@llblab/pi-telegram 0.45.11 → 0.46.0

package/BACKLOG.md

@@ -2,6 +2,11 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
+- [ ] `Session-aware Thread binding` (`next minor`, primary outcome): Replace profile-scoped exact-`cwd` reuse as the sole Workspace identity with a durable composite of normalized exact `cwd` and Pi's stable public session identity. `/telegram-connect` must persist that session-to-Thread binding so reopening, resuming, or continuing the same Pi session automatically restores the same Telegram Thread and letter slot when the retained binding has not been validly displaced. Different sessions in one directory must receive distinct live slots, while the same session must not allocate a duplicate after process restart. Session number/name are bounded lookup or presentation aliases only, never routing authority. Preserve authenticated live-owner, accepted-work, displacement, retirement, and slot-pressure fences. This is the principal deliverable of the next minor release.
+  - [x] `Identity and migration contract`: [`docs/multi-instance-bus.md`](./docs/multi-instance-bus.md#approved-next-contract-session-aware-workspace-identity) now fixes the public session source, composite authority, binding-key derivation, lifecycle semantics, exact legacy `{ cwd, ∅ }` coexistence, fail-closed malformed present identity behavior, mixed-version fence, and non-ownership boundaries.
+  - [x] `Store and allocation foundation`: Session-qualified identity, persistence, independent same-cwd claims/slots, strict digest validation, cleanup and retirement snapshots, and exact legacy cwd-only coexistence are locally implemented. The former staged-adoption claim state and commit exceptions have been removed, so no latent mutation path can consume a cwd-only binding. Absence of session identity remains its own key across reload and stale status persistence; same-session restore retains its letter while another session cannot reuse it.
+  - [x] `Leader/follower lifecycle wiring`: Leader assembly now reads public `ctx.sessionManager.getSessionId()`, passes it through sync provisioning, and restores the matching session-qualified Workspace without creating a duplicate Thread; cwd-only legacy state remains an independent `{ cwd, ∅ }` identity and is never exposed through a session lookup. Authenticated follower registration now carries a strict bounded session ID over the bus, preserves it in the live registry, and passes it into leader-owned provisioning; fresh same-cwd follower sessions therefore commit distinct session-qualified bindings. Production follower assembly sources the value from the current Pi context, independently of process instance and session generation. Follower-to-leader promotion now resolves the exact current session binding and preserves its target, slot, generated name, and acknowledged display title through leader handoff. Startup restore and `/telegram-connect` share the session-bearing registration envelope and leader provisioner. Protocol v2 makes session identity mandatory for every cwd-scoped participant and rejects protocol-v1 0.45.x peers before provisioning; the supported upgrade path stops all instances, updates them together, then starts a fresh session-native leader. Session-aware stale-target replacement is now regression-covered: replacing session A updates only A's binding and leaves same-cwd session B untouched. Capability rejection is covered independently from the older durable-admission gate. Startup restore eligibility now checks the current session exactly and never treats a legacy cwd-only binding as that session, so neither a sibling nor `{ cwd, ∅ }` can make a fresh session auto-connect. Explicit `/telegram-connect`, restore-only registration, and reconnect handoff all use the same session-bearing registration runtime; focused tests cover restore-only and handoff transmission. The production integration harness now supplies a distinct stable `sessionManager.getSessionId()` per mocked context, and the lifecycle/cleanup integration regression passes with session-aware leader provisioning. Legacy `{ cwd, ∅ }` records remain readable but inert and independent: they are never adopted, migrated, or used for a v2 session. Full-suite closure is green: the bundled Show Me wording is compressed within its disclosure budget, integration contexts preserve one session manager across idle/active phases, and the complete test command passes.
+  - [ ] `Compatibility and acceptance` (`local-actionable` plus live gate, current): Exact lookup now treats both presence and absence of session ID symmetrically: `{ cwd, ∅ }` cannot match a session binding, and `{ cwd, session }` cannot match legacy. Focused store, follower, leader, and polling suites pass across coexistence, restore-only, same-session process replacement, follower reload/handoff, distinct same-cwd session allocation (the `/fork`/`/new` identity effect), promotion, session-isolated rename, stale-target replacement, malformed identity, and rolling-upgrade capability behavior. Full slot-pressure retirement now selects the oldest eligible exact binding across legacy and session-qualified identities and persists the victim's session component; protection and exact-intent fences remain unchanged. The Pi adapter now has explicit evidence that restart/reload/resume/continue-recent aliases do not influence authority: only the public stable session ID is read, while a forked ID remains distinct. Local acceptance is complete: generation-fenced stale ownership cannot mutate a replacement; target displacement is exact-session isolated; strict legacy and session-qualified snapshots coexist without aliasing or stale resurrection; protocol-v1 peers are explicitly rejected, while all protocol-v2 cwd participants use session-qualified identity. Update the current-contract docs only with locally validated behavior. Remaining gate: a separately operator-authorized live smoke for same-session restoration and two concurrent sessions in one directory.
 - [ ] `Prompt enqueue hotfix` (`optional`, `operator-gated`): Optional nonblocking operator-authorized disposable-follower smoke: overlap delayed voice processing with turn completion and confirm one-time ordered consumption and truthful counts against the [queue contract](./docs/architecture.md#queue-and-dispatch-safety). Separately authorized supported recovery investigation remains open: prevention does not repair an already-wedged in-memory queue; establish the exact recovery path and preservation/discard consequences before mutation, otherwise report the blocker. No journal/ownership edits, replay of settled input, implicit queue clearing, or restart; live activation requires separate operator authorization.
 - [ ] `Channel multimedia posts` (`0.45.1`, live-acceptance-gated): `telegram_message` channel delivery accepts one local `.jpg`/`.jpeg`/`.png`/`.webp` photo or `.mp4` video, uploads it through the multipart transport as `sendPhoto`/`sendVideo` with `text` as the HTML caption, validates kind and size (photo ≤ 10 MiB, video ≤ 50 MiB) plus ≤ 1024 visible caption characters before issuance, and rejects unsupported types and albums instead of downgrading them to links. The channel-post journal binds kind/file name/byte size/SHA-256 and caption, so duplicate requests and lost acknowledgements never re-upload; media-post edits replace the caption through `editMessageCaption`, and Markdown spoilers render as `<tg-spoiler>`. Live image publication passed on `@llb_log`. Regressions cover confirmed publication, duplicate requests, lost ACK, pre-issuance rejection, caption edits, and reconnect replacement. Remaining: operator-authorized disposable-channel acceptance of rejected upload, duplicate request, and caption edit.
