatus(STATUS_KEY, text === undefined ? undefined : appendFastStatus(
       ctx, text,
-      fastEnabled && model?.id === fastModelId,
+      fastEnabled && model?.provider === fastModel?.provider && model?.id === fastModel?.id,
     ));
   };
 
@@ -95,7 +95,7 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
     ctx: ExtensionContext,
     model: CodexUsageModel | undefined,
   ) => {
-    const modelChanged = loadingModel?.id !== model?.id;
+    const modelChanged = loadingModel?.provider !== model?.provider || loadingModel?.id !== model?.id;
     loadingModel = model;
     if (statuslineLoadingTimer) {
       if (modelChanged && lastStatusText !== undefined) setCodexStatus(ctx, lastStatusText, model);
@@ -331,7 +331,7 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
     try {
       const activeModel = model ?? ctx.model;
       const previousFast = fastEnabled;
-      syncFast(activeModel, ctx);
+      syncFast(activeModel);
       forceRender ||= previousFast !== fastEnabled;
       if (!isOpenAICodexModel(activeModel)) {
         clearUsageStatusline(ctx);
@@ -370,7 +370,7 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
   ensureTelegramStatusLineRegistered();
 
   pi.on("session_start", (_event, ctx) => {
-    syncFast(ctx.model, ctx);
+    syncFast(ctx.model);
     ensureTelegramStatusLineRegistered();
     if (isOpenAICodexModel(ctx.model))
       void refreshCurrentCodexUsageStatusline(ctx, true).catch(
@@ -388,7 +388,7 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
   });
 
   pi.on("model_select", (event, ctx) => {
-    syncFast(event.model, ctx);
+    syncFast(event.model);
     if (isOpenAICodexModel(event.model)) {
       void refreshCurrentCodexUsageStatusline(ctx, true, event.model).catch(
         handleAsyncTimerError,
@@ -405,7 +405,7 @@ export function createCodexUsageStatus(pi: ExtensionAPI) {
   });
   return {
     fastChanged(ctx: ExtensionContext, model: PiModel) {
-      syncFast(model, ctx);
+      syncFast(model);
       if (lastStatusText !== undefined) setCodexStatus(ctx, lastStatusText, model);
       renderState(ctx, loadState(), model, true);
     },

package/node_modules/@llblab/pi-codex-usage/lib/telegram.ts

@@ -29,7 +29,7 @@ export function codexUsageTelegramStatusLine(
 ): TelegramStatusLineProviderResult {
   if (!activeModel || !isOpenAICodexModel(activeModel)) return undefined;
   const value = report ? formatCodexUsageStatusValue(report, activeModel) : undefined;
-  const fast = isFastEnabled(activeModel.id);
+  const fast = isFastEnabled(activeModel);
   if (!value && !fast) return undefined;
   return { label: "codex", value: value ? `${value}${fast ? " fast" : ""}` : "fast" };
 }

package/node_modules/@llblab/pi-codex-usage/lib/usage.ts

@@ -4,8 +4,9 @@ const SECOND_MS = 1000;
 const CODEX_USAGE_LIMIT_ID = "codex";
 type PiModel = NonNullable<ExtensionContext["model"]>;
 export type CodexUsageModel = Pick<PiModel, "id" | "name" | "provider">;
+export const OPENAI_USAGE_PROVIDERS = ["openai-codex", "openai"] as const;
 export function isOpenAICodexModel(model: Pick<PiModel, "provider"> | undefined): boolean {
-  return model?.provider === "openai-codex";
+  return OPENAI_USAGE_PROVIDERS.some((provider) => model?.provider === provider);
 }
 export type UsageSource = "pi-auth" | "codex-app-server";
 export type UsageQueryError = { source: UsageSource; message: string; cause?: unknown };

package/node_modules/@llblab/pi-codex-usage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-codex-usage",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "private": false,
   "description": "Pi extension for Codex subscription usage and an optional Fast toggle",
   "keywords": [

package/node_modules/@llblab/pi-telegram/AGENTS.md

@@ -60,6 +60,7 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 ### 4.1 Flat Domain DAG
 
