@llblab/pi-kit 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.10.0 - 2026-09-11
+
+- `State Flow Telegram Surface`: Advances the exact State Flow pin to `0.9.0`, adding the optional fail-open Telegram status line (`State Flow: on · step #N`) and the inline main-menu section button before Settings with Start, Stop, Refresh, and deferred-start control for the current session branch. The package set, resource inventory, and explicit load order remain unchanged.
+- `Grow Loop Telegram Mirror`: Advances the exact Grow Loop pin to `0.8.0`, mirroring the visible loop rhythm (`Grow Loop: #N · waiting`, `#N · Ns`, `#N · running`) into the Telegram status screen with the same fail-open, no-scheduling-change guarantees. The package set, resource inventory, and explicit load order remain unchanged.
+
+## 0.9.1 - 2026-09-11
+
+- `Telegram Draft Cadence`: Advances the exact Telegram pin to `0.45.4`, so each preview segment holds its first frame for one full two-second interval from its first visible text; the opening draft is an accumulated passage instead of a single streamed word, later frames keep the trailing cadence, and rollover after tool work reopens the window while sealing or final publication still cancels pending timers. The package set, resource inventory, and explicit load order remain unchanged.
+- `State Flow Preserved Answers`: Advances the exact State Flow pin to `0.8.1`, preserving the first terminal draft as the runtime-owned response even without `final:true` and bounding same-run fallback turns to eliciting the final patch without replacing the visible answer. The package set, resource inventory, and explicit load order remain unchanged.
+
 ## 0.9.0 - 2026-09-11
 
 - `State Flow Atomic Cohorts`: Advances the exact State Flow pin to `0.8.0`, replacing the single-scope PATCH/UNCHANGED protocol with one `patch_state({global?, cwd?, session?, final?})` primitive whose supplied scopes commit as one atomic transition, turning `final:true` into an ephemeral per-iteration terminal-eligibility latch with bounded three-attempt steering, and retaining exact rejected-call arguments in opt-in diagnostics while preserving the package set, resource inventory, and explicit load order.

package/README.md

@@ -13,9 +13,9 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.53.0` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.1.1` | Isolated nested Pi TUI with explicitly selected extensions |
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.9.4` | Compact Codex/Spark subscription-limit status |
-| [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.7.5` | Visible continuation scheduling and bounded worker Skills |
-| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.8.0` | Atomic scoped state cohorts with final-eligibility resolution |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.45.2` | Telegram companion, queues, files, voice, controls, and Generative Apps guidance |
+| [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.8.0` | Visible continuation scheduling and bounded worker Skills |
+| [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.9.0` | Atomic scoped state cohorts with final-eligibility resolution |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.45.4` | Telegram companion, queues, files, voice, controls, and Generative Apps guidance |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.

package/node_modules/@llblab/pi-grow-loop/AGENTS.md

@@ -27,6 +27,7 @@
 - There is no slash-command control surface. Any ordinary user prompt exits the active runtime rhythm by clearing pending scheduling and hiding loop status; restart/continuation intent belongs to the agent and Grow Loop skill, not to a runtime latch or regex.
 - No start slash commands, budgets, cycle counts, hidden processes, or background agents.
 - Loop status is dynamic: show warning-colored `grow-loop ∞N` only while the next iteration is deferred until idle, `grow-loop Ns` only during the configured countdown, and dim `grow-loop ∞N` only while a loop-scheduled turn is active. Clear active status only after Pi fully settles without an armed successor; low-level run endings may still lead to retry or compaction recovery. Any user input except the runtime's exact expected continuation prompt clears pending loop scheduling and hides loop status, including operator input injected through another extension.
+- Telegram status mirror: when `pi-telegram` is installed, the optional fail-open status-line adapter mirrors the same visible rhythm (`Grow Loop: #N · waiting|Xs|running`) and hides with it. It reads the same runtime state, registers once per process lifetime, disposes on session shutdown, and a missing or unready transport changes nothing.
 - Grow Loop does not own Escape/abort semantics; Escape remains baseline Pi behavior for active agent turns. The runtime does not block future `grow_loop` tool calls; the skill contract owns whether recent user context means continue, stop, restart, or change direction.
 
 ## Topology

package/node_modules/@llblab/pi-grow-loop/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.8.0: Telegram Status Mirror
+
+- `Telegram Mirror`: With the optional `pi-telegram` extension installed, the Telegram Status screen mirrors the same loop rhythm as the terminal status and hides with it: `Grow Loop: #N · waiting` while the next prompt is armed until idle, `#N · 2.4s` during the configured countdown, and `#N · running` while the loop-scheduled turn is active.
+- `Compatibility`: The mirror is optional and fail-open, reads the same runtime state, registers once, disposes on session shutdown, and changes no scheduling behavior; absence of the transport changes nothing.
+
 ## 0.7.5: Status Identity Hotfix
 
 - `Status Identity`: Labels deferred, countdown, and active runtime status as `grow-loop` instead of the ambiguous `loop`, matching the extension's public identity and the neighboring State Flow status convention.

package/node_modules/@llblab/pi-grow-loop/README.md

@@ -150,6 +150,8 @@ The tool never blocks future calls. Whether to continue belongs to the agent and
 
 `N` is monotonic within the current extension instance and advances only once when a turn arms its deferred successor. Repeated `grow_loop` calls before that turn ends retain `N`, replace the pending delay, and report that the iteration was already scheduled. Active status clears when the scheduled agent run fully settles without arming a successor, so automatic retry or compaction recovery does not produce a false idle state. There is no `grow-loop stopped` or `grow-loop paused` status; absence of Grow Loop status means the runtime rhythm is no longer active.
 
