@llblab/pi-kit 0.5.2 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.6.0 - 2026-09-06
+
+- `Current Distribution`: Advances Telegram to `0.44.0`, Grow Loop to `0.7.5`, and Skills to `1.14.1`. The kit now includes reliable default-on Telegram draft previews and prompt anchors, unambiguous `grow-loop` runtime status, and ABCd contiguous-list validation while preserving the existing package set, resource inventory, and load order.
+
 ## 0.5.2 - 2026-09-06
 
 - `Telegram Ordering Hotfix`: Advances the exact Telegram pin to `0.43.2`, bringing bounded threadless command lifetime, causal final/artifact/compaction publication order, stale-delivery fencing, and suppression of voice replay after uncertain acknowledgement. Other pins and the resource inventory remain unchanged; operator-coordinated live smoke follows release.

package/README.md

@@ -13,10 +13,10 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.52.1` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.1.1` | Isolated nested Pi TUI with explicitly selected extensions |
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.9.4` | Compact Codex/Spark subscription-limit status |
-| [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.7.4` | Visible continuation scheduling and bounded worker Skills |
+| [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.7.5` | Visible continuation scheduling and bounded worker Skills |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.3.0` | Opt-in validated state handoffs between agent runs |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.43.2` | Telegram companion, queues, files, voice, controls, and Generative Apps guidance |
-| [`@llblab/skills`](https://github.com/llblab/skills) | `1.14.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.44.0` | Telegram companion, queues, files, voice, controls, and Generative Apps guidance |
+| [`@llblab/skills`](https://github.com/llblab/skills) | `1.14.1` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.
 

package/node_modules/@llblab/pi-grow-loop/AGENTS.md

@@ -23,10 +23,10 @@
 - `grow-loop` skill owns continuation semantics: continue or stop.
 - Routing selects the protocol before worker execution: explicit names override inference; otherwise concrete iterative tasks may select Grow Loop when multiple validated slices and visible checkpoints are useful.
 - `while-true` skill owns only one portable worker pass: discover one canonical work surface, including neutral `Canonical open work: <path>` declarations from relevant project-local delivery instructions, assess reality, reconcile the plan, assemble one bounded validation cohort, execute independent low-coupling tasks with per-task falsification, run shared validation, and hand off. It batches by default when diagnosis remains clear and falls back to a single task for coupled, ordered, large, high-risk, or ambiguous work. A standalone invocation must not activate or call a continuation scheduler. It must not own continuation, user-stop semantics, command phrases, runtime tools, status text, or extension-specific controls; `grow-loop` plus `grow_loop` own sequential continuation only after Grow Loop was selected.
-- `grow_loop` tool only schedules the next visible iteration; its optional `after_seconds` argument accepts `3` through `3600` and defaults to `3`; the minimum preserves an operator-interrupt window before every continuation. Scheduling is idle-deferred: the tool first waits until Pi is idle and no user messages are pending, then starts the configured countdown and sends the compact trigger `while true | grow loop` only if Pi is still idle and no user messages are pending. A longer delay may serve as a continuation timer while asynchronous work finishes. The agent chooses it from evidence about expected remaining duration and reassesses after every wake; the one-hour maximum is exceptional rather than a polling default. If the runtime becomes busy during the countdown, the tool returns to deferred waiting instead of queueing a hidden follow-up. Status shows deferred scheduling as `loop ∞N` with the iteration number in warning color, countdown as `loop Ns`, and active iterations as `loop ∞N` with the iteration number dimmed; `N` is monotonic within the extension instance and advances once per turn that arms a deferred iteration; repeated tool calls in that turn only replace the delay while retaining the same iteration number.
+- `grow_loop` tool only schedules the next visible iteration; its optional `after_seconds` argument accepts `3` through `3600` and defaults to `3`; the minimum preserves an operator-interrupt window before every continuation. Scheduling is idle-deferred: the tool first waits until Pi is idle and no user messages are pending, then starts the configured countdown and sends the compact trigger `while true | grow loop` only if Pi is still idle and no user messages are pending. A longer delay may serve as a continuation timer while asynchronous work finishes. The agent chooses it from evidence about expected remaining duration and reassesses after every wake; the one-hour maximum is exceptional rather than a polling default. If the runtime becomes busy during the countdown, the tool returns to deferred waiting instead of queueing a hidden follow-up. Status shows deferred scheduling as `grow-loop ∞N` with the iteration number in warning color, countdown as `grow-loop Ns`, and active iterations as `grow-loop ∞N` with the iteration number dimmed; `N` is monotonic within the extension instance and advances once per turn that arms a deferred iteration; repeated tool calls in that turn only replace the delay while retaining the same iteration number.
 - There is no slash-command control surface. Any ordinary user prompt exits the active runtime rhythm by clearing pending scheduling and hiding loop status; restart/continuation intent belongs to the agent and Grow Loop skill, not to a runtime latch or regex.
 - No start slash commands, budgets, cycle counts, hidden processes, or background agents.
-- Loop status is dynamic: show warning-colored `loop ∞N` only while the next iteration is deferred until idle, `loop Ns` only during the configured countdown, and dim `loop ∞N` only while a loop-scheduled turn is active. Clear active status only after Pi fully settles without an armed successor; low-level run endings may still lead to retry or compaction recovery. Any user input except the runtime's exact expected continuation prompt clears pending loop scheduling and hides loop status, including operator input injected through another extension.
+- Loop status is dynamic: show warning-colored `grow-loop ∞N` only while the next iteration is deferred until idle, `grow-loop Ns` only during the configured countdown, and dim `grow-loop ∞N` only while a loop-scheduled turn is active. Clear active status only after Pi fully settles without an armed successor; low-level run endings may still lead to retry or compaction recovery. Any user input except the runtime's exact expected continuation prompt clears pending loop scheduling and hides loop status, including operator input injected through another extension.
