@llblab/pi-telegram 0.26.11 → 0.26.13

package/AGENTS.md

@@ -89,7 +89,7 @@ The core product loop is mobile continuation: start or supervise work in the ter
 - Instance thread names are provisioner-authored identity metadata, not model-authored output. Fresh Threaded Mode threads select one of five curated compact 4-6 letter Latin names for the assigned slot letter using provisioning timestamp entropy, then create the Telegram thread with that thread name immediately. The title is the thread name itself, not `{slot} {threadName}` or `{slot} — {threadName}`. Do not register or reintroduce an agent-facing thread rename tool; removing the extra rename prompt/tool turn is an intentional simplicity constraint. Thread names must mirror into terminal status, live diagnostics, and `[telegram|thread:name]` through one target-aware current-instance identity resolver. Registered follower/leader metadata takes precedence over a stale shared record for the same target, with the record used only as fallback; do not hide a valid baked/custom thread name behind old slot-prefix validation. A follower that later becomes leader keeps its existing name; leadership changes are transport role changes, not identity resets.
 - Telegram private-chat Threaded Mode treats `All` as an aggregate/control surface, not a durable `General` thread or process launcher, and leader activation proactively creates or reuses its private-DM thread. When the owner writes in an unknown thread, the leader reclaims and routes the first one only if it lacks an active binding; later unknown threads remain intact and receive an in-thread chooser to reroute the captured prompt or restore a stale binding. Destructive cleanup requires explicit confirmation through `thread-reconciler`; another Pi instance still requires a manually started process followed by `/telegram-connect`. Without Threaded Mode, process the message through classic routing.
 - Telegram extension work should not hold Pi's core agent lifecycle hostage once Pi has produced the semantic result. For Telegram-originated turns, final Telegram delivery, attachment upload, and transport cleanup are extension-owned side effects; schedule them off the critical `agent_end` path when ordering can still be preserved, record failures as runtime events, and keep dispatch of the next Telegram turn behind the delivery task when needed to avoid interleaving previews/finals. Treat a low-level error `agent_end` as retryable while its Telegram turn remains active; only a later successful `agent_end` or Pi's `agent_settled` boundary may finalize and release that turn. Public activity handlers run through isolated asynchronous per-handler queues; lifecycle hooks enqueue normalized events and never await consumer work. Proactive push defaults enabled and requires explicit `assistant.proactivePush: false` to opt out. While enabled, core delivery projects each completed Pi-visible assistant text block from local/autonomous work once and in order; bind admitted blocks to the exact target, profile/token transport stamp, direct leader epoch or follower registration generation, and session generation. Token deltas, hidden reasoning, tool traffic, stale authority, and Telegram-owned turns never enter that projection.
-- Core thinking/tool visibility is controlled by file-backed `assistant.activity: "quiet" | "thinking" | "tools" | "verbose"`; every Pi instance reloads the shared config at `agent-start` before admitting activity so process-local cache cannot broaden the selected class. It defaults to `verbose` when absent and remains separate from proactive public prose and assistant Markdown: provider-exposed thinking uses only a durable ordinary HTML expandable blockquote, while completed executed tools use native Rich Messages whose closed `<Tool>: <status>` root details preserve sentence case while uppercasing an initial two- or three-letter repeated prefix, then contain an open-by-default `arguments` child plus closed `update`, `result`, or `error` children with plain lowercase labels and JSON pre blocks; treat these labels like quote-free outer JSON keys and add no list marker. Thinking renders inline Markdown as Telegram HTML without spending a separate header row; `verbose` enables both classes, and every activity send/edit disables Telegram link previews while technical evidence also neutralizes HTTP(S) auto-link detection as a client-safe fallback. Keep it compact by default, exact-target/transport-generation fenced, start-order preserving, boundary-aware, memory/transport bounded, and non-blocking; final delivery waits for admitted technical activity only inside the extension-owned background task, and session replacement abandons queued old-generation work without waiting on old transport. Read legacy `assistant.activityVerbosity` only when `assistant.activity` is absent and remove it on the next Settings write. Never invent unavailable provider-private thinking or replay a possibly committed technical message.
+- Core thinking/tool visibility is controlled by file-backed `assistant.activity: "quiet" | "thinking" | "tools" | "verbose"`; every Pi instance reloads the shared config at `agent-start` before admitting activity so process-local cache cannot broaden the selected class. It defaults to `verbose` when absent and remains separate from proactive public prose and assistant Markdown: provider-exposed thinking uses only a durable ordinary HTML expandable blockquote, while completed executed tools use native Rich Messages whose closed `<Tool>: <status>` root details preserve sentence case while uppercasing an initial two- or three-letter repeated prefix, then contain an open-by-default `arguments` child plus closed `update`, `result`, or `error` children with lowercase monospaced labels and JSON pre blocks; treat each label as one quote-free outer JSON key and add no icon, list marker, or heading emphasis. Thinking renders inline Markdown as Telegram HTML without spending a separate header row; `verbose` enables both classes, and every activity send/edit disables Telegram link previews while technical evidence also neutralizes HTTP(S) auto-link detection as a client-safe fallback. Keep it compact by default, exact-target/transport-generation fenced, start-order preserving, boundary-aware, memory/transport bounded, and non-blocking; final delivery waits for admitted technical activity only inside the extension-owned background task, and session replacement abandons queued old-generation work without waiting on old transport. Read legacy `assistant.activityVerbosity` only when `assistant.activity` is absent and remove it on the next Settings write. Never invent unavailable provider-private thinking or replay a possibly committed technical message.
 - Telegram runtime state should be treated as event-driven reconciliation of extension assumptions against observable Telegram signals, not as a full Telegram bot read-model and not as a reason to query Telegram on every action. Keep a local assumption model for bot identity/capabilities, pairing assumptions, thread support, known thread lifecycle, bound instance targets, reservations, and transport health. Invalidate and reconcile the relevant slice on meaningful events: startup/reload, lifecycle service messages, stale-send/API errors, setup/pairing changes, follower register/prune, explicit status/debug requests, and bounded low-frequency leader health ticks. `lib/sync.ts` owns sync slices, observation intake, invalidation triggers, status/debug freshness, and reconciliation scheduling; it must not promise complete bot-state mirroring because Bot API lacks a complete topic listing surface. `lib/thread-reconciler.ts` owns pure Threaded Mode lifecycle planning and should become the only policy authority for destructive thread cleanup decisions. `threads` owns current Telegram UI thread/tab binding primitives and thread-name helpers mapped to Bot API topic transport, `status` renders projections, and `index.ts` only wires ports. `tmp/telegram/logs.jsonl` is a session-local redacted runtime evidence stream for race debugging and resets on extension start / runtime scope changes; it is diagnostics only, not routing/provisioning authority. `state.json` should be an observable/debug snapshot aligned with `/telegram-status` (extension runtime, bot capabilities including `bot.lastSlot`, runtime role, live roster projection, reservations, diagnostics), not routing/provisioning authority. Because every process on one Telegram profile shares this file, only the active transport lock owner may persist it; followers read current state and gain write authority only after promotion. Status-only writes must refresh disk-backed bindings before serialization so a stale loaded snapshot cannot erase newer leader state. Live bus/runtime state is authoritative; file reservations and fresh capability observations may be startup hints/collision guards only; stale snapshots must re-probe before suppressing bus/topic behavior. Do not persist stale/offline/failed thread target history as source of truth.
 - Thread bindings are bidirectional. From the Pi-instance side, an instance knows and preserves its target, slot, thread name, lifecycle state, and direct-delivery defaults. From the Telegram-client/bot side, the bridge observes thread creation/close/reopen/stale-send signals and reconciles them into instance binding state. Lifecycle transitions that affect operator understanding should be Telegram-visible when a live transport remains: every successful follower registration/re-registration gets a compact connected notice in the assigned thread, while heartbeat pruning stays silent because it is only liveness suspicion. These notices should use the instance thread name when known and fall back to the slot letter only while the thread is still unnamed. New unknown or command-created temporary threads receive the complete forward plus replace/restore control set and remain preserved until the user chooses one. Successful forward deletes the chooser and temporary thread; successful replace/restore always deletes the chooser, rebinds the temporary thread, and deletes only the replaced old thread. Any destructive cleanup must go through `thread-reconciler`. Unknown `forum_topic_created` service events are observations, not destructive cleanup proof.
 - The multi-instance bus uses private bot DMs with Telegram private-chat Threaded Mode enabled for the bot. No supergroup, group, or forum configuration is needed; the thread chat is always the private chat with the paired owner. Threaded capability checks must use bot/private-chat evidence such as `getMe.has_topics_enabled`, incoming `message_thread_id`, and topic operation success/failure; do not use group chat metadata as the control-plane truth for Telegram private-chat Threaded Mode.