+With the optional `pi-telegram` extension installed, the Telegram Status screen mirrors the same rhythm and stays hidden whenever the terminal status is hidden: `Grow Loop: #N · waiting`, `#N · 2.4s` during the countdown, and `#N · running` while the loop-scheduled turn is active. The mirror reads the same runtime state, fails open without the transport, and changes no scheduling behavior.
+
 ## Interruption Model
 
 Any user prompt except the scheduler's exact expected continuation prompt exits the active runtime rhythm. This includes operator input delivered through Telegram, RPC bridges, or other extensions:

package/node_modules/@llblab/pi-grow-loop/index.ts

@@ -14,16 +14,47 @@ const DEFAULT_FOLLOW_UP_DELAY_MS = 3000;
 const DEFAULT_COUNTDOWN_TICK_MS = 100;
 const MIN_AFTER_SECONDS = 3;
 const MAX_AFTER_SECONDS = 3600;
+const TELEGRAM_STATUS_IMPORT_SPECIFIERS = [
+  "@llblab/pi-telegram/status",
+  new URL("../pi-telegram/api/status.ts", import.meta.url).href,
+];
 
 type Timer = ReturnType<typeof setTimeout> & { unref?: () => void };
 type PendingIteration = {
   interval: Timer;
   timeout?: Timer;
+  countdownStartedAt?: number;
+  countdownDelayMs?: number;
 };
 
+export interface GrowLoopTelegramProgress {
+  iteration: number;
+  state: "waiting" | "countdown" | "running";
+  remainingSeconds?: number;
+}
+
+export interface GrowLoopTelegramStatusLine {
+  label: string;
+  value: string;
+}
+
+export type GrowLoopTelegramStatusProvider = () => GrowLoopTelegramStatusLine | undefined;
+export type GrowLoopTelegramStatusRegistrar = (
+  provider: GrowLoopTelegramStatusProvider,
+) => (() => void) | undefined;
+
+interface TelegramStatusLineModule {
+  registerTelegramStatusLineProvider?: (
+    provider: GrowLoopTelegramStatusProvider,
+    options: { id: string },
+  ) => () => void;
+}
+
 type GrowLoopOptions = {
   followUpDelayMs?: number;
   countdownTickMs?: number;
+  /** Injection seam for the optional pi-telegram status line; defaults to the public pi-telegram membrane. */
+  registerTelegramStatusLine?: GrowLoopTelegramStatusRegistrar;
 };
 
 export function buildGrowLoopPrompt(): string {
@@ -39,6 +70,28 @@ export function getExistingExtensionSkillPaths(extensionUrl: string): string[] {
   return existsSync(skillsDir) ? [skillsDir] : [];
 }
 
