@llblab/pi-kit 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.5.1 - 2026-09-06
+
+- `Telegram Continuity Hotfix`: Advances the exact Telegram pin to `0.43.1`, bringing bounded persistent polling-conflict stand-down with accepted queue preservation, missing/null system-prompt normalization, and authority-fenced preview cleanup without changing the resource inventory.
+
 ## 0.5.0 - 2026-09-05
 
 - `Telegram Native Controls`: Advances the exact Telegram pin to `0.43.0`, bringing in-body button blocks, shared JSON/CML disabled controls, HTML footer fallback, and updated agent Skills while preserving package-owned implementations and the existing resource inventory.

package/README.md

@@ -15,7 +15,7 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.9.4` | Compact Codex/Spark subscription-limit status |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.7.4` | Visible continuation scheduling and bounded worker Skills |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.3.0` | Opt-in validated state handoffs between agent runs |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.43.0` | Telegram companion, queues, files, voice, controls, and Generative Apps guidance |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.43.1` | Telegram companion, queues, files, voice, controls, and Generative Apps guidance |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.14.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.43.1: Transport And Preview Continuity
+
+- `Conflict Stand-Down`: Stops transport after ten consecutive competing getUpdates conflicts, including ownership checks, heartbeat, monitoring, and bus teardown. Releases only the exact local lock and revokes direct authority even if release fails, while preserving accepted local queue work. A persistent terminal status and one diagnostic distinguish lost ownership from a competing external client; cancelled reconnects and stale admission cannot supersede current lifecycle work.
+- `Prompt And Preview Continuity`: Treats absent/null host system prompts as empty while retaining Telegram guidance, clears completed text from preview state after successful delivery, and rejects stale session/transport completions before they can clear a replacement preview. Receipt-conflict diagnostics now include the receipt and source update ids; durable handoff verification remains fail-closed.
+
 ## 0.43.0: Native Button Blocks
 
 - `In-Body Controls`: Renders standalone `telegram_button` fences as native button rows between paragraphs using the same singleton/mixed JSON/CML grammar and callback ownership as footer comments. Invalid/incomplete blocks register nothing, previews hide action payloads, literal examples remain inert, and HTML mode moves controls to the footer. In-body clicks acknowledge without recoloring; operator-confirmed current-client smoke passed; cross-client/follower checks remain pending.

package/node_modules/@llblab/pi-telegram/README.md

@@ -59,6 +59,8 @@ The connected Pi instance owns Telegram polling. Use `/telegram-connect <name>`
 
 After an unclean computer shutdown, `/telegram-connect` detects truncated or structurally invalid temporary ownership/routing files, quarantines only the damaged files under `tmp/telegram/recovery/`, and retries once. A journal snapshot removed by older broad temp cleanup is rebuilt when its complete segment history proves an empty result, while a revisionless snapshot is repaired from the first surviving segment's exact predecessor when the reconstructed tail validates. Otherwise the snapshot and segments are quarantined as recovery evidence, a fresh journal is published, and startup continues with an informational diagnostic instead of requiring manual JSON repair. Saved `telegram.json` configuration and runtime diagnostics remain intact. Recovery never replaces a verifiable live owner; if safe automatic recovery cannot complete, the command gives one explicit Pi-restart instruction instead of requiring deletion of the whole `tmp/` directory.
 
+Persistent competing `getUpdates` clients cause a bounded transport stand-down rather than endless retries. Accepted local work remains queued/executable, but Telegram delivery stops. Inspect `/telegram-status --debug`, stop the competing client, then reconnect. See [Runtime Ownership](./docs/architecture.md#runtime-ownership).
+
 ### 4. Pair your Telegram account
 
 Open the bot DM and send:

package/node_modules/@llblab/pi-telegram/docs/architecture.md

@@ -92,7 +92,7 @@ The repository uses a **Flat Domain DAG**:
 
 Pi is the primary and only officially supported host. `pi-telegram` may still accept narrow, host-neutral representation differences at its existing Pi-facing boundary when they preserve native Pi behavior and do not create a second runtime policy layer:
 
-- `prompts` preserves either Pi's plain system-prompt string or an ordered block array supplied by a compatible host, appending Telegram guidance without collapsing host-owned blocks.
+- `prompts` preserves either Pi's plain system-prompt string or an ordered block array supplied by a compatible host, appending Telegram guidance without collapsing host-owned blocks. An absent/null host system prompt is treated as empty, including the disconnected metadata-stripping path.
 - `pi` normalizes settings-manager construction that is either synchronous or asynchronous, then adapts either Pi's legacy enabled-model methods or a generic `get` / `set` settings service before model-menu reads and scoped-model persistence use it. Hosts without an explicit reload method rely on fresh asynchronous construction; durable writes still require `flush`.
 - `lifecycle` continues to require Pi's semantic `agent_settled` boundary. It does not infer terminal settlement from host-specific `agent_end`, retry, or stop events; a compatibility shim must reproduce that contract before it can safely support activity identity and unrecovered-error finalization.
 