 - [ ] `Manual Thread naming` (`gated-but-preparable`, release priority): Local bot-owned `/name Name` and bare `/name` flows avoid model dispatch. One expiring exact-target input dialog immediately accepts the next valid name, always offers cancel, and offers **Reset to automatic** only while a manual override exists; duplicate/stale callbacks cannot repeat mutation. Durable manual override supersedes every automatic display mode, reset is leader/follower generation- and target-fenced, and Letters remains the default without rewriting recovery identity. Local review findings are remediated, including Bot-API-wait target-replacement regressions for leader/follower rename and reset. Remaining: disposable live acceptance for command-menu ordering, dialog, invalid input, duplicate callbacks, leader/follower rename and reset.

package/CHANGELOG.md

@@ -4,6 +4,10 @@
 
 ## Unreleased
 
+## 0.46.0: Session-aware Workspace Threads
+
+- `Session-aware Thread binding`: Workspace identity restored session-qualified bindings from Pi's stable public session identity, so reopening, resuming, or replacing a process reclaims the same Telegram Thread and letter while distinct sessions in one directory keep independent targets. Strict legacy cwd-only records remain inert and coexist safely; protocol v2 rejects mixed 0.45.x peers before provisioning, and exact-session cleanup, displacement, rename, promotion, and slot-pressure fences are preserved.
+
 ## 0.45.11: Consumer-owned companion semantics
 
 - `Extension boundaries`: Removes consumer-specific state-scope emoji from the Telegram UI registry. The bridge continues to own generic Rich Message headings and inspection semantics, while companion extensions independently own their domain labels, composition rules, and presentation through the public section API.

package/README.md

@@ -6,7 +6,7 @@
 
 `pi-telegram` turns a private Telegram DM into a mobile operator surface for Pi. It accepts prompts, queues work, streams readable previews, delivers final replies and files, exposes safe controls, and lets companion extensions add Telegram-native capabilities without owning a second bot loop.
 
-It is a **runtime adapter**, not a remote terminal. Start or supervise work in the Pi TUI, then continue from Telegram while away from the keyboard. Each Telegram destination follows a running Pi instance and sends prompts into that instance's currently active session; it is not permanently bound to one session file or session identity. The bridge preserves Pi session semantics instead of pretending Telegram is a PTY, shell, process launcher, or session browser. That boundary is the product: Telegram gets safe runtime handles, not raw terminal power.
+It is a **runtime adapter**, not a remote terminal. Start or supervise work in the Pi TUI, then continue from Telegram while away from the keyboard. In Threaded Mode, a durable Workspace binding uses Pi's stable public session identity to restore the same Telegram Thread when that session resumes; live instance ownership and the exact Telegram target still authorize routing. The bridge preserves Pi session semantics instead of pretending Telegram is a PTY, shell, process launcher, or session browser. That boundary is the product: Telegram gets safe runtime handles, not raw terminal power.
 
 Every completed intermediate commentary block from a Telegram-originated turn is delivered once as its own message before the existing final reply. While Telegram is connected, local, autonomous, and unclassified extension follow-up work also projects visible checkpoints and the final answer to the authorized Telegram target once and in order, preserving assistant-authored `telegram_button` comments as interactive prompt buttons. This connected companion projection is always active rather than configurable. Neither path mirrors local prompts, thinking, tool traffic, token deltas, or stale-generation work. The separate `Activity` setting defaults to `verbose` so new installations discover collapsed provider-exposed thinking and tool evidence immediately; operators can narrow it to one class or choose `quiet`. See [Outbound](docs/outbound.md#public-assistant-output) and the [configuration reference](docs/public-api.md#configuration-api).
 
@@ -55,7 +55,7 @@ Paste the bot token. If `~/.pi/agent/telegram.json` already contains a saved tok
 /telegram-connect
 ```
 
-The connected Pi instance owns Telegram polling. Use `/telegram-connect <profile>` to activate a named profile, and optionally append `as=Name` to name a fresh Workspace Thread. Each profile is a parallel bot runtime with isolated polling, diagnostics, Threaded Mode state, and local bus transport; the `default` profile keeps unsuffixed runtime paths. In classic mode each profile uses a singleton lock. When Telegram private-chat Threaded Mode is available, one live instance becomes the profile's leader and later visible Pi instances register as followers. A reopened follower Workspace with a remembered Thread reconnects automatically at session startup; a new Workspace still requires explicit `/telegram-connect`.
+The connected Pi instance owns Telegram polling. Use `/telegram-connect <profile>` to activate a named profile, and optionally append `as=Name` to name a fresh Workspace Thread. Each profile is a parallel bot runtime with isolated polling, diagnostics, Threaded Mode state, and local bus transport; the `default` profile keeps unsuffixed runtime paths. In classic mode each profile uses a singleton lock. When Telegram private-chat Threaded Mode is available, one live instance becomes the profile's leader and later visible Pi instances register as followers. Reopening or resuming the same Pi session restores its remembered Thread at session startup; a distinct session in the same directory has its own binding and still requires explicit `/telegram-connect` when no remembered binding exists.
 
 After an unclean computer shutdown, `/telegram-connect` detects truncated or structurally invalid temporary ownership/routing files, quarantines only the damaged files under `tmp/telegram/recovery/`, and retries once. A journal snapshot removed by older broad temp cleanup is rebuilt when its complete segment history proves an empty result, while a revisionless snapshot is repaired from the first surviving segment's exact predecessor when the reconstructed tail validates. Otherwise the snapshot and segments are quarantined as recovery evidence, a fresh journal is published, and startup continues with an informational diagnostic instead of requiring manual JSON repair. Unsupported journal versions block recovery without rewriting or quarantining the retained files; use a compatible runtime rather than deleting journals. Saved `telegram.json` configuration and runtime diagnostics remain intact. Recovery never replaces a verifiable live owner; if safe automatic recovery cannot complete, the command gives one explicit Pi-restart instruction instead of requiring deletion of the whole `tmp/` directory.