 - Grow Loop does not own Escape/abort semantics; Escape remains baseline Pi behavior for active agent turns. The runtime does not block future `grow_loop` tool calls; the skill contract owns whether recent user context means continue, stop, restart, or change direction.
 
 ## Topology

package/node_modules/@llblab/pi-grow-loop/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.7.5: Status Identity Hotfix
+
+- `Status Identity`: Labels deferred, countdown, and active runtime status as `grow-loop` instead of the ambiguous `loop`, matching the extension's public identity and the neighboring State Flow status convention.
+
 ## 0.7.4: Worker Handoff Ownership Hotfix
 
 - `Worker Handoff`: Keeps canonical work-surface resolution and handoff fields with While True; Grow Loop locks user scope and decides whether to schedule another iteration from the returned evidence without duplicating discovery or worker analysis.

package/node_modules/@llblab/pi-grow-loop/README.md

@@ -144,18 +144,18 @@ The tool never blocks future calls. Whether to continue belongs to the agent and
 ## Runtime Statuses
 
 - No status — no active loop rhythm, or the operator took the turn.
-- `loop ∞N` warning — the next loop prompt is armed and waiting for idle/no pending messages.
-- `loop Ns` countdown — Pi is idle and the configured delay is running.
-- `loop ∞N` dim — the compact loop prompt was sent for this iteration.
+- `grow-loop ∞N` warning — the next loop prompt is armed and waiting for idle/no pending messages.
+- `grow-loop Ns` countdown — Pi is idle and the configured delay is running.
+- `grow-loop ∞N` dim — the compact loop prompt was sent for this iteration.
 
-`N` is monotonic within the current extension instance and advances only once when a turn arms its deferred successor. Repeated `grow_loop` calls before that turn ends retain `N`, replace the pending delay, and report that the iteration was already scheduled. Active status clears when the scheduled agent run fully settles without arming a successor, so automatic retry or compaction recovery does not produce a false idle state. There is no `loop stopped` or `loop paused` status; absence of loop status means the runtime rhythm is no longer active.
+`N` is monotonic within the current extension instance and advances only once when a turn arms its deferred successor. Repeated `grow_loop` calls before that turn ends retain `N`, replace the pending delay, and report that the iteration was already scheduled. Active status clears when the scheduled agent run fully settles without arming a successor, so automatic retry or compaction recovery does not produce a false idle state. There is no `grow-loop stopped` or `grow-loop paused` status; absence of Grow Loop status means the runtime rhythm is no longer active.
 
 ## Interruption Model
 
 Any user prompt except the scheduler's exact expected continuation prompt exits the active runtime rhythm. This includes operator input delivered through Telegram, RPC bridges, or other extensions:
 
 ```text
-Runtime: loop 3.0s or loop ∞2
+Runtime: grow-loop 3.0s or grow-loop ∞2
 User: What changed?
 Runtime: hides loop status and cancels pending scheduling
 Agent: answers, stops, changes direction, or later continues based on intent and context
@@ -193,7 +193,7 @@ Normal continuation:
 ```text
 User: grow loop
 Agent: closes one backlog slice, validates, reports evidence, calls grow_loop
-Runtime: loop ∞1 → loop 3.0s → while true | grow loop
+Runtime: grow-loop ∞1 → grow-loop 3.0s → while true | grow loop
 ```
 
 Terminal stop proof:

package/node_modules/@llblab/pi-grow-loop/index.ts

@@ -9,6 +9,7 @@ import type {
 import { Type } from "typebox";
 
 const STATUS_KEY = "pi-grow-loop";
+const STATUS_LABEL = "grow-loop";
 const DEFAULT_FOLLOW_UP_DELAY_MS = 3000;
 const DEFAULT_COUNTDOWN_TICK_MS = 100;
 const MIN_AFTER_SECONDS = 3;
@@ -42,7 +43,8 @@ function statusCountdown(ctx: ExtensionContext, seconds: number) {
   const theme = ctx.ui.theme;
   ctx.ui.setStatus(
     STATUS_KEY,
-    theme.fg("accent", "loop") + theme.fg("dim", ` ${seconds.toFixed(1)}s`),
+    theme.fg("accent", STATUS_LABEL) +
+      theme.fg("dim", ` ${seconds.toFixed(1)}s`),
   );
 }
 
@@ -50,7 +52,7 @@ function statusRunning(ctx: ExtensionContext, iteration: number) {
   const theme = ctx.ui.theme;
   ctx.ui.setStatus(
     STATUS_KEY,
-    theme.fg("accent", "loop") + theme.fg("dim", ` ∞${iteration}`),
+    theme.fg("accent", STATUS_LABEL) + theme.fg("dim", ` ∞${iteration}`),
   );
 }
 
@@ -58,7 +60,8 @@ function statusDeferred(ctx: ExtensionContext, iteration: number) {
   const theme = ctx.ui.theme;
   ctx.ui.setStatus(
     STATUS_KEY,
-    theme.fg("accent", "loop") + theme.fg("warning", ` ∞${iteration}`),
+    theme.fg("accent", STATUS_LABEL) +
+      theme.fg("warning", ` ∞${iteration}`),
   );
 }
 

package/node_modules/@llblab/pi-grow-loop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-grow-loop",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "private": false,
   "description": "Semantic loop-engineering for agent-owned, visible, interruptible continuation in Pi",
   "keywords": [

package/node_modules/@llblab/pi-telegram/AGENTS.md

@@ -126,7 +126,7 @@ The detailed map is canonical in [`docs/architecture.md`](./docs/architecture.md
 - Remove dead code immediately. Reachability from composition roots, public exports, tests, registered surfaces, and documented APIs—not recent usefulness—determines whether code is live.
 - Treat every meaningful `index.ts` edit as a composition-pressure check, but keep one-off live adapter wiring there when extraction would only hide cross-domain state.