package/BACKLOG.md

@@ -2,45 +2,6 @@
 
 _This backlog tracks only open release-relevant work: hotfixes, bounded maintenance, live runtime verification, evidence-gated Telegram client follow-ups, and upstream Pi API blockers. Completed outcomes and validation evidence belong in `CHANGELOG.md`, not in this queue._
 
-## P0 — 0.26.11 Windows Release Gates
-
-Context: the first final release matrix correctly held publication after loaded Windows scheduling exceeded two integration-only deadlines: queued model-menu completion and graceful shutdown of a full-Pi parent fixture. Neither failure changed the runtime feature contract, but both gates must remain bounded and preserve their exact assertions.
-
-Open work:
-
-- [x] Recheck the generic integration predicate at its deadline and give only the model-menu completion assertion a five-second budget.
-- [x] Give the full-Pi parent fixture up to ten seconds to complete graceful shutdown after its stop marker, without weakening exit-code or child-poll assertions.
-- [ ] Pass two fresh Linux/macOS/Windows matrices after these final changes.
-
-Done when: both Windows-sensitive evidence paths complete under runner load, genuine hangs remain bounded and diagnostic, and two consecutive release matrices pass before merge.
-
-## P0 — Settings Description Choice Ordering
-
-Context: Settings detail copy historically tended to place the default value first. The default is metadata, not an ordering rule. Value descriptions should mirror the actual choice controls so operators can scan explanatory text and buttons in the same sequence.
-
-Open work:
-
-- [x] Order every core Settings value-description list exactly like its selectable controls: keyboard rows top-to-bottom and values within a shared row left-to-right; never move a value merely because it carries `(default)`.
-- [x] Keep `(default)` attached to the actual default wherever that value falls in control order; for example, Draft previews should describe `on` before `off (default)` because the buttons display On then Off, while Activity should retain `quiet`, `thinking`, `tools`, `verbose (default)`.
-- [x] Make the option/control order the explicit source of truth or protect parity with focused regressions so description and keyboard order cannot drift independently.
-- [x] Live-smoke the Settings detail ordering before the guarded release flow.
-
-Done when: every Settings description follows its visible chooser rather than default-first history, default annotations remain truthful, automated parity coverage passes, and live Telegram screens confirm scan order.
-
-## P0 — Nested Tool Evidence List Styling
-
-Context: nested Rich tool evidence labels should read like quote-free outer JSON keys rather than peer headings or list items. Plain lowercase labels distinguish evidence children from the root without adding a redundant marker. Root labels remain sentence-case, but tool names beginning with a two- or three-character run of the same ASCII letter should preserve that recognizable prefix as uppercase instead of flattening it to one initial capital.
-
-Open work:
-
-- [x] Render each child summary as a marker-free plain lowercase label: `arguments`, `update N (K earlier omitted)`, `result`, or `error`.
-- [x] At the root level only, uppercase a leading repeated-letter run when its length is two or three, then retain ordinary label casing for the remainder; examples: `ffgrep` → `FFgrep`, `fffind` → `FFFind`, and `bash` → `Bash`.
-- [x] Keep Arguments open-by-default behavior intact, secondary nodes collapsed, and all JSON evidence, bounds, ordering, coalescing, redaction, fallback, and fencing guarantees unchanged.
-- [x] Update focused Rich block regressions, durable UI documentation, changelog, and package metadata.
-- [x] Live-smoke `FFFind` and `Bash` roots plus the nested hierarchy, then remove the redundant minus from the final design in response to operator feedback.
-
-Done when: opening a tool root reveals compact quote-free evidence keys without adding height, all evidence behavior remains intact, automated validation passes, live clients confirm the hierarchy, and the hotfix clears the guarded release flow.
-
 ## P1 — Windows Graceful Disconnect Test Budget
 