+export function formatGrowLoopTelegramValue(progress: GrowLoopTelegramProgress): string {
+  if (progress.state === "countdown") return `#${progress.iteration} · ${(progress.remainingSeconds ?? 0).toFixed(1)}s`;
+  if (progress.state === "running") return `#${progress.iteration} · running`;
+  return `#${progress.iteration} · waiting`;
+}
+
+async function registerGrowLoopTelegramStatus(
+  provider: GrowLoopTelegramStatusProvider,
+): Promise<(() => void) | undefined> {
+  for (const specifier of TELEGRAM_STATUS_IMPORT_SPECIFIERS) {
+    try {
+      const imported = (await import(specifier)) as TelegramStatusLineModule;
+      if (typeof imported.registerTelegramStatusLineProvider === "function") {
+        return imported.registerTelegramStatusLineProvider(provider, { id: "@llblab/pi-grow-loop" });
+      }
+    } catch {
+      // pi-telegram is optional; its absence only disables the Telegram status line.
+    }
+  }
+  return undefined;
+}
+
 function statusCountdown(ctx: ExtensionContext, seconds: number) {
   const theme = ctx.ui.theme;
   ctx.ui.setStatus(
@@ -82,20 +135,21 @@ function scheduleIteration(
   iteration: number,
   clearPending: () => void,
   expectOwnPrompt: () => void,
-  options: Required<GrowLoopOptions>,
+  options: Required<Pick<GrowLoopOptions, "followUpDelayMs" | "countdownTickMs">>,
 ): PendingIteration {
-  let countdownStartedAt: number | undefined;
   statusDeferred(ctx, iteration);
   const pending = {} as PendingIteration;
   pending.interval = setInterval(() => {
-    if (!countdownStartedAt) {
+    if (pending.countdownStartedAt === undefined) {
       if (!ctx.isIdle() || ctx.hasPendingMessages()) return;
-      countdownStartedAt = Date.now();
+      pending.countdownStartedAt = Date.now();
+      pending.countdownDelayMs = options.followUpDelayMs;
       statusCountdown(ctx, options.followUpDelayMs / 1000);
       pending.timeout = setTimeout(() => {
         pending.timeout = undefined;
         if (!ctx.isIdle() || ctx.hasPendingMessages()) {
-          countdownStartedAt = undefined;
+          pending.countdownStartedAt = undefined;
+          pending.countdownDelayMs = undefined;
           statusDeferred(ctx, iteration);
           return;
         }
@@ -105,7 +159,7 @@ function scheduleIteration(
       pending.timeout.unref?.();
       return;
     }
-    const elapsed = Date.now() - countdownStartedAt;
+    const elapsed = Date.now() - pending.countdownStartedAt;
     const remainingMs = Math.max(options.followUpDelayMs - elapsed, 0);
     if (remainingMs > 0) statusCountdown(ctx, remainingMs / 1000);
   }, options.countdownTickMs) as Timer;
@@ -122,23 +176,63 @@ export default function growLoopExtension(
       partialOptions.followUpDelayMs ?? DEFAULT_FOLLOW_UP_DELAY_MS,
     countdownTickMs:
       partialOptions.countdownTickMs ?? DEFAULT_COUNTDOWN_TICK_MS,
+    registerTelegramStatusLine: partialOptions.registerTelegramStatusLine,
   };
   let iteration = 0;
   let lastCtx: ExtensionContext | undefined;
   let pendingIteration: PendingIteration | undefined;
   let ownPromptPending = false;
   let scheduledThisTurn = false;
+  let runningIteration: number | undefined;
+  let unregisterTelegramStatus: (() => void) | undefined;
+  let telegramRegistration: Promise<void> | undefined;
+  let telegramGeneration = 0;
   const clearPending = () => {
     if (!pendingIteration) return;
     if (pendingIteration.timeout) clearTimeout(pendingIteration.timeout);
     clearInterval(pendingIteration.interval);
     pendingIteration = undefined;
   };
+  const telegramStatusProvider = (): GrowLoopTelegramStatusLine | undefined => {
+    if (pendingIteration) {
+      if (pendingIteration.countdownStartedAt === undefined) {
+        return { label: "Grow Loop", value: formatGrowLoopTelegramValue({ iteration, state: "waiting" }) };
+      }
+      const elapsed = Date.now() - pendingIteration.countdownStartedAt;
+      const remainingSeconds = Math.max((pendingIteration.countdownDelayMs ?? 0) - elapsed, 0) / 1000;
+      return { label: "Grow Loop", value: formatGrowLoopTelegramValue({ iteration, state: "countdown", remainingSeconds }) };
+    }
+    if (runningIteration !== undefined) {
+      return { label: "Grow Loop", value: formatGrowLoopTelegramValue({ iteration: runningIteration, state: "running" }) };
+    }
+    return undefined;
+  };
+  const ensureTelegramStatusRegistered = () => {
+    if (unregisterTelegramStatus || telegramRegistration) return;
+    if (options.registerTelegramStatusLine) {
+      unregisterTelegramStatus = options.registerTelegramStatusLine(telegramStatusProvider) ?? undefined;
+      return;
+    }
+    const generation = telegramGeneration;
+    telegramRegistration = registerGrowLoopTelegramStatus(telegramStatusProvider)
+      .then((unregister) => {
+        if (generation !== telegramGeneration) {
+          unregister?.();
+          return;
+        }
+        unregisterTelegramStatus = unregister;
+      })
+      .finally(() => {
+        if (generation === telegramGeneration) telegramRegistration = undefined;
+      });
+  };
   const hideLoopStatus = (ctx: ExtensionContext) => {
     ownPromptPending = false;
+    runningIteration = undefined;
     clearPending();
     ctx.ui.setStatus(STATUS_KEY, undefined);
   };
+  ensureTelegramStatusRegistered();
   pi.on("resources_discover", async () => {
     const skillPaths = getExistingExtensionSkillPaths(import.meta.url);
     if (skillPaths.length === 0) return;
@@ -147,12 +241,23 @@ export default function growLoopExtension(
   pi.on("session_shutdown", async () => {
     ownPromptPending = false;
     scheduledThisTurn = false;
+    runningIteration = undefined;
     clearPending();
+    telegramGeneration += 1;
+    unregisterTelegramStatus?.();
+    unregisterTelegramStatus = undefined;
+    telegramRegistration = undefined;
     lastCtx?.ui.setStatus(STATUS_KEY, undefined);
   });
+  pi.on("session_start", async () => {
+    ensureTelegramStatusRegistered();
+  });
   pi.on("agent_settled", async (_event, ctx) => {
     lastCtx = ctx;
-    if (!pendingIteration) ctx.ui.setStatus(STATUS_KEY, undefined);
+    if (!pendingIteration) {
+      runningIteration = undefined;
+      ctx.ui.setStatus(STATUS_KEY, undefined);
+    }
   });
   pi.on("input", async (event, ctx) => {
     lastCtx = ctx;
@@ -194,6 +299,7 @@ export default function growLoopExtension(
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       lastCtx = ctx;
       ownPromptPending = false;
+      runningIteration = undefined;
       clearPending();
       const isReschedule = scheduledThisTurn;
       if (!isReschedule) {
@@ -212,8 +318,9 @@ export default function growLoopExtension(
         clearPending,
         () => {
           ownPromptPending = true;
+          runningIteration = nextIteration;
         },
-        { ...options, followUpDelayMs: delayMs },
+        { followUpDelayMs: delayMs, countdownTickMs: options.countdownTickMs },
       );
       return {
         content: [

package/node_modules/@llblab/pi-grow-loop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-grow-loop",
-  "version": "0.7.5",
+  "version": "0.8.0",
   "private": false,
   "description": "Semantic loop-engineering for agent-owned, visible, interruptible continuation in Pi",
   "keywords": [

