@llblab/pi-kit 0.35.3 → 0.35.4

package/AGENTS.md

@@ -23,6 +23,7 @@
 - An explicitly requested bundled-extension release also authorizes synchronizing and releasing the kit in the same task; do not stop at local preparation. Follow the guarded repository release flow. Installation and live-client reload remain separately authorized.
 - Bundle every included Pi package so npm installation is self-contained under this package's module root. Keep repository-local `legacy-peer-deps=true` so host-provided Pi peers are not resolved into the kit's lockfile; Pi supplies them at runtime.
 - Expose only resources declared by each included package. Prefer published distribution entrypoints over source entrypoints when both exist.
+- Extension entrypoints are pointers, not copies: every declared extension re-exports the exact bundled entrypoint from `extensions/<name>/index.<ext>`, and that folder is published so Pi shows a compact label. A bundled package must therefore resolve auxiliary files, workers, spawned scripts, sibling packages, and extension-local resources from its own module URL (`import.meta.url`), never from the declared entry path or `process.argv[1]`; only the declared entry is redirected, so anything located from that path breaks.
 - Do not copy extension source, Skills, or documentation into this repository.
 - Preserve package independence: a kit release may advance any subset of included extensions without forcing lockstep extension releases.
 - Adding packages or newly exposed capabilities requires a kit minor bump. For updates to the existing composition, derive the kit version bump from the highest dependency bump in the synchronized release cohort: dependency patch-only updates require a kit patch bump, while any dependency minor update requires a kit minor bump. Do not let lower-level dependency bumps force a larger kit bump.
@@ -34,4 +35,5 @@
 - Run `npm test` after manifest or inventory changes.
 - Run `npm run pack:check` before declaring package readiness.
 - Inspect the dry-run tarball inventory to confirm every package in `bundledDependencies` and its declared resources are present.
+- Confirm that a newly added or advanced package resolves its auxiliary files from `import.meta.url`; a pointer-loaded extension must still start its own workers and scripts.
 - Run `npm run validate` at completion.

package/BACKLOG.md

@@ -4,6 +4,7 @@ Package pins, resource order and bundled runtime ownership remain authoritative
 
 ## Carried checks
 
+- **Installed 0.35.4 Telegram smoke (operator-owned):** After separately authorized kit installation/reload of every Pi process together, run `/telegram-new` in one follower instance and confirm the same Thread is reused with a new letter slot and title, with no second tab and no orphan left behind. Then restart that instance, open a new session in the same folder, and confirm it adopts the retained Thread instead of provisioning another. Do not erase accepted work or replay uncertain input. Packed validation does not certify installed clients.
 - **Installed 0.35.3 label smoke (operator-owned):** After separately authorized kit installation/reload, confirm the startup list and `pi config` show one compact entry per bundled extension (`@llblab/pi-kit:pi-actors` and so on), that every extension still loads exactly once without duplicate-registration warnings, and that Skills are unaffected. Packed validation does not certify installed clients.
 - **Installed 0.35.2 Telegram smoke (operator-owned):** After separately authorized kit installation/reload, connect a new Thread with every letter slot occupied and confirm it appears in seconds without the leader stalling or its followers going stale. Repeat the operator's earlier checks for leader failover after `/telegram-disconnect`, follower takeover, and collapsed repeated log records. Packed validation does not certify installed clients.
 - **Installed 0.35.1 Telegram smoke (operator-owned):** After separately authorized kit installation/reload, verify Reroute removes an exhausted temporary tab and Restore keeps the new tab while deleting its unprotected predecessor. Confirm protected work survives. Guest PNG/JPEG, document and MP3 replacement plus staging cleanup remain explicitly deferred upstream live checks; verify unsupported OGG/Opus feedback separately. Upstream idle-leader acceptance and kit packaging checks do not certify this installation.

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.35.4: Telegram Session Thread Continuity
+
+- `Telegram pin`: Advances only the exact Telegram pin from `0.57.2` to `0.57.3`. A session replaced inside one Pi process now reuses its preserved Thread on every registration path instead of provisioning a second tab, and a new session registering in a folder whose previous session is provably gone adopts that binding's exact target and slot while the predecessor binding is re-keyed. A live predecessor or an ambiguous candidate set keeps ordinary provisioning.