 Context: the graceful follower-disconnect integration overrides the production 30-second bus budget with 500 milliseconds even though the path persists cleanup intent, performs close/delete operations, updates binding state, and returns an authenticated response. A loaded Windows runner exceeded that artificial deadline while the same focused path completes promptly under normal scheduling.

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.26.13: Entrypoint Compression And BotFather Prerequisites
+
+- `Entrypoint Compression`: Moved low-level policy out of `index.ts` into owning domains: the deferred queue dispatch delay defaults in the queue domain, the delivery generation seed is built by the delivery domain, the `target-bindings` sync slice key and the default profile name resolve from their domains, and bus-runtime capability answers come from the thread capability state. Removed a redundant follower client timeout literal that duplicated the domain default. Impact: the composition root wires ports while constants, generations, and capability decisions stay with their owning domains.
+- `Assembly Ownership`: Extracted the follower assembly (receiver, target replacement, recovery, registration) and session-lifecycle assembly (queue, follower, services) dependency structures into builders owned by `bus-follower` and `lifecycle`, normalizing shared ports and moving auth-secret derivation and grouped-input sequencing into domain runtimes. Impact: assembly shape and policy live in the owning domains, and the entrypoint reads as named construction steps instead of nested constructor calls.
+- `Setup Documentation`: Documented the BotFather prerequisites for guest mode, private-chat Threaded Mode, and queue-reaction admin rights in the Quick Start. Impact: operators can enable the capabilities a feature needs instead of discovering that a disabled capability silently never triggers.
+
+## 0.26.12: Monospaced Tool Evidence Keys
+
+- `Tool Evidence Typography`: Rendered nested `arguments`, `update`, `result`, and `error` summaries as lowercase inline code, including any dropped-update suffix in the same span. Impact: child labels read as compact quote-free outer JSON keys while root styling, disclosure state, evidence blocks, message height, and delivery guarantees remain unchanged.
+
 ## 0.26.11: Compact Tool Hierarchy And Ordered Settings Copy
 
 - `Tool Evidence Hierarchy`: Restyled nested Rich evidence summaries as plain lowercase labels (`arguments`, `update`, `result`, `error`) without icons, list markers, or heading emphasis. Arguments still open with the root and secondary evidence remains collapsed. Impact: child nodes read as quote-free outer JSON keys without adding message height or changing evidence behavior.

package/README.md

@@ -67,6 +67,14 @@ Open the bot DM and send:
 
 The first Telegram user to message the bot becomes the allowed owner. Other users are ignored.
 
+### 5. Enable optional bot capabilities in BotFather
+
+Enable the optional capabilities the bridge needs in [@BotFather](https://t.me/BotFather). The bridge does not fail loudly when a capability is off; the feature simply never triggers.
+
+1. Enable guest mode so the bot can answer mentions and replies in chats where it is not a member.
+2. Enable private-chat Threaded Mode; when it is available, one live instance becomes the profile's leader and later visible Pi instances register as followers. Without it, the bridge stays in classic single-owner DM mode.
+3. Make the bot an administrator in any chat where the queue reaction shortcuts (👍 promote, 👎 remove) should work. Reaction updates require admin rights, so the shortcuts silently do nothing in non-admin chats; private chats deliver reactions without admin rights.
+
 ## What It Feels Like
 
 - Start a task in the terminal, walk away, and keep supervising it from your phone.

package/docs/activity.md

@@ -180,7 +180,7 @@ Pi provider events use `thinking_*`; the public product term is `reasoning`. The
 
 Tool activity uses Pi's executed-tool lifecycle (`tool_execution_start/update/end`), not provider `toolcall_*` payloads. Provider tool-call boundaries are used only to classify preceding assistant prose. This prevents duplicate tool rows and reports actual execution results.
 