 - Cohesive domains live as flat `/lib/*.ts` modules whose local import graph is acyclic.
+- `In-memory lifecycles`: Use pure transitions and a domain-owned effect shell when competing asynchronous sources, generation/cancellation fencing or timers justify the pattern. The shared `machine` leaf owns runner mechanics only; state, events, effects and authority stay with the domain. Durable admission, custody, Workspace and IPC retain their transactional contracts.
 - `lib/extension.ts` constructs high-level runtimes and wires live ports. Domain policy, mutable state, sequencing, identity, retries, normalization, and lifecycle recovery belong to the owning `/lib` module.
 - During refactoring, add a domain only for demonstrated cross-domain reuse or a concrete dependency-direction/cycle problem. Prefer an existing cohesive owner; a closed helper cluster, independent tests or file length alone is insufficient. An acyclic validator result does not justify a new boundary. Do not atomize cohesive modules or create one-use wrappers merely to shrink `index.ts`.
 - `bindings` owns Pi-facing registration and narrow cross-domain assembly; it may connect established ports but must not absorb routing, rendering, transport, or mutable policy.
@@ -85,7 +86,7 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 - Admission is journal-first: validate and persist the complete `getUpdates` response before one monotonic offset commit, then signal an independent worker without awaiting semantic execution. Missing cursor with a non-empty journal, malformed/foreign authority, or capacity exhaustion fails closed. “Durable” means process-crash recovery after atomic rename, not unflushed host/kernel/filesystem/device/power-loss survival.
 - Storage cutovers must reconcile actual consumer locations before correcting path adapters. Never normalize a relative historical reference into new authority or treat equal reference strings / empty canonical storage as source completeness. Exact-path preflight is lexical only; physical identity, historical coverage, writer closure and migration remain separate proofs.
 - Workspace mutations acquire cross-process admission before their shared process-local gate and hold it through asynchronous API work and durable settlement. Topic lifecycle, complete unbound/reroute target handling, manual disconnect, and session-restart cleanup use profile-wide scope; either retained retirement-fence phase rejects them before state access. Cleanup admission spans intent publication, target mutation, persistence, and successful transport release. Explicit manual disconnect may stop only its captured local transport after cleanup admission/effects fail; it must not bypass Thread mutation fences, release a replacement connection, claim unconfirmed deletion, or retry an uncertain stop. Session-restart cleanup retains its admission-required behavior. Detached reconciliation that mutates Thread state must reacquire fresh profile admission through the same gate; it cannot inherit a caller lease that ended before its timer runs. A live operation ID has one process-local caller: concurrent reuse is rejected before lease acquisition, while retry after the caller exits may resume exact durable authority.
-- Workspace retirement is capacity-pressure-only. Elapsed time and heartbeat silence never trigger deletion; only complete `A`–`Z` exhaustion may propose the oldest continuously proven inactive, fully unprotected binding. Exact deletion, durable retirement, and fence completion precede slot reuse. Authorized demand-driven rotation retries one failed fresh allocation after retirement; restore-only follower startup never evicts. Release ordinary registration/provisioning leases before acquiring the destructive fence, retain the shared mutation gate across retirement, and validate the exact permit immediately before one non-retried deletion. Persist an exact method/target-matched rejection before withdrawing its intent; release that fence only after durable withdrawal, retaining the binding. A later attempt requires fresh operation authority. Protection reads must never repair, quarantine, or reset journals. Non-destructive owner detachment must atomically retain one exact Workspace binding and its letter while removing only its uniquely matched owner record and stamping first inactivity; it never manufactures Thread-deletion evidence or clears accepted work. During authenticated follower registration, the exact Workspace claim owns the letter: a mismatched retained target record is repaired to that claim before binding commit, while any unrelated binding that owns the stale letter remains untouched. Retained prune observations are bounded, non-routing and registration/profile/epoch/runtime-fenced. One unfinished preservation operation retains its admission identity across fresh-PID-proof retries; it can never become deletion authority. Leader quit requires completed delivery/polling/worker teardown under the captured session generation, profile and epoch; reload/new/resume/fork never establish inactivity. Unknown deletion outcomes retain their fence; only confirmed durable completion permits reuse.