@@ -135,6 +135,8 @@ Telegram configuration lives in `~/.pi/agent/telegram.json`. Bot/session identit
 - `/telegram-connect` acquires or moves the active profile's owner slot before polling starts. `/telegram-disconnect` keeps its destructive confirmation, then stops polling and releases only that exact slot. In Threaded Mode it tears down the disconnecting instance's bound Telegram thread: leaders delete their own thread directly, and followers send an authenticated exact-generation disconnect envelope and wait for confirmed leader cleanup before unregistering. Graceful Pi `quit` always preserves the owner slot as restart intent, allowing a reopened same-`cwd` session to reclaim the stale lease. When `threads.automaticCleanup` is enabled (the default), quit also deletes the bound Telegram tab without releasing that restart intent; disabling it preserves the tab through replacement-style suspension. Failed automatic cleanup records diagnostics and falls back to safe suspension so remaining lifecycle cleanup still runs.
 - Session start schedules polling resume asynchronously only when the owner slot already points at the current `pid`/`cwd`, or when a stale same-`cwd` owner can be safely replaced after process restart. Startup and `/resume` do not wait on leader election, Bot API probes, poller handoff, or thread reconciliation before restoring the Pi session.
 - The polling owner alone bounds `getUpdates`: each request derives its cancellation budget from Telegram's declared long-poll timeout plus 10 seconds of transport grace (10 seconds for the zero-timeout initial sync and 40 seconds for the normal 30-second poll). The request-local controller inherits poller cancellation, rejects its owner at the budget, and fences any late transport result. Ordinary Bot API and media operations do not receive speculative blanket deadlines. Existing caller signals remain authoritative through API retry waits, only retry-safe methods replay explicit retryable responses, and non-idempotent sends preserve commit-unknown evidence instead of risking duplicate mutation.
+- Ten consecutive `getUpdates` conflict responses, including initial cursor sync, terminate polling with `persistent-conflict`; a successful response or a different error resets the count. The controller detaches its inner promise before notifying the locked lifecycle, avoiding teardown waiting on itself. That lifecycle stops ownership checks, lease refresh, capability monitoring, typing, and classic or bus transport (including leader health, pruning, and IPC), withdraws local direct authority, and transactionally releases only its exact lock. A failed durable release leaves local authority revoked; explicit reacquisition mints a fresh epoch. Accepted queue receipts and local Pi dispatch survive. One terminal diagnostic distinguishes lost local ownership from a competing client despite an apparently owned lock and reports cleanup failures; ordinary status refreshes retain generic `error` until transport recovers. Remove the competing client, then use `/telegram-connect`; no automatic retry continues after the terminal threshold.
+- Manual and automatic polling starts share a lifecycle generation. A later suspend, disconnect, persistent-conflict stop, or accepted start invalidates older startup continuations; reconnect captures its generation before waiting for transport teardown and rechecks it before acquiring ownership and after awaited startup work. Obsolete completion or failure cannot report a successful connection or roll back a replacement. Admission rejects stale/unauthorized contexts before advancing its own startup generation, so a rejected call cannot cancel valid in-flight initialization. After awaited bus startup, thread-aware completion checks its generation before starting leader health or changing fallback/startup-option state; teardown clears health independently of the current mode flag. Startup probes, capability-monitor transitions, and observed-target transitions share an orchestration lifecycle fence and check it inside their effect-owning helpers after awaited queries, persistence, or transport work. Monitor stop also invalidates pending observations. These checks suppress subsequent state changes, fallback, health, and status effects; already-issued API/persistence calls retain their own transport/storage fencing.
 - `pollingActive` reports only whether this runtime still owns an unresolved polling lifecycle; it is not health evidence. A separate observable state records `starting`, `long-poll`, `persisting-journal`, `persisting-offset`, `retrying`, or `stopped`, together with phase start, current update id, last successful response time/count, and terminal stop reason. This distinguishes a stuck HTTP poll from downstream update work without a wall-clock stale heuristic.
 - Built-in read-only menu commands return after required local mutation and schedule context-fenced rendering and command synchronization independently, so those effects cannot withhold the next inbound offset.
 - Pi `print`/`json` run modes stay passive. Inherited child sessions that share `telegram.json` but do not own the exact `pid`/`cwd` slot must not poll or call `getUpdates` unless the operator force-takes ownership.
@@ -339,7 +341,7 @@ Assistant delivery guarantees:
 - Quoted rich replies use Telegram `rich_message` blocks as the prompt-context source when available, so `[reply]` context receives rendered plain text instead of raw `InputRichMessage.markdown` fallback text. Replied media runs through the same inbound handlers and voice transcription providers as current-message media, with provenance-scoped `[outputs|from:…]` appended inside the reply block.
 - Long native Markdown replies are split only at Telegram Rich Message transport limits; oversized fenced code, display-math, and fully wrapped inline-formatting blocks are rewrapped per chunk so persisted Rich Markdown chunks remain structurally valid.
 - When Draft previews are enabled, streaming previews pass structurally closed assistant Markdown prefixes through to `sendRichMessageDraft` with ownership checks, voice suppression, and serialized flushes. Unclosed inline spans, links, fenced code, comments, and display-math blocks are held back until a safe boundary exists. Draft failures are recorded and the failing frame is skipped instead of degrading to raw plain-message previews, because partial Markdown can be invalid while the final message remains valid.
-- Preview flushes are serialized so older edits cannot race newer drafts; final delivery waits for active draft flushes and does not perform a post-final draft-clear call.
+- Preview flushes are serialized so older edits cannot race newer drafts; final delivery waits for active draft flushes and does not perform a post-final draft-clear call. Successful final text delivery clears the local pending preview text only while the captured session and transport remain active, so a late delivery or Rich-attachment cleanup cannot erase replacement preview state.
 
 UI/compat rendering guarantees:
 

package/node_modules/@llblab/pi-telegram/docs/multi-instance-bus.md

@@ -434,7 +434,7 @@ Follower Restore requires exact registration generation and expected old target
 
 - Two leaders calling `getUpdates` is the main safety failure.
 - Lock heartbeat/takeover must be atomic enough to prevent this under normal local concurrency.
-- If Telegram returns API conflict behavior, record diagnostics and force one leader to step down.
+- Persistent competing `getUpdates` clients trigger a full transport stand-down even when the local lock still appears owned; the stopped runtime preserves accepted local work and releases only its exact ownership. See [Runtime Ownership](./architecture.md#runtime-ownership) for the threshold, diagnostic, and reconnect contract.
 
 ## Security Boundaries
 

package/node_modules/@llblab/pi-telegram/index.ts

@@ -1034,6 +1034,12 @@ export default function (pi: Pi.ExtensionAPI) {
       Pi.ExtensionContext
     >({
       state: pollingControllerState,
+      canStart(ctx) {
+        return telegramSessionContextStore.isCurrent(ctx) && lockRuntime.owns(ctx);
+      },
+      onPersistentConflict(ctx, count): Promise<void> {
+        return lockedPollingRuntime.onPersistentConflict(ctx, count);
+      },
       getConfig: configStore.get,
       hasBotToken: configStore.hasBotToken,
       deleteWebhook,
@@ -1205,8 +1211,10 @@ export default function (pi: Pi.ExtensionAPI) {
   const threadAwarePollingPorts = telegramThreadCapabilityRuntime.pollingPorts;
   const lockedPollingRuntime = Locks.createTelegramLockedPollingRuntime({
     lock: lockRuntime,
+    transportMonitor: telegramThreadCapabilityMonitor,
     hasBotToken: configStore.hasBotToken,
     canStartPolling: Pi.canStartPollingInExtensionContext,
+    isContextCurrent: telegramSessionContextStore.isCurrent,
     formatStartBlockedMessage: Pi.formatPollingStartBlockedByRunMode,
     startPolling: threadAwarePollingPorts.startPolling,
     stopPolling: threadAwarePollingPorts.stopPolling,