-`args`, `update`, and `result` may contain paths, source text, command output, or other sensitive data. They are available to trusted local extension code but must not be rendered wholesale by default. Core `quiet` mode renders none of them. Visible tool modes redact known secret shapes, truncate every evidence field, and place completed tool evidence in native Rich Messages with an open-by-default `arguments` child plus closed `update`/`result`/`error` details; child summaries use plain lowercase labels without list markers, like quote-free outer JSON keys, while their evidence remains in JSON pre blocks.
+`args`, `update`, and `result` may contain paths, source text, command output, or other sensitive data. They are available to trusted local extension code but must not be rendered wholesale by default. Core `quiet` mode renders none of them. Visible tool modes redact known secret shapes, truncate every evidence field, and place completed tool evidence in native Rich Messages with an open-by-default `arguments` child plus closed `update`/`result`/`error` details; child summaries use lowercase monospaced labels without icons, list markers, or heading emphasis, like quote-free outer JSON keys, while their evidence remains in JSON pre blocks.
 
 ## Delivery Context
 

package/docs/architecture.md

@@ -315,7 +315,7 @@ Queue reactions are shortcut controls for waiting turns. Promotion reactions (`
 
 When `assistant.proactivePush` is enabled and this instance has exact direct or follower transport authority, completed public assistant text blocks from local/autonomous work are sent once and in source order to the instance's authorized target. Visible commentary/checkpoints and the final block use the configured Rich or HTML renderer. Proactive projection excludes reasoning, tool traffic, token deltas, local prompt text, Telegram-owned turns, and stale generations. Each admitted block remains fenced to its exact target, profile/token stamp, leader epoch or follower registration generation, and session generation; non-idempotent acknowledgement ambiguity never authorizes replay.
 
-`assistant.activity` is an independent bridge-owned projection over normalized Activity events. Each process reloads the shared file-backed setting at `agent-start` before activity admission, so multi-instance mode cannot continue projecting a stale broader process-local selection. Omitted values resolve to `verbose`, while invalid values fail closed to `quiet`; `thinking` and `tools` select one technical class, while `verbose` enables both. Provider-exposed thinking uses persistent ordinary HTML containing only a standard expandable blockquote with a bounded redacted latest-text window and inline Markdown rendered as Telegram HTML. Completed executed tools use native Rich Messages: each closed `<Tool>: <status>` root details node uses sentence case with a preserved uppercase two- or three-letter repeated prefix, then the native disclosure chevron reveals an open-by-default `arguments` child plus closed retained `update N` and `result`/`error` child details with plain lowercase, marker-free summaries and JSON pre blocks; known-safe Rich rejections fall back to the previous HTML disclosure. The projection captures the exact target and transport stamp at activity admission, serializes updates, preserves tool-start order, closes coalescing across assistant/thinking boundaries, bounds retained text/update memory plus edit frames and message/tool size, disables previews and HTTP(S) auto-link recognition inside technical evidence, and never replays a possibly committed send. Session generations own independent queues, so replacement drops queued old work without waiting on an old call. Both proactive prose and active-turn final delivery wait for the admitted activity queue inside their extension-owned delivery tasks, preserving technical-before-semantic ordering without delaying Pi lifecycle completion. Settlement, replacement, disconnect, failure, or stale authority clears only local ownership; already-sent activity messages remain in chat.
+`assistant.activity` is an independent bridge-owned projection over normalized Activity events. Each process reloads the shared file-backed setting at `agent-start` before activity admission, so multi-instance mode cannot continue projecting a stale broader process-local selection. Omitted values resolve to `verbose`, while invalid values fail closed to `quiet`; `thinking` and `tools` select one technical class, while `verbose` enables both. Provider-exposed thinking uses persistent ordinary HTML containing only a standard expandable blockquote with a bounded redacted latest-text window and inline Markdown rendered as Telegram HTML. Completed executed tools use native Rich Messages: each closed `<Tool>: <status>` root details node uses sentence case with a preserved uppercase two- or three-letter repeated prefix, then the native disclosure chevron reveals an open-by-default `arguments` child plus closed retained `update N` and `result`/`error` child details with lowercase monospaced, marker-free summaries and JSON pre blocks; known-safe Rich rejections fall back to the previous HTML disclosure. The projection captures the exact target and transport stamp at activity admission, serializes updates, preserves tool-start order, closes coalescing across assistant/thinking boundaries, bounds retained text/update memory plus edit frames and message/tool size, disables previews and HTTP(S) auto-link recognition inside technical evidence, and never replays a possibly committed send. Session generations own independent queues, so replacement drops queued old work without waiting on an old call. Both proactive prose and active-turn final delivery wait for the admitted activity queue inside their extension-owned delivery tasks, preserving technical-before-semantic ordering without delaying Pi lifecycle completion. Settlement, replacement, disconnect, failure, or stale authority clears only local ownership; already-sent activity messages remain in chat.
 
 Telegram prompt guidance is context- and authority-aware. Only an exact direct owner or live registered follower exposes the three pi-telegram model tools, their active-tool metadata, and the compact local bridge suffix. Disconnect or authority loss removes those surfaces for subsequent requests without touching foreign tools; reconnect/recovery restores only the pi-telegram subset that was active before suspension, including across same-process reload. Telegram-originated turns receive a compact pointer to `telegram_help` plus dynamic prompt blocks such as `[voice] delivery: automatic voice`; full voice/button/direct-delivery/Threaded Mode syntax stays in the help tool rather than every system prompt.
 

package/docs/outbound.md

@@ -17,7 +17,7 @@ Proactive blocks use `assistant.rendering` independently of voice policy. Rich m
 `assistant.activity` defaults to `verbose` when absent and accepts four modes: `quiet`, `thinking`, `tools`, and `verbose`. Explicit stored values remain unchanged; invalid values fail closed to `quiet`. Every Pi instance reloads this shared file-backed mode at `agent-start`, so a setting changed from one thread applies to subsequent runs in the other live instances without requiring process reload. `thinking` shows only provider-exposed thinking, `tools` shows only completed executed tools, and `verbose` shows both without mixing technical UI into assistant Markdown.
 