+- Workspace retirement is capacity-pressure-only. Elapsed time and heartbeat silence never trigger deletion; only complete `A`–`Z` exhaustion may propose the oldest continuously proven inactive, fully unprotected binding. Exact deletion, durable retirement, and fence completion precede slot reuse. Authorized demand-driven rotation retries one failed fresh allocation after retirement; restore-only follower startup never evicts. Release ordinary registration/provisioning leases before acquiring the destructive fence, retain the shared mutation gate across retirement, and validate the exact permit immediately before one non-retried deletion. Persist an exact method/target-matched rejection before withdrawing its intent; release that fence only after durable withdrawal, retaining the binding. A later attempt requires fresh operation authority. Protection reads must never repair, quarantine, or reset journals. Non-destructive owner detachment must atomically retain one exact Workspace binding and its letter while removing only its uniquely matched owner record and stamping first inactivity; it never manufactures Thread-deletion evidence or clears accepted work. During authenticated follower registration, a mismatched retained target record is repaired to the exact Workspace claim before binding commit; if same-target commit adopts the retained binding's slot, its returned binding then owns the registration result and owner-record slot. Unrelated bindings that own a stale or provisional letter remain untouched. Same-target re-keying retains historical journal keys and exact source tuples without upgrading unknown completeness. Retained prune observations are bounded, non-routing and registration/profile/epoch/runtime-fenced. One unfinished preservation operation retains its admission identity across fresh-PID-proof retries; it can never become deletion authority. Leader quit requires completed delivery/polling/worker teardown under the captured session generation, profile and epoch; reload/new/resume/fork never establish inactivity. Unknown deletion outcomes retain their fence; only confirmed durable completion permits reuse.
 - Foreign forwarding settles as `accepted`, `retryable`, or `terminal-rejected`. Only an authenticated acknowledgement carrying the expected `deliveryId` and `sourceUpdateId` releases leader journal authority. Negative, missing, stale, mismatched, or capacity-failed settlement remains durable; callback error answers are side effects only. Exception: the operator-approved fixed chooser deadline may discard its exact unclaimed donor pending source without a body archive or delivery-success claim. Accepted recipient queue/work and bound Threads are untouched; old donor controls and late reports cannot replay it. The lifetime and temporary cleanup contract lives in `docs/architecture.md`.
 - A forwarding delivery id is stable across registration replacement and derives from envelope kind, source `update_id`, and stable recipient binding. Runtime instance and registration generation remain separate attempt fences. Persisted message ownership carries the stable binding so replay can rebind only to its current authenticated registration.
 - A queued receipt persists its acquiring runtime instance, OS pid/process-birth identity, session generation, acquisition id, and acquisition time. Only exact authority may settle or discard it. Cached presence is not current execution proof: prepared custody must revalidate the exact queued owner/group without recovery and refuse offers or uncertain reads. Completion requires an exact removal acknowledgement, never merely `!ready`; a retained acknowledgement permits local cleanup only, not replay. Same-process session replacement may reconstruct the claim and the original process may settle after transport ownership moves; a foreign process may neither replay nor settle it through generic removal or a copied acquisition id.
@@ -102,8 +103,9 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 - `/stop`, `/abort`, `/next`, and `/continue` respectively reset+abort, abort while preserving queue, force the next turn, and enqueue a control-lane continuation. A negative reaction to an original standalone `/continue` settles and removes only its exact waiting source-addressed continuation; positive reactions do not change its control lane. Protect the Pi-owned pending head and already-started work, preserve other queue positions, and never address synthetic model continuations by their reply anchor. Settlement failure retains the continuation. Abort-history folding applies only to Telegram-owned active turns. A busy `/next` marks only its exact active Telegram turn: terminal abort settlement attempts one explicit abort notice before the exact selected queued prompt receives its dispatch notice. Notice failure is diagnostic and cannot block dispatch; a later `/abort` or `/stop` cancels both pending transition notices before taking ownership. Target command adapters must forward these transition ports. A successful dispatch notice keeps the queued prompt's one reply-header claim across agent start, so later messages in that turn never repeat it.