+- `Checks`: The exact-pin test, README inventory and pointer targets now read `0.57.3`; the seven published pointer entrypoints and declared Skill paths are unchanged. Packed validation covers build, types, tests, audit and bundle inventory only, so installed-client behavior remains an operator check in [Backlog](./BACKLOG.md).
+
 ## 0.35.3: Compact Bundled Extension Labels
 
 - `Extension wiring`: Each bundled extension is now declared through a thin pointer at `extensions/<name>/index.js` that re-exports the exact bundled entrypoint, so the Pi startup list and `pi config` show `@llblab/pi-kit:pi-telegram` instead of the full nested path. Pins, load order and package code are unchanged, and an explicit `pi.extensions` still suppresses conventional directory discovery, so nothing loads twice.

package/README.md

@@ -18,7 +18,7 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.1` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.26.4` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.57.2` | Telegram companion with per-prompt Steer, queued controls, Reroute/Restore, recoverable connections, previews, follower Threads, files, and voice |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.57.3` | Telegram companion with per-prompt Steer, queued controls, Reroute/Restore, recoverable connections, previews, follower Threads, files, and voice |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.
@@ -56,7 +56,7 @@ npm install
 npm run validate
 ```
 
-The repository-local `.npmrc` keeps Pi-provided peer packages out of the kit's lockfile; Pi supplies those peers at runtime. To advance an included package, update its exact version in `dependencies`, run `npm install`, synchronize bundled dependencies, each declared extension pointer and its target, declared Skill paths, tests, the table above, and the changelog, then validate the packed artifact. Keep every pointer target identical to the entrypoint its pin declares. Expose only resources declared by the published owning package; do not use version ranges or unpublished local paths.
+The repository-local `.npmrc` keeps Pi-provided peer packages out of the kit's lockfile; Pi supplies those peers at runtime. To advance an included package, update its exact version in `dependencies`, run `npm install`, synchronize bundled dependencies, each declared extension pointer and its target, declared Skill paths, tests, the table above, and the changelog, then validate the packed artifact. Keep every pointer target identical to the entrypoint its pin declares. A bundled package must resolve auxiliary files, workers and sibling packages from its own module URL rather than from the declared entry path, because a pointer redirects only that entry. Expose only resources declared by the published owning package; do not use version ranges or unpublished local paths.
 
 ## Security
 

package/node_modules/@llblab/pi-telegram/AGENTS.md

@@ -87,6 +87,7 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 - Admission is journal-first: validate and persist the complete `getUpdates` response before one monotonic offset commit, then signal an independent worker without awaiting semantic execution. Missing cursor with a non-empty journal, malformed/foreign authority, or capacity exhaustion fails closed. “Durable” means process-crash recovery after atomic rename, not unflushed host/kernel/filesystem/device/power-loss survival.
 - Storage cutovers must reconcile actual consumer locations before correcting path adapters. Never normalize a relative historical reference into new authority or treat equal reference strings / empty canonical storage as source completeness. Exact-path preflight is lexical only; physical identity, historical coverage, writer closure and migration remain separate proofs.
 - Workspace mutations acquire cross-process admission before their shared process-local gate and hold it through asynchronous API work and durable settlement. Topic lifecycle, complete unbound/reroute target handling, manual disconnect, and session-restart cleanup use profile-wide scope; either retained retirement-fence phase rejects them before state access. Cleanup admission spans intent publication, target mutation, persistence, and successful transport release. Explicit manual disconnect may stop only its captured local transport after cleanup admission/effects fail; it must not bypass Thread mutation fences, release a replacement connection, claim unconfirmed deletion, or retry an uncertain stop. Session-restart cleanup retains its admission-required behavior. Detached reconciliation that mutates Thread state must reacquire fresh profile admission through the same gate; it cannot inherit a caller lease that ended before its timer runs. A live operation ID has one process-local caller: concurrent reuse is rejected before lease acquisition, while retry after the caller exits may resume exact durable authority.