 
@@ -236,7 +236,7 @@ Classic private DM mode is the base product mode. When Telegram private-chat Thr
 - Followers are visible Pi processes started by the operator.
 - Each connected instance gets a Telegram thread target.
 - Queued work for a live follower transfers through authenticated exact-journal handoff rather than replaying under the transport owner.
-- Follower session replacement preserves registration, and a reopened follower Workspace with a remembered Thread reconnects automatically without allocating a Thread for an unremembered Workspace.
+- Reopening, resuming, or replacing the process for the same Pi session restores its remembered Thread; distinct sessions in one directory keep independent bindings and letter slots.
 - Unknown threads are preserved and offered explicit reroute/restore choices.
 - Telegram never launches hidden Pi processes.
 
@@ -245,7 +245,7 @@ In Threaded Mode, open Settings → **🧵 Thread display** to choose **Letters*
 | Mode | Best for | Runtime shape |
 | --- | --- | --- |
 | Classic DM | One running Pi instance and its active session controlled from one private bot chat | One polling owner, one queue/runtime surface |
-| Threaded Mode | Several visible Pi instances sharing one bot | One leader owns transport; each named private-chat thread follows its assigned instance and current session |
+| Threaded Mode | Several visible Pi sessions sharing one bot | One leader owns transport; each private-chat Thread retains one session-qualified Workspace binding |
 
 ## Environment Configuration
 

package/docs/multi-instance-bus.md

@@ -178,6 +178,18 @@ Production retirement requires a durable profile-scoped reader/writer ledger own
 - A retired binding no longer promises its former name/letter on reopen; the Workspace may be provisioned anew. Retained message ownership and journal evidence must never route old work through a recycled letter: full binding generation and target remain mandatory independently of display labels.
 - Implement and validate using isolated stores and mocked Telegram APIs. Do not delete live Threads, migrate live journals/locks manually, publish, or restart operator instances as part of local preparation. Operator smoke on disposable Threads is a separate gate.
 
+## Approved Next Contract: Session-Aware Workspace Identity
+
+Status: locally implemented and validated for the next minor release; final compatibility acceptance and the operator-authorized live smoke remain tracked in `BACKLOG.md`.
+
+A durable Workspace binding is owned by the selected bot profile plus `{ cwd, sessionId? }`. `cwd` is the normalized exact full path. When present, `sessionId` is the exact non-empty bounded value returned by the public `ctx.sessionManager.getSessionId()` API. Session display names, selector positions, session file paths, process instance IDs, and lifecycle generations are metadata or transient fences, never substitutes for the stable session ID. Absence is a real identity value `{ cwd, ∅ }`, not a wildcard; malformed present values still fail closed.
+
+The persisted binding stores the exact session ID and derives its new binding key from the existing collision-verified Workspace directory key plus a full SHA-256 digest of the session ID. Exact persisted values remain the collision check; the digest is an index component, not independent authority. Reopening, `/resume`, `/continue`/continue-recent, or process replacement with the same `{ cwd, sessionId }` reclaims the same retained target and profile-wide letter when current ownership, accepted-work, admission, and retirement evidence allow it. `/new` and `/fork` produce distinct session IDs and therefore distinct bindings even in the same directory. `/reload` changes neither component.
+
+Legacy cwd-only bindings remain exact compatibility identities whose absent session component is itself a unique key. They are neither wildcard session bindings nor adoption candidates: session-aware claims never stamp, migrate, consume, or restore them, and instead allocate their own `{ cwd, sessionId }` binding subject to the same global slot and protection rules. `{ cwd, ∅ }`, `{ cwd, session-a }`, and `{ cwd, session-b }` may coexist as majestic degradation for older state and peers. The 0.46 runtime reads strict legacy records as inert independent `{ cwd, ∅ }` bindings but never migrates, adopts, or routes a session through them. Protocol v2 is session-native and intentionally incompatible with protocol-v1 0.45.x peers. Upgrade requires stopping all Telegram instances first, updating them together, and then starting them again; the first v2 process becomes leader with its own session-qualified binding.
+
+Routing authority remains the authenticated live owner plus exact numeric Telegram target. Session identity selects and restores a durable binding but never authorizes message delivery by itself. Slot pressure and retirement continue to operate on exact binding snapshots; they must carry the session component so cleanup, displacement, and letter reuse cannot target another session in the same directory.
+
 ## Leader Election
 
 Leader election is heartbeat-gated and lock-backed. The polling owner checks exact lock ownership every second, refreshes its durable lease every two seconds, and becomes stale after eight seconds; the serialized expected-owner transaction remains the final cross-platform election authority.
@@ -194,7 +206,7 @@ Followers first try to re-register after leader reload or unknown-heartbeat resp
 
 ### Protocol identity and compatibility
 
-The local wire contract has protocol version `1`, independent from the npm package version. Follower registration and the leader acknowledgement carry `{ protocolVersion, runtimeBuild, capabilities }`. Capability names are canonical, unique, and sorted. A leader rejects missing or mismatched protocol identity before provisioning a target or publishing the follower into live routing; a strict follower likewise rejects an acknowledgement without compatible leader identity. Different package builds remain compatible when their protocol versions agree. `durable-follower-admission-v1` gates source forwarding, while `queue-handoff-v1` independently gates live semantic queue transfer; every participant in a routed handoff must advertise it. `workspace-follower-auto-connect-v1` gates restore-only startup admission. `thread-display-mode-v1` gates exact-generation follower display-setting requests and Letters/Directories require compatible connected followers; returning to Names allows legacy peers. Registration checks the current display-mode requirement before provisioning and again before live publication. The leader serializes config persistence and title application. `workspace-thread-rename-v1` independently gates follower rename requests whose exact registration generation is checked before the leader mutates Telegram and persists the Workspace binding.