package/node_modules/@llblab/pi-state-flow/AGENTS.md

@@ -24,15 +24,15 @@
 - Bind every loaded scope and active Pi branch/checkpoint to the corresponding State Flow Git revision. Resume and tree restoration must recover branch-correct runtime config and semantic layers from that revision without blindly importing Git `HEAD`; reading an older revision must use object-level Git reads and never reset or check out the shared repository worktree.
 - Every accepted semantic change, including session-only and response-only changes, atomically updates affected checkpoint/tail pairs and temporal metadata and creates one immediate local Git commit when Git is available; each commit stages the complete non-ignored worktree delta (`git add -A` semantics, including manual deletions) before overlaying exact prepared State Flow outputs, respects `.gitignore`, keeps State Flow-owned active files under compare-and-swap protection, and synchronizes the caller-visible index to the committed tree. `remotePublication` is branch runtime policy: `turn-end` queues only the newest accepted target for asynchronous non-interactive push, `off` remains local-only, and `transition` preserves synchronous legacy behavior. Queue state is operational metadata beneath the Git common directory, not semantic history; use exact targets, destination identity, symlink-safe atomic CAS, descendant-only coalescing, cross-process worker leases, restart recovery, and truthful failure diagnostics. Remote failure never rolls back accepted state or regenerates an answer. A repository with no remote is intentionally local-only; only Git executable `ENOENT` authorizes file-only mode.
 - Register `patch_state` as the sole model-authored semantic mutation protocol. It accepts optional fixed `global`, `cwd`, and `session` semantic patches plus optional `final:true`; require at least one scope or `final:true`, reject unknown fields, `final:false`, empty supplied scopes, material no-ops, and the retired `{scope, patch}` / `unchanged` grammar. Validate every supplied scope against one causal basis and publish it all-or-nothing with one identity, temporal boundary, and durable cohort. Never accept model-authored `response`.
-- Treat every semantic `patch_state` as a strict inference barrier. Give it sequential execution mode, inspect Pi's synchronized current assistant message during tool preflight, require exactly one `patch_state` call in that response, and block every sibling tool call before execution. Every enabled iteration begins terminal-ineligible; only a successful call containing `final:true` latches eligibility for the next accepted `turn_end`, without stopping later reasoning, tools, or patches. If the model attempts terminal prose before eligibility, discard that transient draft and issue a hidden same-run instruction for the first two attempts; the third attempted terminal completion ends steering with one concise error while preserving committed state, enablement, and the rejected-response boundary. Failed patch calls do not consume this ephemeral three-attempt budget. A subsequent legal patch remains possible, and only a later accepted ordinary answer is reconciled.
-- Reconcile `response` only from the actually accepted ordinary assistant answer at `turn_end`; it remains runtime-owned. State Flow has no terminal HTML-comment mutation protocol and does not parse generic service comments. A draft intercepted for pending turn resolution is not final, must never reach `response`, and may be followed by `patch_state` in the same unfinished run. Other extensions retain ownership of their own comments and output handling.
+- Treat every semantic `patch_state` as a strict inference barrier. Give it sequential execution mode, inspect Pi's synchronized current assistant message during tool preflight, require exactly one `patch_state` call in that response, and block every sibling tool call before execution. Every enabled iteration begins terminal-ineligible; only a successful call containing `final:true` latches eligibility for the next accepted `turn_end`, without stopping later reasoning, tools, or patches. If a terminal draft ends before eligibility, preserve it as the runtime-owned response at that `turn_end` and start at most two same-run fallback turns whose only purpose is the `final:true` patch; an eligible draft whose final validation fails after a later acquisition follows the same path. Fallback turns never enter `response`, and their only instruction is to apply `patch_state` with any durable changes and `final:true`, or `{final:true}` alone. A successful fallback closes resolution with the preserved answer intact; two failed fallbacks close the iteration with the preserved answer and current state plus one bounded warning and a finalization diagnostic. Failed patch calls do not consume fallback turns. A subsequent legal patch remains possible, and only an accepted ordinary answer is reconciled.
+- Reconcile `response` only from the actually accepted ordinary assistant answer at `turn_end`; it remains runtime-owned. State Flow has no terminal HTML-comment mutation protocol and does not parse generic service comments. The first terminal draft that cannot be reconciled is preserved as the iteration response rather than discarded; fallback turns during pending resolution never reach `response`. Other extensions retain ownership of their own comments and output handling.
 - Treat terminal state as a decision-relevant handoff, not narration: retain source-addressed reusable operational knowledge in `artifacts`; compile stable requirements, confirmed decisions, rejected approaches, and interface commitments into `contract`; retain observations, validation, failures, current domain state, unresolved work, interaction consequences, and exact continuation in `working`. Preserve relevant completed prerequisites and verified outcomes while removing obsolete progress narration; reconcile only information affected by the run and relevant existing commitments, not every scope or repository surface.
 - Preserve active constraints, unresolved questions, consequential negative results, and the next discriminating check before compression. Distinguish observations, user requirements, assistant decisions, and hypotheses; do not promote assistant conclusions to user requirements. Retain useful source locators and validity conditions for consequential facts without mandatory per-value metadata. Keep rejection reasons and reconsideration conditions. Reconcile contradictions through evidence or user clarification instead of silently overwriting established constraints or observations; retain unresolved conflicts and decision-relevant hypotheses as uncertain. These are protocol obligations, not deterministic semantic validation gates.
 - Treat `working` as last observations, not a live workspace. Revalidate volatile facts before consequential actions; after interruption or branch navigation inspect relevant external effects before repeating operations. Failed state commits and restored memory do not undo tool effects. Missing evidence proves neither success nor absence of effects: retain uncertainty and the next check. Keep revalidation targeted, without action ledgers or runtime freshness/rollback guarantees.
 - Treat each successful `SKILL.md` read as CWD artifact acquisition using the finalized tool-execution arguments after mutable interception: require a non-empty compiler output in the next `patch_state` call under `cwd.artifacts[exactReadPath]` with `description`, `kind: "skill"`, and a flexible non-empty `compilation` object; hash the executed source bytes and record runtime-owned `sourceHash` plus `skill-artifact-v1` `compilerRevision` in the CWD provenance registry; reject missing, unhashable, malformed, or forged freshness data; replace the complete prior Skill artifact and its provenance entry on refresh so obsolete evidence cannot survive. `contract.compiled_skills` is retired and rejected; migrate useful legacy entries into artifacts while preserving behavior and marking fallback hashes unverified when the source is unavailable.
 - Make the model audit and optimize complete state at every handoff: reorganize inefficient structure, merge fragmented facts, compress history into conclusions, and delete stale, completed, redundant, or low-value keys while preserving active commitments and evidence.
 - Accept omitted semantic fields inside each supplied scope patch, but reject empty supplied scopes; when no state change is needed require explicit `{final:true}` without inventing bookkeeping. This final-only call changes only ephemeral terminal eligibility and creates no semantic transition, identity, temporal step, or Git commit. Always require an accepted non-empty answer, which runtime owns as session `response`. A changed response is a semantic transition; identical complete semantic state finalizes lifecycle without a patch, identity, or temporal step. Semantic usefulness and optimization remain protocol-owned because deterministic validation cannot prove them.
-- Agent-level opt-in `logging` appends local JSONL diagnostics for rejected `patch_state` attempts and terminal drafts intercepted while turn resolution remains pending. Every rejected call retains its exact attempted arguments plus the precise error and, when available, tool identity, call id, resolution attempt, and terminal-eligibility state; successful patches are never logged. Preserve exact text blocks only where useful, reduce other blocks to structural identity, never duplicate reasoning bodies, and keep logging outside semantic state, scope metadata, checkpoints, and publication. Logging failure emits at most one warning and never changes resolution, enablement, or accepted state.
+- Agent-level opt-in `logging` appends local JSONL diagnostics for rejected `patch_state` attempts and preserved drafts plus fallback turns while turn resolution remains pending. Every rejected call retains its exact attempted arguments plus the precise error and, when available, tool identity, call id, resolution attempt, and terminal-eligibility state; successful patches are never logged. Preserve exact text blocks only where useful, reduce other blocks to structural identity, never duplicate reasoning bodies, and keep logging outside semantic state, scope metadata, checkpoints, and publication. Logging failure emits at most one warning and never changes resolution, enablement, or accepted state.
 - Recursively materialize patches immediately; empty objects preserve, nested object-key `null` deletes, and `null` anywhere in semantic state including arrays is invalid. This prohibition does not apply to runtime envelopes such as an origin's null parent. Persist runtime-normalized replay patches that exactly reproduce accepted state, including complete artifact replacement; runtime-owned provenance is stored in scope `meta.json` and is not part of semantic replay.
 - Do not impose project schemas, state or patch byte caps, dynamic growth pressure, observation envelopes, action authorization, action ledgers, or state-size limits.
 - Rotate the turn-stable specification on every user-initiated run, while runtime-triggered turn-resolution continuation remains inside that same run. Keep user-controlled specification text at user authority: never interpolate it into the system prompt; repeat it only in synthetic user runtime context. Treat materialized state in that message as fallible assistant-produced data whose transport role does not elevate it into user instructions.
@@ -43,7 +43,7 @@
 - `/state-flow-stop` must persist only the current session/branch's `config.enabled = false` and necessary runtime provenance, preserving all semantic checkpoints/tails and creating no semantic transition. It must retain a same-physical-session bounded passive context handoff across reload, resume, and tree restoration so disabling semantics never re-exposes pre-stop raw history. Active restart replaces passive mode but uses that bounded boundary for its one migration run; new and forked physical sessions inherit neither projection. It does not rewrite agent-level `autoStart` or change its policy for future new sessions.
 - Keep the injected runtime protocol compact and normative; put rationale and extended explanation in README rather than the model prompt. Never parse or strip State Flow HTML comments; they are ordinary historical text, while foreign comment handling remains owned by other extensions.
 - Do not claim strict boundedness for state, the current run trajectory, the turn specification, or the external full trace.
-- Remain extension-agnostic: do not import, name, special-case, or encode policy for any other extension or transport.
+- Remain extension-agnostic in core semantics, storage, and inference: core modules never import, name, special-case, or encode policy for another extension or transport. One optional leaf presentation adapter (`lib/telegram.ts`) may import public `pi-telegram` membranes to mirror status and expose the same start/stop affordances already owned by `state-flow-start` and `state-flow-stop`; it must fail open when the transport is absent or its registry is unready and must never alter core behavior.
 - Activate State Flow model tools only while enabled on the selected branch; preserve every unrelated active tool when toggling them. Keep mutation confined to `patch_state` and historical observation read-only.
 - Keep `.github/workflows/release.yml` as the sole version-tag release owner: it validates immutable tag identity, publishes through npm Trusted Publisher with provenance, verifies the public package, and only then creates the GitHub Release. Keep package, lockfile, tag, and changelog versions aligned; never add a long-lived npm token fallback.
 - Run `npm run validate` after retained code changes.