+- One Thread keeps one owner across session replacement. A session replaced inside the same process reuses its preserved handoff Thread instead of provisioning another. A new session in a folder whose previous session is provably gone (no live registration for its target, absent runtime PID) adopts that binding's exact target and slot, and the predecessor binding is re-keyed to the successor rather than left as an orphan active row. A live predecessor, an ambiguous candidate set, an unknown runtime, or a missing liveness probe keeps ordinary provisioning.
 - Workspace retirement is capacity-pressure-only. Elapsed time and heartbeat silence never trigger deletion; only complete `A`–`Z` exhaustion may propose the oldest continuously proven inactive, fully unprotected binding. Exact deletion, durable retirement, and fence completion precede slot reuse. Authorized demand-driven rotation retries one failed fresh allocation after retirement; restore-only follower startup never evicts. Release ordinary registration/provisioning leases before acquiring the destructive fence, retain the shared mutation gate across retirement, and validate the exact permit immediately before one non-retried deletion. Persist an exact method/target-matched rejection before withdrawing its intent; release that fence only after durable withdrawal, retaining the binding. A later attempt requires fresh operation authority. Protection reads must never repair, quarantine, or reset journals. Non-destructive owner detachment must atomically retain one exact Workspace binding and its letter while removing only its uniquely matched owner record and stamping first inactivity; it never manufactures Thread-deletion evidence or clears accepted work. During authenticated follower registration, a mismatched retained target record is repaired to the exact Workspace claim before binding commit; if same-target commit adopts the retained binding's slot, its returned binding then owns the registration result and owner-record slot. Unrelated bindings that own a stale or provisional letter remain untouched. Same-target re-keying retains historical journal keys and exact source tuples without upgrading unknown completeness. Retained prune observations are bounded, non-routing and registration/profile/epoch/runtime-fenced. One unfinished preservation operation retains its admission identity across fresh-PID-proof retries; it can never become deletion authority. Leader quit requires completed delivery/polling/worker teardown under the captured session generation, profile and epoch; reload/new/resume/fork never establish inactivity. Unknown deletion outcomes retain their fence; only confirmed durable completion permits reuse.
 - Foreign forwarding settles as `accepted`, `retryable`, or `terminal-rejected`. Only an authenticated acknowledgement carrying the expected `deliveryId` and `sourceUpdateId` releases leader journal authority. Negative, missing, stale, mismatched, or capacity-failed settlement remains durable; callback error answers are side effects only. Exception: the operator-approved fixed chooser deadline may discard its exact unclaimed donor pending source without a body archive or delivery-success claim. Accepted recipient queue/work and bound Threads are untouched; old donor controls and late reports cannot replay it. The lifetime and temporary cleanup contract lives in `docs/architecture.md`.
 - A forwarding delivery id is stable across registration replacement and derives from envelope kind, source `update_id`, and stable recipient binding. Runtime instance and registration generation remain separate attempt fences. Persisted message ownership carries the stable binding so replay can rebind only to its current authenticated registration.

package/node_modules/@llblab/pi-telegram/BACKLOG.md

@@ -2,4 +2,10 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
-No open tasks.
+## Transit Thread lifecycle
+
+An All input's temporary routing Thread must outlive its pending choice and leave no residue.
+
+- [ ] A Thread with a pending Reroute/Restore choice is never deleted by unbound-topic reconciliation; only its own Reroute, cancel or expiry removes it.
+- [ ] Cancel resolves from the durable journal, so it still works after the tab or chooser message is gone.
+- [ ] Expiry reports a visible "prompt not delivered" result instead of silently discarding the input as `routing-expiry`.

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 ## Unreleased
 
+## 0.57.3: Session Thread Continuity
+
+- `Session handoff`: A session replaced inside one Pi process now reuses its preserved Thread on every registration path, not only connect recovery. The successor re-keys onto the same tab and slot with the new session id, so `/new` no longer provisions a second tab and leaves the previous one without an owner.