+The session-native local wire contract has protocol version `2`, independent from the npm package version. Follower registration and the leader acknowledgement carry `{ protocolVersion, runtimeBuild, capabilities }`. Capability names are canonical, unique, and sorted. A leader rejects missing or mismatched protocol identity before provisioning a target or publishing the follower into live routing; a strict follower likewise rejects an acknowledgement without compatible leader identity. Different package builds remain compatible when their protocol versions agree. `durable-follower-admission-v1` gates source forwarding, while `queue-handoff-v1` independently gates live semantic queue transfer; every participant in a routed handoff must advertise it. `workspace-follower-auto-connect-v1` gates restore-only startup admission. Session identity is part of protocol v2 rather than an optional capability. Every cwd-scoped v2 registration carries the exact bounded session ID; missing identity is rejected before provisioning or publication. Reconnect, replacement, and promotion preserve it. Protocol-v1 peers are rejected by the base version check, avoiding mixed semantic branches. `thread-display-mode-v1` gates exact-generation follower display-setting requests and Letters/Directories require compatible connected followers; returning to Names allows legacy peers. Registration checks the current display-mode requirement before provisioning and again before live publication. The leader serializes config persistence and title application. `workspace-thread-rename-v1` independently gates follower rename requests whose exact registration generation is checked before the leader mutates Telegram and persists the Workspace binding.
 
 Negotiated identities remain on the live follower registry and appear in `/telegram-status --debug` plus the observational state snapshot. The Threaded Mode capability monitor owns one in-flight probe across lifecycle generations: stop/restart invalidates a late read, and a replacement monitor waits for the previous request to settle instead of creating overlapping transport transitions. Durable follower admission is authorized only when both peers advertise `durable-follower-admission-v1`, never inferred from package version: a capable runtime rejects missing support before provisioning, inbound routing, or election-roster eligibility. Authentication and exact registration generation remain mandatory independently of protocol compatibility. `follower.register` is the explicit bootstrap request and may provision; capability-gated `follower.restoreWorkspace` is startup-only and may claim, probe, or replace a remembered binding but returns `workspace-binding-unavailable` without allocating when no binding or claim-fenced legacy exact-`cwd` record exists. Both carry a fresh generation; every later request is exact-generation-fenced against the live registry entry. `bus.ack` is response-only and is rejected if submitted as a server request. Leader forwarding never synthesizes authority for an unknown recipient and preserves the follower's exact durable receipt end to end.
 

package/lib/bus-follower.ts

@@ -293,6 +293,7 @@ export interface TelegramBusFollowerRegistrationRuntimeDeps<
   getNowMs?: () => number;
   getPid?: () => number;
   getProcessBirthId?: () => string;
+  getSessionId?: (ctx: TContext) => string | undefined;
   getSessionGeneration?: () => number;
   timeoutMs?: number;
   registrationTimeoutMs?: number;
@@ -374,6 +375,7 @@ export function createTelegramBusFollowerPromotionHandler<
   topicTargetStore: Threads.TelegramTopicTargetStore;
   instanceId: string;
   getActiveProfileName: () => string | undefined;
+  getSessionId?: (ctx: TContext) => string | undefined;
   startLeader: (
     ctx: TContext,
     election: TelegramBusFollowerElection,
@@ -400,6 +402,7 @@ export function createTelegramBusFollowerPromotionHandler<
             store: input.topicTargetStore,
             instanceId: input.instanceId,
             cwd: ctx.cwd,
+            sessionId: input.getSessionId?.(ctx),
             telegramProfile: input.getActiveProfileName(),
             target: binding.target,
             slot: binding.slot,
@@ -1771,6 +1774,7 @@ export function createTelegramBusFollowerRegistrationRuntime<
             ? { slot: deps.registrationState?.getSlot() ?? lastKnownSlot }
             : {}),
           cwd: ctx.cwd,
+          sessionId: deps.getSessionId?.(ctx),
           pid: getPid(),
           processBirthId: deps.getProcessBirthId?.(),
           sessionGeneration: deps.getSessionGeneration?.(),

package/lib/bus-leader.ts

@@ -113,6 +113,7 @@ export interface TelegramBusLeaderTargetProvisionerDeps<TContext> {
   getAllowedUserId: () => number | undefined;
   instanceId: string;
   getCwd?: (ctx: TContext) => string | undefined;
+  getSessionId?: (ctx: TContext) => string | undefined;
   getTelegramProfile?: () => string | undefined;
   shouldForceFreshUnnamed?: () => boolean;
   getRequestedThreadName?: () => string | undefined;
@@ -234,6 +235,7 @@ export interface TelegramBusLeaderRuntimeAssemblyDeps<TContext> {
   getAllowedUserId: () => number | undefined;
   instanceId: string;
   getCwd?: (ctx: TContext) => string | undefined;
+  getSessionId?: (ctx: TContext) => string | undefined;
   getTelegramProfile?: () => string | undefined;
   shouldForceFreshUnnamed?: () => boolean;
   getRequestedThreadName?: () => string | undefined;
@@ -413,6 +415,7 @@ export function createTelegramBusLeaderRuntimeAssembly<TContext>(
     ...provisionerPorts,
     instanceId: deps.instanceId,
     getCwd: deps.getCwd,
+    getSessionId: deps.getSessionId,
     getTelegramProfile: deps.getTelegramProfile,
     shouldForceFreshUnnamed: deps.shouldForceFreshUnnamed,
     getRequestedThreadName: deps.getRequestedThreadName,
@@ -908,6 +911,7 @@ export function createTelegramBusFollowerTargetProvisioner(
           {
             existingBindingOnly:
               options?.existingWorkspaceBindingOnly === true,
+            sessionId: registration.sessionId,
             onCapacityUnavailable() {
               capacityUnavailable = true;
             },
@@ -925,6 +929,7 @@ export function createTelegramBusFollowerTargetProvisioner(
       ? deps.topicTargetStore.getWorkspaceBinding(
           workspaceIdentity.cwd,
           workspaceIdentity.instanceSlot,
+          workspaceIdentity.sessionId,
         )
       : undefined;
     const provision = Threads.createTelegramTopicTargetProvisioner({
@@ -1567,6 +1572,7 @@ export function createTelegramBusLeaderTargetProvisioner<TContext>(
         getAllowedUserId: deps.getAllowedUserId,
         instanceId: deps.instanceId,
         cwd: normalizedCwd,
+        sessionId: deps.getSessionId?.(ctx),
         telegramProfile: deps.getTelegramProfile?.(),
         forceFreshUnnamed: deps.shouldForceFreshUnnamed?.(),
         requestedThreadName: deps.getRequestedThreadName?.(),
@@ -2101,6 +2107,8 @@ export function createTelegramBusLeaderEnvelopeHandler(deps: {
           );
         if (
           !compatibility.compatible || !displayCompatible() ||
+          (envelope.registration.cwd !== undefined &&
+            envelope.registration.sessionId === undefined) ||
           (restoringWorkspace && !supportsWorkspaceAutoConnect)
         ) {
           return {
@@ -2110,7 +2118,11 @@ export function createTelegramBusLeaderEnvelopeHandler(deps: {
             protocol: deps.protocolIdentity,
             error: { code: "incompatible-protocol" as const },
             message: `Incompatible Telegram bus protocol: ${
-              compatibility.reason ?? "missing-capability"
+              compatibility.reason ??