 - A model selection from an authorized Telegram target may stop and continue any interruptible active agent run in that same Pi session, including local/TUI work. Queue the synthetic control-lane continuation before aborting; when no Telegram prompt owns the run, bind continuation and reply ownership to the exact model-menu chat/Thread/message. Delay abort until every active tool execution settles, and clear both selection and fallback target on cancellation, agent start, settlement, or session replacement.
 - Telegram extension side effects must not hold Pi's core lifecycle hostage after semantic completion. Preserve ordering in extension-owned background work, record failures, and fence target/profile/transport/session authority.
+- In Threaded Mode, All is service/input-only. New output, previews, typing and routing UI require a concrete Thread; neither implicit fallback nor explicit aggregate delivery may write to All. Unavailable routing authority retains input without an All notice or silent settlement. Classic DM and explicit channel/business destinations remain separate; historical All output is not auto-cleaned.
 - Complete assistant/guest model answers use Telegram-native Rich Markdown. Harness-owned menus, status, diagnostics, thinking, and tool evidence remain explicit HTML/plain or their documented native surface. Before Telegram preview or final delivery, strip every assistant-authored HTML comment regardless of Markdown position while keeping action activation top-level-only; a comment-only result sends no text message. Preserve literal code outside comments and structurally safe chunking; never split invalid markup.
-- `preview` owns streaming lifecycle only, not assistant rendering. Finalization waits for active preview flushes and must not issue pre/post-final draft-clear calls that create transient Telegram draft UI. Turns that already answer as one atomic reply (voice replies, Guest Mode queries) never stream previews.
+- `preview` owns streaming lifecycle only, not assistant rendering. Finalization waits for the captured generation's preceding preview work, never later drafts blocked by that publication, and must not issue pre/post-final draft-clear calls that create transient Telegram draft UI. Reset/invalidation detaches predecessor dependencies; late settlements cannot mutate replacement state. Turns that already answer as one atomic reply (voice replies, Guest Mode queries) never stream previews.
 - Native `sendChatAction(typing)` is the automatic activity signal for unsettled agent and compaction work while Telegram transport is authorized. Extension-owned blocking UI prompts pause it and completion resumes it while either work owner remains active. Compaction may stop only a typing loop it actually started; it must preserve a pre-existing agent-owned loop. Refresh only the assigned Thread on a conservative three-second cadence; do not mirror typing to aggregate `All` and multiply shared-chat flood pressure. Typing is best-effort presence only: a failed exact-target action remains a structured diagnostic and must not replace a healthy connected/leader/follower status with `error`. Do not invent extra in-chat work indicators or emit activity for startup/connect/reload/recovery alone.
 - Public activity handlers and connected companion delivery are asynchronous, target-bound, generation-fenced surfaces. Connected companion projection has no independent opt-out: disconnect or authority loss is its boundary. Token deltas, hidden reasoning, unknown sources, and stale authority never enter public projection.
 - Thread display defaults to the profile-scoped Letters strategy, with Names, Directory Snake, and Directory Title as the other automatic choices; Names projects the generated dictionary name for the slot. Unsupported retained display keys resolve to Letters without rewriting persisted configuration. A durable manual Thread display name retained on its Workspace binding overrides any automatic projection until exact reset; keep generated/recovery identity separate from manual and acknowledged display fields. After leader startup, automatic display contraction waits one follower-staleness window so election and follower re-registration cannot briefly remove and restore an acknowledged same-cwd suffix; stop/start generation cancels stale reconciliation. UI labels, emoji semantics, navigation, settings controls, callback namespaces, voice behavior, command templates, and assistant markup follow the linked `/docs` contracts. Generated human-readable action labels use `emoji + space + text`; emoji-free action text is only a reasoned no-semantic-marker fallback. State/value controls follow the [button control hierarchy](./docs/ui-style.md#button-control-hierarchy), not the action-label grammar. Non-spatial generated controls default to top-level vertical cells, with nested rows reserved for unmistakably compact peers. Do not restate other evolving UI details here.