+- `Successor adoption`: A new session registering in a folder whose previous session is provably gone adopts that binding's exact target and slot, and the retained binding is re-keyed to the successor instead of leaving an orphan active row. A live predecessor, an ambiguous candidate set, an unknown runtime or a missing liveness probe keeps ordinary provisioning.
+
 ## 0.57.2: Connect Latency and Session Identity
 
 - `Connect latency`: A new Thread no longer waits about 20 seconds when all 26 letter slots are occupied. Slot rotation read the complete journal namespace and every shared journal once per binding inside one synchronous pass, freezing the leader's event loop and staling healthy follower heartbeats. One occupancy snapshot now reads that binding-independent evidence once, and every fresh snapshot still re-reads it so post-fence checks see newly arrived work.

package/node_modules/@llblab/pi-telegram/dist/lib/bus-follower.js

@@ -1851,9 +1851,9 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                 deps.setActiveAuthSecret?.(undefined);
                 await deps.stopReceiving?.();
             };
-            const pendingHandoff = options && !options.recoverConnection
-                ? undefined
-                : getTelegramFollowerSessionHandoff();
+            // A fresh handoff belongs to this same process, so a replaced session reuses its Thread: the tab keeps
+            // one identity and only its owner rotates. Explicit options still override the preserved target.
+            const pendingHandoff = getTelegramFollowerSessionHandoff();
             const pendingHandoffOptions = isTelegramFollowerSessionHandoffFresh(pendingHandoff)
                 ? {
                     target: pendingHandoff.target,

package/node_modules/@llblab/pi-telegram/dist/lib/bus-leader.js

@@ -922,6 +922,55 @@ export function createTelegramBusFollowerTargetProvisioner(deps) {
             if (candidates.length === 1)
                 restoredPredecessor = candidates[0];
         }
+        // A new session in a folder whose previous session is gone takes over that Thread: the tab keeps a single
+        // owner and the retired binding is re-keyed instead of being left behind as an orphan.
+        if (!restoredPredecessor &&
+            registration.cwd &&
+            registration.sessionId &&
+            !registration.previousInstanceId &&
+            deps.getLiveFollowers &&
+            deps.isFollowerProcessAlive) {
+            const identity = Threads.createTelegramWorkspaceBindingIdentity(registration.cwd, 0, registration.sessionId);
+            const liveFollowers = deps.getLiveFollowers();
+            const candidates = deps.topicTargetStore
+                .listWorkspaceBindings()
+                .filter((binding) => !!(identity &&
+                binding.cwd === identity.cwd &&
+                binding.sessionId !== identity.sessionId))
+                .flatMap((binding) => {
+                const matches = deps.topicTargetStore
+                    .list()
+                    .filter((record) => record.status === "active" &&
+                    record.owner?.kind === "manual-follower" &&
+                    record.target.chatId === binding.target.chatId &&
+                    record.target.threadId === binding.target.threadId);
+                return matches.length === 1
+                    ? [{ binding, record: matches[0] }]
+                    : [];
+            })
+                .filter(({ record }) => {
+                if (liveFollowers.some((peer) => peer.instanceId === record.instanceId ||
+                    (peer.target?.chatId === record.target.chatId &&
+                        peer.target.threadId === record.target.threadId)))
+                    return false;
+                const match = /^([1-9][0-9]*):[0-9]+$/.exec(record.instanceId ?? ""), pid = match ? Number(match[1]) : undefined;
+                if (pid === undefined || !Number.isSafeInteger(pid))
+                    return false;
+                try {
+                    return deps.isFollowerProcessAlive(pid) === false;
+                }
+                catch {
+                    return false;
+                }
+            });
+            // Ambiguity keeps ordinary provisioning: never guess which retained tab a new session inherits.