+                (envelope.registration.cwd !== undefined &&
+                  envelope.registration.sessionId === undefined
+                  ? "missing-session-identity"
+                  : "missing-capability")
             }.`,
           };
         }

package/lib/bus.ts

@@ -220,7 +220,7 @@ export function createTelegramBusAuthSecret(): string {
   return randomBytes(32).toString("base64url");
 }
 
-export const TELEGRAM_BUS_PROTOCOL_VERSION = 1 as const;
+export const TELEGRAM_BUS_PROTOCOL_VERSION = 2 as const;
 export const TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION =
   "durable-follower-admission-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_QUEUE_HANDOFF =
@@ -369,6 +369,7 @@ export interface TelegramBusInstanceRegistration {
   threadName?: string;
   slot?: string;
   cwd?: string;
+  sessionId?: string;
   pid?: number;
   target?: TelegramTarget;
   busSocketPath?: string;
@@ -2991,6 +2992,12 @@ function parseRegistration(
     registration.slot = value.slot;
   }
   if (typeof value.cwd === "string") registration.cwd = value.cwd;
+  if (value.sessionId !== undefined) {
+    if (typeof value.sessionId !== "string" || !value.sessionId ||
+        value.sessionId !== value.sessionId.trim() ||
+        Buffer.byteLength(value.sessionId, "utf8") > 256) return undefined;
+    registration.sessionId = value.sessionId;
+  }
   if (typeof value.pid === "number") registration.pid = value.pid;
   if (typeof value.busSocketPath === "string") {
     registration.busSocketPath = value.busSocketPath;

package/lib/extension.ts

@@ -1124,6 +1124,7 @@ export default function (pi: Pi.ExtensionAPI) {
       topicTargetStore: threadStore,
       instanceId: telegramInstanceId,
       getActiveProfileName: configStore.getActiveProfileName,
+      getSessionId: Pi.getExtensionContextSessionId,
       getWorkspaceAdmission: workspaceAdmissionRuntime.resolve,
       async startLeader(ctx, election, onAcquired): Promise<boolean> {
         const result = await lockedPollingRuntime.start(ctx, {
@@ -1202,6 +1203,7 @@ export default function (pi: Pi.ExtensionAPI) {
         getProcessBirthId() {
           return telegramQueueProcessBirthId;
         },
+        getSessionId: Pi.getExtensionContextSessionId,
         getSessionGeneration: telegramSessionContextStore.getGeneration,
         async onRegistered(ctx) {
           await followerAdmissionLifecycleRuntime.onTransportChanged(ctx);
@@ -1318,6 +1320,7 @@ export default function (pi: Pi.ExtensionAPI) {
       getAllowedUserId: configStore.getAllowedUserId,
       instanceId: telegramInstanceId,
       getCwd: Pi.getExtensionContextCwd,
+      getSessionId: Pi.getExtensionContextSessionId,
       getTelegramProfile: configStore.getActiveProfileName,
       getThreadDisplayMode() {
         return Config.resolveTelegramThreadDisplayMode(configStore.get());
@@ -1412,7 +1415,10 @@ export default function (pi: Pi.ExtensionAPI) {
         });
       },
       hasRememberedWorkspaceBinding(ctx) {
-        return threadStore.hasWorkspaceBinding(Pi.getExtensionContextCwd(ctx));
+        return threadStore.hasWorkspaceBinding(
+          Pi.getExtensionContextCwd(ctx),
+          Pi.getExtensionContextSessionId(ctx),
+        );
       },
       suspendLiveThreadTarget: telegramBusLeaderState.clear,
       stopFollowerRegistration: telegramBusFollowerRegistration.stop,

package/lib/pi.ts

@@ -260,6 +260,10 @@ export function getExtensionContextCwd(ctx: ExtensionContext): string {
   return ctx.cwd;
 }
 
+export function getExtensionContextSessionId(ctx: ExtensionContext): string {
+  return ctx.sessionManager.getSessionId();
+}
+
 export function isExtensionContextIdle(ctx: ExtensionContext): boolean {
   return ctx.isIdle();
 }

package/lib/sync.ts

@@ -46,6 +46,7 @@ export interface TelegramLeaderThreadSyncDeps {
   getAllowedUserId: () => number | undefined;
   instanceId: string;
   cwd?: string;
+  sessionId?: string;
   telegramProfile?: string;
   forceFreshUnnamed?: boolean;
   requestedThreadName?: string;
@@ -654,6 +655,7 @@ export async function ensureTelegramLeaderThreadBinding(
         normalizedLeaderCwd,
         deps.instanceId,
         legacyLeaderRecord?.instanceId,
+        { sessionId: deps.sessionId },
       )
     : undefined;
   if (deps.cwd && !workspaceIdentity) {
@@ -715,6 +717,7 @@ export async function ensureTelegramLeaderThreadBinding(
     ? deps.topicTargetStore.getWorkspaceBinding(
         workspaceIdentity.cwd,
         workspaceIdentity.instanceSlot,
+        workspaceIdentity.sessionId,
       )
     : undefined;
   const legacyWorkspaceBinding =

package/lib/thread-cleanup-manager.ts

@@ -17,6 +17,8 @@ import type { TelegramWorkspaceDeletionPermit,
 export interface TelegramThreadCleanupBindingSnapshot {
   cwd: string;
   workspaceKey: string;
+  sessionId?: string;
+  sessionKey?: string;
   instanceSlot: string;
   slot?: string;
   bindingKey: string;