package/node_modules/@llblab/pi-state-flow/BACKLOG.md

@@ -2,6 +2,13 @@
 
 Completed release work belongs in [CHANGELOG.md](CHANGELOG.md). No implementation item remains open for 0.8.0.
 
+## Candidate evolution
+
+- [ ] **Read-only global bootstrap layer:** Project the existing global materialization into enabled and non-enabled sessions by default, so even one-shot work starts carrying established cross-project facts, preferences, routing, and conventions. The global scope is the highest-value, lowest-cost half of the memory, while writing carries the protocol and curation tax; making the read side unconditional gives continuity without enabling mutation.
+  - Boundary: project the existing durable global materialization only. No writes, transitions, patches, barriers, session/CWD initialization, or temporal-history changes. Model tools and the full protocol remain opt-in behind explicit start, and the bootstrap adds no second semantic mode.
+  - Open questions: whether deferred Markdown freshness discovery must run ahead of the first inference, token cost of a stable global prefix, behavior under untrusted project contexts, and naming distinct from the existing bootstrap-run concept.
+  - Status: candidate, not scheduled. Do not start without a dedicated release contract.
+
 ## Deferred host integration
 
 - [ ] **Native default session continuation:** Integrate the existing read-only recommendation, exact-selection, and rehydration contracts before Pi creates `SessionManager`, while preserving explicit new/resume and native-picker precedence, truthful notices, and cross-process session ownership. Pi 0.84.4 exposes no suitable pre-session resolver hook, so this requires upstream support or an SDK/launcher integration. Reverify the host API before taking the item; it is not a release dependency.