 - Provider-exposed thinking updates one persistent ordinary HTML message containing only a standard Telegram `<blockquote expandable>` with a bounded redacted latest-text window. Omitting a separate icon/level header saves one chat row while the disclosure's unique shape remains recognizable. Inline Markdown emphasis and code render as Telegram HTML instead of leaking raw markers. The bridge sends the message once, edits it only as thinking grows, and leaves the disclosure in chat; it never uses Rich drafts/Rich Messages. Providers that expose no thinking produce none.
-- Completed executed tools use native `sendRichMessage` block objects. Each tool is one closed root details node summarized as bold `<Tool>:` plus monospaced `<status>`; root labels remain sentence-case except that a leading two- or three-character repeated-letter prefix stays uppercase (`fffind` → `FFFind`). The native disclosure chevron identifies the row, and opening it immediately reveals the open `arguments` child plus separate closed retained `update N`, `result`, or `error` child details. Each child summary is a plain lowercase label—visually a quote-free outer JSON key with no list marker—and contains one preformatted `json` block. Updates remain chronological, dropped-update counts appear in the first retained update summary, and arrays of object entries keep the denser `[{ ... }, { ... }]` layout. A known-safe Rich HTTP 400 rejection falls back once to the previous expandable HTML representation; ambiguous non-idempotent outcomes never replay.
+- Completed executed tools use native `sendRichMessage` block objects. Each tool is one closed root details node summarized as bold `<Tool>:` plus monospaced `<status>`; root labels remain sentence-case except that a leading two- or three-character repeated-letter prefix stays uppercase (`fffind` → `FFFind`). The native disclosure chevron identifies the row, and opening it immediately reveals the open `arguments` child plus separate closed retained `update N`, `result`, or `error` child details. Each child summary is one lowercase monospaced label—visually a quote-free outer JSON key with no icon, list marker, or heading emphasis—and contains one preformatted `json` block. Updates remain chronological, dropped-update counts appear in the first retained update summary, and arrays of object entries keep the denser `[{ ... }, { ... }]` layout. A known-safe Rich HTTP 400 rejection falls back once to the previous expandable HTML representation; ambiguous non-idempotent outcomes never replay.
 - Thinking `sendMessage`/`editMessageText` disables link previews and breaks HTTP(S) auto-link recognition inside evidence. Rich tool messages set `skip_entity_detection: true`, so URL-like arguments, updates, and results remain literal code. Consecutive tools coalesce by editing one message only while target, activity, generation, ordering boundary, tool count, and serialized-size bounds still match. Assistant or thinking content closes the batch. A non-idempotent send with unknown commit state is never replayed; failed or ambiguous edits start no fallback send.
 
 Thinking retains only a bounded latest-text window, tool updates retain only a bounded latest-entry window, and a session reset abandons queued old-generation work without making the replacement session wait for an old transport call. Final-answer delivery waits for the admitted activity queue inside the extension-owned background delivery task, so completed technical evidence cannot be overtaken by the semantic answer and Pi lifecycle completion remains non-blocking.