@@ -40,6 +42,8 @@ export interface TelegramThreadCleanupCandidate {
   bindingKey: string;
   cwd: string;
   workspaceKey: string;
+  sessionId?: string;
+  sessionKey?: string;
   instanceSlot: string;
   slot: string;
   target: { chatId: number; threadId: number };
@@ -56,6 +60,21 @@ function validTarget(target: { chatId: number; threadId: number }): boolean {
     target.threadId > 0;
 }
 
+function validSessionIdentity(value: {
+  sessionId?: unknown;
+  sessionKey?: unknown;
+}): boolean {
+  if (value.sessionId === undefined && value.sessionKey === undefined) return true;
+  if (typeof value.sessionId !== "string" || !value.sessionId ||
+      value.sessionId !== value.sessionId.trim() ||
+      Buffer.byteLength(value.sessionId, "utf8") > 256 ||
+      typeof value.sessionKey !== "string" || !/^[a-f0-9]{64}$/u.test(value.sessionKey)) {
+    return false;
+  }
+  return createHash("sha256").update(value.sessionId).digest("hex") ===
+    value.sessionKey;
+}
+
 /** Returns no candidates when any identity/evidence ambiguity exists. */
 export function planTelegramInactiveThreadCleanup(input: {
   profileName: string;
@@ -72,7 +91,7 @@ export function planTelegramInactiveThreadCleanup(input: {
     const key = targetKey(binding.target);
     const slot = binding.slot;
     if (!binding.bindingKey || !binding.cwd || !binding.workspaceKey || !binding.instanceSlot ||
-        typeof slot !== "string" || !slot ||
+        typeof slot !== "string" || !slot || !validSessionIdentity(binding) ||
         !validTarget(binding.target) || bindingKeys.has(binding.bindingKey) || bindingTargets.has(key)) return [];
     bindingKeys.add(binding.bindingKey);
     bindingTargets.add(key);
@@ -101,8 +120,11 @@ export function planTelegramInactiveThreadCleanup(input: {
         evidence.liveOwner !== "clear" || evidence.acceptedWork !== "clear" ||
         evidence.deliveryAuthority !== "clear" || competing.has(targetKey(binding.target))) continue;
     candidates.push({ profileName: input.profileName, bindingKey: binding.bindingKey,
-      cwd: binding.cwd, workspaceKey: binding.workspaceKey, instanceSlot: binding.instanceSlot,
-      slot, target: { ...binding.target }, inactiveSinceMs,
+      cwd: binding.cwd, workspaceKey: binding.workspaceKey,
+      ...(binding.sessionId && binding.sessionKey
+        ? { sessionId: binding.sessionId, sessionKey: binding.sessionKey }
+        : {}),
+      instanceSlot: binding.instanceSlot, slot, target: { ...binding.target }, inactiveSinceMs,
       bindingUpdatedAtMs: binding.updatedAtMs });
   }
   return candidates.sort((left, right) => left.bindingKey.localeCompare(right.bindingKey));
@@ -124,7 +146,11 @@ export function captureTelegramInactiveThreadCleanupEvidence<
 }): Parameters<typeof planTelegramInactiveThreadCleanup>[0] {
   const sourceBindings = input.listBindings();
   const bindings = sourceBindings.map(binding => ({
-    cwd: binding.cwd, workspaceKey: binding.workspaceKey, instanceSlot: binding.instanceSlot,
+    cwd: binding.cwd, workspaceKey: binding.workspaceKey,
+    ...(binding.sessionId && binding.sessionKey
+      ? { sessionId: binding.sessionId, sessionKey: binding.sessionKey }
+      : {}),
+    instanceSlot: binding.instanceSlot,
     ...(binding.slot === undefined ? {} : { slot: binding.slot }), bindingKey: binding.bindingKey, target: { ...binding.target },
     ...(binding.inactiveSinceMs === undefined ? {} : { inactiveSinceMs: binding.inactiveSinceMs }),
     updatedAtMs: binding.updatedAtMs,
@@ -237,16 +263,20 @@ function validateWorkSet(value: unknown, profileName: string): TelegramThreadCle
   const createdAtMs = value.createdAtMs as number;
   const entries = value.entries.map(raw => {
     if (!isObject(raw) || !onlyKeys(raw, ["profileName", "bindingKey", "cwd", "workspaceKey",
-      "instanceSlot", "slot", "target", "inactiveSinceMs", "bindingUpdatedAtMs", "state", "updatedAtMs",
+      "sessionId", "sessionKey", "instanceSlot", "slot", "target", "inactiveSinceMs", "bindingUpdatedAtMs", "state", "updatedAtMs",
       "issuedAtMs", "permitOperationId", "permitIntentId", "permitLeaderEpoch", "deletedAtMs"]) || raw.profileName !== profileName || typeof raw.bindingKey !== "string" ||
       !raw.bindingKey || typeof raw.cwd !== "string" || !raw.cwd || typeof raw.workspaceKey !== "string" ||
-      !raw.workspaceKey || typeof raw.instanceSlot !== "string" || !raw.instanceSlot ||
+      !raw.workspaceKey || !validSessionIdentity(raw) ||
+      typeof raw.instanceSlot !== "string" || !raw.instanceSlot ||
       typeof raw.slot !== "string" || !raw.slot || !isObject(raw.target) ||
       !onlyKeys(raw.target, ["chatId", "threadId"]) || !validTarget(raw.target as unknown as { chatId: number; threadId: number }) ||
       !safeTime(raw.inactiveSinceMs) || !safeTime(raw.bindingUpdatedAtMs) ||
       (raw.bindingUpdatedAtMs as number) < (raw.inactiveSinceMs as number) || !safeTime(raw.updatedAtMs))