 - Follow [`docs/ui-style.md`](./docs/ui-style.md) for interface copy, emoji, buttons, menus, and dialogs. Update the registry before assigning a new UI emoji meaning. Standalone notices use one fully bold emoji-led sentence with a terminal period; menu or chooser headings use the same hierarchy with a terminal colon. Material names may add nested italic emphasis without breaking the outer bold span. Callback alerts preserve equivalent emoji-led plain text because Telegram does not support rich formatting there.
-- Markdown tables use compact source formatting with `---` separator cells and one surrounding space per cell. Preserve vendored references unchanged.
+- Markdown lists never contain blank lines between adjacent items; list items are not paragraphs. Use blank lines only between paragraphs or independently separated blocks. Markdown tables use compact source formatting with `---` separator cells and one surrounding space per cell. Preserve vendored references unchanged.
 - Treat Windows filesystem, named-pipe, lock, heartbeat, and atomic-rename reports as high-signal evidence; reduce them to regressions or explicit platform caveats.
 - Route significant runtime failures through the redacted recent-event recorder. Keep the compact TUI status at generic `error`; details belong in diagnostics.
 

package/node_modules/@llblab/pi-telegram/BACKLOG.md

@@ -2,7 +2,6 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
-- [ ] `Post-release command and ordering smoke`: By explicit operator decision, perform live smoke after the combined `0.43.2` hotfix rather than gate publication on it. Verify threadless command routing and Telegram-originated final/artifact/compaction ordering, including follower delivery, without deleting live journals or accepted work. Deterministic verification does not establish the operator's exact incident or constitute live-client evidence. Retain the limits in `docs/outbound.md#publication-limits`; no exactly-once or bounded-pending-queue guarantee is claimed. Installed-runtime replacement remains a separate operator action.
 - [ ] `Live-thread continuity and recovery`: Make loss and restoration of a live thread truthful and safe without discarding accepted work or deleting a currently owned target; the initial cause of the observed stale-thread API failures remains unproven.
   - [ ] Complete the remaining operator-coordinated live smoke beyond the operator-confirmed successful leader Restore: verify follower Restore, inaccessible callbacks, already-absent chooser cleanup, direct stale-target diagnostics, and preservation of accepted local work/active-turn target. Use disposable test threads. The successful leader flow does not independently prove these failure paths or establish the initial stale-thread failure cause.
 - [ ] `Native in-body controls live smoke`: Extend the operator-confirmed successful current-client smoke (singleton CML and mixed JSON/CML rows between paragraphs, ordinary prompt callbacks, labeled disabled control, separate footer callback, and HTML-mode footer fallback) to an independently identified second client, follower routing, blank disabled cells, and app-method dispatch/revision rejection. Do not infer coverage from the confirmed ordinary-button flow; in-body selection uses callback acknowledgement, not body recoloring.

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -2,20 +2,24 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## Unreleased
+
+## 0.44.0: Reliable Draft Previews
+
+- `Draft Experience`: Enables previews when no current or legacy preference is configured, preserving explicit opt-outs without migration and identifying on as the default in Settings. A two-second leading/trailing throttle sends the first eligible frame immediately and then only the latest accumulated text, producing an operator-accepted rhythm on short and long answers while reducing Telegram rate-limit pressure.
+- `Preview Completion`: Seals draft updates when an assistant message ends, cancels pending throttle timers, and waits only for an already-issued request. Retryable failures defer fresh frames without replaying stale bodies or delaying the final; queued, late, failed, cancelled, and replacement drafts cannot append an obsolete tail.
+- `Publication Ownership`: Gives intermediate and final text one permanent publication owner, eliminating rollover duplication. Background finals capture their originating preview before admission, so delayed work cannot seal, overwrite, await, or deadlock a replacement turn. Rollover barriers remain outside Pi lifecycle hooks and release on failure or cancellation.
+- `Prompt Anchors`: Preserves once-per-turn quoting across delayed text, voice, ordinary uploads, Rich media, and operational delivery. The first successfully delivered permanent response carries the originating prompt anchor; known rejection preserves it for fallback, unknown ACK avoids unsafe replay, and later responses omit the repeated quote.
+
 ## 0.43.2: Command Lifetime And Publication Order
 
 - `All-Tab Command Expiry`: Uses the original Telegram timestamp to expire unselected Threaded Mode command choosers after 60 minutes, settle their deferred source, and reject stale buttons; replay of an expired command creates no new chooser. Active dispatch pauses expiry; failed attempts retain the original deadline, and accepted queue receipts remain protected. Excludes `/thread`, bound threads, classic mode, and invalid timestamps; storage failures retain journal authority.
 - `Selected All-Tab Commands`: Settles still-deferred sources after successful local command dispatch or confirmed follower acceptance, preventing replay after chooser cleanup. Failed follower transfers retain their sources. Background menu rendering remains non-blocking, and commands admitted to the Pi queue retain receipt-governed settlement.
 - `Repeated All-Tab Starts`: A newly delivered chooser for an identical unselected `/start` supersedes older sources from the same user/chat and active admission worker. Different arguments, other commands, and previously selected intents remain separate; superseded callbacks become inert. Failed chooser sends discard their in-memory attempt without settling the journal source, so retries do not exhaust chooser capacity.
-
 - `Causal Publication Order`: Serializes bridge-owned assistant blocks, activity disclosures, active-turn finals/artifacts, and automatic compaction notices through their existing activity domain before transport routing. Compaction notices cannot overtake delayed local finals; Pi hooks do not wait for their network delivery. Captures notice/activity target and authority at admission and fences queued publications across session replacement; independent handler queues remain separate.
-
 - `Artifact Delivery Authority`: Rechecks active-turn/session authority after voice/file preparation and recording actions. Cancellation suppresses later uploads, provider/text fallbacks, and stale Rich-message ownership writes without discarding the attachment list. Already-issued requests and in-flight synthesis are not undone; ambiguous uploads never authorize replay.