package/index.ts

@@ -107,7 +107,7 @@ export default function (pi: Pi.ExtensionAPI) {
     Ownership.createTelegramBusMessageOwnershipRuntime({
       instanceId: telegramInstanceId,
       getProfileKey() {
-        return getActiveTelegramThreadProfile() ?? "default";
+        return getActiveTelegramThreadProfile() ?? Config.TELEGRAM_DEFAULT_PROFILE_NAME;
       },
       listFollowers: telegramBusFollowerRegistry.list,
     });
@@ -117,9 +117,7 @@ export default function (pi: Pi.ExtensionAPI) {
   const runtimeEvents = runtimeDiagnostics.events;
   const recordRuntimeEvent = runtimeDiagnostics.recordRuntimeEvent;
   const configStore = Config.createTelegramConfigStore({ recordRuntimeEvent });
-  const isTelegramBusRuntimeEnabled = function (): boolean {
-    return !telegramThreadCapabilityState.isTopicModeUnavailable();
-  };
+  const isTelegramBusRuntimeEnabled = telegramThreadCapabilityState.isBusRuntimeEnabled;
   Config.bindGlobalTelegramConfigRuntime(configStore);
   const configControls = Config.createTelegramConfigControls(configStore);
   const lockRuntime = Locks.createTelegramLockRuntime<Pi.ExtensionContext>({
@@ -225,7 +223,6 @@ export default function (pi: Pi.ExtensionAPI) {
   );
   const deferredQueueDispatchRuntime =
     Queue.createTelegramDeferredQueueDispatchRuntime<Pi.ExtensionContext>({
-      delayMs: 50,
       recordRuntimeEvent,
     });
   const pollingControllerState = Polling.createTelegramPollingControllerState();
@@ -364,7 +361,6 @@ export default function (pi: Pi.ExtensionAPI) {
       getForwardCommentBatchPosition:
         textGroupRuntime.getPreparedForwardingPosition,
       recordRuntimeEvent,
-      timeoutMs: 30_000,
     });
   const telegramApiRuntime = BusApi.createTelegramBusAwareApiRuntime({
     directRuntime: directTelegramApiRuntime,
@@ -446,7 +442,8 @@ export default function (pi: Pi.ExtensionAPI) {
       getActiveTurnTarget: activeTurnRuntime.getTarget,
       getActiveGuestQueryId: activeTurnRuntime.getGuestQueryId,
     });
-  const deliveryGenerationSeed = `${telegramInstanceId}:${Date.now()}`;
+  const deliveryGenerationSeed =
+    Delivery.createTelegramDeliveryGenerationSeed(telegramInstanceId);
   const deliveryLifecycleRuntime =
     Delivery.createTelegramBridgeDeliveryLifecycleHooks({
       generationSeed: deliveryGenerationSeed,
@@ -687,10 +684,13 @@ export default function (pi: Pi.ExtensionAPI) {
       followerRegistry: telegramBusFollowerRegistry,
       followerTargetController,
       onRestored() {
-        telegramSyncStateRuntime.markSliceFresh("target-bindings", {
-          nowMs: Date.now(),
-          action: "follower-thread-restore",
-        });
+        telegramSyncStateRuntime.markSliceFresh(
+          Sync.TELEGRAM_SYNC_SLICE_TARGET_BINDINGS,
+          {
+            nowMs: Date.now(),
+            action: "follower-thread-restore",
+          },
+        );
       },
     });
   const observedThreadTargetBinding =
@@ -811,58 +811,54 @@ export default function (pi: Pi.ExtensionAPI) {
       handleAuthorizedReactionUpdate:
         inboundRouteRuntime.handleAuthorizedReactionUpdate,
     });
-  const telegramBusFollowerAssembly: BusFollower.TelegramBusFollowerRuntimeAssembly<Pi.ExtensionContext> =
-    BusFollower.createTelegramBusFollowerRuntimeAssembly<
+  const telegramBusFollowerAssemblyDeps =
+    BusFollower.createTelegramBusFollowerRuntimeAssemblyDeps<
       Pi.ExtensionContext,
       Updates.TelegramMessageReactionUpdated,
       Routing.TelegramRoutedCallbackQuery,
       Routing.TelegramRoutedMessage
     >({
+      instanceId: telegramInstanceId,
+      registrationState: telegramBusFollowerRegistrationState,
+      recordRuntimeEvent,
       receiver: {
         socketPath: getTelegramBusFollowerSocketPath,
-        instanceId: telegramInstanceId,
         getContext: telegramSessionContextStore.get,
         getAuthSecret: telegramBusFollowerControlState.getActiveAuthSecret,
         ...forwardedRouteHandlers,
         prepareForwardedMessage: textGroupRuntime.prepareForwardedMessage,
-        recordRuntimeEvent,
       },
       targetReplacement: {
         topicTargetStore: threadStore,
-        registrationState: telegramBusFollowerRegistrationState,
-        instanceId: telegramInstanceId,
         getManualFollowerProfileKey: getTelegramManualFollowerProfileKey,
         manualFollowerOwnerId: telegramManualFollowerOwnerId,
         getSyncState: telegramSyncStateRuntime.getState,
         setSyncState: telegramSyncStateRuntime.setState,
         updateStatus,
-        recordRuntimeEvent,
       },
       recovery: {
-        registrationState: telegramBusFollowerRegistrationState,
         getLeaderState: lockRuntime.getState,
         setLifecyclePhase: telegramBusFollowerControlState.setLifecyclePhase,
         updateStatus,
         promoteToLeader: promoteTelegramBusFollowerToLeader,
         getActiveContext: telegramSessionContextStore.get,
-        recordRuntimeEvent,
       },
       registration: {
-        instanceId: telegramInstanceId,
         getFollowerBusSocketPath: getTelegramBusFollowerSocketPath,
         getLeaderSocketPath: getTelegramBusSocketPath,
-        registrationState: telegramBusFollowerRegistrationState,
         isContextActive: telegramSessionContextStore.isCurrent,
         createRequestId: telegramBusFollowerClients.createRequestId,
-        getLeaderAuthSecret(owner) {
-          return owner.busSecret;
-        },
-        setActiveAuthSecret:
-          telegramBusFollowerControlState.setActiveAuthSecret,
+        setActiveAuthSecret: telegramBusFollowerControlState.setActiveAuthSecret,
         getProfileKey: getTelegramManualFollowerProfileKey,
-        recordRuntimeEvent,
       },
     });
+  const telegramBusFollowerAssembly: BusFollower.TelegramBusFollowerRuntimeAssembly<Pi.ExtensionContext> =
+    BusFollower.createTelegramBusFollowerRuntimeAssembly<
+      Pi.ExtensionContext,
+      Updates.TelegramMessageReactionUpdated,
+      Routing.TelegramRoutedCallbackQuery,
+      Routing.TelegramRoutedMessage
+    >(telegramBusFollowerAssemblyDeps);
   const telegramBusFollowerRegistration =
     telegramBusFollowerAssembly.registration;
   const pollingRuntime = Polling.createTelegramPollingControllerRuntime({
@@ -1001,8 +997,8 @@ export default function (pi: Pi.ExtensionAPI) {
       stopPolling: lockedPollingRuntime.stop,
       recordRuntimeEvent,
     });
-  const sessionLifecycleRuntime =
-    Lifecycle.createTelegramBridgeSessionLifecycleAssembly({
+  const telegramBridgeSessionLifecycleDeps =
+    Lifecycle.createTelegramBridgeSessionLifecycleDeps({
       contextStore: telegramSessionContextStore,
       queue: {
         getCurrentModel: getContextModel,
@@ -1038,20 +1034,24 @@ export default function (pi: Pi.ExtensionAPI) {
         recordRuntimeEvent,
       },
       services: {
-        resumeGroupedInput(ctx) {
-          mediaGroupRuntime.resume(ctx);
-          textGroupRuntime.resume(ctx);
+        mediaGroup: {
+          resume: mediaGroupRuntime.resume,
+          suspend: mediaGroupRuntime.suspend,
+        },
+        textGroup: {
+          resume: textGroupRuntime.resume,
+          suspend: textGroupRuntime.suspend,
         },
-        suspendGroupedInput: TextGroups.createTelegramGroupedInputClearer({
-          clearMediaGroups: mediaGroupRuntime.suspend,
-          clearTextGroups: textGroupRuntime.suspend,
-        }),
         delivery: deliveryLifecycleRuntime,
         polling: lockedPollingRuntime,
         capabilityMonitor: telegramThreadCapabilityMonitor,
         queueWatchdog: queueDispatchWatchdogRuntime,
       },
     });
+  const sessionLifecycleRuntime =
+    Lifecycle.createTelegramBridgeSessionLifecycleAssembly(
+      telegramBridgeSessionLifecycleDeps,
+    );
 