package/node_modules/@llblab/pi-state-flow/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.9.0: Telegram status surface
+
+- `Interop`: Added an optional fail-open `pi-telegram` presentation adapter. With the transport installed, the status screen shows `State Flow: on · step #N` while enabled, and the inline main menu places a `🌀 State Flow: #N` or `⚫️ State Flow: off` section button directly before Settings.
+- `Control`: The section submenu exposes the branch lifecycle already owned by the commands: Start, Stop, Refresh, and Cancel start while a start deferred behind an active run is pending. A busy start waits for the current run to settle, Stop applies immediately, and the adapter calls the same start/stop functions as `/state-flow-start` and `/state-flow-stop`.
+- `Compatibility`: Registration fails open when pi-telegram is absent or its section registry is not ready, retries on session start, and disposes on session shutdown. Core semantics, storage, inference, and hosts without pi-telegram are unchanged.
+
+## 0.8.1: Preserved answers and bounded fallback resolution
+
+- `Resolution`: A terminal draft is never discarded. A draft ending before eligibility — or an eligible draft whose final validation fails for a later acquisition — is preserved as the runtime-owned response at `turn_end`, then at most two same-run fallback turns exist only to obtain the `final:true` patch. Fallback turns never enter `response`; success commits their patches with the preserved answer intact, and exhaustion closes the iteration with the preserved answer, current state, one bounded warning, and a finalization diagnostic.
+
 ## 0.8.0: Atomic cohorts and final eligibility
 
 - `Protocol`: Replaced the single-scope PATCH and UNCHANGED forms with one canonical `patch_state({global?, cwd?, session?, final?})` call. Supplied scopes validate against one causal basis and publish as one atomic transition with a single identity, temporal boundary, durable cohort, and inference barrier; unknown fields, `final:false`, empty scopes, and material no-ops fail closed.

package/node_modules/@llblab/pi-state-flow/README.md

@@ -66,6 +66,8 @@ Stopping changes the current session/branch configuration, preserves semantic ch
 
 The compact status is an accent `state-flow` and dim `#<step>`. Detailed status distinguishes runtime config/meta from semantic materialization, reports scope keys, the selected temporal head and runtime revision, available hot offsets, per-scope retained patch tails, artifact counts, stale Markdown reasons, and pending publication. Retained tails may include inherited pre-origin records, so their counts are not active history depth. It labels global/CWD/session/effective state without dumping source bodies. Failed inspection means unavailable evidence, never a falsely clean count.
 
+When the optional `pi-telegram` extension is installed, State Flow mirrors the same identity there: the Status screen shows `State Flow: on · step #N` while enabled, and the inline main menu places a `🌀 State Flow: #N` or `⚫️ State Flow: off` section button directly before Settings. The button opens a compact control submenu for the current session branch: `Start` or `Stop`, `Refresh`, and `Cancel start` while a start deferred behind an active run is pending. Starting while a run is active waits for that run to settle; stopping applies immediately. Registration fails open when the transport is absent, retries when the section registry becomes ready, and disposes on session shutdown; the `/state-flow-*` commands remain the authority and nothing changes for hosts without `pi-telegram`.
+
 ## State, scope, and time
 
 Every scope has exactly the same semantic shape:
@@ -219,7 +221,7 @@ patch_state({...?, final:true}) → atomic accepted state + terminal eligibility
 patch_state({final:true}) → terminal eligibility only, with no semantic transition
 ```
 
-Every enabled iteration begins terminal-ineligible. `final:true` latches eligibility for the next accepted `turn_end`; it does not terminate the turn, stop tools or reasoning, freeze state, or prevent later `patch_state` calls. An unresolved visible draft is not accepted as a response. State Flow discards it and issues a hidden same-run instruction for the first two attempted terminal completions; the third ends steering with one concise error while preserving committed state and enablement. Failed patch calls do not consume this ephemeral budget. A later successful `final:true` permits the final ordinary answer. Only that accepted answer reaches `response`; aborted, length-limited, and provider-error endings never do.
+Every enabled iteration begins terminal-ineligible. `final:true` latches eligibility for the next accepted `turn_end`; it does not terminate the turn, stop tools or reasoning, freeze state, or prevent later `patch_state` calls. A terminal draft that ends before eligibility, or an eligible draft whose final validation fails after a later acquisition, is preserved: it is reconciled as the runtime-owned `response` at that `turn_end` instead of being discarded, and State Flow starts at most two same-run fallback turns whose only purpose is to obtain the `final:true` patch. Fallback turns are never the response. A successful `final:true` during a fallback commits its patches and closes resolution with the preserved answer intact; when both fallbacks pass without it, the iteration closes with the preserved answer and current state, plus one bounded warning and a finalization diagnostic. Failed patch calls do not consume fallback turns. Only an accepted answer reaches `response`; aborted, length-limited, and provider-error endings never do.
 
 A semantic patch remains an inference barrier. The complete scope cohort is validated, durably accepted, and rematerialized before further reasoning. Empty supplied scopes and materially no-op scope cohorts are rejected; omit unchanged scopes and use `{final:true}` alone when no semantic update is needed. `response` is never accepted from the model. The final answer is ordinary assistant output, not a state transport. State Flow has no terminal `state_flow` HTML-comment protocol and does not parse generic service comments. Historical `state_flow` text is ordinary text. Other extensions retain ownership of their own comments such as `telegram_button`. Never put secrets in state.
 
@@ -294,7 +296,7 @@ npm install
 npm run validate
 ```
 
