@llblab/pi-telegram 0.38.0 → 0.39.1

package/AGENTS.md

@@ -80,14 +80,14 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 - Foreign forwarding settles as `accepted`, `retryable`, or `terminal-rejected`. Only an authenticated acknowledgement carrying the expected `deliveryId` and `sourceUpdateId` releases leader journal authority. Negative, missing, stale, mismatched, or capacity-failed settlement remains durable; callback error answers are side effects only.
 - A forwarding delivery id is stable across registration replacement and derives from envelope kind, source `update_id`, and stable recipient binding. Runtime instance and registration generation remain separate attempt fences. Persisted message ownership carries the stable binding so replay can rebind only to its current authenticated registration.
 - A queued receipt persists its acquiring runtime instance, OS pid/process-birth identity, session generation, acquisition id, and acquisition time. Only exact authority may settle or discard it. Same-process session replacement may reconstruct the claim and the original process may settle after transport ownership moves; a foreign process may neither replay nor settle it through generic removal or a copied acquisition id.
-- Startup and elapsed time are not owner-death proof; queued authority has no time lease. Dead-owner recovery groups the complete receipt and transactionally rechecks pid liveness plus process-birth identity: only an absent PID or mismatched stable Linux/macOS birth proof returns all sources to `pending`; a matching proof is `alive`, while Windows or inaccessible birth metadata is `unverifiable`, and both non-dead outcomes keep authority queued. The live-transfer contract is authenticated offer → exact-generation bounded payload staging → recipient CAS acceptance → exact receipt-and-owner ACK → donor removal → recipient readiness. The offer freezes donor settlement/recovery; controls rebuild local closures; negative/mismatched pre-acceptance ACK cancels only an unaccepted offer and retains donor work; a lost post-acceptance ACK cannot cancel recipient authority and leaves donor memory frozen for explicit reconciliation.
+- Startup and elapsed time are not owner-death proof; queued authority has no time lease. Dead-owner cleanup groups the complete receipt and transactionally rechecks pid liveness plus process-birth identity: only an absent PID or mismatched stable Linux/macOS birth proof discards all session-owned sources without replay; a matching proof is `alive`, while Windows or inaccessible birth metadata is `unverifiable`, and both non-dead outcomes keep authority queued. The live-transfer contract is authenticated offer → exact-generation bounded payload staging → recipient CAS acceptance → exact receipt-and-owner ACK → donor removal → recipient readiness. The offer freezes donor settlement/recovery; controls rebuild local closures; negative/mismatched pre-acceptance ACK cancels only an unaccepted offer and retains donor work; a lost post-acceptance ACK cannot cancel recipient authority and leaves donor memory frozen for explicit reconciliation.
 - Execution failures persist bounded diagnostics and attempt state as `retry-wait`. Automatic retry continues indefinitely with exponential `1s → 2s → 4s → 8s → 16s → 32s → 60s` delay capped at 60 seconds; later independent updates continue draining, durable authority is never silently discarded, and legacy `failed` entries resume automatically at startup. Snapshot-plus-segment journals compact only after 256 unapplied revisions or 4 MiB; snapshot-first cleanup tolerates redundant segments, and empty authority may atomically rebind bot/profile identity. Missing snapshots left by the retired broad temp cleanup rebuild only from a complete provably empty segment chain, while revisionless snapshots may recover from a validated later segment predecessor; otherwise the snapshot and segments move atomically under `tmp/telegram/recovery/` before a fresh journal is published and startup continues with informational recovery evidence.
 - An unresolved reaction delays only the exact governed queue item identified by chat/message sources, not unrelated queue work. Queue receipt publication follows in-memory append and precedes dispatch request; receipt-bearing turns remain queued until every exact source commits.
 - The detailed implementation and release gates live in [`docs/architecture.md`](./docs/architecture.md), [`docs/multi-instance-bus.md`](./docs/multi-instance-bus.md), and [`BACKLOG.md`](./BACKLOG.md).
 
 ### 4.4 Queue, Delivery, And User Surfaces
 
-- Queue lane/kind admission is explicit. Dispatch waits for active-turn, pending-dispatch, control, compaction, `ctx.isIdle()`, and Pi pending-message guards; a dispatched prompt stays queued until `agent_start` consumes it. Each prompt is one object with one active lane and no reserved return slot. Normal and Priority are separate FIFO lanes: crossing lanes removes it from the source and appends it at the destination tail, while Keep/Skip and same-category emoji changes preserve lane position. Complete reaction sets independently derive Priority from recognized positive emoji and Skip from recognized negative emoji; both may coexist, Skip wins only at dispatch, and suppressed turns remain visible without blocking unrelated work.
+- Queue lane/kind admission is explicit. Dispatch waits for active-turn, pending-dispatch, control, compaction, `ctx.isIdle()`, and Pi pending-message guards; a dispatched prompt stays queued until `agent_start` consumes it. Each prompt is one object with one active lane and no reserved return slot. Normal and Priority are separate FIFO lanes: crossing lanes removes it from the source and appends it at the destination tail, while Keep/Skip and same-category emoji changes preserve lane position. Complete reaction sets independently derive Priority from recognized positive emoji and Skip from recognized negative emoji; both may coexist, suppressed turns retain durable receipts while waiting, and Skip settles them only when the prompt reaches dispatch before dropping it without inference. Suppressed turns remain visible at a struck-through physical ordinal without contributing to executable queue counters, while graceful session shutdown discards all remaining queue authority before clearing memory.
 - `/stop`, `/abort`, `/next`, and `/continue` respectively reset+abort, abort while preserving queue, force the next turn, and enqueue a control-lane continuation. Abort-history folding applies only to Telegram-owned active turns.
 - Telegram extension side effects must not hold Pi's core lifecycle hostage after semantic completion. Preserve ordering in extension-owned background work, record failures, and fence target/profile/transport/session authority.
 - Complete assistant/guest model answers use Telegram-native Rich Markdown. Harness-owned menus, status, diagnostics, thinking, and tool evidence remain explicit HTML/plain or their documented native surface. Preserve literal code and structurally safe chunking; never split invalid markup.
@@ -125,7 +125,7 @@ The detailed map is canonical in [`docs/architecture.md`](./docs/architecture.md
 - Keep interfaces consistent with their owning exported contract. Use local structural `*Like`/view types only for deliberate narrow projections, not duplicate source-of-truth models.
 - Remove dead code immediately. Reachability from composition roots, public exports, tests, registered surfaces, and documented APIs—not recent usefulness—determines whether code is live.
 - Treat every meaningful `index.ts` edit as a composition-pressure check, but keep one-off live adapter wiring there when extraction would only hide cross-domain state.
-- Follow [`docs/ui-style.md`](./docs/ui-style.md) for interface copy, emoji, buttons, menus, and dialogs. Update the registry before assigning a new UI emoji meaning.
+- Follow [`docs/ui-style.md`](./docs/ui-style.md) for interface copy, emoji, buttons, menus, and dialogs. Update the registry before assigning a new UI emoji meaning. Standalone notices use one fully bold emoji-led heading with terminal punctuation; callback alerts preserve equivalent emoji-led plain text because Telegram does not support rich formatting there.
 - Markdown tables use compact source formatting with `---` separator cells and one surrounding space per cell. Preserve vendored references unchanged.
 - Treat Windows filesystem, named-pipe, lock, heartbeat, and atomic-rename reports as high-signal evidence; reduce them to regressions or explicit platform caveats.
 - Route significant runtime failures through the redacted recent-event recorder. Keep the compact TUI status at generic `error`; details belong in diagnostics.

package/BACKLOG.md

@@ -2,7 +2,6 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
-- [ ] `Coherent voice reply policy`: Release the validated `manual`, `mirror`, and `always` policy cleanup as `0.38.0`, then reconcile issue #235 and open exact migration issues for `johnlam1968/pi-voice-telegram` and `luxus/pi-xai-voice`, whose TTS providers still consume the removed transcript-caption API.
 - [ ] `Operator-confirmed pairing`: Replace first-contact automatic ownership with an explicit pending request that the trusted Pi interface can allow or reject before `allowedUserId` is persisted or any Telegram prompt executes; retain manual preconfiguration, bound pending-request lifetime and multiplicity, fail closed across session/transport replacement, and cover unauthorized-first-contact races.
 - [ ] `Environment-backed bot tokens`: Let each profile store an exact Pi-native `$ENV_VAR` or `${ENV_VAR}` reference in `telegram.json` instead of copying the resolved secret; preserve the originating alias when `/telegram-setup` prefills from a supported environment variable, resolve only at validation/activation boundaries, fail closed with a redacted named-variable diagnostic when unresolved, retain literal-token compatibility, and cover named profiles, reload, persistence, status, and secret-redaction paths.
 - [ ] [`Inference bypass Generative Apps`](./docs/generative-apps.md): Let the agent install and bind one managed JavaScript app owner for a generated-prompt prefix so deterministic controls can bypass model inference without creating another button grammar.