package/node_modules/@llblab/pi-telegram/lib/locks.ts

@@ -871,6 +871,7 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
     options.runtimeGeneration ?? allocateTelegramLockRuntimeGeneration();
   let ownedLockKey: string | undefined;
   let ownedLock: TelegramLockEntry | undefined;
+  let deliveryRevoked = false;
   const stateOptions = () => ({
     nowMs: getNowMs(),
     staleHeartbeatMs: options.staleHeartbeatMs,
@@ -917,7 +918,8 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
         );
         if (
           state.kind === "active-here" &&
-          hasSameLockOwner(current, expectedOwned)
+          hasSameLockOwner(current, expectedOwned) &&
+          !deliveryRevoked
         ) {
           return {
             result: {
@@ -958,6 +960,7 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
         if (
           !acquireOptions.election &&
           (state.kind === "active-here" || state.kind === "active-elsewhere") &&
+          !(deliveryRevoked && hasSameLockOwner(current, expectedOwned)) &&
           (!acquireOptions.force ||
             !expectedReplacementMatches ||
             !canReplaceCurrent)
@@ -978,6 +981,7 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
         locks[effectiveKey] = lock;
         ownedLockKey = effectiveKey;
         ownedLock = lock;
+        deliveryRevoked = false;
         return {
           result: {
             ok: true,
@@ -987,8 +991,10 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
           changed: true,
         };
       }),
-    release: () =>
-      withLockTransaction(locksPath, (locks) => {
+    release: () => {
+      // Withdraw local send authority even if the durable release fails.
+      deliveryRevoked = true;
+      return withLockTransaction(locksPath, (locks) => {
         const effectiveKey = resolveEffectiveKey();
         const state = getLockState(
           parseTelegramLockEntry(locks[effectiveKey]),
@@ -1008,17 +1014,20 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
           ownedLock = undefined;
         }
         return { result: state, changed };
-      }),
+      });
+    },
     getState: () => getLockState(readLock(), pid, isAlive, stateOptions()),
     getStatusLabel: () =>
       formatLockState(getLockState(readLock(), pid, isAlive, stateOptions())),
     getOwnedLeaderEpoch: () => {
+      if (deliveryRevoked) return undefined;
       const effectiveKey = resolveEffectiveKey();
       const lock = parseTelegramLockEntry(readLocks(locksPath)[effectiveKey]);
       const exactOwner = adoptCompatibleOwnedLock(effectiveKey, lock);
       return hasSameLockOwner(lock, exactOwner) ? lock?.leaderEpoch : undefined;
     },
     owns: (ctx) => {
+      if (deliveryRevoked) return false;
       const effectiveKey = resolveEffectiveKey();
       const lock = parseTelegramLockEntry(readLocks(locksPath)[effectiveKey]);
       return hasSameLockOwner(
@@ -1027,7 +1036,7 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
       );
     },
     commitIfOwned: (commit) =>
-      withLockTransaction(locksPath, (locks) => {
+      !deliveryRevoked && withLockTransaction(locksPath, (locks) => {
         const effectiveKey = resolveEffectiveKey();
         const lock = parseTelegramLockEntry(locks[effectiveKey]);
         const exactOwner =
@@ -1043,7 +1052,7 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
         return { result: true, changed: false };
       }),
     refresh: (ctx) =>
-      withLockTransaction(locksPath, (locks) => {
+      !deliveryRevoked && withLockTransaction(locksPath, (locks) => {
         const effectiveKey = resolveEffectiveKey();
         const lock = parseTelegramLockEntry(locks[effectiveKey]);
         const expectedOwner = adoptCompatibleOwnedLock(effectiveKey, lock, ctx);
@@ -1116,6 +1125,7 @@ export interface TelegramLockedPollingRuntime<
   ) => Promise<TelegramLockedPollingStartResult>;
   stop: () => Promise<string>;
   suspend: () => Promise<void>;
+  onPersistentConflict: (ctx: TContext, count: number) => Promise<void>;
   onSessionStart: (_event: unknown, ctx: TContext) => Promise<void>;
   registerFollowerWithOwner?: (
     ctx: TContext,
@@ -1130,6 +1140,7 @@ export interface TelegramLockedPollingRuntimeDeps<
   lock: TelegramLockRuntime<TContext>;
   hasBotToken: () => boolean;
   canStartPolling?: (ctx: TContext) => boolean;
+  isContextCurrent?: (ctx: TContext) => boolean;
   formatStartBlockedMessage?: (ctx: TContext) => string;
   startPolling: (
     ctx: TContext,
@@ -1142,6 +1153,7 @@ export interface TelegramLockedPollingRuntimeDeps<
   ) => boolean | undefined | Promise<boolean | undefined>;
   stopFollowerRegistration?: () => void;
   onTransportAvailabilityChanged?: () => void;
+  transportMonitor?: { start: (ctx: TContext) => void; stop: () => void };
   updateStatus: (ctx: TContext) => void;
   recordRuntimeEvent?: (
     category: string,
@@ -1164,9 +1176,10 @@ export function createTelegramLockedPollingRuntime<
   let ownershipCheckInterval: ReturnType<typeof setInterval> | undefined;
   let ownershipRefreshInterval: ReturnType<typeof setInterval> | undefined;
   let ownershipStop: Promise<void> | undefined;
+  let activeContext: TContext | undefined;
   let takeoverCandidate: TelegramLockEntry | undefined;
   let sessionAutoStartRun: Promise<void> | undefined;
-  let sessionAutoStartGeneration = 0;
+  let pollingGeneration = 0;
   const ownershipCheckMs =
     deps.ownershipCheckMs ?? TELEGRAM_OWNERSHIP_CHECK_MS;
   const ownershipRefreshMs =
@@ -1178,7 +1191,9 @@ export function createTelegramLockedPollingRuntime<
     ownershipRefreshInterval = undefined;
   };
   const suspendPolling = async () => {
-    sessionAutoStartGeneration += 1;
+    pollingGeneration += 1;
+    activeContext = undefined;
+    deps.transportMonitor?.stop();
     deps.stopFollowerRegistration?.();
     stopOwnershipWatcher();
     if (sessionAutoStartRun) {
@@ -1192,6 +1207,8 @@ export function createTelegramLockedPollingRuntime<
   };
   const stopAfterOwnershipLoss = () => {
     if (ownershipStop) return;
+    activeContext = undefined;
+    deps.transportMonitor?.stop();
     stopOwnershipWatcher();
     deps.onTransportAvailabilityChanged?.();
     ownershipStop = deps
@@ -1228,7 +1245,10 @@ export function createTelegramLockedPollingRuntime<
   const runOwnedPollingStart = async (
     ctx: TContext,
     options: TelegramLockedPollingStartOptions,
+    isCurrent: () => boolean,