-
 - `Final Admission`: Reserves final/error publication at the terminal message boundary and transfers it only to the originating turn before asynchronous config loading. Compaction uses the same queue instead of a separate buffer. Empty outcomes reserve no slot; replacement, preparation failure, settlement, and session reset release unused reservations. Terminal preview cleanup is background and bound to the captured draft.
-
 - `Compaction Observation`: Fences superseded timeout callbacks and stale-context terminal hooks so they cannot clear a newer observation. The five-minute fallback remains an observer timeout, not proof of Pi completion or cancellation.
-
 - `Activity Replacement`: Fences late config refresh, thinking acknowledgements, tool edits, failures, and settlement cleanup before state mutation or HTML fallback. Old work can no longer overwrite a replacement target/message, erase new tool arguments, or block new thinking output; loss of transport authority also suppresses fallback without requiring a session reset.
 
 ## 0.43.1: Transport And Preview Continuity

package/node_modules/@llblab/pi-telegram/README.md

@@ -256,7 +256,7 @@ Most controls live in Pi commands or the Telegram menu. Environment variables re
 | Inbound file limit | `PI_TELEGRAM_INBOUND_FILE_MAX_BYTES`, `TELEGRAM_MAX_FILE_SIZE_BYTES` |
 | Outbound attachment limit | `PI_TELEGRAM_OUTBOUND_ATTACHMENT_MAX_BYTES`, `TELEGRAM_MAX_ATTACHMENT_SIZE_BYTES` |
 
-Defaults are chosen for ordinary private-bot use: saved config in `~/.pi/agent`, inbound temp files in `~/.pi/agent/tmp/telegram`, `assistant: { rendering: "rich", draftPreviews: false, activity: "verbose", timeInjection: "interval" }` for assistant output and activity, and native Telegram active status for long-running turns.
+Defaults are chosen for ordinary private-bot use: saved config in `~/.pi/agent`, inbound temp files in `~/.pi/agent/tmp/telegram`, `assistant: { rendering: "rich", draftPreviews: true, activity: "verbose", timeInjection: "interval" }` for assistant output and activity, and native Telegram active status for long-running turns.
 
 ## Extension Platform
 

package/node_modules/@llblab/pi-telegram/docs/outbound.md

@@ -8,12 +8,18 @@ Text handlers use the portable [Command Template Standard](./command-templates.m
 
 ## Public Assistant Output
 
-Every completed `assistant-segment` with `placement: "intermediate"` from a Telegram-originated turn is delivered as its own message to the immutable originating target before the ordinary active-turn final reply. Final and terminal-partial Telegram segments remain owned by active-turn settlement so the final answer, voice, buttons, previews, and artifacts are not duplicated.
+Every completed `assistant-segment` with `placement: "intermediate"` from a Telegram-originated turn is delivered as its own message to the immutable originating target before the ordinary active-turn final reply. Final and terminal-partial Telegram segments remain owned by active-turn settlement so the final answer, voice, buttons, previews, and artifacts are not duplicated. Activity captures the originating turn's optional `replyToMessageId` at agent start; delayed projection uses that captured prompt rather than the current active turn. Once-per-turn quoting remains: the first successfully delivered permanent reply carries the prompt anchor, and subsequent messages/chunks do not repeat it. Native/HTML text, voice, ordinary uploads, Rich media, and operational delivery share the reply reservation owner. Known send rejection releases an unused anchor for fallback; an unknown ACK retains it because Telegram may already have delivered the message. Turn-start reset joins the publication FIFO behind the preceding turn's final instead of clearing its quote state early. Local/autonomous output without a Telegram prompt invents no anchor.
 
 While Telegram is connected, local, autonomous, and unclassified extension follow-up Pi work always projects every completed public block—including visible commentary/checkpoints and the final answer—to the instance's authorized target in source order. There is no projection setting or opt-out: disconnecting Telegram is the boundary that stops this companion surface. Both paths consume normalized complete Activity segments rather than raw token deltas, reasoning, or tool traffic.
 
 Projected blocks use `assistant.rendering` independently of voice policy. Rich mode sends native Rich Markdown and HTML mode keeps the established HTML renderer; assistant-authored `telegram_button` comments are planned into prompt buttons before either renderer runs, while projection does not synthesize voice or attach queued files merely because Rich rendering is active. Ordered admission revalidates the exact target, profile/token transport generation, leader epoch or follower registration generation, and session generation before each send. Active-turn final delivery joins the shared [activity-publication order](./architecture.md), preserving commentary-before-final order without blocking Pi lifecycle completion. A `commit-unknown` outcome never permits replay.
 
+Assistant-message completion seals its preview state: queued follow-up drafts and late updates are suppressed. Native final delivery still waits for the already-issued draft request before sending the permanent answer, so an older draft is not deliberately allowed to overtake the final. Intermediate publication seals and drains its captured preview before sending permanent text. Preview rollover itself sends no permanent message: it carries the preceding delivery boundary and draft identity into the next state without holding the Pi message-start hook. The next draft waits for that publication to settle, including failure or cancellation. Active-turn final delivery captures its preview operations before entering the background queue: it drains only the originating draft, leaves a successor's preview untouched, and cannot wait for a successor publication queued behind itself. Delivery authority is rechecked after the captured flush; if the original preview has been replaced, ordinary final sending remains the queue's responsibility. This does not promise instant delivery or eliminate Telegram/client latency.
+
+Assistant previews use a two-second leading/trailing throttle per preview controller, with at most one request in flight. The first eligible snapshot sends immediately; changes inside the window replace pending text, and one trailing timer sends the latest safe snapshot without moving its deadline on every delta. Message/turn rollover preserves the remaining interval. Sealing, clearing, or replacing preview state cancels its timer; final publication drains only an already-issued request and never waits for the throttle deadline.