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.39.1: Compaction Failure Formatting Hotfix
+
+- `Compaction Failure Formatting`: Preserves the HTML parse mode when a confirmed `/compact` callback reports asynchronous failure, preventing bold standalone failure headings from appearing as literal `<b>…</b>` markup in Telegram.
+
+## 0.39.0: Session-Owned Queue Lifecycle
+
+- `Queue Counters`: Excludes Skip-marked prompts immediately from the shared executable queue count used by the Pi status bar and Telegram main menu while preserving physical queue position, deferred drop semantics, and reversible Keep behavior.
+- `Skip Settlement`: Preserves durable receipts while a skipped prompt waits, then settles them atomically when that prompt reaches dispatch before dropping it without inference; settlement failure retains the head instead of creating replay ambiguity.
+- `Session-Owned Queue`: Graceful shutdown discards all remaining queue receipts before clearing memory, while startup atomically discards receipts whose former process is proven dead instead of replaying them; replacement and unrelated sessions therefore start without inherited work.
+- `Consistent Information Headings`: Standardizes standalone progress, success, empty, busy, unavailable, cancellation, and failure notices as fully bold emoji-led headings, while callback alerts retain equivalent plain text and automatic compaction waits for the preceding final answer before announcing its start.
+- `Queue Menu`: Keeps skipped prompts visible in place with their physical ordinal struck through in list and detail views, so deferred removal is legible without renumbering or moving later work.
+- `Agent Context`: Routes connected and Telegram-turn guidance across `telegram-bridge`, `generated-control-surface`, and `generative-apps` by activation role, asks the agent to load only missing Skill instructions, and removes Telegram tool context while transport is unavailable.
+- `Bot API Reference`: Updates the vendored Telegram Bot API reference and lookup Skill through Bot API 10.3 while retaining the 10.0–10.3 freshness history and validated symbol, anchor, and line indexes.
+
 ## 0.38.0: Coherent Voice Reply Policy
 
 - `Voice Reply Policy`: Renames the default user-facing `hidden` mode to `manual` while retaining `hidden` as a read-only configuration and callback compatibility alias. `manual`, `mirror`, and `always` remain the complete policy set: explicit `telegram_voice`, modality mirroring, or automatic voice replacement.

package/README.md

@@ -199,7 +199,7 @@ Queue policy:
 - One prompt is one queue object with exactly one current lane and one current position; it never reserves a shadow place in the other lane.
 - Priority and Normal are separate FIFO lanes; Priority dispatches first.
 - Moving `Normal → Priority` removes the prompt from Normal and places it at the Priority tail. Moving `Priority → Normal` removes it from Priority and places it at the Normal tail; no former position is restored.
-- Keep/Skip never changes lane position. Skip remains reversible while waiting and drops the prompt without a model turn only when dispatch reaches it.
+- Keep/Skip never changes lane position. Skip preserves durable authority while waiting so Keep remains reversible, then settles that authority and drops the prompt without a model turn when dispatch reaches it. Skipped prompts stay visible at their physical queue position with a struck-through ordinal, but are excluded immediately from the executable queue count shown in both the Pi status bar and Telegram main menu. Graceful session shutdown discards all remaining queued authority, so a new session starts empty.
 - Reactions control two independent dimensions; changing one category preserves the other:
   - `Positive`: `👍`, `⚡️`, `❤️`, `🕊`, `🔥` — controls Priority.
   - `Negative`: `👎`, `👻`, `💔`, `💩`, `🗑` — controls Skip.

package/docs/architecture.md

@@ -213,13 +213,13 @@ Compaction runs under the journal transaction lock when either 256 unapplied seg
 
 Queue receipt ownership is independent from the Telegram transport lock. A same-instance, same-process generation may reconstruct its local receipt across a fenced session replacement and may settle it after transport ownership moves. A different process reports the receipt as foreign, never republishes it into its local queue, and cannot complete it even if it reads the acquisition id. Startup no longer treats process replacement as proof that an owner died: foreign and legacy unowned receipts remain durable.
 
-Recovery and live handoff are compare-and-set under the journal transaction. Queue discard during exact queue-lifecycle cancellation requires the exact local owner/acquisition and removes all receipt sources atomically. Before admission worker start, the lifecycle groups each foreign receipt and asks the journal to recheck OS pid liveness plus process-birth identity under the same transaction; a live owner returns `owner-alive` and a live owner without stable birth proof returns `owner-unverifiable`, both without mutation, while exact negative proof converts the complete receipt back to `pending`. Replacement registration carries its exact pid/process-birth before this check; when registration and recovery race, that live identity wins the liveness proof and the queued receipt remains untouched. Only then does the replacement worker start, replay, and acquire a fresh receipt id/acquisition, fencing every stale owner.
+Cleanup and live handoff are compare-and-set under the journal transaction. Queue discard during exact queue-lifecycle cancellation requires the exact local owner/acquisition and removes all receipt sources atomically. Before admission worker start, the lifecycle groups each foreign receipt and asks the journal to recheck OS pid liveness plus process-birth identity under the same transaction; a live owner returns `owner-alive` and a live owner without stable birth proof returns `owner-unverifiable`, both without mutation, while exact negative proof atomically discards the complete session-owned receipt without replay. Replacement registration carries its exact pid/process-birth before this check; when registration and cleanup race, that live identity wins the liveness proof and the queued receipt remains untouched. A replacement or unrelated worker therefore never executes queue work whose prior owner is proven dead.
 
 Authenticated live handoff uses journal CAS plus bounded local IPC. The donor creates a one-time high-entropy token and durably offers the complete receipt to one exact recipient runtime/process/session identity; the journal stores only a digest bound to queue kind, receipt sources, donor acquisition, and recipient identity. While offered, donor completion/discard and dead-owner recovery fail closed, so authority cannot disappear during payload transfer. Prompt payloads carry all queue fields; control payloads carry only their stable `status`/`model` identity and rebuild executable closures locally. The separately negotiated `queue-handoff-v1` capability gates this envelope for leader and both peer generations. Each receipt carries its exact source journal binding; the donor derives the recipient follower-journal binding from the authenticated stable follower profile before routing. The bus validates payload shape/size and exact donor/recipient registration generations, and the recipient selects only that matching active lifecycle, stages one complete receipt idempotently, accepts the journal CAS, and returns the exact receipt plus newly minted owner in its ACK. Malformed, legacy-unbound, inactive-generation, or unavailable bindings fail closed.
 
 During recipient staging, presenting the token atomically replaces the journal owner with a fresh acquisition carrying the handoff digest, removes the offer, and permanently fences donor settlement. The donor treats only an ACK carrying that exact accepted owner as success and never repeats acceptance against a donor-bound journal runtime. The recipient can repeat the same acceptance idempotently; a different token cannot claim an already accepted receipt. The coordinator contract orders offer → stage/accept exact receipt-and-owner ACK → donor removal → recipient readiness for direct leader→follower and follower→follower routing. Before acceptance, negative or mismatched acknowledgement exactly cancels the offer and keeps donor work. After acceptance, a lost acknowledgement cannot roll authority back: cancellation fails closed and donor memory remains frozen until exact accepted-owner reconciliation removes it. Recipient registration carries exact process-birth/session identity, and staged payloads remain outside the live dispatch store until accepted journal authority has been reconstructed. Production advertises `queue-handoff-v1` only with this exact role/journal selection and uses the same coordinator ordering for direct leader→follower and follower→follower routes.
 