-Validation runs TypeScript checks, automated tests, and an import smoke check. Temporal algebra tests compare all available offsets with independently retained test snapshots through dense/sparse repeated folding, shared transitions, deletion overlays, no-ops, and forks. Temporary-repository tests also cover explicit migration, ten committed sparse transitions with folding and all hot offsets, cold Git scope recovery, and historical symlink rejection. Storage-level tests also prove atomic runtime/semantic publication, config-only stop without semantic history, runtime identity and lineage validation, self-reference resolution across unrelated commits, and exact accepted-commit retry. Real Pi tests also exercise configured automatic activation, deferred source discovery, strict draft → resolution → accepted-answer continuation, temporal barriers and next-inference state, lazy runtime offset-one reads, unchanged shared-stream inheritance, old-branch stop/resume, and bounded passive stop/restart projection. The complete twenty-case temporal acceptance audit is documented in the property map; the canonical backlog identifies any subsequent open work.
+Validation runs TypeScript checks, automated tests, and an import smoke check. Temporal algebra tests compare all available offsets with independently retained test snapshots through dense/sparse repeated folding, shared transitions, deletion overlays, no-ops, and forks. Temporary-repository tests also cover explicit migration, ten committed sparse transitions with folding and all hot offsets, cold Git scope recovery, and historical symlink rejection. Storage-level tests also prove atomic runtime/semantic publication, config-only stop without semantic history, runtime identity and lineage validation, self-reference resolution across unrelated commits, and exact accepted-commit retry. Real Pi tests also exercise configured automatic activation, deferred source discovery, strict draft → preserved answer and fallback resolution → accepted-answer continuation, temporal barriers and next-inference state, lazy runtime offset-one reads, unchanged shared-stream inheritance, old-branch stop/resume, and bounded passive stop/restart projection. The complete twenty-case temporal acceptance audit is documented in the property map; the canonical backlog identifies any subsequent open work.
 
 - [Canonical open work](BACKLOG.md)
 - [Delivery history](CHANGELOG.md)

package/node_modules/@llblab/pi-state-flow/docs/architecture.md

@@ -19,7 +19,7 @@ The extension owns durable memory while enabled. Global semantic memory is alway
 - `memory`: external promotion records and memory diagnostics.
 - `continuation`: native-header discovery, runtime-provenance inspection, deterministic recommendation, and host startup precedence.
 - `publication`: remote policy, durable CAS queue/store, cross-process leases, and asynchronous worker lifecycle.
-- `status`, `extension`: operator projection and Pi adapter wiring.
+- `status`, `telegram`, `extension`: operator projection, the optional fail-open pi-telegram presentation adapter, and Pi adapter wiring.
 
 ## Semantic state
 
@@ -71,7 +71,7 @@ A final-only `patch_state({"final":true})` call changes only ephemeral terminal
 
 `read_state` reads one cached effective or scoped projection at offsets zero through seven. It never publishes or advances history.
 
-Every enabled assistant iteration starts terminal-ineligible. Only a successful `patch_state` call containing `final:true` latches eligibility for the next accepted `turn_end`; the call may atomically include global, CWD, and session patches. Eligibility does not stop later reasoning, tools, or patches. If terminal prose arrives before eligibility, State Flow discards that draft and issues a hidden same-run instruction for the first two terminal attempts. The third attempt ends steering with one concise error while preserving committed state and enablement; failed patch calls do not consume the budget. A following legal patch remains possible, and only a later accepted ordinary answer is reconciled into runtime-owned `response` at `turn_end`. State Flow no longer parses `state_flow` or generic HTML comments; historical comments are ordinary text and other extensions retain their own comment handling.
+Every enabled assistant iteration starts terminal-ineligible. Only a successful `patch_state` call containing `final:true` latches eligibility for the next accepted `turn_end`; the call may atomically include global, CWD, and session patches. Eligibility does not stop later reasoning, tools, or patches. If terminal prose arrives before eligibility, State Flow preserves that draft and reconciles it into runtime-owned `response` at `turn_end`, then starts at most two same-run fallback turns whose only purpose is the `final:true` patch. The same path covers an eligible draft whose final validation fails after a later acquisition. Fallback turns never become the response: a successful `final:true` commits its patches and closes resolution with the preserved answer intact, while two failed fallbacks close the iteration with the preserved answer and current state plus one bounded warning and a finalization diagnostic. Failed patch calls do not consume the budget. A following legal patch remains possible, and only an accepted ordinary answer is reconciled into runtime-owned `response` at `turn_end`. State Flow no longer parses `state_flow` or generic HTML comments; historical comments are ordinary text and other extensions retain their own comment handling.
 
 ## Lifecycle planes
 
@@ -199,7 +199,9 @@ Unknown keys fail loading. State Flow memory ownership and global availability a
 
 `/state-flow-status` reports branch mode, runtime revision, temporal head/history depth, scope keys, patch tails, artifact freshness, memory-bearing scopes, external-promotion summaries, remote policy/queue state, and pending publication. Unavailable materialization is reported as unavailable, never fabricated as empty. Artifact source bodies are not read for status.
 
-Opt-in `logging` appends local JSONL diagnostics for rejected `patch_state` calls and terminal drafts intercepted while turn eligibility is pending. A rejected call retains its exact attempted arguments, the precise error, and, when available, tool identity, call id, resolution attempt, and terminal-eligibility state; accepted patches are never logged. Records preserve useful exact text blocks and reduce other blocks to structural identity without duplicating reasoning. They are never semantic state, scope `meta.json`, Pi checkpoints, or repository input. Write failure changes no resolution, enablement, or accepted state and reports at most one bounded local warning.
+With `pi-telegram` installed, the optional `telegram` adapter mirrors the same identity in Telegram: the Status screen row shows `State Flow: on · step #N` while enabled, and the main-menu section button before Settings opens the branch start/stop submenu. Registration is fail-open and retried on session start, disposal happens on session shutdown, the adapter reads the same snapshot as the compact terminal status, and its start/stop actions call the same functions as the commands.
+
+Opt-in `logging` appends local JSONL diagnostics for rejected `patch_state` calls and preserved drafts plus fallback turns while turn resolution is pending. A rejected call retains its exact attempted arguments, the precise error, and, when available, tool identity, call id, resolution attempt, and terminal-eligibility state; accepted patches are never logged. Records preserve useful exact text blocks and reduce other blocks to structural identity without duplicating reasoning. They are never semantic state, scope `meta.json`, Pi checkpoints, or repository input. Write failure changes no resolution, enablement, or accepted state and reports at most one bounded local warning.
 