   ): Promise<boolean> => {
+    if (!isCurrent()) return false;
+    activeContext = ctx;
     startOwnershipWatcher(ctx);
     try {
       if (!deps.lock.refresh(snapshotLockContext(ctx))) {
@@ -1236,8 +1256,10 @@ export function createTelegramLockedPollingRuntime<
         return false;
       }
       await options.onAcquired?.();
+      if (!isCurrent()) return false;
       await deps.startPolling(ctx, options);
     } catch (error) {
+      if (!isCurrent()) return false;
       stopOwnershipWatcher();
       try {
         await deps.stopPolling();
@@ -1246,14 +1268,22 @@ export function createTelegramLockedPollingRuntime<
           phase: "startup-rollback",
         });
       }
+      if (!isCurrent()) return false;
       deps.lock.release();
       deps.onTransportAvailabilityChanged?.();
       throw error;
     }
-    if (deps.lock.owns(ctx)) return true;
+    if (!isCurrent()) return false;
+    if (deps.lock.owns(ctx)) {
+      if (activeContext !== ctx) return false;
+      deps.transportMonitor?.start(ctx);
+      return true;
+    }
     stopOwnershipWatcher();
     if (ownershipStop) await ownershipStop;
+    if (!isCurrent()) return false;
     await deps.stopPolling();
+    if (!isCurrent()) return false;
     deps.onTransportAvailabilityChanged?.();
     return false;
   };
@@ -1270,6 +1300,17 @@ export function createTelegramLockedPollingRuntime<
       if (!canStartPolling(ctx)) {
         return { ok: false, message: formatStartBlockedMessage(ctx) };
       }
+      const cancelled = {
+        ok: false as const,
+        canTakeover: false as const,
+        message: "Telegram polling startup was cancelled or superseded.",
+      };
+      if (deps.isContextCurrent?.(ctx) === false) return cancelled;
+      const generation = ++pollingGeneration;
+      const isCurrent = () => generation === pollingGeneration &&
+        (deps.isContextCurrent?.(ctx) ?? true);
+      if (ownershipStop) await ownershipStop;
+      if (!isCurrent()) return cancelled;
       let acquired = deps.lock.acquire(ctx, {
         force: options.force,
         expectedOwner:
@@ -1306,6 +1347,7 @@ export function createTelegramLockedPollingRuntime<
               ctx,
               acquired.lock,
             );
+            if (!isCurrent()) return cancelled;
             if (registered) {
               deps.updateStatus(ctx);
               return { ok: true, canTakeover: false };
@@ -1337,13 +1379,15 @@ export function createTelegramLockedPollingRuntime<
         };
       }
       takeoverCandidate = undefined;
-      if (!(await runOwnedPollingStart(ctx, options))) {
+      if (!(await runOwnedPollingStart(ctx, options, isCurrent))) {
+        if (!isCurrent()) return cancelled;
         return {
           ok: false,
           canTakeover: false,
           message: "Telegram leadership changed during polling startup.",
         };
       }
+      if (!isCurrent()) return cancelled;
       deps.onTransportAvailabilityChanged?.();
       deps.updateStatus(ctx);
       const staleSuffix = acquired.replacedStale ? " Replaced stale lock." : "";
@@ -1362,6 +1406,42 @@ export function createTelegramLockedPollingRuntime<
       return "Telegram bridge disconnected.";
     },
     suspend: suspendPolling,
+    onPersistentConflict: async (ctx, count) => {
+      if (activeContext === undefined || ownershipStop) return;
+      if (!(deps.isContextCurrent?.(ctx) ?? activeContext === ctx)) return;
+      activeContext = undefined;
+      pollingGeneration += 1;
+      stopOwnershipWatcher();
+      deps.transportMonitor?.stop();
+      let ownership = "unverifiable";
+      const cleanupErrors: string[] = [];
+      try {
+        ownership = deps.lock.owns(snapshotLockContext(ctx)) ? "owned" : "lost";
+      } catch (error) {
+        cleanupErrors.push(String(error));
+      }
+      try {
+        deps.lock.release();
+      } catch (error) {
+        ownership = "unverifiable";
+        cleanupErrors.push(String(error));
+      }
+      ownershipStop = Promise.resolve()
+        .then(() => deps.stopPolling())
+        .catch((error) => { cleanupErrors.push(String(error)); })
+        .finally(() => {
+          ownershipStop = undefined;
+          deps.recordRuntimeEvent?.("polling", ownership === "lost"
+            ? "Telegram transport stopped: local ownership lost; check for another Pi instance."
+            : "Telegram transport stopped: competing getUpdates client or ownership mismatch.", {
+            phase: "persistent-conflict", count, ownership,
+            ...(cleanupErrors.length ? { cleanupErrors } : {}),
+          });
+          deps.updateStatus(ctx);
+        });
+      deps.onTransportAvailabilityChanged?.();
+      await ownershipStop;
+    },
     onSessionStart: async (_event, ctx) => {
       if (!deps.hasBotToken()) return;
       if (!canStartPolling(ctx)) return;
@@ -1379,15 +1459,18 @@ export function createTelegramLockedPollingRuntime<
       ) {
         return;
       }
-      sessionAutoStartGeneration += 1;
-      const generation = sessionAutoStartGeneration;
+      if (deps.isContextCurrent?.(ctx) === false) return;
+      const generation = ++pollingGeneration;
+      const isCurrent = () => generation === pollingGeneration &&
+        (deps.isContextCurrent?.(ctx) ?? true);
       const startedAtMs = Date.now();
       deps.recordRuntimeEvent?.("lock", "Telegram auto-start scheduled", {
         phase: "auto-start-scheduled",
       });
       const run = (async () => {
         await new Promise((resolve) => setTimeout(resolve, 0));
-        if (generation !== sessionAutoStartGeneration) return;
+        if (ownershipStop) await ownershipStop;
+        if (!isCurrent()) return;
         if (canResumeStaleSameCwd || canHandoffSameProcess) {
           const acquired = deps.lock.acquire(
             ctx,
@@ -1397,9 +1480,9 @@ export function createTelegramLockedPollingRuntime<
           );
           if (!acquired.ok) return;
         }
-        if (generation !== sessionAutoStartGeneration) return;
-        if (!(await runOwnedPollingStart(ctx, {}))) return;
-        if (generation !== sessionAutoStartGeneration) return;
+        if (!isCurrent()) return;
+        if (!(await runOwnedPollingStart(ctx, {}, isCurrent))) return;
+        if (!isCurrent()) return;
         deps.onTransportAvailabilityChanged?.();
         deps.updateStatus(ctx);
         deps.recordRuntimeEvent?.("lock", "Telegram auto-start completed", {