-Queued semantic authority has no elapsed-time lease. A timeout cannot prove either owner death or effect quiescence, so it cannot safely recover a receipt. Resolution is limited to authenticated live handoff, exact owner discard/settlement, or transaction-rechecked negative PID plus process-birth evidence. Live or unverifiable owners remain queued indefinitely rather than risking duplicate execution.
+Queued semantic authority has no elapsed-time lease. A timeout cannot prove either owner death or effect quiescence, so it cannot safely resolve a receipt. Resolution is limited to authenticated live handoff, exact owner discard/settlement, or transaction-rechecked negative PID plus process-birth evidence that permits terminal cleanup without replay. Live or unverifiable owners remain queued rather than risking duplicate or cross-session execution.
 
 The initial `offset: -1` cursor bootstrap is allowed only when both cursor and journal are absent or empty. Thereafter process-level ordering is journal atomic rename → one monotonic offset atomic rename → worker signal. Failure before journal publication leaves the offset unchanged; failure after journal publication but before offset publication permits Telegram redelivery and journal dedupe; failure after offset publication but before worker signal replays from the journal on restart. Queue-owner, retry, terminal, handoff, and completion transitions use the same journal publication primitive and therefore share this process-crash boundary. The final completion window is at-least-once, so replay-sensitive external effects must use `update_id` or the stable delivery id as an idempotency key.
 
@@ -236,7 +236,7 @@ The canonical update transition contract is:
 - `retry-wait → executing`: only after `nextRetryAtMs`; repeated signals before eligibility do not execute the entry. Automatic retries continue indefinitely with exponential `1s → 2s → 4s → 8s → 16s → 32s → 60s` delay capped at `60s`, while later independent updates continue draining.
 - Legacy `failed → retry-wait`: startup atomically resumes terminal entries written by earlier `0.28.0` candidates. Runtime policy never silently discards durable inbound authority and exposes no Pi command for manual retry/discard.
 - `queued → offered → staged → queued`: only the exact persisted donor may offer or cancel a live handoff; an offer preserves donor ownership but freezes ordinary settlement and recovery. Authenticated bounded IPC stages one exact payload/receipt outside the live queue. Exact recipient acceptance mints a fresh acquisition, reconstructs local ownership, removes donor work, then publishes recipient dispatch readiness.
-- `queued → completed | pending`: only the exact persisted owner receipt may complete or discard queued sources; generic completion rejects queued state. Process-birth-proven owner death may atomically recover the complete unoffered receipt to `pending`; live, unverifiable, or offered owners remain queued.
+- `queued → completed`: only the exact persisted owner receipt may complete or discard queued sources; generic completion rejects queued state. Process-birth-proven owner death atomically discards the complete unoffered session-owned receipt without replay; live, unverifiable, or offered owners remain queued.
 
 The worker executes at most 64 eligible entries from one validated journal snapshot, commits ordinary completions through one journal transaction, then yields through a generation-checked event-loop boundary. Retry, queue, or prior-generation boundaries first flush completed ids and force a fresh snapshot, preserving exact state-transition atomicity without per-entry parse/rewrite churn. A deterministic 2,048-entry stress gate requires exactly 32 completion publications, 33 reads including the final empty snapshot, continued 1ms timer progress, and less than 250ms maximum observed heartbeat delay. Byte-capacity tests cover failed and retry-wait diagnostics, queue receipt/owner and handoff metadata, and operator dispositions; every rejected growth leaves the prior authority bytes unchanged. It still scans later independent entries after retry or terminal persistence. An unresolved reaction remains a queue-mutation dependency even in `retry-wait` or `failed`, but dispatch checks that dependency against the candidate queue item's exact chat and source message ids instead of globally blocking unrelated targets. Successful replay or an exact discard disposition releases the dependency. Worker state, debug status, state snapshots, and redacted runtime events expose journal depth, retry/terminal counts, the next retry, latest terminal identity, copyable operator commands, and the exact first foreign queued owner identity (instance, PID/birth, session, and acquisition) when semantic authority belongs to another process.
 
@@ -270,7 +270,7 @@ A prompt is one queue object with exactly one active lane membership and one cur
 
 Telegram reactions are shortcut controls over those dimensions. Positive reactions (`👍`, `⚡️`, `❤️`, `🕊`, `🔥`) control Priority; negative reactions (`👎`, `👻`, `💔`, `💩`, `🗑`) control Skip. The runtime compares the complete old and new reaction sets and mutates only categories that changed, so adding or removing a negative reaction cannot silently change Priority, and changing a positive reaction cannot silently change Skip. The listed order selects the retained display emoji when several recognized emoji from one category coexist; it does not let one category override the other.
 
-Priority and Skip may coexist, including `👍 + 💩`. The prompt remains at its Priority-lane position while waiting, but Skip wins when dispatch reaches it: the dispatcher drops it without a model turn and continues. A skipped prompt remains visible with only its negative emoji, survives authenticated queue handoff, and can return to Keep until it reaches the head. Queue item detail exposes symmetric Priority/Normal and Keep/Skip selectors instead of an irreversible Delete action.
+Priority and Skip may coexist, including `👍 + 💩`. The prompt remains at its Priority-lane position while waiting, and its durable journal receipts remain intact so Keep stays reversible and exact live handoff remains possible. Skip wins when dispatch reaches the prompt: the dispatcher first settles those receipts durably, then drops it without a model turn and continues; settlement failure retains the skipped head instead of allowing replay ambiguity. The prompt stays visible with only its negative emoji, is excluded immediately from the executable queue count shared by the Pi status bar and Telegram main menu, and keeps a struck-through physical ordinal. Returning it to Keep restores its contribution to the count without moving it. Graceful session shutdown discards all remaining queue receipts before clearing session-local memory, and startup discards receipts only after proving their former process dead, so a new or unrelated session never inherits queued work. Queue item detail exposes symmetric Priority/Normal and Keep/Skip selectors instead of an irreversible Delete action.
 
 Menu and reaction controls share the same canonical queue state. A menu Keep can clear internal Skip without changing Priority or queue position, but Telegram's Bot API cannot remove a reaction created by the user; the visible user reaction can therefore remain until that user removes it. Once Pi has consumed or dropped a prompt, later reactions cannot retract or restore it.
 