package/node_modules/@llblab/pi-telegram/BACKLOG.md

@@ -2,4 +2,4 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
-No open work.
+No open tasks.

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -4,6 +4,17 @@
 
 ## Unreleased
 
+## 0.55.0: Native Restore and fenced lifecycles
+
+- `Restore cleanup`: Live Restore binds the new tab and decides old-tab cleanup before native leader/follower inputs run. Protected work defers cleanup; session replacement carries no deletion grant, and unknown deletion never repeats. Follower execution targets the rebound tab without rewriting journal originals or quoting the former tab. Exact donor ACKs seal routing clocks and retire the menu. Reader/execution capabilities, source custody and detached replies stay separate; busy hints coalesce.
+- `Runtime state`: In-memory lifecycles now use isolated pure TypeScript transitions and domain-owned effect shells. A shared leaf runner drives preview, typing, model switching, grouped input, compaction and follower recovery without adding a runtime dependency; durable admission, custody, Workspace and IPC retain their existing transactional owners.
+- `Preview ordering`: A publication waits only for its preceding draft and publications, never a later draft that waits for it. New turns and sessions detach old preview dependencies, and late draft, timer or publication settlements cannot unblock or overwrite replacement work. Final replies still drain their own issued draft without post-final clearing.
+- `Model switching`: Restarting or clearing a switch now consumes its staged model and continuation together, preventing an old tool settlement from aborting the continuation again. Synchronous nested controller calls retain the outer continuation context and abort handler.
+- `Grouped input`: Albums and split text share one fenced pending-group lifecycle. Separate text batches end at a message identity rather than a mutable count, and a synchronous dispatcher failure retains the input and schedules retry instead of leaving the group permanently dispatching.
+- `Typing ownership`: Queue dispatch preserves its exact Thread; Threaded Mode refuses missing targets and stops Classic chat-only loops on mode changes. Context/generation and loop-owner fences guard starts, queued HTTP/IPC issuance, ticks and awaited lifecycle continuations without letting stale work claim replacement typing. Typing never replays HTTP or transport fallback after failure; follower callbacks stay local. Compaction retains its own loop and preserves agent-owned activity.
+- `Reconnect lifecycle`: Follower startup restores its exact session's retained Thread after proving the former runtime PID absent and no registered peer owns it; live/unknown predecessors stay protected. Connect notices use acknowledged display titles, not provisional generated names. Manual Connect/Restore retain prepared context, read-only checks, committed slots and journal history. Stale recovery cannot change a replacement connection; stopped leader startup cannot poll or publish its endpoint.
+- `Thread surfaces`: All is input-only: sends, drafts, media, forwards and activity require a concrete Thread; implicit fallback and aggregate output are refused. Routing failures retain input, not All notices. Voice/files/albums enter one routing tab. Exact Linux/macOS home displays as Home/home with normal suffixes; manual names and other modes stay unchanged. Restore publishes acknowledged titles to heartbeat/TUI without changing generated identity; late old-target title ACKs are ignored.
+
 ## 0.54.4: Restored tabs take their Pi's name
 
 - `Restore title`: Restoring a Pi into a routing tab ("move Pi into this tab") now renames the tab to that Pi's Thread display title, as Workspace Restore already did; previously a live-rebind Restore left the tab named `🚦 Routing`. A failed rename is recorded and never blocks the Restore.