       throw new Error("Telegram Thread cleanup entry schema is invalid.");
     const base = { profileName, bindingKey: raw.bindingKey, cwd: raw.cwd, workspaceKey: raw.workspaceKey,
+      ...(typeof raw.sessionId === "string" && typeof raw.sessionKey === "string"
+        ? { sessionId: raw.sessionId, sessionKey: raw.sessionKey }
+        : {}),
       instanceSlot: raw.instanceSlot, slot: raw.slot, target: { chatId: raw.target.chatId as number,
         threadId: raw.target.threadId as number }, inactiveSinceMs: raw.inactiveSinceMs as number,
       bindingUpdatedAtMs: raw.bindingUpdatedAtMs as number, updatedAtMs: raw.updatedAtMs as number };

package/lib/threads.ts

@@ -52,6 +52,10 @@ export interface TelegramThreadNameInput {
 export interface TelegramWorkspaceBindingIdentity {
   cwd: string;
   workspaceKey: string;
+  /** Exact durable Pi session identity; absent only on legacy cwd-only bindings. */
+  sessionId?: string;
+  /** Full SHA-256 index component for session-qualified bindings. */
+  sessionKey?: string;
   /** Immutable legacy binding-key component, not the displayed global letter. */
   instanceSlot: string;
   bindingKey: string;
@@ -60,6 +64,27 @@ export interface TelegramWorkspaceBindingIdentity {
 }
 
 const TELEGRAM_WORKSPACE_KEY_MAX_LENGTH = 180;
+const TELEGRAM_SESSION_ID_MAX_LENGTH = 256;
+
+export function normalizeTelegramSessionId(
+  sessionId: string,
+): string | undefined {
+  if (typeof sessionId !== "string") return undefined;
+  const normalized = sessionId.trim();
+  return normalized && Buffer.byteLength(normalized, "utf8") <=
+      TELEGRAM_SESSION_ID_MAX_LENGTH
+    ? normalized
+    : undefined;
+}
+
+export function createTelegramSessionKey(
+  sessionId: string,
+): string | undefined {
+  const normalized = normalizeTelegramSessionId(sessionId);
+  return normalized
+    ? createHash("sha256").update(normalized).digest("hex")
+    : undefined;
+}
 
 export function normalizeTelegramWorkspacePath(
   cwd: string,
@@ -116,21 +141,39 @@ function createTelegramWorkspaceBindingIdentityWithKey(
   cwd: string,
   workspaceKey: string,
   ordinal: number,
+  sessionId?: string,
 ): TelegramWorkspaceBindingIdentity | undefined {
   const instanceSlot = createTelegramWorkspaceInstanceSlot(ordinal);
   if (!instanceSlot) return undefined;
+  const normalizedSessionId = sessionId === undefined
+    ? undefined
+    : normalizeTelegramSessionId(sessionId);
+  const sessionKey = normalizedSessionId
+    ? createTelegramSessionKey(normalizedSessionId)
+    : undefined;
+  if (sessionId !== undefined && (!normalizedSessionId || !sessionKey)) {
+    return undefined;
+  }
+  const legacyBindingKey = instanceSlot === "a"
+    ? workspaceKey
+    : `${workspaceKey}${instanceSlot}`;
   return {
     cwd,
     workspaceKey,
+    ...(normalizedSessionId && sessionKey
+      ? { sessionId: normalizedSessionId, sessionKey }
+      : {}),
     instanceSlot,
-    bindingKey:
-      instanceSlot === "a" ? workspaceKey : `${workspaceKey}${instanceSlot}`,
+    bindingKey: sessionKey
+      ? `${legacyBindingKey}-s-${sessionKey}`
+      : legacyBindingKey,
   };
 }
 
 export function createTelegramWorkspaceBindingIdentity(
   cwd: string,
   ordinal = 0,
+  sessionId?: string,
 ): TelegramWorkspaceBindingIdentity | undefined {
   const normalized = normalizeTelegramWorkspacePath(cwd);
   const workspaceKey = normalized
@@ -141,6 +184,7 @@ export function createTelegramWorkspaceBindingIdentity(
     normalized,
     workspaceKey,
     ordinal,
+    sessionId,
   );
 }
 
@@ -249,6 +293,10 @@ export interface TelegramThreadIdentityRecord {
 export interface TelegramWorkspaceThreadBinding {
   cwd: string;
   workspaceKey: string;
+  /** Exact durable Pi session identity; absent only on legacy cwd-only bindings. */
+  sessionId?: string;
+  /** Full SHA-256 index component for session-qualified bindings. */
+  sessionKey?: string;
   instanceSlot: string;
   bindingKey: string;
   target: TelegramTarget & { threadId: number };
@@ -453,7 +501,8 @@ export interface TelegramTopicTargetStore {
   ) => Promise<boolean>;
   commitInactiveWorkspaceCleanup: (
     expected: TelegramWorkspaceThreadBinding | {
-      cwd: string; workspaceKey: string; instanceSlot: string; slot: string; bindingKey: string;
+      cwd: string; workspaceKey: string; sessionId?: string; sessionKey?: string;
+      instanceSlot: string; slot: string; bindingKey: string;
       target: { chatId: number; threadId: number }; inactiveSinceMs: number; bindingUpdatedAtMs: number;
     },
     isCurrent: () => boolean,
@@ -465,7 +514,7 @@ export interface TelegramTopicTargetStore {
     ) => TelegramWorkspaceExternalProtectionEvidence,
     options?: { expectedRetirement?: TelegramWorkspaceRetirementIntent },
   ) => TelegramWorkspaceSlotOccupancySnapshot;
-  hasWorkspaceBinding: (cwd: string) => boolean;
+  hasWorkspaceBinding: (cwd: string, sessionId?: string) => boolean;