+
+The Bot API client does not replay draft snapshots through API retry backoff. After a retryable draft HTTP failure (`429` or `5xx`), it defers new draft requests for that bot/chat/thread using the existing `Retry-After` or default backoff delay; it stores a deadline, not a body or a background retry. A deferred update does not advance the preview's last-delivered text. Fresh updates can send after the deadline, while a sealed preview cannot resume. Different bots and thread targets have independent cooldowns; credential rotation for the same bot does not bypass its deadline. Permanent replies retain their existing retry policy. Already-issued requests and Telegram/client rendering can still delay visible completion.
+
 ### Publication Limits
 
 The ordered publication queue is process-local, in-memory, and not a durable outbox. Slow preparation or delivery holds later publications from the same instance; Pi lifecycle hooks do not wait for network publication. Terminal preview cleanup also runs in the background, captures the original draft before scheduling, and rechecks draft identity and delivery authority after a pending flush; it cannot clear a replacement draft. A new session drops queued old-generation work and starts its own sequence without waiting for an already-running call. Separate instances have separate publication queues, but still share Telegram/leader transport limits.
@@ -64,7 +70,7 @@ The voice pipeline is detailed below: configured `type: "voice"` handlers first,
 
 ### Single Rich attachment result
 
-When `assistant.rendering` is `"rich"`, a Telegram-originated turn that queues exactly one probe-confirmed PNG/JPEG photo, MP4 video, or MP3 audio file through `telegram_attach` can combine that artifact with the final assistant Markdown in one multipart `sendRichMessage` result. The bridge normalizes the Markdown, adds one `tg://photo`, `tg://video`, or `tg://audio` reference, preserves the triggering-message reply anchor and assigned thread, carries assistant-authored inline buttons, and records the returned message id under the exact local/follower ownership scope.
+When `assistant.rendering` is `"rich"`, a Telegram-originated turn that queues exactly one probe-confirmed PNG/JPEG photo, MP4 video, or MP3 audio file through `telegram_attach` can combine that artifact with the final assistant Markdown in one multipart `sendRichMessage` result. The bridge normalizes the Markdown, adds one `tg://photo`, `tg://video`, or `tg://audio` reference, preserves the assigned thread and once-per-turn reply policy, carries assistant-authored inline buttons, and records the returned message id under the exact local/follower ownership scope.
 
 The optimization is deliberately narrow. HTML rendering, empty final text, multiple files, documents and other unsupported formats, Guest Mode, explicit `telegram_voice`, voice-preferred turns, and OGG/Opus artifacts retain their established text/attachment/voice paths. A known-safe Rich upload rejection falls back to those paths. A `commit-unknown` transport outcome or a nominally successful upload without a verifiable message id never falls back or replays because the first non-idempotent send may already have committed.
 

package/node_modules/@llblab/pi-telegram/docs/public-api.md

@@ -119,6 +119,7 @@ Hidden/default semantics are represented by absence:
 
 - `threads.automaticCleanup` defaults to `true`; graceful Pi quit deletes the instance's bound Threaded Mode tab without prompting but preserves the owner slot as independent restart intent. Set it to `false`, or use `🧹 Thread cleanup` in Telegram Settings, to preserve the tab too. A confirmed `/telegram-disconnect`, unlike quit, clears restart ownership. Settings views and cleanup reload shared config before evaluating this switch, so another live Pi instance's update takes effect without restarting. Confirmed leader/follower teardown persists an exact target/runtime-generation cleanup intent before Telegram deletion; an interrupted attempt remains retryable by the current or successor leader under current authority and clears only after confirmed deletion. A same-profile replacement leader first adopts any still-active binding and cancels its superseded cleanup, so startup never deletes and recreates a reusable thread. If a follower's graceful envelope is missed, the leader may create the same fenced cleanup only after its heartbeat is stale, the OS confirms the exact registered PID no longer exists, cleanup remains enabled, and no replacement registration can overtake deletion. Heartbeat loss alone, live/unknown process liveness, IPC failure, and auth failure remain non-destructive. Invalid-config recovery makes the setting unresolved and therefore skips destructive cleanup. Manual `/telegram-disconnect` keeps its confirmation and teardown behavior regardless of this setting.
 - Every complete intermediate assistant text block from a Telegram-originated turn is delivered once to its immutable target before the existing final reply; final and terminal-partial segments stay with settlement to prevent duplicate replies. While Telegram transport remains authorized, local/autonomous work also projects every completed public block, including commentary and the final block. This connected companion projection is always active and excludes token deltas, hidden reasoning, tool calls/arguments/results, empty blocks, unknown sources, and stale authority. Projection uses the configured Rich or HTML assistant renderer and binds admitted work to the exact target, profile/token transport generation, direct leader epoch or follower registration generation, and session generation. Retired top-level and `assistant.proactivePush` keys are ignored; the nested key is removed during config normalization.
+- `assistant.draftPreviews` defaults to `true` when absent; explicit `true` or `false` values, including compatibility aliases, remain authoritative. Reading the default does not persist or migrate configuration. Telegram Settings writes the canonical field.
 - `assistant.activity` accepts exactly `"quiet"`, `"thinking"`, `"tools"`, or `"verbose"`; omitted values default to `"verbose"`, explicit values remain unchanged, and invalid values fail closed to `"quiet"`. Each Pi process reloads the shared file-backed value at `agent-start`, so multi-instance activity isolation never relies on a stale process-local config snapshot. `thinking` shows only provider-exposed thinking, `tools` shows only completed tool activity, and `verbose` shows both. Thinking uses persistent ordinary HTML `sendMessage`/`editMessageText` disclosure with a standard expandable blockquote, a `🧠` header carrying the current Pi thinking level, and bounded redacted text whose inline Markdown renders as Telegram HTML. Tools use native Rich Messages with one header followed by separate closed details and JSON pre blocks for bounded redacted arguments, retained updates, and results/errors. Thinking disables link previews on every HTML send/edit and neutralizes HTTP(S) auto-link detection; Rich tool output disables automatic entity detection, with the same protections retained by its HTML fallback. Consecutive tools coalesce only inside the same ordered activity segment and bounded message. Legacy `assistant.activityVerbosity` is read only when `assistant.activity` is absent and is removed by the next Activity Settings write.