package/node_modules/@llblab/pi-telegram/README.md

@@ -143,7 +143,7 @@ Enable the optional capabilities the bridge needs in the [@BotFather](https://t.
 | Generative Apps | Install or explicitly replace a reviewed `.mjs` application whose generated JSON button view may mix direct `app::method` actions with ordinary model prompts. | Repeated games, controls, tutors, and adapters compile routine interaction without losing selective model interpretation, explanation, or adaptation. |
 | Callback routing | Route known callbacks to the owner extension and unknown callbacks back into Pi. | Companion extensions can build UI without polling Telegram themselves. |
 | Threaded Mode | Run one leader plus visible follower Pi instances through named private-chat threads. | One bot can host a local multi-instance Pi organism without hidden process spawning. |
-| Reroute and restore | Give unknown and command-created temporary threads explicit forward and replace/restore choices. | Forward removes the temporary tab; restore rebinds it and may remove only the replaced old tab after positive cleanup proofs. Blocked cleanup preserves the relocation and protected work. |
+| Reroute and restore | Give text, voice, files and albums sent from `All`, plus unknown threads, explicit reroute and replace/restore choices. | Forward removes the temporary tab; restore rebinds it and may remove only the replaced old tab after positive cleanup proofs. Blocked cleanup preserves the relocation and protected work. |
 | Extension sections | Add menu sections, commands, status rows, settings, callbacks, and delivery helpers from companion extensions. | `pi-telegram` becomes a platform surface for other Pi extensions. |
 | Runtime diagnostics | Use `/telegram-status` and recent runtime events for connection, role, negotiated bus protocol/build/capabilities, separate polling and inbound-worker progress, journal depth, local/foreign queue ownership, automatic retry waits, transport, and failures. | Compatible build skew, foreign semantic authority, a healthy poller, durable backoff and an infrastructure-blocked worker remain distinguishable without hidden logs. |
 | Safety and ownership | Pair one owner, lock transport, scope targets, and reject fake terminal behavior. | Remote access remains explicit, bounded, and understandable. |
@@ -196,6 +196,8 @@ Named profile identifiers contain only lowercase ASCII letters and digits (maxim
 
 ## Main Surfaces
 
+In Threaded Mode, `All` is input-only: messages enter temporary routing tabs, and Pi replies stay in bound Threads. Missing routing or delivery targets fail closed instead of sending fallback messages to All. There is no automatic cleanup of old All output. Classic DM behavior is unchanged.
+
 ### Operator Menu
 
 `/start` opens the Telegram-native control panel: status, prompt-template commands, model selection, thinking level, settings, queue controls, and extension sections. It is the primary Telegram UI; reaction shortcuts are secondary queue affordances.
@@ -248,14 +250,14 @@ Classic private DM mode is the base product mode. When Telegram private-chat Thr
 - When all `A`–`Z` slots are reserved, a new connection may reclaim the oldest inactive, unprotected Thread. **This deletes that Thread and all its messages**, not Pi session history or project files. Active or protected work blocks reclamation; restoring a remembered session does not evict another binding.
 - Telegram never launches hidden Pi processes.
 