package/docs/ui-style.md

@@ -26,8 +26,8 @@ Use emoji as stable semantic markers, not decoration. Emoji carry transportable
 | `🧠` | Thinking level | `/thinking`, thinking menu headings, thinking status rows | Use only for reasoning/thinking controls. |
 | `🔢` | Queue list / ordered work | `/queue`, queue menu entrypoints | Queue item rows may also use numeric labels. |
 | `⏱️` | Queue is ticking / current work is active | Inline main-menu Queue row only | Running-clock queue state: the narrow present moment is being worked now. |
-| `⏳` | Queue has waiting prompts | Inline main-menu Queue row only | Hourglass queue state: sand above the neck is future work still waiting. |
-| `⌛` | Queue is empty / standing idle | Inline main-menu Queue row only | Standing hourglass queue state: no future work is waiting above the neck. |
+| `⏳` | Waiting / temporarily busy | Inline main-menu Queue row, busy notices | Hourglass means work or availability is pending; the sentence must name what is busy. |
+| `⌛` | Empty / standing idle | Inline main-menu Queue row, empty-queue notices | Standing hourglass means no future work is waiting above the neck. |
 | `⚙️` | Settings / configuration | Settings menu headings and Settings navigation rows | Extension-injected rows appear before the built-in `⚙️ Settings` row. |
 | `🧩` | Extension-provided surface | Extension command examples, extension section examples | Companion extensions may choose their own emoji, but `🧩` means generic extension/plugin. |
 | `👄` | Voice reply policy | Voice reply settings row and detail card | Not a generic audio attachment marker. |
@@ -43,19 +43,28 @@ Use emoji as stable semantic markers, not decoration. Emoji carry transportable
 | --- | --- | --- | --- |
 | `🟢` | Start / active / current positive state | `/start`, active row, current selected option, active `On` toggle | In command context it means “open/start menu”; in state context it means selected/active. |
 | `🗜` | Compact session | `/compact`, compact confirmation action | Do not use for generic cleanup/delete. |
-| `⏩` | Force next queued turn | `/next` command and matching menu action | Means skip/advance to next waiting item. |
-| `▶️` | Continue/resume generation | `/continue` command and matching menu action | Means resume/continue current session flow, not force-next. |
-| `⏹️` | Abort current Pi work | `/abort` command description | Stops active work but is not a destructive queue clear by itself. |
-| `🟥` | Stop / abort-and-clear danger | `/stop` command description | Stronger than `⏹️`; use for disruptive stop/clear semantics. |
+| `⏩` | Abort and advance | Busy `/next` command result and matching menu action | Means the active turn is aborted before advancing to queued work. |
+| `▶️` | Play / continue immediately | Idle `/next` result, `/continue` command, and matching menu action | Means work can start or resume directly without first aborting an active turn. |
+| `⏹️` | Abort current Pi work | `/abort` command description and active `/stop` result | Stops active work; accompanying copy states separately when queued work is cleared. |
+| `🟥` | Destructive stop command | `/stop` command description | Strong warning at the command/action entrypoint; standalone results use the more precise idle or abort state icon. |
 | `🆕` | New session / fresh start | Reserved visible extension command example for `/new`-like flows | Same-thread Telegram `/new` is currently blocked by Pi core API; keep this meaning reserved. |
 | `🌀` | Refresh | Queue refresh row and future refresh buttons | Re-fetch/re-render current surface, not transport reconnect. |
 | `↪️` | Reroute to an existing target | Thread chooser buttons that send a captured command/message from one thread to another live thread | Curved arrow means the message arrived here but bends to another target. |
 | `🔁` | Replace/restore mode | Thread replace/restore chooser entrypoints | Opens a second step for moving a Pi instance binding to the current source thread. |
 | `➡️` | Choose replacement target | Thread replace/restore target buttons that select which Pi instance should move to the current thread | Use inside the second replace/restore chooser, not for ordinary reroutes. |
 | `☑️` | Activate / choose this item | Model detail activation action, generated button-only choice heading | Positive selection cue; use `🟢 Active` for already-current state. |
-| `❌` | No / cancel | Confirmation cancel buttons | Use for safe cancellation, not destructive removal. |
+| `❌` | No / cancel / terminal failure | Confirmation cancel buttons and terminal failure notices | Do not use for a recoverable operation failure that leaves session state intact. |
 | `🗑` | Delete / defer removal | Destructive confirmations and removal reaction | In the queue menu, reversible Keep/Skip selectors replace immediate deletion. |
 
+### Informational Feedback
+
+| Emoji | Meaning | Canonical surfaces | Notes |
+| --- | --- | --- | --- |
+| `💤` | Nothing active | No-active-turn notices | Neutral idle result, not an error. |
+| `✅` | Completed successfully | Compaction and other completion notices | Use only after the operation has completed. |
+| `🚫` | Unavailable, denied, or cancelled operation | Missing capability/auth notices, access denial, and compaction cancellation | Callback alerts use the same emoji without bold markup. |
+| `⚠️` | Recoverable operation failure | Compaction failure notice | The attempted operation failed, but the original session state remains usable. |
+
 ### State Indicators And Button Grammars
 
 | Emoji | Meaning | Canonical surfaces | Notes |
@@ -71,6 +80,8 @@ Use emoji as stable semantic markers, not decoration. Emoji carry transportable
 
 Queue reactions are shortcut controls for waiting turns. Preserve their semantics across Telegram reactions, queue-menu rows, status previews, and tests. Positive emoji control the Priority/Normal lane; negative emoji control Keep/Skip. These categories are independent, may coexist, and mutate only their own dimension. Crossing lanes appends the prompt at the destination FIFO tail; changing Keep/Skip or changing emoji within one category preserves lane position. Skip wins only when dispatch reaches the prompt.
 
+Skipped queue ordinals strike only the numeric position. Detail HTML closes `<s>` before the period; list-button labels place a hair-space boundary between the combining-struck number and the plain period so Telegram font overhang cannot visually strike punctuation.
+
 Queue item detail renders two independent selector rows:
 
 - `🟡 Priority` / `⚫️ Normal` or `⚫️ Priority` / `🟣 Normal` selects the lane.
@@ -209,11 +220,14 @@ Examples:
 
 ## Message Cards
 
-Message cards sent by the bot should start with a strong heading.
+Message cards and standalone informational notices sent by the bot should start with a strong heading.
 
 Rules:
 
 - Start with a bold heading or, for dialogs, a bold question.
+- Format standalone notices as one fully bold line: relevant emoji, one space, concise sentence, and terminal period or colon.
+- Apply the same hierarchy to success, progress, empty, busy, unavailable, cancellation, and failure notices; do not bold only a fragment of a standalone notice.
+- Callback alerts remain plain text because Telegram does not support rich text there, but still keep the relevant emoji and concise sentence.
 - Setting detail cards may include an emoji in the heading, then a colon and the current value in `<code>`.
 - Explain what the setting does and what the options mean only as much as needed.
 - Order setting value descriptions exactly like the chooser: rows top-to-bottom and values in a shared row left-to-right. Keep `(default)` on the actual default wherever it falls; default status never changes order.

package/index.ts

@@ -359,6 +359,7 @@ export default function (pi: Pi.ExtensionAPI) {
     getActiveToolExecutions: lifecycle.getActiveToolExecutions,
     hasPendingModelSwitch: pendingModelSwitchStore.has,
     getQueuedItems: telegramQueueStore.getQueuedItems,
+    getQueuedItemCount: Queue.countExecutableTelegramQueueItems,
     formatQueuedStatus: Queue.formatQueuedTelegramItemsStatus,
     getRecentRuntimeEvents: runtimeEvents.getEvents,
     getRuntimeLockState: lockRuntime.getStatusLabel,
@@ -1234,6 +1235,7 @@ export default function (pi: Pi.ExtensionAPI) {
         prepareTempDir,
         updateStatus,
         unbindDeferredDispatchContext: deferredQueueDispatchRuntime.unbind,
+        discardQueuedItems: queueMutationRuntime.clear,
         clearModelMenuState: modelMenuRuntime.clear,
         getActiveTurnChatId: activeTurnRuntime.getChatId,
         getActiveTurnTarget: activeTurnRuntime.getTarget,