   // --- Extension API Bindings ---
 

package/lib/activity-verbosity.ts

@@ -212,7 +212,7 @@ function createToolActivityDetail(
 ): TelegramInputRichBlock {
   return {
     type: "details",
-    summary,
+    summary: { type: "code", text: summary },
     blocks: [{ type: "pre", text, language: "json" }],
     ...(isOpen ? { is_open: true as const } : {}),
   };

package/lib/bus-follower.ts

@@ -514,6 +514,91 @@ export function createTelegramBusForwardedRouteHandlers<
   };
 }
 
+export interface TelegramBusFollowerRuntimeAssemblyPorts<
+  TContext extends { cwd?: string },
+  TReactionUpdate,
+  TCallbackQuery,
+  TMessage = unknown,
+> {
+  instanceId: string;
+  registrationState: TelegramBusFollowerRegistrationState;
+  recordRuntimeEvent: (
+    category: string,
+    error: unknown,
+    details?: Record<string, unknown>,
+  ) => void;
+  receiver: Omit<
+    TelegramBusForwardedUpdateReceiverRuntimeDeps<
+      TContext,
+      TReactionUpdate,
+      TCallbackQuery,
+      TMessage
+    >,
+    "handleReplaceTarget" | "instanceId" | "recordRuntimeEvent"
+  >;
+  targetReplacement: Omit<
+    TelegramBusFollowerTargetReplacementHandlerDeps<TContext>,
+    "registrationState" | "instanceId" | "recordRuntimeEvent"
+  >;
+  recovery: Omit<
+    TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext>,
+    "getRegistrationRuntime" | "registrationState" | "recordRuntimeEvent"
+  >;
+  registration: Omit<
+    TelegramBusFollowerRegistrationRuntimeDeps<TContext>,
+    | "startReceiving"
+    | "stopReceiving"
+    | "onHeartbeatFailure"
+    | "instanceId"
+    | "registrationState"
+    | "recordRuntimeEvent"
+  >;
+}
+
+export function createTelegramBusFollowerRuntimeAssemblyDeps<
+  TContext extends { cwd?: string },
+  TReactionUpdate,
+  TCallbackQuery,
+  TMessage = unknown,
+>(
+  ports: TelegramBusFollowerRuntimeAssemblyPorts<
+    TContext,
+    TReactionUpdate,
+    TCallbackQuery,
+    TMessage
+  >,
+): TelegramBusFollowerRuntimeAssemblyDeps<
+  TContext,
+  TReactionUpdate,
+  TCallbackQuery,
+  TMessage
+> {
+  return {
+    receiver: {
+      ...ports.receiver,
+      instanceId: ports.instanceId,
+      recordRuntimeEvent: ports.recordRuntimeEvent,
+    },
+    targetReplacement: {
+      ...ports.targetReplacement,
+      instanceId: ports.instanceId,
+      registrationState: ports.registrationState,
+      recordRuntimeEvent: ports.recordRuntimeEvent,
+    },
+    recovery: {
+      ...ports.recovery,
+      registrationState: ports.registrationState,
+      recordRuntimeEvent: ports.recordRuntimeEvent,
+    },
+    registration: {
+      ...ports.registration,
+      instanceId: ports.instanceId,
+      registrationState: ports.registrationState,
+      recordRuntimeEvent: ports.recordRuntimeEvent,
+    },
+  };
+}
+
 export function createTelegramBusFollowerRuntimeAssembly<
   TContext extends { cwd?: string },
   TReactionUpdate,
@@ -1260,7 +1345,9 @@ export function createTelegramBusFollowerRegistrationRuntime<
         deps.getLeaderSocketPath?.() ??
         getTelegramBusSocketPath();
       await deps.startReceiving?.();
-      activeAuthSecret = deps.getLeaderAuthSecret?.(leader);
+      activeAuthSecret = deps.getLeaderAuthSecret
+        ? deps.getLeaderAuthSecret(leader)
+        : leader?.busSecret;
       deps.setActiveAuthSecret?.(activeAuthSecret);
       const registrationGeneration = deps.createRequestId();
       const registrationEnvelope: Extract<

package/lib/delivery.ts

@@ -198,6 +198,10 @@ export function createTelegramDeliveryLifecycleHooks(
   };
 }
 
+export function createTelegramDeliveryGenerationSeed(instanceId: string): string {
+  return `${instanceId}:${Date.now()}`;
+}
+
 /** @internal */
 export function createTelegramBridgeDeliveryLifecycleHooks<TTransportStamp>(
   deps: Omit<

package/lib/lifecycle.ts

@@ -6,6 +6,7 @@
 
 import * as BusFollower from "./bus-follower.ts";
 import * as Queue from "./queue.ts";
+import * as TextGroups from "./text-groups.ts";
 import type {
   AgentEndEvent,
   AgentSettledEvent,
@@ -253,6 +254,67 @@ export interface TelegramBridgeSessionLifecycleAssemblyDeps<
   services: TelegramBridgeSessionServiceRuntime;
 }
 