+            if (candidates.length === 1 && identity?.sessionId) {
+                const candidate = candidates[0];
+                if (candidate.binding.sessionId &&
+                    deps.topicTargetStore.adoptWorkspaceThreadBindingForSession(candidate.binding.cwd, candidate.binding.sessionId, identity.sessionId, candidate.binding.target))
+                    restoredPredecessor = candidate.record;
+            }
+        }
         let capacityUnavailable = false;
         const workspaceIdentity = registration.cwd
             ? deps.topicTargetStore.claimWorkspaceIdentity(registration.cwd, registration.instanceId, registration.previousInstanceId ?? restoredPredecessor?.instanceId, {

package/node_modules/@llblab/pi-telegram/dist/lib/threads.d.ts

@@ -569,6 +569,11 @@ export interface TelegramTopicTargetStore {
         sessionHandoff?: boolean;
         onCapacityUnavailable?: () => void;
     }) => TelegramWorkspaceBindingIdentity | undefined;
+    /**
+     * Re-keys one retained Thread binding from a retired session to its successor at the same slot and target,
+     * so the tab keeps a single owner. Fails without mutation when the source binding or slot identity is absent.
+     */
+    adoptWorkspaceThreadBindingForSession: (cwd: string, sourceSessionId: string, sessionId: string, target: TelegramTarget) => boolean;
     releaseWorkspaceClaim: (instanceId: string) => boolean;
     upsertWorkspaceBinding: (binding: TelegramWorkspaceThreadBinding, claimInstanceId?: string) => TelegramWorkspaceThreadBinding | undefined;
     upsert: (record: TelegramTopicTargetRecord) => TelegramTopicTargetRecord;

package/node_modules/@llblab/pi-telegram/dist/lib/threads.js

@@ -2877,6 +2877,34 @@ export function createTelegramTopicTargetStore(options) {
             }
         };
     };
+    /**
+     * Re-keys one retained Thread binding from a retired session to its successor at the same slot and target,
+     * so the tab keeps a single owner. Fails without mutation when the source binding or slot identity is absent.
+     */
+    const rekeyWorkspaceBindingForSession = (cwd, sourceSessionId, sessionId, target) => {
+        const sourceEntry = Array.from(workspaceBindings.entries()).find(([, binding]) => binding.cwd === cwd &&
+            binding.sessionId === sourceSessionId &&
+            targetMatches(binding.target, target));
+        if (!sourceEntry)
+            return false;
+        const [sourceKey, sourceBinding] = sourceEntry;
+        const replacementIdentity = Array.from({
+            length: TELEGRAM_WORKSPACE_SLOTS.length,
+        })
+            .map((_, ordinal) => createTelegramWorkspaceBindingIdentityWithKey(sourceBinding.cwd, sourceBinding.workspaceKey, ordinal, sessionId))
+            .find((identity) => identity?.instanceSlot === sourceBinding.instanceSlot);
+        if (!replacementIdentity ||
+            replacementIdentity.instanceSlot !== sourceBinding.instanceSlot)
+            return false;
+        workspaceBindings.delete(sourceKey);
+        workspaceBindings.set(getWorkspaceBindingMapKey(replacementIdentity), {
+            ...sourceBinding,
+            ...replacementIdentity,
+            updatedAtMs: getNowMs(),
+        });
+        markDirty();
+        return true;
+    };
     return {
         async load() {
             if (workspaceIO && dirty && !loadedScopeMatches(getPath()))
@@ -4797,6 +4825,20 @@ export function createTelegramTopicTargetStore(options) {
             const binding = workspaceBindings.get(mapKey);
             return binding ? cloneWorkspaceBinding(binding) : undefined;
         },
+        adoptWorkspaceThreadBindingForSession(cwd, sourceSessionId, sessionId, target) {
+            if (workspaceRetirementCommitInFlight)
+                return false;
+            const normalizedCwd = normalizeTelegramWorkspacePath(cwd);
+            const normalizedSource = normalizeTelegramSessionId(sourceSessionId);