package/lib/bindings.ts

@@ -95,11 +95,28 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
   sendUserMessage: Queue.TelegramQueueDispatchRuntimeDeps<TContext>["sendUserMessage"];
   recordRuntimeEvent?: TelegramRuntimeEventRecorder;
 }): TelegramQueueBindingRuntime<TContext> {
+  const settleDiscardedItems = (
+    items: readonly Queue.TelegramQueueItem<TContext>[],
+    ctx: TContext,
+  ): boolean => {
+    const durableItems = items.filter(
+      (item) => (item.admissionReceipts?.length ?? 0) > 0,
+    );
+    if (durableItems.length === 0) return true;
+    const settlement = deps.admission.getSettlement();
+    if (!settlement) return false;
+    settlement.onItemsDiscarded(durableItems, ctx);
+    return durableItems.every((item) => !settlement.isItemReady(item));
+  };
   const mutation = Queue.createTelegramQueueMutationController({
     ...deps.store,
     allocateLaneOrder: deps.queue.allocateItemOrder,
     onItemsDiscarded(items, ctx) {
-      deps.admission.getSettlement()?.onItemsDiscarded(items, ctx);
+      if (!settleDiscardedItems(items, ctx)) {
+        throw new Error(
+          "Telegram queue items could not be discarded durably.",
+        );
+      }
     },
     updateStatus: deps.updateStatus,
     recordRuntimeEvent: deps.recordRuntimeEvent,
@@ -136,6 +153,9 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
     onControlSettled(item, ctx) {
       deps.admission.getSettlement()?.onControlSettled(item, ctx);
     },
+    onPromptSkipped(item, ctx) {
+      return settleDiscardedItems([item], ctx);
+    },
     updateStatus: deps.updateStatus,
     sendTextReply: deps.sendTextReply,
     recordRuntimeEvent: deps.recordRuntimeEvent,
@@ -909,6 +929,25 @@ export function registerTelegramLifecycleRuntimeHooks({
       { replyToPrompt: false },
     );
   };
+  let activeTurnDeliveryTail = Promise.resolve();
+  const scheduleActiveTurnDelivery = (task: () => Promise<void>): void => {
+    const previous = activeTurnDeliveryTail;
+    activeTurnDeliveryTail = (async () => {
+      await previous;
+      await new Promise<void>((resolve) => {
+        const timer = setTimeout(resolve, 0);
+        timer.unref?.();
+      });
+      await task();
+    })().catch((error) => {
+      recordRuntimeEvent("delivery", error, {
+        phase: "agent-end-background-delivery",
+      });
+    });
+  };
+  const waitForActiveTurnDelivery = async (): Promise<void> => {
+    await activeTurnDeliveryTail;
+  };
   const agentLifecycleHooks = Queue.createTelegramAgentLifecycleHooks<
     Queue.PendingTelegramTurn,
     Pi.ExtensionContext,
@@ -950,16 +989,7 @@ export function registerTelegramLifecycleRuntimeHooks({
     dispatchNextQueuedTelegramTurn,
     requestDeferredDispatchNextQueuedTelegramTurn:
       deferredQueueDispatchRuntime.request,
-    scheduleActiveTurnDelivery(task) {
-      const timer = setTimeout(() => {
-        void task().catch((error) => {
-          recordRuntimeEvent("delivery", error, {
-            phase: "agent-end-background-delivery",
-          });
-        });
-      }, 0);
-      timer.unref?.();
-    },
+    scheduleActiveTurnDelivery,
     clearPreview: previewRuntime.clear,
     setPreviewPendingText: previewRuntime.setPendingText,
     finalizeMarkdownPreview,
@@ -1079,7 +1109,11 @@ export function registerTelegramLifecycleRuntimeHooks({
       activityRuntime.onCompactionStart(Pi.getSessionCompactionReason(event));
       compactionObserver.onSessionBeforeCompact(event, ctx);
       if (shouldNotify) {
-        await sendCompactionNotice(Commands.TELEGRAM_COMPACTION_STARTED_TEXT);
+        await waitForActiveTurnDelivery();
+        if (!isSessionContextActive(ctx)) return;
+        await sendCompactionNotice(
+          Commands.TELEGRAM_COMPACTION_STARTED_MARKDOWN,
+        );
       }
     },
     async onSessionCompact(event, ctx) {
@@ -1088,7 +1122,9 @@ export function registerTelegramLifecycleRuntimeHooks({
       compactionObserver.onSessionCompact(event, ctx);
       if (observedAutomaticCompaction) {
         observedAutomaticCompaction = false;
-        await sendCompactionNotice(Commands.TELEGRAM_COMPACTION_COMPLETED_TEXT);
+        await sendCompactionNotice(
+          Commands.TELEGRAM_COMPACTION_COMPLETED_MARKDOWN,
+        );
       }
     },
     async onAgentStart(event, ctx) {

package/lib/commands.ts

@@ -9,6 +9,7 @@ import {
   TELEGRAM_DEFAULT_PROFILE_NAME,
 } from "./config.ts";
 import type { ExtensionAPI, ExtensionCommandContext } from "./pi.ts";
+import { escapeHtml } from "./rendering.ts";
 import type { TelegramBridgeStatusLineOptions } from "./status.ts";
 import {
   createTelegramControlItemBuilder,
@@ -185,9 +186,24 @@ export function formatTelegramCommandEmojiPrefix(
   return `${getTelegramCommandEmoji(command)} `;
 }
 
+export function formatTelegramInformationHeading(
+  emoji: string,
+  text: string,
+): string {
+  return `<b>${escapeHtml(emoji)} ${escapeHtml(text)}</b>`;
+}
+
 export const TELEGRAM_COMPACTION_STARTED_TEXT =
-  `${formatTelegramCommandEmojiPrefix("compact")}Compaction started.`;
-export const TELEGRAM_COMPACTION_COMPLETED_TEXT = "✅ Compaction completed.";
+  formatTelegramInformationHeading(
+    getTelegramCommandEmoji("compact"),
+    "Compaction started.",
+  );
+export const TELEGRAM_COMPACTION_COMPLETED_TEXT =
+  formatTelegramInformationHeading("✅", "Compaction completed.");
+export const TELEGRAM_COMPACTION_STARTED_MARKDOWN =
+  `**${formatTelegramCommandEmojiPrefix("compact")}Compaction started.**`;
+export const TELEGRAM_COMPACTION_COMPLETED_MARKDOWN =
+  "**✅ Compaction completed.**";
 
 function formatTelegramBotCommandDescription(
   command: TelegramCommandEmojiName,
@@ -585,7 +601,10 @@ export interface TelegramStopCommandDeps {
   setFoldQueuedPromptsIntoHistory: (fold: boolean) => void;
   abortCurrentTurn: () => void;
   updateStatus: () => void;
-  sendTextReply: (text: string) => Promise<void>;
+  sendTextReply: (
+    text: string,
+    options?: { parseMode?: "HTML" },
+  ) => Promise<void>;
 }
 
 export interface TelegramRuntimeEventRecorderPort {
@@ -619,7 +638,10 @@ export interface TelegramCompactCommandDeps extends TelegramRuntimeEventRecorder
     onComplete: () => void;
     onError: (error: unknown) => void;
   }) => void;
-  sendTextReply: (text: string) => Promise<void>;
+  sendTextReply: (
+    text: string,
+    options?: { parseMode?: "HTML" },
+  ) => Promise<void>;
   suppressStartNotice?: boolean;
 }
 
@@ -921,8 +943,11 @@ export function createTelegramCommandTargetRuntime<
         await deps.sendTextReply(
           target.chatId,
           target.replyToMessageId,
-          "Settings menu is unavailable.",
-          { target },
+          formatTelegramInformationHeading(
+            "🚫",
+            "Settings menu is unavailable.",
+          ),
+          { target, parseMode: "HTML" },
         );
         return;
       }
@@ -1108,6 +1133,25 @@ function getTelegramCommandErrorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
+function formatTelegramCompactionFailure(error: unknown): string {
+  let message = getTelegramCommandErrorMessage(error).trim();
+  const redundantPrefixes = [
+    "Compaction failed: ",
+    "Turn prefix summarization failed: ",
+  ];
+  let stripped = true;
+  while (stripped) {
+    stripped = false;
+    for (const prefix of redundantPrefixes) {
+      if (!message.startsWith(prefix)) continue;
+      message = message.slice(prefix.length).trim();
+      stripped = true;
+    }
+  }
+  const sentence = /[.!?]$/u.test(message) ? message : `${message}.`;
+  return `Compaction failed! ${sentence}`;
+}
+
 export function parseTelegramCommand(
   text: string,
 ): ParsedTelegramCommand | undefined {
@@ -1165,7 +1209,10 @@ export async function handleTelegramStopCommand(
         ? ` Cleared ${formatTelegramQueuedTurnCount(clearedCount)}.`
         : "";
     if (clearedCount > 0) deps.updateStatus();
-    await deps.sendTextReply(`No active turn.${clearedSuffix}`);
+    await deps.sendTextReply(
+      formatTelegramInformationHeading("💤", `No active turn.${clearedSuffix}`),
+      { parseMode: "HTML" },
+    );
     return;
   }
   deps.abortCurrentTurn();
@@ -1174,7 +1221,13 @@ export async function handleTelegramStopCommand(
     clearedCount > 0
       ? ` Cleared ${formatTelegramQueuedTurnCount(clearedCount)}.`
       : "";
-  await deps.sendTextReply(`Aborted current turn.${clearedSuffix}`);
+  await deps.sendTextReply(
+    formatTelegramInformationHeading(
+      "⏹️",
+      `Aborted current turn.${clearedSuffix}`,
+    ),
+    { parseMode: "HTML" },
+  );
 }
 
 export async function handleTelegramAbortCommand(deps: {
@@ -1184,17 +1237,26 @@ export async function handleTelegramAbortCommand(deps: {
   abortCurrentTurn: () => void;
   setFoldQueuedPromptsIntoHistory: (fold: boolean) => void;
   updateStatus: () => void;
-  sendTextReply: (text: string) => Promise<void>;
+  sendTextReply: (
+    text: string,
+    options?: { parseMode?: "HTML" },
+  ) => Promise<void>;
 }): Promise<void> {
   deps.clearPendingModelSwitch();
   if (!deps.hasAbortHandler()) {
-    await deps.sendTextReply("No active turn.");
+    await deps.sendTextReply(
+      formatTelegramInformationHeading("💤", "No active turn."),
+      { parseMode: "HTML" },
+    );
     return;
   }
   deps.setFoldQueuedPromptsIntoHistory(deps.hasActiveTelegramTurn());
   deps.abortCurrentTurn();
   deps.updateStatus();
-  await deps.sendTextReply("Aborted current turn.");
+  await deps.sendTextReply(
+    formatTelegramInformationHeading("⏹️", "Aborted current turn."),
+    { parseMode: "HTML" },
+  );
 }
 