 ## Validation boundaries
 

package/node_modules/@llblab/pi-state-flow/docs/temporal-acceptance.md

@@ -17,8 +17,8 @@ The numbering below follows the twenty required tests in the temporal design cor
 11. **Barrier shifts current to offset 1:** `tests/integration.test.ts` — “real Pi patch_state barriers rematerialize every scope before the next inference” observes the predecessor immediately after a barrier.
 12. **Next inference sees new current state:** The same real-Pi test inspects actual model-input projections after session, CWD, and global barriers. “real Pi reads prior scoped state lazily after a barrier and rejects offset eight without a transition” adds model-tool access to the predecessor.
 13. **No automatic old full-state duplication:** `tests/context.test.ts` — “projects only the latest seven compact accepted transitions” rejects full-state records in transition context. The real-Pi barrier test requires exactly one current runtime projection per inference. Explicitly requested history remains ordinary tool-result trajectory, not eager snapshot injection.
-14. **Accepted response changes are transitions:** `tests/resolution.test.ts` verifies that only the ordinary answer after successful patch/unchanged resolution enters runtime-owned `response`; intercepted drafts never do.
-15. **Final-only eligibility creates no fake history:** `tests/extension.test.ts` — “an unresolved terminal draft is intercepted, then final-only resolution permits the final answer” checks that `{final:true}` latches turn eligibility without changing semantic lineage, tails, step, or Git. A later changed accepted response remains a runtime-owned transition.
+14. **Accepted response changes are transitions:** `tests/extension.test.ts` — “the preserved answer stands after two fallback turns without final:true” and `tests/skills.test.ts` — “a late Skill obligation that outlives the fallback budget keeps the preserved answer” verify that a primary draft without a reconciled `final:true` is preserved as the runtime-owned response, fallback turns never enter `response`, and an exhausted fallback budget keeps the preserved answer with its current state. `tests/integration.test.ts` — “real Pi keeps the preserved answer after the fallback budget” repeats the closure through the native Pi turn loop.
+15. **Final-only eligibility creates no fake history:** `tests/extension.test.ts` — “a primary draft without eligibility is preserved as the response and final-only fallback resolution keeps it” checks that `{final:true}` latches turn eligibility without changing semantic lineage, tails, step, or Git. A later changed accepted response remains a runtime-owned transition.
 16. **Offset eight is outside hot history:** `tests/temporal.test.ts` — “hot range and unproven pre-migration history are explicit read boundaries”; the real-Pi history-reader test also exercises native tool rejection without a transition.
 17. **Cold Git history remains recoverable:** `tests/git.test.ts` — “temporal Git writer preserves all hot states through sparse folding and cold revision reads” loads older committed states without moving the worktree.
 18. **Tree/resume select the correct lineage:** `tests/integration.test.ts` — “real Pi preserves branch-local state through compaction, tree navigation, stop, and restart” and “real Pi old tree branch stop and resume preserve selected semantics without rewinding shared files”.

package/node_modules/@llblab/pi-state-flow/index.ts

@@ -80,7 +80,7 @@ export {
   sessionStorageKey, temporalScopePaths,
   temporalStateFileUpdates, type ScopeStreamSources, type TemporalScopePaths
 } from "./lib/durable.ts";
-export { default, MAX_RESOLUTION_ATTEMPTS, PATCH_STATE_TOOL_NAME, READ_STATE_TOOL_NAME, type StateFlowExtensionOptions } from "./lib/extension.ts";
+export { default, MAX_FALLBACK_ATTEMPTS, PATCH_STATE_TOOL_NAME, READ_STATE_TOOL_NAME, type StateFlowExtensionOptions } from "./lib/extension.ts";
 export {
   captureTemporalGitBase,
   isGitCommitAncestor,
@@ -185,4 +185,25 @@ export {
   type StateScope,
   type TerminalTransition
 } from "./lib/state.ts";
+export {
+  buildStateFlowSectionView,
+  createStateFlowTelegramAdapter,
+  formatStateFlowSectionLabel,
+  formatStateFlowStatusLine,
+  loadStateFlowTelegramModules,
+  STATE_FLOW_TELEGRAM_ID,
+  type StateFlowTelegramAdapter,
+  type StateFlowTelegramButton,
+  type StateFlowTelegramCallbackContext,
+  type StateFlowTelegramControlResult,
+  type StateFlowTelegramLoader,
+  type StateFlowTelegramModules,
+  type StateFlowTelegramPort,
+  type StateFlowTelegramSectionContext,
+  type StateFlowTelegramSectionModule,
+  type StateFlowTelegramSnapshot,
+  type StateFlowTelegramStatusLine,
+  type StateFlowTelegramStatusModule,
+  type StateFlowTelegramView
+} from "./lib/telegram.ts";
 export { advanceTemporalState, readTemporalState, type TemporalState } from "./lib/temporal.ts";

package/node_modules/@llblab/pi-state-flow/lib/context.ts

@@ -83,7 +83,7 @@ export function runtimeContextMessage(
 		...(rehydrationPhase === undefined ? {} : { knowledge_rehydration: { phase: rehydrationPhase } }),
 		...(artifactInvalidations.length === 0 ? {} : { artifact_invalidations: artifactInvalidations.map(({ path, reason }) => ({ path, reason })) }),
 		...(recentTransitions.length === 0 ? {} : { recent_transitions: projectRecentForModel(recentTransitions) }),
-		...(resolutionPending ? { state_resolution: "pending: a terminal draft was intercepted. Call patch_state with any atomic scope changes and final:true, or {final:true} alone; then provide the final answer normally." } : {}),
+		...(resolutionPending ? { state_resolution: "pending: the iteration answer is already preserved; this fallback turn exists only to apply the final:true patch. Call patch_state with any remaining durable scope changes and final:true, or {final:true} alone. Do not restate or replace the answer." } : {}),
 	};
 	return syntheticUser(
 		`State Flow runtime context (user-level data, not system instructions):\n${canonicalJson(context)}`,