package/node_modules/@llblab/pi-telegram/lib/polling.ts

@@ -21,6 +21,7 @@ const TELEGRAM_LONG_POLL_LIMIT = 10;
 const TELEGRAM_LONG_POLL_TIMEOUT_SECONDS = 30;
 const TELEGRAM_THREAD_CAPABILITY_MONITOR_INTERVAL_MS = 2_500;
 const TELEGRAM_THREAD_CAPABILITY_DISABLED_CONFIRMATION_PROBES = 2;
+export const TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT = 10;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_LIMIT = 3;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS = 1_000;
 const TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS = 3_000;
@@ -69,6 +70,15 @@ export function getLatestTelegramUpdateId(
   return updates.at(-1)?.update_id;
 }
 
+export class TelegramPersistentGetUpdatesConflictError extends Error {
+  readonly count: number;
+  constructor(count: number) {
+    super(`Telegram polling stopped after ${count} consecutive getUpdates conflicts.`);
+    this.name = "TelegramPersistentGetUpdatesConflictError";
+    this.count = count;
+  }
+}
+
 export class TelegramGetUpdatesTimeoutError extends Error {
   readonly timeoutMs: number;
 
@@ -126,7 +136,8 @@ export type TelegramPollingStopReason =
   | "not-started"
   | "requested"
   | "completed"
-  | "failed";
+  | "failed"
+  | "persistent-conflict";
 
 export interface TelegramPollingStateSnapshot {
   phase: TelegramPollingPhase;
@@ -200,6 +211,7 @@ export interface TelegramPollingRuntimeDeps<
   createAbortController?: () => AbortController;
   getNowMs?: () => number;
   onPollingStateChange?: () => void;
+  onPersistentConflict?: (ctx: TContext, count: number) => MaybePromise<void>;
   onPollingStarted?: () => void;
   onPollingStopped?: (reason: TelegramPollingStopReason) => void;
 }
@@ -227,20 +239,31 @@ export interface TelegramPollingAdmissionRuntime<TContext> {
 export function createTelegramPollingAdmissionRuntime<TContext>(deps: {
   polling: TelegramPollingController<TContext>;
   prepareStart?: () => MaybePromise<void>;
+  canStart?: (ctx: TContext) => boolean;
   validateStart?: () => void;
   worker: {
     onSessionStart: (ctx: TContext) => Promise<void>;
   };
 }): TelegramPollingAdmissionRuntime<TContext> {
+  let generation = 0;
   return {
     isActive: deps.polling.isActive,
     async start(ctx) {
+      if (!(deps.canStart?.(ctx) ?? true)) return;
+      const expectedGeneration = ++generation;
+      const isCurrent = () => expectedGeneration === generation && (deps.canStart?.(ctx) ?? true);
+      if (!isCurrent()) return;
       await deps.prepareStart?.();
+      if (!isCurrent()) return;
       deps.validateStart?.();
       await deps.worker.onSessionStart(ctx);
-      await deps.polling.start(ctx);
+      if (!isCurrent()) return;
+      deps.polling.start(ctx);
+    },
+    async stop() {
+      generation += 1;
+      await deps.polling.stop();
     },
-    stop: deps.polling.stop,
   };
 }
 
@@ -256,6 +279,7 @@ export type TelegramDurablePollingRuntimeAssemblyDeps<
   TelegramPollingControllerRuntimeDeps<TUpdate, TContext>,
   "appendUpdateBatch" | "getJournalEntryCount" | "signalUpdateWorker"
 > & {
+  canStart?: (ctx: TContext) => boolean;
   journal: {
     appendBatch: (
       updates: readonly TUpdate[],
@@ -287,6 +311,7 @@ export function createTelegramDurablePollingRuntimeAssembly<
   const admission = createTelegramPollingAdmissionRuntime({
     polling: controller,
     prepareStart: deps.journal.prepareCursorCutover,
+    canStart: deps.canStart,
     validateStart() {
       if (deps.journal.getAcceptedThroughUpdateId() !== undefined) return;
       if (deps.journal.getBootstrapEntryCount() === 0) return;
@@ -312,6 +337,7 @@ export type TelegramPollingControllerRuntimeDeps<
   createAbortController?: () => AbortController;
   getNowMs?: () => number;
   onPollingStateChange?: () => void;
+  onPersistentConflict?: (ctx: TContext, count: number) => MaybePromise<void>;
 };
 
 function notifyTelegramPollingStateChange(
@@ -390,6 +416,7 @@ export function createTelegramPollingControllerRuntime<
     createAbortController: deps.createAbortController,
     getNowMs,
     onPollingStateChange: deps.onPollingStateChange,
+    onPersistentConflict: deps.onPersistentConflict,
     recordRuntimeEvent: deps.recordRuntimeEvent,
   });
 }
@@ -503,6 +530,7 @@ export function startTelegramPollingRuntime<TContext>(
   deps.setPollingController(controller);
   deps.onPollingStarted?.();
   let failed = false;
+  let persistentConflict: TelegramPersistentGetUpdatesConflictError | undefined;
   let runPromise: Promise<void>;
   try {
     runPromise = deps.runPollLoop(ctx, controller.signal);
@@ -513,24 +541,40 @@ export function startTelegramPollingRuntime<TContext>(
   promise = runPromise
     .catch((error) => {
       if (shouldStopTelegramPolling(controller.signal.aborted, error)) return;
+      if (error instanceof TelegramPersistentGetUpdatesConflictError) {
+        persistentConflict = error;
+        return;
+      }
       failed = true;
       deps.recordRuntimeEvent?.("polling", error, {
         phase: "controller",
       });
     })
-    .finally(() => {
+    .finally(async () => {
       const ownsPromise = deps.getPollingPromise() === promise;
       const ownsController = deps.getPollingController() === controller;
       if (ownsPromise) deps.setPollingPromise(undefined);
       if (ownsController) deps.setPollingController(undefined);
-      if (ownsPromise || ownsController) {
-        deps.onPollingStopped?.(
-          failed
-            ? "failed"
-            : controller.signal.aborted
-              ? "requested"
-              : "completed",
-        );
+      if (!ownsPromise && !ownsController) return;
+      deps.onPollingStopped?.(
+        controller.signal.aborted ? "requested" : persistentConflict
+          ? "persistent-conflict" : failed ? "failed" : "completed",
+      );
+      // Detach the inner promise before outer teardown calls polling.stop().
+      if (persistentConflict && !controller.signal.aborted) {
+        try {
+          if (deps.onPersistentConflict) {
+            await deps.onPersistentConflict(ctx, persistentConflict.count);
+          } else {
+            deps.stopTypingLoop();
+            deps.recordRuntimeEvent?.("polling", persistentConflict, {
+              phase: "persistent-conflict", count: persistentConflict.count,
+            });
+          }
+        } catch (error) {
+          deps.recordRuntimeEvent?.("polling", error, { phase: "conflict-stand-down" });
+        }
+        if (deps.getPollingController() || deps.getPollingPromise()) return;
       }
       updateTelegramPollingStatusSafely(deps.updateStatus, ctx, {
         recordRuntimeEvent: deps.recordRuntimeEvent,
@@ -581,6 +625,11 @@ export interface TelegramThreadCapabilityReaderDeps {
   ) => Promise<TResponse>;
 }
 
+interface TelegramThreadCapabilityLifecycle {
+  capture: () => () => boolean;
+  invalidate: () => void;
+}
+
 export interface TelegramStartupThreadCapabilityProbeDeps extends TelegramThreadCapabilityReaderDeps {
   topicTargetStore: TelegramThreadCapabilityStore;
   recordEvent: (
@@ -595,6 +644,7 @@ export interface TelegramStartupThreadCapabilityProbeDeps extends TelegramThread
 export interface TelegramThreadCapabilityRuntimeDeps<
   TContext,
 > extends TelegramThreadCapabilityReaderDeps {
+  lifecycle?: TelegramThreadCapabilityLifecycle;
   topicTargetStore: TelegramThreadCapabilityStore;
   ownsLock: (ctx: TContext) => boolean;
   isFollowerRegistered?: () => boolean;
@@ -672,6 +722,7 @@ export interface TelegramThreadAwarePollingDeps<
   TContext,
   TOwner,
 > extends TelegramStartupThreadCapabilityProbeDeps {
+  lifecycle?: TelegramThreadCapabilityLifecycle;
   isBusRuntimeEnabled: () => boolean;
   isTopicModeUnavailableError: (error: unknown) => boolean;
   getPollingStartedWithTelegramBus: () => boolean;
@@ -749,7 +800,16 @@ export function createTelegramThreadCapabilityStateRuntime(): TelegramThreadCapa
 export function createTelegramThreadCapabilityOrchestration<TContext, TOwner>(
   deps: TelegramThreadCapabilityOrchestrationDeps<TContext, TOwner>,
 ): TelegramThreadCapabilityOrchestration<TContext, TOwner> {
+  let generation = 0;
+  const lifecycle: TelegramThreadCapabilityLifecycle = {
+    capture() {
+      const expected = generation;
+      return () => expected === generation;
+    },
+    invalidate() { generation++; },
+  };
   const capabilityDeps: TelegramThreadCapabilityRuntimeDeps<TContext> = {
+    lifecycle,
     getAllowedUserId: deps.getAllowedUserId,
     callApi: deps.callApi,
     topicTargetStore: deps.topicTargetStore,
@@ -773,6 +833,7 @@ export function createTelegramThreadCapabilityOrchestration<TContext, TOwner>(
     monitor: createTelegramThreadCapabilityMonitor(capabilityDeps),
     observeTarget: createTelegramThreadTargetObservationHandler(capabilityDeps),
     pollingPorts: createTelegramThreadAwarePollingPorts({
+      lifecycle,
       getAllowedUserId: deps.getAllowedUserId,
       callApi: deps.callApi,
       topicTargetStore: deps.topicTargetStore,
@@ -807,8 +868,11 @@ export async function readTelegramThreadCapability(
 