 - Voice Reply `hidden`: no `voice.replyMode` key is persisted; legacy `manual` resolves to this silent default. `mirror` adds `[voice] delivery: automatic voice` only to voice/audio-input turns, while `always` adds the same effective line to every Telegram turn.
 - Agent activity status is not configurable. While Telegram transport remains authorized, Telegram uses native `sendChatAction(typing)` / product `...active` status as the automatic in-chat work signal for unsettled agent and compaction work. Extension-owned blocking UI prompts pause it and completion resumes it while either work owner remains active.

package/node_modules/@llblab/pi-telegram/index.ts

@@ -553,6 +553,24 @@ export default function (pi: Pi.ExtensionAPI) {
       editInteractiveMessage,
       recordRuntimeEvent,
     });
+  const nativeMarkdownDraftSender =
+    TelegramApi.createTelegramAssistantDraftSender({
+      getAssistantRenderingMode: configControls.getAssistantRenderingMode,
+      renderMarkdownToHtmlDraft: Replies.renderTelegramMarkdownToHtmlDraft,
+      sendMessageDraft,
+      sendRichMessageDraft,
+    });
+  const previewRuntime = Preview.createTelegramAssistantPreviewRuntime({
+    getActiveTurn: activeTurnRuntime.get,
+    isAssistantMessage: Replies.isAssistantAgentMessage,
+    getMessageText: Replies.getAgentMessageText,
+    getDefaultReplyToMessageId: activeTurnRuntime.getReplyToMessageId,
+    sendDraft: nativeMarkdownDraftSender,
+    canSend: configControls.areDraftPreviewsEnabled,
+    sendMarkdownReply,
+    recordRuntimeEvent,
+    ...replyTransport,
+  });
   const {
     activityRuntime,
     activityVerbosityRuntime,
@@ -561,6 +579,7 @@ export default function (pi: Pi.ExtensionAPI) {
   } = Bindings.createTelegramActivityBindingRuntime({
     generation: deliveryGenerationSeed,
     assistantOutput: {
+      prepareTelegramPreview: previewRuntime.preparePublication,
       authority: {
         getPreferredTarget: proactivePushTargetGetter,
         getFallbackChatId: proactivePushChatIdGetter,
@@ -617,27 +636,10 @@ export default function (pi: Pi.ExtensionAPI) {
     sendUserMessage,
     recordRuntimeEvent,
   });
-  const nativeMarkdownDraftSender =
-    TelegramApi.createTelegramAssistantDraftSender({
-      getAssistantRenderingMode: configControls.getAssistantRenderingMode,
-      renderMarkdownToHtmlDraft: Replies.renderTelegramMarkdownToHtmlDraft,
-      sendMessageDraft,
-      sendRichMessageDraft,
-    });
-  const previewRuntime = Preview.createTelegramAssistantPreviewRuntime({
-    getActiveTurn: activeTurnRuntime.get,
-    isAssistantMessage: Replies.isAssistantAgentMessage,
-    getMessageText: Replies.getAgentMessageText,
-    getDefaultReplyToMessageId: activeTurnRuntime.getReplyToMessageId,
-    sendDraft: nativeMarkdownDraftSender,
-    canSend: configControls.areDraftPreviewsEnabled,
-    sendMarkdownReply,
-    recordRuntimeEvent,
-    ...replyTransport,
-  });
-  const { finalizeMarkdownPreview } =
+  const { finalizeMarkdownPreview, preparePreviewDelivery } =
     Outbound.createTelegramOutboundTextPreviewRuntime({
       finalizeMarkdownPreview: previewRuntime.finalizeMarkdown,
+      preparePreviewDelivery: previewRuntime.prepareDelivery,
       execCommand: CommandTemplates.execCommandTemplate,
       getHandlers: configStore.getOutboundHandlers,
       recordRuntimeEvent,
@@ -1397,6 +1399,7 @@ export default function (pi: Pi.ExtensionAPI) {
     deleteMessage: deleteTelegramMessage,
     sendGuestReply,
     finalizeMarkdownPreview,
+    preparePreviewDelivery,
     proactivePushTargetGetter,
     getAssistantRenderingMode: configControls.getAssistantRenderingMode,
     recordMessageOwnership: messageOwnershipRuntime.recordLocal,

package/node_modules/@llblab/pi-telegram/lib/activity.ts

@@ -32,6 +32,7 @@ export interface TelegramActivityEnvelope {
   sequence: number;
   source: TelegramActivitySource;
   target?: TelegramActivityTarget;
+  replyToMessageId?: number;
   timestamp: number;
 }
 
@@ -422,8 +423,8 @@ export function createTelegramActivityBridgeRuntime(deps: {
     recordInputSource(source) {
       getRuntime()?.recordInputSource(source);
     },
-    onAgentStart(target) {
-      getRuntime()?.onAgentStart(target);
+    onAgentStart(target, replyToMessageId) {
+      getRuntime()?.onAgentStart(target, replyToMessageId);
     },
     onAssistantEvent(event) {
       getRuntime()?.onAssistantEvent(event);
@@ -492,7 +493,7 @@ export type TelegramAssistantStreamEvent =
 export interface TelegramActivityRuntime {
   onSessionStart?: () => void;
   recordInputSource: (source: TelegramActivityInputSource) => void;
-  onAgentStart: (activeTelegramTarget?: TelegramActivityTarget) => void;
+  onAgentStart: (activeTelegramTarget?: TelegramActivityTarget, replyToMessageId?: number) => void;
   onAssistantEvent: (event: TelegramAssistantStreamEvent) => void;
   onAssistantMessageEnd: (stopReason?: string) => void;
   onToolStart: (event: {
@@ -549,6 +550,7 @@ export function createTelegramActivityRuntime(deps: {
   let activityId: string | undefined;
   let activitySource: TelegramActivitySource = "unknown";