+            const normalizedSession = normalizeTelegramSessionId(sessionId);
+            if (!normalizedCwd ||
+                !normalizedSource ||
+                !normalizedSession ||
+                normalizedSource === normalizedSession ||
+                hasWorkspaceRetirementConflict({ cwd: normalizedCwd }))
+                return false;
+            return rekeyWorkspaceBindingForSession(normalizedCwd, normalizedSource, normalizedSession, target);
+        },
         claimWorkspaceIdentity(cwd, instanceId, previousInstanceId, options) {
             if (workspaceRetirementCommitInFlight)
                 return undefined;
@@ -4824,24 +4866,9 @@ export function createTelegramTopicTargetStore(options) {
                     binding.sessionId === replacement.sourceSessionId &&
                     targetMatches(binding.target, replacement.target));
                 if (sourceEntry) {
-                    const [sourceKey, sourceBinding] = sourceEntry;
-                    const replacementIdentity = Array.from({
-                        length: TELEGRAM_WORKSPACE_SLOTS.length,
-                    })
-                        .map((_, ordinal) => createTelegramWorkspaceBindingIdentityWithKey(sourceBinding.cwd, sourceBinding.workspaceKey, ordinal, normalizedSessionId))
-                        .find((identity) => identity?.instanceSlot === sourceBinding.instanceSlot);
-                    if (replacementIdentity &&
-                        replacementIdentity.instanceSlot === sourceBinding.instanceSlot) {
-                        const existingTargetRecord = Array.from(records.values()).find((record) => targetMatches(record.target, replacement.target));
+                    const existingTargetRecord = Array.from(records.values()).find((record) => targetMatches(record.target, replacement.target));
+                    if (rekeyWorkspaceBindingForSession(normalizedCwd, replacement.sourceSessionId, normalizedSessionId, replacement.target))
                         replacementPreviousInstanceId = existingTargetRecord?.instanceId;
-                        workspaceBindings.delete(sourceKey);
-                        workspaceBindings.set(getWorkspaceBindingMapKey(replacementIdentity), {
-                            ...sourceBinding,
-                            ...replacementIdentity,
-                            updatedAtMs: getNowMs(),
-                        });
-                        markDirty();
-                    }
                 }
             }
             const effectivePreviousInstanceId = previousInstanceId ?? replacementPreviousInstanceId;

package/node_modules/@llblab/pi-telegram/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.57.2",
+  "version": "0.57.3",
   "private": false,
   "publishConfig": {
     "access": "public"

package/node_modules/@llblab/pi-telegram/lib/bus-follower.ts

@@ -3027,9 +3027,9 @@ export function createTelegramBusFollowerRegistrationRuntime<
         deps.setActiveAuthSecret?.(undefined);
         await deps.stopReceiving?.();
       };
-      const pendingHandoff = options && !options.recoverConnection
-        ? undefined
-        : getTelegramFollowerSessionHandoff();
+      // A fresh handoff belongs to this same process, so a replaced session reuses its Thread: the tab keeps
+      // one identity and only its owner rotates. Explicit options still override the preserved target.
+      const pendingHandoff = getTelegramFollowerSessionHandoff();
       const pendingHandoffOptions = isTelegramFollowerSessionHandoffFresh(
         pendingHandoff,
       )

package/node_modules/@llblab/pi-telegram/lib/bus-leader.ts

@@ -1583,6 +1583,80 @@ export function createTelegramBusFollowerTargetProvisioner(
         });
       if (candidates.length === 1) restoredPredecessor = candidates[0];
     }
+    // A new session in a folder whose previous session is gone takes over that Thread: the tab keeps a single
+    // owner and the retired binding is re-keyed instead of being left behind as an orphan.