 export async function probeTelegramStartupThreadCapability(
   deps: TelegramStartupThreadCapabilityProbeDeps,
+  isCurrent: () => boolean = () => true,
 ): Promise<boolean | undefined> {
+  if (!isCurrent()) return;
   const threadModeEnabled = await readTelegramThreadCapability(deps);
+  if (!isCurrent()) return;
   const nowMs = (deps.getNowMs ?? Date.now)();
   if (threadModeEnabled === false) {
     deps.topicTargetStore.setBotState({
@@ -817,6 +881,7 @@ export async function probeTelegramStartupThreadCapability(
       lastReconcileAction: "startup-bot-topics-disabled",
     });
     await deps.topicTargetStore.persist();
+    if (!isCurrent()) return;
     deps.recordEvent("bus", "Telegram Threaded Mode unavailable on startup", {
       phase: "startup-bot-topics-disabled",
     });
@@ -831,6 +896,7 @@ export async function probeTelegramStartupThreadCapability(
       lastReconcileAction: "startup-bot-topics-enabled",
     });
     await deps.topicTargetStore.persist();
+    if (!isCurrent()) return;
     deps.setTopicModeUnavailable(false);
   }
   return threadModeEnabled;
@@ -865,8 +931,11 @@ export async function applyTelegramThreadCapability<TContext>(
   threadModeEnabled: boolean,
   phase: string,
   deps: TelegramThreadCapabilityRuntimeDeps<TContext>,
+  isCurrent: () => boolean = deps.lifecycle?.capture() ?? (() => true),
 ): Promise<void> {
+  if (!isCurrent()) return;
   await deps.topicTargetStore.load();
+  if (!isCurrent()) return;
   const nowMs = (deps.getNowMs ?? Date.now)();
   const previousBotState = deps.topicTargetStore.getBotState();
   if (!threadModeEnabled) {
@@ -886,6 +955,7 @@ export async function applyTelegramThreadCapability<TContext>(
       lastReconcileAction: phase,
     });
     await deps.topicTargetStore.persist();
+    if (!isCurrent()) return;
     deps.setTopicModeUnavailable(true);
     deps.stopFollowerRegistration();
     if (
@@ -894,16 +964,20 @@ export async function applyTelegramThreadCapability<TContext>(
     ) {
       deps.stopLeaderHealth();
       await deps.stopBusPolling();
+      if (!isCurrent()) return;
       deps.setPollingStartedWithTelegramBus(false);
       try {
         await deps.startClassicPolling(ctx);
+        if (!isCurrent()) return;
       } catch (classicError) {
+        if (!isCurrent()) return;
         deps.topicTargetStore.setBotState({
           threadMode: "disabled",
           updatedAtMs: (deps.getNowMs ?? Date.now)(),
           lastReconcileAction: `${phase}-classic-restore-failed`,
         });
         await deps.topicTargetStore.persist();
+        if (!isCurrent()) return;
         deps.recordEvent("bus", classicError, {
           phase: `${phase}-classic-restore`,
         });
@@ -919,14 +993,18 @@ export async function applyTelegramThreadCapability<TContext>(
     lastReconcileAction: phase,
   });
   await deps.topicTargetStore.persist();
+  if (!isCurrent()) return;
   deps.setTopicModeUnavailable(false);
   if (!deps.getPollingStartedWithTelegramBus() && deps.ownsLock(ctx)) {
     await deps.stopClassicPolling();
+    if (!isCurrent()) return;
     deps.setPollingStartedWithTelegramBus(true);
     try {
       await deps.startBusPolling(ctx);
+      if (!isCurrent()) return;
       deps.startLeaderHealth();
     } catch (error) {
+      if (!isCurrent()) return;
       deps.setPollingStartedWithTelegramBus(false);
       const threadModeUnavailable =
         deps.isTopicModeUnavailableError?.(error) === true;
@@ -937,17 +1015,21 @@ export async function applyTelegramThreadCapability<TContext>(
           lastReconcileAction: `${phase}-unavailable`,
         });
         await deps.topicTargetStore.persist();
+        if (!isCurrent()) return;
         deps.setTopicModeUnavailable(true);
       }
       try {
         await deps.startClassicPolling(ctx);
+        if (!isCurrent()) return;
       } catch (classicError) {
+        if (!isCurrent()) return;
         deps.topicTargetStore.setBotState({
           threadMode: "disabled",
           updatedAtMs: (deps.getNowMs ?? Date.now)(),
           lastReconcileAction: `${phase}-classic-restore-failed`,
         });
         await deps.topicTargetStore.persist();
+        if (!isCurrent()) return;
         deps.recordEvent("bus", classicError, {
           phase: `${phase}-classic-restore`,
         });
@@ -963,17 +1045,25 @@ export async function applyTelegramThreadCapability<TContext>(
 export function createTelegramThreadAwarePollingPorts<TContext, TOwner>(
   deps: TelegramThreadAwarePollingDeps<TContext, TOwner>,
 ): TelegramThreadAwarePollingPorts<TContext, TOwner> {
+  let generation = 0;
   const startPolling = async (
     ctx: TContext,
     options?: { forceFreshLeaderThread?: boolean },
   ): Promise<void> => {
+    const expectedGeneration = ++generation;
+    deps.lifecycle?.invalidate();
+    const isLifecycleCurrent = deps.lifecycle?.capture() ?? (() => true);
+    const isCurrent = () => expectedGeneration === generation && isLifecycleCurrent();
     await deps.topicTargetStore.load();
+    if (!isCurrent()) return;
     let startupThreadCapability: boolean | undefined;
     try {
-      startupThreadCapability = await probeTelegramStartupThreadCapability(deps);
+      startupThreadCapability = await probeTelegramStartupThreadCapability(deps, isCurrent);
     } catch (error) {
+      if (!isCurrent()) return;
       deps.recordEvent("bus", error, { phase: "startup-thread-mode-probe" });
     }
+    if (!isCurrent()) return;
     deps.setTopicModeUnavailable(startupThreadCapability !== true);
     if (deps.isBusRuntimeEnabled()) {
       deps.setTopicModeUnavailable(false);
@@ -983,32 +1073,39 @@ export function createTelegramThreadAwarePollingPorts<TContext, TOwner>(
           !!options?.forceFreshLeaderThread,
         );
         await deps.startBusLeaderPolling(ctx);
+        if (!isCurrent()) return;
         deps.startLeaderHealth();
         return;
       } catch (error) {
+        if (!isCurrent()) return;
         deps.setPollingStartedWithTelegramBus(false);
         if (!deps.isTopicModeUnavailableError(error)) throw error;
         deps.setTopicModeUnavailable(true);
         await deps.topicTargetStore.load();
+        if (!isCurrent()) return;
         deps.topicTargetStore.setBotState({