 export async function handleTelegramNextCommand(deps: {
@@ -1213,7 +1275,10 @@ export async function handleTelegramNextCommand(deps: {
 }): Promise<void> {
   deps.clearPendingModelSwitch();
   if (!deps.hasQueuedItems()) {
-    await deps.sendTextReply("<b>Queue is empty.</b>", { parseMode: "HTML" });
+    await deps.sendTextReply(
+      formatTelegramInformationHeading("⌛", "Queue is empty."),
+      { parseMode: "HTML" },
+    );
     return;
   }
   if (!deps.isIdle() && deps.hasAbortHandler()) {
@@ -1221,17 +1286,30 @@ export async function handleTelegramNextCommand(deps: {
     deps.abortCurrentTurn();
     deps.updateStatus();
     await deps.sendTextReply(
-      "Aborted current turn. Dispatching next queued turn.",
+      formatTelegramInformationHeading(
+        "⏩",
+        "Aborted! Dispatching next queued turn.",
+      ),
+      { parseMode: "HTML" },
     );
     return;
   }
   if (!deps.isIdle()) {
-    await deps.sendTextReply("Pi is busy. Send /abort or /stop first.");
+    await deps.sendTextReply(
+      formatTelegramInformationHeading(
+        "⏳",
+        "Pi is busy. Send /abort or /stop first.",
+      ),
+      { parseMode: "HTML" },
+    );
     return;
   }
   deps.dispatchNextQueuedTurn();
   deps.updateStatus();
-  await deps.sendTextReply("Dispatching next queued turn.");
+  await deps.sendTextReply(
+    formatTelegramInformationHeading("▶️", "Dispatching next queued turn."),
+    { parseMode: "HTML" },
+  );
 }
 
 export async function handleTelegramContinueCommand<TMessage, TContext>(
@@ -1301,15 +1379,15 @@ export async function handleTelegramCompactConfirmationCallback<TContext>(
   const chatId = callbackMessage?.chat?.id;
   const messageId = callbackMessage?.message_id;
   if (typeof chatId !== "number" || typeof messageId !== "number") {
-    await deps.answerCallbackQuery(query.id, "Interactive message expired.");
+    await deps.answerCallbackQuery(query.id, "⌛ Interactive message expired.");
     return true;
   }
   if (query.data === "compact:cancel") {
     await deps.editInteractiveMessage(
       chatId,
       messageId,
-      "Compaction cancelled.",
-      "plain",
+      "<b>🚫 Compaction cancelled.</b>",
+      "html",
       { inline_keyboard: [] },
     );
     await deps.answerCallbackQuery(query.id);
@@ -1319,7 +1397,7 @@ export async function handleTelegramCompactConfirmationCallback<TContext>(
     chatId,
     messageId,
     TELEGRAM_COMPACTION_STARTED_TEXT,
-    "plain",
+    "html",
     { inline_keyboard: [] },
   );
   await deps.answerCallbackQuery(query.id);
@@ -1345,7 +1423,11 @@ export async function handleTelegramCompactCommand(
     deps.isCompactionInProgress()
   ) {
     await deps.sendTextReply(
-      "Cannot compact while Pi or the Telegram queue is busy. Wait for queued turns to finish or send /abort first.",
+      formatTelegramInformationHeading(
+        "⏳",
+        "Cannot compact while Pi or the Telegram queue is busy. Wait for queued turns to finish or send /abort first.",
+      ),
+      { parseMode: "HTML" },
     );
     return;
   }
@@ -1359,7 +1441,9 @@ export async function handleTelegramCompactCommand(
         deps.setCompactionInProgress(false);
         deps.updateStatus();
         dispatchNextQueuedTelegramTurnAfterCompact(deps);
-        void deps.sendTextReply(TELEGRAM_COMPACTION_COMPLETED_TEXT);
+        void deps.sendTextReply(TELEGRAM_COMPACTION_COMPLETED_TEXT, {
+          parseMode: "HTML",
+        });
       },
       onError: (error) => {
         deps.stopTypingLoop?.();
@@ -1367,8 +1451,13 @@ export async function handleTelegramCompactCommand(
         deps.updateStatus();
         dispatchNextQueuedTelegramTurnAfterCompact(deps);
         deps.recordRuntimeEvent?.("compact", error);
-        const errorMessage = getTelegramCommandErrorMessage(error);
-        void deps.sendTextReply(`Compaction failed: ${errorMessage}`);
+        void deps.sendTextReply(
+          formatTelegramInformationHeading(
+            "⚠️",
+            formatTelegramCompactionFailure(error),
+          ),
+          { parseMode: "HTML" },
+        );
       },
     });
   } catch (error) {
@@ -1376,14 +1465,19 @@ export async function handleTelegramCompactCommand(
     deps.setCompactionInProgress(false);
     deps.updateStatus();
     deps.recordRuntimeEvent?.("compact", error);
-    const errorMessage = getTelegramCommandErrorMessage(error);
-    await deps.sendTextReply(`Compaction failed: ${errorMessage}`);
+    await deps.sendTextReply(
+      formatTelegramInformationHeading(
+        "⚠️",
+        formatTelegramCompactionFailure(error),
+      ),
+      { parseMode: "HTML" },
+    );
     return;
   }
   if (!deps.suppressStartNotice) {
-    await deps.sendTextReply(
-      TELEGRAM_COMPACTION_STARTED_TEXT,
-    );
+    await deps.sendTextReply(TELEGRAM_COMPACTION_STARTED_TEXT, {
+      parseMode: "HTML",
+    });
   }
 }
 

package/lib/journal.ts

@@ -3381,15 +3381,8 @@ export function createTelegramUpdateJournalStore(
         const recoveredUpdateIds = [...requestedIds].sort((a, b) => a - b);
         const published = publishMutation(
           current,
-          current.file.entries.map((entry) =>
-            requestedIds.has(entry.updateId)
-              ? {
-                  updateId: entry.updateId,
-                  update: entry.update,
-                  admittedAtMs: entry.admittedAtMs,
-                  state: "pending" as const,
-                }
-              : entry,
+          current.file.entries.filter(
+            (entry) => !requestedIds.has(entry.updateId),
           ),
           true,
         );

package/lib/lifecycle.ts

@@ -345,25 +345,27 @@ export function createTelegramBridgeSessionLifecycleAssembly<
     stopPolling: suspendForReplacement,
     clearPendingMediaGroups: deps.services.suspendGroupedInput,
   });
-  const servicesLifecycle = appendTelegramLifecycleHooks(
-    queueLifecycle,
-    {
-      async onSessionStart(event, ctx) {
-        deps.services.resumeGroupedInput(ctx);
-        await deps.services.delivery.onSessionStart();
-        await deps.services.polling.onSessionStart(event, ctx);
-        deps.services.capabilityMonitor.start(ctx);
-        deps.services.queueWatchdog.start(ctx);
-      },
-      async onSessionShutdown() {
-        await deps.services.delivery.onSessionShutdown();
-        deps.services.queueWatchdog.stop();
-        deps.services.capabilityMonitor.stop();
-        await deps.services.inboundWorker.onSessionShutdown();
-      },
+  const servicesLifecycle: TelegramSessionLifecycleHooks = {
+    async onSessionStart(event, ctx) {
+      await queueLifecycle.onSessionStart(event, ctx);
+      if (!isSessionActive(ctx)) return;
+      deps.services.resumeGroupedInput(ctx);
+      await deps.services.delivery.onSessionStart();
+      await deps.services.polling.onSessionStart(event, ctx);
+      deps.services.capabilityMonitor.start(ctx);
+      deps.services.queueWatchdog.start(ctx);
     },
-    isSessionActive,
-  );
+    async onSessionShutdown(event, ctx) {
+      if (!isSessionActive(ctx)) return;
+      await deps.services.delivery.onSessionShutdown();
+      if (!isSessionActive(ctx)) return;
+      deps.services.queueWatchdog.stop();
+      deps.services.capabilityMonitor.stop();
+      await queueLifecycle.onSessionShutdown(event, ctx);
+      if (!isSessionActive(ctx)) return;
+      await deps.services.inboundWorker.onSessionShutdown();
+    },
+  };
   const followerLifecycle = appendTelegramLifecycleHooks(
     servicesLifecycle,
     {