+    if (
+      !restoredPredecessor &&
+      registration.cwd &&
+      registration.sessionId &&
+      !registration.previousInstanceId &&
+      deps.getLiveFollowers &&
+      deps.isFollowerProcessAlive
+    ) {
+      const identity = Threads.createTelegramWorkspaceBindingIdentity(
+        registration.cwd,
+        0,
+        registration.sessionId,
+      );
+      const liveFollowers = deps.getLiveFollowers();
+      const candidates = deps.topicTargetStore
+        .listWorkspaceBindings()
+        .filter(
+          (binding) =>
+            !!(
+              identity &&
+              binding.cwd === identity.cwd &&
+              binding.sessionId !== identity.sessionId
+            ),
+        )
+        .flatMap((binding) => {
+          const matches = deps.topicTargetStore
+            .list()
+            .filter(
+              (record) =>
+                record.status === "active" &&
+                record.owner?.kind === "manual-follower" &&
+                record.target.chatId === binding.target.chatId &&
+                record.target.threadId === binding.target.threadId,
+            );
+          return matches.length === 1
+            ? [{ binding, record: matches[0]! }]
+            : [];
+        })
+        .filter(({ record }) => {
+          if (
+            liveFollowers.some(
+              (peer) =>
+                peer.instanceId === record.instanceId ||
+                (peer.target?.chatId === record.target.chatId &&
+                  peer.target.threadId === record.target.threadId),
+            )
+          )
+            return false;
+          const match = /^([1-9][0-9]*):[0-9]+$/.exec(record.instanceId ?? ""),
+            pid = match ? Number(match[1]) : undefined;
+          if (pid === undefined || !Number.isSafeInteger(pid)) return false;
+          try {
+            return deps.isFollowerProcessAlive!(pid) === false;
+          } catch {
+            return false;
+          }
+        });
+      // Ambiguity keeps ordinary provisioning: never guess which retained tab a new session inherits.
+      if (candidates.length === 1 && identity?.sessionId) {
+        const candidate = candidates[0]!;
+        if (
+          candidate.binding.sessionId &&
+          deps.topicTargetStore.adoptWorkspaceThreadBindingForSession(
+            candidate.binding.cwd,
+            candidate.binding.sessionId,
+            identity.sessionId,
+            candidate.binding.target,
+          )
+        )
+          restoredPredecessor = candidate.record;
+      }
+    }
     let capacityUnavailable = false;
     const workspaceIdentity = registration.cwd
       ? deps.topicTargetStore.claimWorkspaceIdentity(

package/node_modules/@llblab/pi-telegram/lib/threads.ts

@@ -914,6 +914,16 @@ export interface TelegramTopicTargetStore {
       onCapacityUnavailable?: () => void;
     },
   ) => TelegramWorkspaceBindingIdentity | undefined;
+  /**
+   * Re-keys one retained Thread binding from a retired session to its successor at the same slot and target,
+   * so the tab keeps a single owner. Fails without mutation when the source binding or slot identity is absent.
+   */
+  adoptWorkspaceThreadBindingForSession: (
+    cwd: string,
+    sourceSessionId: string,
+    sessionId: string,
+    target: TelegramTarget,
+  ) => boolean;
   releaseWorkspaceClaim: (instanceId: string) => boolean;
   upsertWorkspaceBinding: (
     binding: TelegramWorkspaceThreadBinding,
@@ -4971,6 +4981,50 @@ export function createTelegramTopicTargetStore(
     };
   };
 
+  /**
+   * Re-keys one retained Thread binding from a retired session to its successor at the same slot and target,
+   * so the tab keeps a single owner. Fails without mutation when the source binding or slot identity is absent.