+export interface TelegramBridgeSessionLifecyclePorts<
+  TQueueItem,
+  TModel = unknown,
+> {
+  contextStore: TelegramSessionContextStore<ExtensionContext>;
+  queue: Omit<
+    Queue.TelegramSessionLifecycleRuntimeDeps<
+      ExtensionContext,
+      TQueueItem,
+      TModel
+    >,
+    "isSessionActive" | "stopPolling" | "clearPendingMediaGroups"
+  >;
+  follower: Omit<
+    BusFollower.TelegramBusFollowerSessionRefreshHookDeps<ExtensionContext>,
+    "isSessionActive"
+  > &
+    BusFollower.TelegramBusFollowerSessionReplacementSuspenderDeps;
+  services: {
+    mediaGroup: {
+      resume(ctx: ExtensionContext): void;
+      suspend(): void;
+    };
+    textGroup: {
+      resume(ctx: ExtensionContext): void;
+      suspend(): void;
+    };
+    delivery: TelegramBridgeSessionServiceRuntime["delivery"];
+    polling: TelegramBridgeSessionServiceRuntime["polling"];
+    capabilityMonitor: TelegramBridgeSessionServiceRuntime["capabilityMonitor"];
+    queueWatchdog: TelegramBridgeSessionServiceRuntime["queueWatchdog"];
+  };
+}
+
+export function createTelegramBridgeSessionLifecycleDeps<
+  TQueueItem,
+  TModel = unknown,
+>(
+  ports: TelegramBridgeSessionLifecyclePorts<TQueueItem, TModel>,
+): TelegramBridgeSessionLifecycleAssemblyDeps<TQueueItem, TModel> {
+  return {
+    contextStore: ports.contextStore,
+    queue: ports.queue,
+    follower: ports.follower,
+    services: {
+      resumeGroupedInput(ctx) {
+        ports.services.mediaGroup.resume(ctx);
+        ports.services.textGroup.resume(ctx);
+      },
+      suspendGroupedInput: TextGroups.createTelegramGroupedInputClearer({
+        clearMediaGroups: ports.services.mediaGroup.suspend,
+        clearTextGroups: ports.services.textGroup.suspend,
+      }),
+      delivery: ports.services.delivery,
+      polling: ports.services.polling,
+      capabilityMonitor: ports.services.capabilityMonitor,
+      queueWatchdog: ports.services.queueWatchdog,
+    },
+  };
+}
+
 export function createTelegramBridgeSessionLifecycleAssembly<
   TQueueItem,
   TModel = unknown,

package/lib/polling.ts

@@ -351,6 +351,7 @@ export interface TelegramThreadCapabilityStateRuntime {
   setBusPollingStarted(started: boolean): void;
   isTopicModeUnavailable(): boolean;
   setTopicModeUnavailable(unavailable: boolean): void;
+  isBusRuntimeEnabled(): boolean;
   shouldForceFreshLeaderThread(): boolean;
   setForceFreshLeaderThread(forceFresh: boolean): void;
 }
@@ -458,6 +459,7 @@ export function createTelegramThreadCapabilityStateRuntime(): TelegramThreadCapa
     setTopicModeUnavailable(unavailable) {
       topicModeUnavailable = unavailable;
     },
+    isBusRuntimeEnabled: () => !topicModeUnavailable,
     shouldForceFreshLeaderThread: () => forceFreshLeaderThread,
     setForceFreshLeaderThread(forceFresh) {
       forceFreshLeaderThread = forceFresh;

package/lib/queue.ts

@@ -2133,13 +2133,19 @@ export interface TelegramDeferredQueueDispatchRuntime<TContext = unknown> {
   request: (dispatchNextQueuedTelegramTurn: (ctx: TContext) => void) => void;
 }
 
+/**
+ * Production debounce for deferred queue dispatch; the factory defaults to this
+ * so the entrypoint wires ports instead of policy constants.
+ */
+export const TELEGRAM_DEFERRED_DISPATCH_DELAY_MS = 50;
+
 export function createTelegramDeferredQueueDispatchRuntime<TContext = unknown>(
   deps: TelegramDeferredQueueDispatchRuntimeDeps = {},
 ): TelegramDeferredQueueDispatchRuntime<TContext> {
   let boundContext: TContext | undefined;
   let generation = 0;
   const timers = new Set<ReturnType<typeof setTimeout>>();
-  const delayMs = deps.delayMs ?? 0;
+  const delayMs = deps.delayMs ?? TELEGRAM_DEFERRED_DISPATCH_DELAY_MS;
   const setTimer =
     deps.setTimer ??
     ((callback: () => void, ms: number): ReturnType<typeof setTimeout> =>

package/lib/sync.ts

@@ -486,6 +486,8 @@ export async function ensureTelegramLeaderThreadBinding(
   return ownTarget;
 }
 
+export const TELEGRAM_SYNC_SLICE_TARGET_BINDINGS = "target-bindings";
+
 export const TELEGRAM_SYNC_SLICES = [
   "bot-identity",
   "bot-capabilities",
@@ -493,7 +495,7 @@ export const TELEGRAM_SYNC_SLICES = [
   "allowed-user",
   "topic-capability",
   "topic-state",
-  "target-bindings",
+  TELEGRAM_SYNC_SLICE_TARGET_BINDINGS,
   "reservations",
   "transport-health",
 ] as const;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.26.11",
+  "version": "0.26.13",
   "private": false,
   "publishConfig": {
     "access": "public"