package/lib/menu-queue.ts

@@ -73,6 +73,10 @@ function toTelegramQueueMenuItems<Context>(
   });
 }
 
+function formatSkippedTelegramQueuePosition(position: number): string {
+  return Array.from(String(position), (char) => `${char}\u0335`).join("");
+}
+
 function buildTelegramQueueMenuReplyMarkup(
   items: readonly TelegramQueueMenuItem[],
   emptyRefreshIndex = 0,
@@ -86,7 +90,7 @@ function buildTelegramQueueMenuReplyMarkup(
       : "queue:refresh";
   const refreshRow = [{ text: "🌀 Refresh", callback_data: refreshData }];
   if (items.length === 0) return { inline_keyboard: [backRow, refreshRow] };
-  const rows = items.map((item, index) => {
+  const rows = items.map((item) => {
     const prefix = item.reactionSuppressionEmoji
       ? `${item.reactionSuppressionEmoji} `
       : item.isPriority
@@ -94,7 +98,11 @@ function buildTelegramQueueMenuReplyMarkup(
         : item.hasAttachments
           ? "📎 "
           : "";
-    const label = `${index + 1}. ${prefix}${item.statusSummary}`;
+    const position = item.reactionSuppressionEmoji
+      ? formatSkippedTelegramQueuePosition(item.queuePosition)
+      : String(item.queuePosition);
+    const ordinalSeparator = item.reactionSuppressionEmoji ? "\u200A" : "";
+    const label = `${position}${ordinalSeparator}. ${prefix}${item.statusSummary}`;
     return [
       {
         text: label,
@@ -162,7 +170,10 @@ function getTelegramQueueMenuItemText(item: TelegramQueueMenuItem): string {
     : item.isPriority
       ? ` ${item.priorityEmoji ?? "⚡"}`
       : "";
-  const heading = `<b>${item.queuePosition}.</b>${badge}`;
+  const position = item.reactionSuppressionEmoji
+    ? `<s>${item.queuePosition}</s>.`
+    : `<b>${item.queuePosition}.</b>`;
+  const heading = `${position}${badge}`;
   const preview = `<pre>${escapeTelegramQueueMenuHtmlPreview(item.promptText)}</pre>`;
   return `${heading}\n${preview}`;
 }
@@ -182,7 +193,7 @@ function buildTelegramQueueItemSubmenuReplyMarkup(
           callback_data: `queue:prio-set:${chatId}:${replyToMessageId}:priority`,
         },
         {
-          text: isPriority ? "⚫️ Normal" : "🟣 Normal",
+          text: isPriority ? "⚫️ Normal" : "🔵 Normal",
           callback_data: `queue:prio-set:${chatId}:${replyToMessageId}:normal`,
         },
       ],

package/lib/menu.ts

@@ -255,7 +255,10 @@ export interface TelegramMenuActionRuntimeDeps<
     chatId: number,
     replyToMessageId: number,
     text: string,
-    options?: { target?: { chatId: number; threadId?: number } },
+    options?: {
+      target?: { chatId: number; threadId?: number };
+      parseMode?: "HTML";
+    },
   ) => Promise<unknown>;
   sectionRegistry?: TelegramSectionRegistry;
   isVoiceReplyActive?: () => boolean;
@@ -798,8 +801,8 @@ export function createTelegramMenuActionRuntime<
           await deps.sendTextReply(
             chatId,
             replyToMessageId,
-            "Cannot open status while Pi is busy. Send /abort, /next, or /stop.",
-            { target: { chatId, threadId } },
+            "<b>⏳ Cannot open status while Pi is busy. Send /abort, /next, or /stop.</b>",
+            { target: { chatId, threadId }, parseMode: "HTML" },
           );
         },
         getModelMenuState: () => deps.getModelMenuState(chatId, ctx, threadId),
@@ -835,16 +838,16 @@ export function createTelegramMenuActionRuntime<
           await deps.sendTextReply(
             chatId,
             replyToMessageId,
-            "Cannot switch model while Pi is busy. Send /abort, /next, or /stop.",
-            { target: { chatId, threadId } },
+            "<b>⏳ Cannot switch model while Pi is busy. Send /abort, /next, or /stop.</b>",
+            { target: { chatId, threadId }, parseMode: "HTML" },
           );
         },
         sendNoModelsMessage: async () => {
           await deps.sendTextReply(
             chatId,
             replyToMessageId,
-            "No available models with configured auth.",
-            { target: { chatId, threadId } },
+            "<b>🚫 No available models with configured auth.</b>",
+            { target: { chatId, threadId }, parseMode: "HTML" },
           );
         },
         getModelMenuState: () => deps.getModelMenuState(chatId, ctx, threadId),

package/lib/prompts.ts

@@ -14,11 +14,11 @@ export const TELEGRAM_DISCONNECTED_CONTEXT_MESSAGE =
 
 const LOCAL_SYSTEM_PROMPT_SUFFIX = `
 
-${TELEGRAM_CONNECTED_CONTEXT_MESSAGE} Load the \`telegram-bridge\` Skill for Telegram-originated turns or explicit requests involving Telegram delivery, actions, Threaded Mode, or diagnosis. Do not use Telegram-specific features from unrelated local/TUI prompts.`;
+${TELEGRAM_CONNECTED_CONTEXT_MESSAGE} For Telegram work, consult bundled Skills in routing order: \`telegram-bridge\` for the transport and turn protocol, \`generated-control-surface\` when contextual controls materially shorten feedback, then \`generative-apps\` when the interaction warrants a reusable deterministic app. Load a Skill only if its instructions are not already present in the current context. Do not use Telegram-specific features from unrelated local/TUI prompts.`;
 
 const TELEGRAM_TURN_SYSTEM_PROMPT_SUFFIX = `
 
-Telegram turn note: Load and follow the \`telegram-bridge\` Skill.`;
+Telegram turn note: Follow the applicable bundled Telegram Skills in routing order; load only missing instructions.`;
 
 export const TELEGRAM_ATTACH_PROMPT_SNIPPET =
   "Queue files for the active Telegram reply; outside Telegram turns, send files directly to Telegram.";

package/lib/queue.ts

@@ -427,12 +427,22 @@ export function createTelegramTransportStampedQueueStore<TContext>(
   };
 }
 
+export function isTelegramQueueItemSkipped<TContext = unknown>(
+  item: TelegramQueueItem<TContext>,
+): boolean {
+  return item.kind === "prompt" && Boolean(item.reactionSuppressionEmoji);
+}
+
+export function countExecutableTelegramQueueItems<TContext = unknown>(
+  items: readonly TelegramQueueItem<TContext>[],
+): number {
+  return items.filter((item) => !isTelegramQueueItemSkipped(item)).length;
+}
+
 export function createTelegramQueueItemCountGetter<TContext = unknown>(
   store: Pick<TelegramQueueStore<TContext>, "getQueuedItems">,
 ): () => number {
-  return () => {
-    return store.getQueuedItems().length;
-  };
+  return () => countExecutableTelegramQueueItems(store.getQueuedItems());
 }
 
 export function createTelegramActiveTurnStore<
@@ -993,7 +1003,8 @@ export function consumeDispatchedTelegramPrompt<TContext = unknown>(
 export function formatQueuedTelegramItemsStatus<TContext = unknown>(
   items: TelegramQueueItem<TContext>[],
 ): string {
-  return items.length === 0 ? "" : ` +${items.length}`;
+  const count = countExecutableTelegramQueueItems(items);
+  return count === 0 ? "" : ` +${count}`;
 }
 