-In Threaded Mode, open Settings → **🧵 Thread display** to choose `letters` (default), `names`, `directory-title`, or `directory-snake` for this bot profile; a retained **directories** value remains available as an unchanged legacy presentation. Fresh tabs are created with the active mode's title instead of being visibly renamed afterward. Telegram tab titles, Pi terminal status, live Thread choosers/notices, prompt attribution, and named `telegram_message` targeting use the same acknowledged display name; target IDs and live registrations still own routing. Names shows the generated dictionary name chosen for the slot, such as `Anchor` for slot `A`; the directory formats produce `api_tools` or `Api Tools` and append `_a` or ` A` only while two or more authenticated live instances share that exact directory. Dormant retained bindings do not keep those suffixes visible. After leader election, automatic title contraction waits one follower-staleness window for live registrations to settle, avoiding a temporary suffix removal and restoration during startup. `/name` sets a manual Thread display name; **Reset to automatic** restores the selected automatic projection. Switching preserves Thread IDs, slots, generated recovery identity, and queue ownership. Partial application reports an error and can be retried without recreating Threads.
+In Threaded Mode, open Settings → **🧵 Thread display** to choose `letters` (default), `names`, `directory-title`, or `directory-snake` for this bot profile. Unsupported retained values, including the retired `directories` mode, fall back to `letters` without rewriting the saved configuration. Fresh tabs are created with the active mode's title instead of being visibly renamed afterward. Telegram tab titles, Pi terminal status, live Thread choosers/notices, prompt attribution, and named `telegram_message` targeting use the same acknowledged display name; target IDs and live registrations still own routing. Names shows the generated dictionary name chosen for the slot, such as `Anchor` for slot `A`; the directory formats produce `api_tools` or `Api Tools` and append `_a` or ` A` only while two or more authenticated live instances share that exact directory. On Linux/macOS, the current user's exact home directory displays as `home` or `Home`; subdirectories keep their own names, and Windows remains unchanged. Dormant retained bindings do not keep those suffixes visible. After leader election, automatic title contraction waits one follower-staleness window for live registrations to settle, avoiding a temporary suffix removal and restoration during startup. `/name` sets a manual Thread display name; **Reset to automatic** restores the selected automatic projection. Switching preserves Thread IDs, slots, generated recovery identity, and queue ownership. Partial application reports an error and can be retried without recreating Threads.
 
 | Mode | Best for | Runtime shape |
 | --- | --- | --- |
 | Classic DM | One running Pi instance and its active session controlled from one private bot chat | One polling owner, one queue/runtime surface |
 | Threaded Mode | Several visible Pi sessions sharing one bot | One leader owns transport; each private-chat Thread retains one session-qualified Workspace binding |
 
-**Live rebinding (0.53.0):** Restore uses one same-session save/apply/release channel for prompts and supported commands/templates, with separately fenced best-effort old-Thread cleanup. Existing work and exact source/receipt custody remain protected; legacy Restore readers/receivers retain continuity with older instances. Windows runs the same paths, and CI covers it. See [Multi-Instance Bus](./docs/multi-instance-bus.md#live-rebind-channel).
+**Live rebinding:** Restore confirms the new binding, makes one old-tab cleanup decision, then releases the saved input through its native prompt, command or template owner. Negotiated followers use the same order without another queue. Earlier protected work defers cleanup; `/new` cannot carry an old-session deletion grant into its replacement. An unknown delete never repeats or blocks ordinary input on the confirmed new tab. Exact source/receipt custody remains separate from replies and model completion. Upgrade participating readers for the new metadata; older peers retain their supported legacy path. See [Multi-Instance Bus](./docs/multi-instance-bus.md#live-rebind-channel).
 
 ## Environment Configuration
 

package/node_modules/@llblab/pi-telegram/dist/lib/activity.d.ts

@@ -101,11 +101,13 @@ export interface TelegramActivityDispatcher {
 }
 /** @internal */
 export declare function createTelegramActivityDispatcher(deps?: {
+    captureDrain?: () => (() => void) | undefined;
     recordFailure?: (handlerId: string, event: TelegramActivityEvent, error: unknown) => void;
 }): TelegramActivityDispatcher;
 /** @internal */
 export declare function createTelegramActivityBridgeRuntime(deps: {
     generation: string;
+    captureDrain?: () => (() => void) | undefined;
     observeEvent?: (event: TelegramActivityEvent) => void;
     recordFailure?: (handlerId: string, event: TelegramActivityEvent, error: unknown) => void;
     now?: () => number;
@@ -207,7 +209,9 @@ export interface TelegramActivityPublicationRuntime {
     hasUnconfirmed: () => boolean;
     reset: () => void;
 }
-export declare function createTelegramActivityPublicationRuntime(): TelegramActivityPublicationRuntime;
+export declare function createTelegramActivityPublicationRuntime(deps?: {
+    captureDrain?: () => (() => void) | undefined;
+}): TelegramActivityPublicationRuntime;
 export interface TelegramAssistantOutputRuntime {
     start: () => void;
     beginTurn: () => void;