+   */
+  const rekeyWorkspaceBindingForSession = (
+    cwd: string,
+    sourceSessionId: string,
+    sessionId: string,
+    target: TelegramTarget,
+  ): boolean => {
+    const sourceEntry = Array.from(workspaceBindings.entries()).find(
+      ([, binding]) =>
+        binding.cwd === cwd &&
+        binding.sessionId === sourceSessionId &&
+        targetMatches(binding.target, target),
+    );
+    if (!sourceEntry) return false;
+    const [sourceKey, sourceBinding] = sourceEntry;
+    const replacementIdentity = Array.from({
+      length: TELEGRAM_WORKSPACE_SLOTS.length,
+    })
+      .map((_, ordinal) =>
+        createTelegramWorkspaceBindingIdentityWithKey(
+          sourceBinding.cwd,
+          sourceBinding.workspaceKey,
+          ordinal,
+          sessionId,
+        ),
+      )
+      .find((identity) => identity?.instanceSlot === sourceBinding.instanceSlot);
+    if (
+      !replacementIdentity ||
+      replacementIdentity.instanceSlot !== sourceBinding.instanceSlot
+    )
+      return false;
+    workspaceBindings.delete(sourceKey);
+    workspaceBindings.set(getWorkspaceBindingMapKey(replacementIdentity), {
+      ...sourceBinding,
+      ...replacementIdentity,
+      updatedAtMs: getNowMs(),
+    });
+    markDirty();
+    return true;
+  };
   return {
     async load() {
       if (workspaceIO && dirty && !loadedScopeMatches(getPath()))
@@ -7505,6 +7559,31 @@ export function createTelegramTopicTargetStore(
       const binding = workspaceBindings.get(mapKey);
       return binding ? cloneWorkspaceBinding(binding) : undefined;
     },
+    adoptWorkspaceThreadBindingForSession(
+      cwd,
+      sourceSessionId,
+      sessionId,
+      target,
+    ) {
+      if (workspaceRetirementCommitInFlight) return false;
+      const normalizedCwd = normalizeTelegramWorkspacePath(cwd);
+      const normalizedSource = normalizeTelegramSessionId(sourceSessionId);
+      const normalizedSession = normalizeTelegramSessionId(sessionId);
+      if (
+        !normalizedCwd ||
+        !normalizedSource ||
+        !normalizedSession ||
+        normalizedSource === normalizedSession ||
+        hasWorkspaceRetirementConflict({ cwd: normalizedCwd })
+      )
+        return false;
+      return rekeyWorkspaceBindingForSession(
+        normalizedCwd,
+        normalizedSource,
+        normalizedSession,
+        target,
+      );
+    },
     claimWorkspaceIdentity(cwd, instanceId, previousInstanceId, options) {
       if (workspaceRetirementCommitInFlight) return undefined;
       const normalizedCwd = normalizeTelegramWorkspacePath(cwd);
@@ -7539,41 +7618,18 @@ export function createTelegramTopicTargetStore(
             targetMatches(binding.target, replacement.target),
         );
         if (sourceEntry) {
-          const [sourceKey, sourceBinding] = sourceEntry;
-          const replacementIdentity = Array.from({
-            length: TELEGRAM_WORKSPACE_SLOTS.length,
-          })
-            .map((_, ordinal) =>
-              createTelegramWorkspaceBindingIdentityWithKey(
-                sourceBinding.cwd,
-                sourceBinding.workspaceKey,
-                ordinal,
-                normalizedSessionId,
-              ),
-            )
-            .find(
-              (identity) =>
-                identity?.instanceSlot === sourceBinding.instanceSlot,
-            );
+          const existingTargetRecord = Array.from(records.values()).find(
+            (record) => targetMatches(record.target, replacement.target),
+          );
           if (
-            replacementIdentity &&
-            replacementIdentity.instanceSlot === sourceBinding.instanceSlot
-          ) {
-            const existingTargetRecord = Array.from(records.values()).find(
-              (record) => targetMatches(record.target, replacement.target),
-            );
+            rekeyWorkspaceBindingForSession(
+              normalizedCwd,
+              replacement.sourceSessionId,
+              normalizedSessionId,
+              replacement.target,
+            )
+          )
             replacementPreviousInstanceId = existingTargetRecord?.instanceId;
-            workspaceBindings.delete(sourceKey);
-            workspaceBindings.set(
-              getWorkspaceBindingMapKey(replacementIdentity),
-              {
-                ...sourceBinding,
-                ...replacementIdentity,
-                updatedAtMs: getNowMs(),
-              },
-            );
-            markDirty();
-          }
         }
       }
       const effectivePreviousInstanceId =

package/node_modules/@llblab/pi-telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.57.2",
+  "version": "0.57.3",
   "private": false,
   "publishConfig": {
     "access": "public"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-kit",
-  "version": "0.35.3",
+  "version": "0.35.4",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -48,7 +48,7 @@
     "@llblab/pi-codex-usage": "0.13.1",
     "@llblab/pi-grow-loop": "0.9.0",
     "@llblab/pi-state-flow": "0.26.4",
-    "@llblab/pi-telegram": "0.57.2",
+    "@llblab/pi-telegram": "0.57.3",
     "@llblab/skills": "1.15.0"
   },
   "bundledDependencies": [