 export function truncateTelegramQueueSummary(
@@ -2062,6 +2073,7 @@ export interface TelegramSessionStartRuntimeDeps<TContext, TModel = unknown> {
 export interface TelegramSessionShutdownRuntimeDeps<TQueueItem> {
   isSessionActive?: () => boolean;
   unbindDeferredDispatchContext?: () => void;
+  discardQueuedItems?: () => void;
   applyState: (state: TelegramSessionShutdownState<TQueueItem>) => void;
   clearPendingMediaGroups: () => void;
   clearModelMenuState: () => void;
@@ -2090,6 +2102,7 @@ export interface TelegramSessionLifecycleHookRuntimeDeps<
   updateStatus: (ctx: TContext) => void;
   isSessionActive?: (ctx: TContext) => boolean;
   unbindDeferredDispatchContext?: () => void;
+  discardQueuedItems?: (ctx: TContext) => void;
   applySessionShutdownState: (
     state: TelegramSessionShutdownState<TQueueItem>,
   ) => void;
@@ -2286,6 +2299,7 @@ export async function shutdownTelegramSessionRuntime<TQueueItem>(
   deps.unbindDeferredDispatchContext?.();
   await deps.stopPolling();
   if (deps.isSessionActive?.() === false) return;
+  deps.discardQueuedItems?.();
   deps.applyState(buildTelegramSessionShutdownState<TQueueItem>());
   deps.clearPendingMediaGroups();
   deps.clearModelMenuState();
@@ -2339,6 +2353,7 @@ export function createTelegramSessionLifecycleRuntime<
     updateStatus: deps.updateStatus,
     isSessionActive: deps.isSessionActive,
     unbindDeferredDispatchContext: deps.unbindDeferredDispatchContext,
+    discardQueuedItems: deps.discardQueuedItems,
     applySessionShutdownState: stateApplier.applyShutdownState,
     clearPendingMediaGroups: deps.clearPendingMediaGroups,
     clearModelMenuState: deps.clearModelMenuState,
@@ -2387,6 +2402,10 @@ export function createTelegramSessionLifecycleHooks<
           isSessionActive: () =>
             ctx === undefined ? true : (deps.isSessionActive?.(ctx) ?? true),
           unbindDeferredDispatchContext: deps.unbindDeferredDispatchContext,
+          discardQueuedItems:
+            ctx === undefined || !deps.discardQueuedItems
+              ? undefined
+              : () => deps.discardQueuedItems!(ctx),
           applyState: deps.applySessionShutdownState,
           clearPendingMediaGroups: deps.clearPendingMediaGroups,
           clearModelMenuState: deps.clearModelMenuState,
@@ -2476,14 +2495,8 @@ export function clearTelegramQueueItemsRuntime<TContext>(
   const removedItems = deps.getQueuedItems();
   const removedCount = removedItems.length;
   if (removedCount === 0) return 0;
+  deps.onItemsDiscarded?.(removedItems, deps.ctx);
   deps.setQueuedItems([]);
-  try {
-    deps.onItemsDiscarded?.(removedItems, deps.ctx);
-  } catch (error) {
-    deps.recordRuntimeEvent?.("queue", error, {
-      phase: "discard-receipt-settlement",
-    });
-  }
   updateTelegramQueueStatusRuntime(deps);
   return removedCount;
 }
@@ -2877,6 +2890,7 @@ export interface TelegramQueueDispatchControllerDeps<
     item: PendingTelegramControlItem<TContext>,
     ctx: TContext,
   ) => void;
+  onPromptSkipped?: (item: PendingTelegramTurn, ctx: TContext) => boolean;
 }
 
 export interface TelegramQueueDispatchController<TContext = unknown> {
@@ -2940,6 +2954,7 @@ export function createTelegramQueueDispatchRuntime<TContext = unknown>(
       deps.hasPendingInboundQueueMutationForItem,
     isQueueItemAdmissionReady: deps.isQueueItemAdmissionReady,
     onControlSettled: deps.onControlSettled,
+    onPromptSkipped: deps.onPromptSkipped,
     recordRuntimeEvent: deps.recordRuntimeEvent,
   });
 }
@@ -3007,7 +3022,29 @@ export function createTelegramQueueDispatchController<TContext = unknown>(
             deps.updateStatus(ctx);
             return;
           }
+          try {
+            if (deps.onPromptSkipped && !deps.onPromptSkipped(candidate, ctx)) {
+              deps.updateStatus(
+                ctx,
+                "Telegram skipped prompt could not be settled durably.",
+              );
+              return;
+            }
+          } catch (error) {
+            deps.recordRuntimeEvent?.("dispatch", error, {
+              phase: "skip-receipt-settlement",
+            });
+            deps.updateStatus(
+              ctx,
+              "Telegram skipped prompt could not be settled durably.",
+            );
+            return;
+          }
           nextActiveIndex += 1;
+          deps.setQueuedItems([
+            ...activeItems.slice(nextActiveIndex),
+            ...protectedInactiveItems,
+          ]);
         }
       }
       const dispatchableItems = activeItems.slice(nextActiveIndex);
@@ -3031,7 +3068,7 @@ export function createTelegramQueueDispatchController<TContext = unknown>(
         dispatchableItems,
         canDispatch,
       );
-      if (nextActiveIndex > 0 || dispatchPlan.kind !== "none") {
+      if (dispatchPlan.kind !== "none") {
         deps.setQueuedItems([
           ...dispatchPlan.remainingItems,
           ...protectedInactiveItems,

package/lib/routing.ts

@@ -1677,9 +1677,12 @@ export function createTelegramInboundRouteRuntime<
                   })
               : undefined,
             stopTypingLoop: deps.stopTypingLoop,
-            sendTextReply: (text) =>
+            sendTextReply: (text, options) =>
               deps
-                .sendTextReply(chatId, replyToMessageId, text, { target })
+                .sendTextReply(chatId, replyToMessageId, text, {
+                  target,
+                  parseMode: options?.parseMode,
+                })
                 .then(() => {}),
             suppressStartNotice: true,
             recordRuntimeEvent: deps.recordRuntimeEvent,

package/lib/status.ts

@@ -344,6 +344,7 @@ export interface TelegramBridgeStatusRuntimeDeps<
   getActiveToolExecutions: () => number;
   hasPendingModelSwitch: () => boolean;
   getQueuedItems: () => TQueueItem[];
+  getQueuedItemCount?: (items: TQueueItem[]) => number;
   formatQueuedStatus: (items: TQueueItem[]) => string;
   getRecentRuntimeEvents: () => TelegramRuntimeEvent[];
   getRuntimeLockState?: () => string;
@@ -658,6 +659,7 @@ export function createTelegramBridgeStatusRuntime<
     getStatusBarState: (_ctx, error) => {
       const config = deps.getConfig();
       const queuedItems = deps.getQueuedItems();
+      const queuedItemCount = deps.getQueuedItemCount?.(queuedItems) ?? queuedItems.length;
       const hasActiveTurn = deps.hasActiveTurn();
       const hasPendingDispatch = deps.hasDispatchPending();
       const hasPendingModelSwitch = deps.hasPendingModelSwitch();
@@ -677,13 +679,13 @@ export function createTelegramBridgeStatusRuntime<
           hasPendingDispatch ||
           hasPendingModelSwitch ||
           activeToolExecutions > 0 ||
-          queuedItems.length > 0,
+          queuedItemCount > 0,
         processingStatus: getTelegramStatusBarProcessingStatus({
           hasActiveTurn,
           hasPendingDispatch,
           hasPendingModelSwitch,
           activeToolExecutions,
-          queuedItems: queuedItems.length,
+          queuedItems: queuedItemCount,
         }),
         queuedStatus: deps.formatQueuedStatus(queuedItems),
         error,

package/lib/updates.ts

@@ -4583,11 +4583,11 @@ export function createTelegramUpdateAdmissionLifecycleRuntime<TContext>(
         try {
           deps.recordRuntimeEvent?.(
             "inbound-worker",
-            "Recovered queued authority from a confirmed-dead process.",
+            "Discarded session-owned queue authority from a confirmed-dead process.",
             {
-              phase: "dead-queue-owner-recovery",
+              phase: "dead-queue-owner-cleanup",
               receiptId,
-              recoveredUpdateCount: result.recoveredUpdateIds.length,
+              removedUpdateCount: result.recoveredUpdateIds.length,
             },
           );
         } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.38.0",
+  "version": "0.39.1",
   "private": false,
   "publishConfig": {
     "access": "public"