   let activityTarget: TelegramActivityTarget | undefined;
+  let activityReplyToMessageId: number | undefined;
   let sequence = 0;
   let pendingInputSource: TelegramActivityInputSource = "unknown";
   let pendingAssistantSegment: PendingAssistantSegment | undefined;
@@ -584,6 +586,7 @@ export function createTelegramActivityRuntime(deps: {
       sequence,
       source: activitySource,
       ...(activityTarget ? { target: activityTarget } : {}),
+      ...(activityReplyToMessageId !== undefined ? { replyToMessageId: activityReplyToMessageId } : {}),
       timestamp: now(),
     } as TelegramActivityEvent;
     try {
@@ -610,6 +613,7 @@ export function createTelegramActivityRuntime(deps: {
     activityId = undefined;
     activitySource = "unknown";
     activityTarget = undefined;
+    activityReplyToMessageId = undefined;
     sequence = 0;
     pendingAssistantSegment = undefined;
     compactionInProgress = false;
@@ -627,9 +631,10 @@ export function createTelegramActivityRuntime(deps: {
     recordInputSource(source) {
       pendingInputSource = source;
     },
-    onAgentStart(activeTelegramTarget) {
+    onAgentStart(activeTelegramTarget, replyToMessageId) {
       abandonCompaction();
       ensureActivity(activeTelegramTarget);
+      activityReplyToMessageId = activitySource === "telegram" ? replyToMessageId : undefined;
       emit({ type: "agent-start" });
     },
     onAssistantEvent(event) {
@@ -804,7 +809,13 @@ export interface TelegramAssistantOutputRuntime {
   stop: () => void;
 }
 
+export interface TelegramAssistantOutputPreparation {
+  wait: () => Promise<void>;
+  settle: () => void;
+}
+
 export function createTelegramAssistantOutputRuntime<TAuthority = undefined>(deps: {
+  prepareSend?: (event: TelegramAssistantSegmentEvent) => TelegramAssistantOutputPreparation | undefined;
   enqueue?: TelegramActivityPublicationRuntime["enqueue"];
   captureAuthority?: () => TAuthority;
   isAuthorityActive?: (authority: TAuthority) => boolean;
@@ -843,6 +854,7 @@ export function createTelegramAssistantOutputRuntime<TAuthority = undefined>(dep
       admitted.add(key);
       const admittedGeneration = generation;
       const admittedAuthority = deps.captureAuthority?.();
+      const preparation = deps.prepareSend?.(event);
       const enqueue = deps.enqueue ?? ((task: () => Promise<void>) => tail.then(task));
       tail = enqueue(async () => {
         const isAdmittedAuthorityActive = () =>
@@ -853,6 +865,8 @@ export function createTelegramAssistantOutputRuntime<TAuthority = undefined>(dep
             deps.isAuthorityActive(admittedAuthority as TAuthority));
         if (!isAdmittedAuthorityActive() || !deps.canDeliver(event)) return;
         try {
+          if (preparation) await preparation.wait();
+          if (!isAdmittedAuthorityActive() || !deps.canDeliver(event)) return;
           await deps.send(
             event,
             admittedAuthority as TAuthority,
@@ -861,7 +875,7 @@ export function createTelegramAssistantOutputRuntime<TAuthority = undefined>(dep
         } catch (error) {
           deps.recordFailure?.(event, error);
         }
-      });
+      }).finally(() => preparation?.settle());
     },
     waitForIdle() {
       return tail;

package/node_modules/@llblab/pi-telegram/lib/bindings.ts

@@ -353,6 +353,7 @@ export function createTelegramAssistantOutputBindingRuntime<
     typeof OutboundHandlers.createTelegramAssistantOutputSender<TTransportStamp>
   >[0];
   waitForActivityIdle?: () => Promise<void>;
+  prepareTelegramPreview?: () => Activity.TelegramAssistantOutputPreparation | undefined;
   enqueue?: Activity.TelegramActivityPublicationRuntime["enqueue"];
   recordRuntimeEvent: TelegramRuntimeEventRecorder;
 }): TelegramAssistantOutputBindingRuntime<TTransportStamp> {
@@ -366,6 +367,7 @@ export function createTelegramAssistantOutputBindingRuntime<
   const runtime = Activity.createTelegramAssistantOutputRuntime({
     ...authority,
     enqueue: deps.enqueue,
+    prepareSend: (event) => event.source === "telegram" ? deps.prepareTelegramPreview?.() : undefined,
     async send(event, authority, isAuthorityActive) {
       await deps.waitForActivityIdle?.();
       if (!isAuthorityActive()) return;
@@ -778,6 +780,7 @@ interface TelegramLifecycleBindingDeps {
       Keyboard.TelegramInlineKeyboardMarkup
     >["sendGuestReply"]
   >;
+  preparePreviewDelivery?: Queue.TelegramAgentEndRuntimeDeps<Queue.PendingTelegramTurn>["preparePreviewDelivery"];
   finalizeMarkdownPreview: Queue.TelegramAgentEndHookRuntimeDeps<
     Queue.PendingTelegramTurn,
     Pi.ExtensionContext,
@@ -829,6 +832,7 @@ export function registerTelegramLifecycleRuntimeHooks({
   answerGuestQuery,
   deleteMessage,
   sendGuestReply,
+  preparePreviewDelivery,
   finalizeMarkdownPreview,
   proactivePushTargetGetter,
   getAssistantRenderingMode,
@@ -1030,6 +1034,7 @@ export function registerTelegramLifecycleRuntimeHooks({
         cancel: reservation.cancel,
       };
     },
+    preparePreviewDelivery,
     preparePreviewClear: previewRuntime.prepareClear,
     clearPreview: previewRuntime.clear,