           threadMode: "disabled",
           updatedAtMs: Date.now(),
           lastReconcileAction: "thread-mode-unavailable",
         });
         await deps.topicTargetStore.persist();
+        if (!isCurrent()) return;
         deps.recordEvent("bus", error, { phase: "thread-mode-unavailable" });
       } finally {
-        deps.setForceFreshLeaderThreadOnNextStart(false);
+        if (isCurrent()) deps.setForceFreshLeaderThreadOnNextStart(false);
       }
     }
     deps.setPollingStartedWithTelegramBus(false);
     await deps.startClassicPolling(ctx);
   };
   const stopPolling = async (): Promise<void> => {
+    const expectedGeneration = ++generation;
+    deps.lifecycle?.invalidate();
+    deps.setForceFreshLeaderThreadOnNextStart(false);
+    deps.stopLeaderHealth();
     if (deps.getPollingStartedWithTelegramBus()) {
-      deps.stopLeaderHealth();
       await deps.stopBusLeaderPolling();
-      deps.setPollingStartedWithTelegramBus(false);
+      if (expectedGeneration === generation) deps.setPollingStartedWithTelegramBus(false);
       return;
     }
     await deps.stopClassicPolling();
@@ -1043,14 +1140,17 @@ export function createTelegramThreadTargetObservationHandler<TContext>(
     if (transitionPending) return;
     if (deps.topicTargetStore.getBotState().threadMode === "enabled") return;
     transitionPending = true;
+    const isCurrent = deps.lifecycle?.capture() ?? (() => true);
     try {
       await applyTelegramThreadCapability(
         ctx,
         true,
         "thread-target-observed",
         deps,
+        isCurrent,
       );
     } catch (error) {
+      if (!isCurrent()) return;
       deps.recordEvent("bus", error, { phase: "thread-target-observed" });
     } finally {
       transitionPending = false;
@@ -1079,6 +1179,7 @@ export function createTelegramThreadCapabilityMonitor<TContext>(
   let consecutiveDisabledProbes = 0;
   const stop = (): void => {
     generation += 1;
+    deps.lifecycle?.invalidate();
     if (interval) clearInterval(interval);
     interval = undefined;
   };
@@ -1087,7 +1188,8 @@ export function createTelegramThreadCapabilityMonitor<TContext>(
       return;
     }
     const expectedGeneration = generation;
-    const isCurrent = (): boolean => generation === expectedGeneration;
+    const isLifecycleCurrent = deps.lifecycle?.capture() ?? (() => true);
+    const isCurrent = (): boolean => generation === expectedGeneration && isLifecycleCurrent();
     let tracked: Promise<void>;
     tracked = readTelegramThreadCapability(deps)
       .then(async (threadModeEnabled) => {
@@ -1103,6 +1205,7 @@ export function createTelegramThreadCapabilityMonitor<TContext>(
               true,
               "capability-monitor-retry",
               deps,
+              isCurrent,
             );
           }
           return;
@@ -1123,6 +1226,7 @@ export function createTelegramThreadCapabilityMonitor<TContext>(
             false,
             "capability-monitor-disabled-confirmed",
             deps,
+            isCurrent,
           );
           return;
         }
@@ -1153,6 +1257,7 @@ export function createTelegramThreadCapabilityMonitor<TContext>(
               ? "capability-monitor-disabled-confirmed"
               : "capability-monitor-disabled",
           deps,
+          isCurrent,
         );
       })
       .catch((error) => {
@@ -1526,6 +1631,19 @@ export async function runTelegramPollLoop<
   TContext = unknown,
 >(deps: TelegramPollLoopDeps<TUpdate, TContext>): Promise<void> {
   if (!deps.config.botToken) return;
+  let consecutiveGetUpdatesConflicts = 0;
+  const retryConflict = async () => {
+    consecutiveGetUpdatesConflicts += 1;
+    if (consecutiveGetUpdatesConflicts >= TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT) {
+      throw new TelegramPersistentGetUpdatesConflictError(consecutiveGetUpdatesConflicts);
+    }
+    await deps.sleep(
+      consecutiveGetUpdatesConflicts < TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_LIMIT
+        ? TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS
+        : TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS,
+      deps.signal,
+    );
+  };
   try {
     await deps.deleteWebhook(deps.signal);
   } catch {
@@ -1564,7 +1682,9 @@ export async function runTelegramPollLoop<
     } catch (error) {
       if (shouldStopTelegramPolling(deps.signal.aborted, error)) return;
       reportTelegramPollingPhase(deps, "retrying");
-      deps.recordRuntimeEvent?.("polling", error, {
+      if (isTelegramGetUpdatesConflictError(error)) {
+        await retryConflict();
+      } else deps.recordRuntimeEvent?.("polling", error, {
         phase: "initial-sync",
         ...(error instanceof TelegramGetUpdatesTimeoutError
           ? { timeoutMs: error.timeoutMs }
@@ -1572,7 +1692,6 @@ export async function runTelegramPollLoop<
       });
     }
   }
-  let consecutiveGetUpdatesConflicts = 0;
   let currentUpdateId: number | undefined;
   while (!deps.signal.aborted) {
     try {
@@ -1600,6 +1719,10 @@ export async function runTelegramPollLoop<
     } catch (error) {
       if (shouldStopTelegramPolling(deps.signal.aborted, error)) return;
       reportTelegramPollingPhase(deps, "retrying", currentUpdateId);
+      if (isTelegramGetUpdatesConflictError(error)) {
+        await retryConflict();
+        continue;
+      }
       deps.recordRuntimeEvent?.("polling", error, {
         phase:
           error instanceof TelegramGetUpdatesTimeoutError
@@ -1609,17 +1732,6 @@ export async function runTelegramPollLoop<
           ? { timeoutMs: error.timeoutMs }
           : {}),
       });
-      if (isTelegramGetUpdatesConflictError(error)) {
-        consecutiveGetUpdatesConflicts += 1;
-        await deps.sleep(
-          consecutiveGetUpdatesConflicts <
-            TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_LIMIT
-            ? TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS
-            : TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS,
-          deps.signal,
-        );
-        continue;
-      }
       consecutiveGetUpdatesConflicts = 0;
       deps.onErrorStatus(getTelegramPollingErrorMessage(error));
       await deps.sleep(TELEGRAM_POLLING_RETRY_MS, deps.signal);

package/node_modules/@llblab/pi-telegram/lib/prompts.ts

@@ -152,7 +152,7 @@ type TelegramBeforeAgentStartEvent = Omit<
   BeforeAgentStartEvent,
   "systemPrompt"
 > & {
-  systemPrompt: TelegramSystemPrompt;
+  systemPrompt?: TelegramSystemPrompt | null;
 };
 
 type TelegramBeforeAgentStartResult = {
@@ -165,11 +165,12 @@ type TelegramBeforeAgentStartHook = (
 
 export function buildTelegramBridgeSystemPrompt(options: {
   prompt: string;
-  systemPrompt: TelegramSystemPrompt;
+  systemPrompt?: TelegramSystemPrompt | null;
   telegramPrefix?: string;
   localSystemPromptSuffix: string;
   telegramTurnSystemPromptSuffix: string;
 }): TelegramBeforeAgentStartResult {
+  const basePrompt = options.systemPrompt ?? "";
   const telegramPrefix = options.telegramPrefix ?? TELEGRAM_PREFIX;
   const telegramHead = telegramPrefix.endsWith("]")
     ? telegramPrefix.slice(0, -1)
@@ -182,12 +183,12 @@ export function buildTelegramBridgeSystemPrompt(options: {
     ? `${options.telegramTurnSystemPromptSuffix}\n- The current user message came from Telegram.`
     : "";
   return {
-    systemPrompt: Array.isArray(options.systemPrompt)
+    systemPrompt: Array.isArray(basePrompt)
       ? [
-          ...options.systemPrompt,
+          ...basePrompt,
           options.localSystemPromptSuffix + telegramSuffix,
         ]
-      : options.systemPrompt +
+      : basePrompt +
         options.localSystemPromptSuffix +
         telegramSuffix,
   };
@@ -221,8 +222,9 @@ function stripTelegramToolMetadataFromString(systemPrompt: string): string {
 }
 
 function stripTelegramToolMetadataFromSystemPrompt(
-  systemPrompt: TelegramSystemPrompt,
+  systemPrompt: TelegramSystemPrompt | null | undefined,
 ): TelegramSystemPrompt {
+  if (!systemPrompt) return "";
   return Array.isArray(systemPrompt)
     ? systemPrompt.map(stripTelegramToolMetadataFromString)
     : stripTelegramToolMetadataFromString(systemPrompt);

package/node_modules/@llblab/pi-telegram/lib/queue.ts

@@ -1908,6 +1908,8 @@ export async function handleTelegramAgentEndRuntime<
         if (!isDeliveryActive()) return;
         if (richAttachmentDelivered) {
           await deps.clearPreview(turn.chatId, { target: turn.target });
+          if (!isDeliveryActive()) return;
+          deps.setPreviewPendingText("");
         }
       } catch (error) {
         deps.recordRuntimeEvent?.("delivery", error, {
@@ -1938,6 +1940,8 @@ export async function handleTelegramAgentEndRuntime<
             { replyMarkup, target: turn.target },
           );
         }
+        if (!isDeliveryActive()) return;
+        deps.setPreviewPendingText("");
       } catch (error) {
         deps.recordRuntimeEvent?.("delivery", error, {
           phase: "final-text",

package/node_modules/@llblab/pi-telegram/lib/status.ts

@@ -291,6 +291,7 @@ export interface TelegramStatusBarTheme {
 export interface TelegramStatusBarState {
   hasBotToken: boolean;
   pollingActive: boolean;
+  pollingStopReason?: string;
   paired: boolean;
   busRole?: TelegramBridgeBusRole;
   busLifecyclePhase?: TelegramBridgeBusLifecyclePhase;
@@ -699,6 +700,7 @@ export function createTelegramBridgeStatusRuntime<
           queuedItems: queuedItemCount,
         }),
         queuedStatus: deps.formatQueuedStatus(queuedItems),
+        pollingStopReason: deps.getPollingState?.().stopReason,
         error,
       };
     },
@@ -889,6 +891,8 @@ export function buildTelegramStatusBarText(
     : "";
   if (!state.hasBotToken)
     return `${label} ${theme.fg("muted", "not configured")}${queued}`;
+  if (state.pollingStopReason === "persistent-conflict" && state.busRole !== "follower")
+    return `${label} ${theme.fg("error", "error")}`;
   if (!state.paired)
     return `${label} ${theme.fg("warning", "awaiting pairing")}${queued}`;
   if (state.busLifecyclePhase === "electing")

package/node_modules/@llblab/pi-telegram/lib/updates.ts

@@ -2160,6 +2160,7 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
     failurePhase: string,
     error: unknown,
     currentUpdateId?: number,
+    extraDetails?: Record<string, unknown>,
   ): "blocked" => {
     blocked = true;
     state.lastFailureAtMs = getNowMs();
@@ -2168,6 +2169,7 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
       phase: failurePhase,
       generation: owner?.generation,
       ...(currentUpdateId !== undefined ? { updateId: currentUpdateId } : {}),
+      ...extraDetails,
     });
     transition("blocked", currentUpdateId, blockedReason);
     return "blocked";
@@ -2553,6 +2555,10 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
             `Telegram queue receipt ${normalized.receiptId} conflicts with committed authority.`,
           ),
           currentUpdateId,
+          {
+            receiptId: normalized.receiptId,
+            sourceUpdateIds: normalized.sourceUpdateIds,
+          },
         );
       }
       return "duplicate";

package/node_modules/@llblab/pi-telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.43.0",
+  "version": "0.43.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/node_modules/@llblab/pi-telegram/skills/telegram-bridge/references/diagnosis.md

@@ -13,4 +13,6 @@ These slash commands are registered Pi commands, not shell executables or agent
 
 When `PI_CODING_AGENT_DIR` selects another compatible runtime, resolve its equivalent `tmp/telegram` directory.
 
+A `persistent-conflict` polling stop means the bounded competing-`getUpdates` threshold triggered full transport stand-down, not cancellation of accepted local Pi work. The terminal diagnostic distinguishes lost local ownership from a competing client despite an apparently owned lock. Check other profiles, agent directories, installations, or non-Pi clients sharing the bot; after removing the competition, reconnect through the supported Pi command. Do not restart repeatedly or alter lock files to compete for the stream.
+
 Do not mutate ownership files, bridge state, journals, bindings, or locks to force recovery. Use supported commands and preserve exact profile, target, transport, and session authority. Never claim successful delivery without transport evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-kit",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -45,7 +45,7 @@
     "@llblab/pi-codex-usage": "0.9.4",
     "@llblab/pi-grow-loop": "0.7.4",
     "@llblab/pi-state-flow": "0.3.0",
-    "@llblab/pi-telegram": "0.43.0",
+    "@llblab/pi-telegram": "0.43.1",
     "@llblab/skills": "1.14.0"
   },
   "bundledDependencies": [