     setPreviewPendingText: previewRuntime.setPendingText,
@@ -1052,6 +1057,7 @@ export function registerTelegramLifecycleRuntimeHooks({
   Lifecycle.setResetTransportReplyDedup(Replies.resetTransportReplyDedup);
   const agentStartWithDedupReset = Lifecycle.createAgentStartDedupHook(
     agentLifecycleHooks.onAgentStart,
+    scheduleActiveTurnDelivery,
   );
   let uiPromptActive = false;
   const startAgentActivityTypingLoop = (ctx: Pi.ExtensionContext): boolean => {
@@ -1187,7 +1193,8 @@ export function registerTelegramLifecycleRuntimeHooks({
       agentWorkActive = true;
       cancelPendingFinalPublication();
       await agentStartWithDedupReset(event, ctx);
-      activityRuntime.onAgentStart(activeTurnRuntime.get()?.target);
+      const turn = activeTurnRuntime.get();
+      activityRuntime.onAgentStart(turn?.target, turn?.replyToMessageId);
       startAgentActivityTypingLoop(ctx);
     },
     async onToolExecutionStart(event, ctx) {
@@ -1233,6 +1240,7 @@ export function registerTelegramLifecycleRuntimeHooks({
     onMessageEnd(event, ctx) {
       if (!isSessionContextActive(ctx)) return;
       if (event.message.role === "assistant") {
+        previewRuntime.seal();
         activityRuntime.onAssistantMessageEnd(event.message.stopReason);
       }
       if (event.message.role !== "assistant" || event.message.stopReason === "toolUse" || event.message.stopReason === "aborted") return;

package/node_modules/@llblab/pi-telegram/lib/config.ts

@@ -744,7 +744,7 @@ export function createTelegramDraftPreviewsChecker(
       config.assistant?.draftPreviews ??
       config.draftPreviews ??
       config.richDraftPreviews ??
-      false
+      true
     );
   };
 }

package/node_modules/@llblab/pi-telegram/lib/delivery.ts

@@ -10,7 +10,7 @@ import {
   type TelegramInlineKeyboardMarkup,
 } from "./keyboard.ts";
 import {
-  buildTelegramReplyParameters,
+  withTelegramReplyParameters,
   renderTelegramMessage,
 } from "./replies.ts";
 import {
@@ -724,23 +724,23 @@ export function createTelegramBridgeDeliveryRuntime(
     },
     async sendChunk(target, chunk, options) {
       assertTransportActive();
-      const replyParameters = buildTelegramReplyParameters(
-        target.chatId,
-        options.replyToMessageId,
-        target,
-      );
-      const body = {
-        chat_id: target.chatId,
-        text: chunk.text,
-        ...(chunk.parseMode === "html" ? { parse_mode: "HTML" as const } : {}),
-        ...getTelegramTargetThreadParams(target),
-        ...(replyParameters ? { reply_parameters: replyParameters } : {}),
-        ...(options.replyMarkup ? { reply_markup: options.replyMarkup } : {}),
-      };
-      const sent = await deps.api.sendMessage(
-        target.threadId === undefined
-          ? markTelegramBusAggregateDelivery(body)
-          : body,
+      const sent = await withTelegramReplyParameters(
+        target.chatId, options.replyToMessageId, target,
+        (replyParameters) => {
+          const body = {
+            chat_id: target.chatId,
+            text: chunk.text,
+            ...(chunk.parseMode === "html" ? { parse_mode: "HTML" as const } : {}),
+            ...getTelegramTargetThreadParams(target),
+            ...(replyParameters ? { reply_parameters: replyParameters } : {}),
+            ...(options.replyMarkup ? { reply_markup: options.replyMarkup } : {}),
+          };
+          return deps.api.sendMessage(
+            target.threadId === undefined
+              ? markTelegramBusAggregateDelivery(body)
+              : body,
+          );
+        },
       );
       assertTransportActive();
       deps.recordOwnership({

package/node_modules/@llblab/pi-telegram/lib/lifecycle.ts

@@ -37,9 +37,15 @@ export function setResetTransportReplyDedup(fn: () => void): void {
 
 export function createAgentStartDedupHook(
   inner: (event: AgentStartEvent, ctx: ExtensionContext) => Promise<void>,
+  schedulePublication?: (task: () => Promise<void>) => void,
 ): (event: AgentStartEvent, ctx: ExtensionContext) => Promise<void> {
   return async (event, ctx) => {
-    if (resetTransportReplyDedupFn) resetTransportReplyDedupFn();
+    const reset = resetTransportReplyDedupFn;
+    if (reset) {
+      // A new turn must not erase the anchor of a final still ahead in the FIFO.
+      if (schedulePublication) schedulePublication(async () => { reset(); });
+      else reset();
+    }
     return inner(event, ctx);
   };
 }

package/node_modules/@llblab/pi-telegram/lib/menu-settings.ts

@@ -184,8 +184,8 @@ export function buildDraftPreviewsSettingsText(enabled: boolean): string {
     "",
     "Show live answer drafts while the model is answering.",
     "",
-    "<code>-</code> <code>on</code>: stream safe Telegram Rich Draft frames before the final answer.",
-    "<code>-</code> <code>off</code> (default): show native active status, then send one final answer.",
+    "<code>-</code> <code>on</code> (default): stream safe Telegram Rich Draft frames before the final answer.",
+    "<code>-</code> <code>off</code>: show native active status, then send one final answer.",
   ].join("\n");
 }