   setWorkspaceDisplayTitle: (
     expected: TelegramWorkspaceThreadBinding,
     title: string,
@@ -478,6 +527,7 @@ export interface TelegramTopicTargetStore {
   getWorkspaceBinding: (
     cwd: string,
     instanceSlot?: string,
+    sessionId?: string,
   ) => TelegramWorkspaceThreadBinding | undefined;
   claimWorkspaceIdentity: (
     cwd: string,
@@ -485,6 +535,7 @@ export interface TelegramTopicTargetStore {
     previousInstanceId?: string,
     options?: {
       existingBindingOnly?: boolean;
+      sessionId?: string;
       onCapacityUnavailable?: () => void;
     },
   ) => TelegramWorkspaceBindingIdentity | undefined;
@@ -1124,9 +1175,12 @@ function cloneIdentityRecord(
 }
 
 function getWorkspaceBindingMapKey(
-  binding: Pick<TelegramWorkspaceThreadBinding, "cwd" | "instanceSlot">,
+  binding: Pick<
+    TelegramWorkspaceThreadBinding,
+    "cwd" | "instanceSlot" | "sessionId"
+  >,
 ): string {
-  return `${binding.cwd}\u0000${binding.instanceSlot}`;
+  return `${binding.cwd}\u0000${binding.sessionId ?? ""}\u0000${binding.instanceSlot}`;
 }
 
 function normalizeWorkspaceBindingRecord(
@@ -1145,15 +1199,30 @@ function normalizeWorkspaceBindingRecord(
     return undefined;
   }
   const cwd = normalizeTelegramWorkspacePath(record.cwd);
+  const sessionId = typeof record.sessionId === "string"
+    ? normalizeTelegramSessionId(record.sessionId)
+    : undefined;
+  const sessionKey = typeof record.sessionKey === "string"
+    ? record.sessionKey
+    : undefined;
+  const hasSessionFields = record.sessionId !== undefined ||
+    record.sessionKey !== undefined;
+  const expectedSessionKey = sessionId
+    ? createTelegramSessionKey(sessionId)
+    : undefined;
+  const legacyBindingKey = record.instanceSlot === "a"
+    ? record.workspaceKey
+    : `${record.workspaceKey}${record.instanceSlot}`;
+  const expectedBindingKey = expectedSessionKey
+    ? `${legacyBindingKey}-s-${expectedSessionKey}`
+    : legacyBindingKey;
   if (
     !cwd ||
     cwd !== record.cwd ||
     !record.workspaceKey ||
     !/^[a-z]+$/u.test(record.instanceSlot) ||
-    record.bindingKey !==
-      (record.instanceSlot === "a"
-        ? record.workspaceKey
-        : `${record.workspaceKey}${record.instanceSlot}`)
+    (hasSessionFields && (!sessionId || sessionKey !== expectedSessionKey)) ||
+    record.bindingKey !== expectedBindingKey
   ) {
     return undefined;
   }
@@ -1191,6 +1260,7 @@ function normalizeWorkspaceBindingRecord(
   return {
     cwd,
     workspaceKey: record.workspaceKey,
+    ...(sessionId && sessionKey ? { sessionId, sessionKey } : {}),
     instanceSlot: record.instanceSlot,
     bindingKey: record.bindingKey,
     ...(record.showSlotSuffix === true ? { showSlotSuffix: true } : {}),
@@ -1684,7 +1754,10 @@ export function createTelegramTopicTargetStore(
   );
   let workspaceClaims = new Map<
     string,
-    { identity: TelegramWorkspaceBindingIdentity; instanceId: string }
+    {
+      identity: TelegramWorkspaceBindingIdentity;
+      instanceId: string;
+    }
   >();
   let reservations: TelegramThreadReservation[] = [];
   let pendingProvisions: TelegramThreadPendingProvision[] = [];
@@ -2404,8 +2477,16 @@ export function createTelegramTopicTargetStore(
       if (workspaceRetirementCommitInFlight || !isCurrent()) return false;
       const cleanupSnapshot = "bindingUpdatedAtMs" in expected ? expected : undefined;
       const normalized = cleanupSnapshot ? undefined : normalizeWorkspaceBindingRecord(expected);
+      const cleanupSessionId = cleanupSnapshot?.sessionId === undefined
+        ? undefined
+        : normalizeTelegramSessionId(cleanupSnapshot.sessionId);
+      const cleanupSessionKey = cleanupSessionId
+        ? createTelegramSessionKey(cleanupSessionId)
+        : undefined;
       if (cleanupSnapshot && (!cleanupSnapshot.cwd || !cleanupSnapshot.workspaceKey ||
           !cleanupSnapshot.instanceSlot || !cleanupSnapshot.slot || !cleanupSnapshot.bindingKey ||
+          ((cleanupSnapshot.sessionId !== undefined || cleanupSnapshot.sessionKey !== undefined) &&
+            (!cleanupSessionId || cleanupSnapshot.sessionKey !== cleanupSessionKey)) ||
           !Number.isSafeInteger(cleanupSnapshot.inactiveSinceMs) ||
           !Number.isSafeInteger(cleanupSnapshot.bindingUpdatedAtMs) ||
           !Number.isSafeInteger(cleanupSnapshot.target.chatId) ||
@@ -2416,6 +2497,7 @@ export function createTelegramTopicTargetStore(
       if (!binding) return isCurrent();
       const exact = cleanupSnapshot ? binding.cwd === cleanupSnapshot.cwd &&
         binding.workspaceKey === cleanupSnapshot.workspaceKey &&
+        binding.sessionId === cleanupSessionId && binding.sessionKey === cleanupSessionKey &&
         binding.instanceSlot === cleanupSnapshot.instanceSlot && binding.slot === cleanupSnapshot.slot &&
         binding.bindingKey === cleanupSnapshot.bindingKey && targetMatches(binding.target, cleanupSnapshot.target) &&
         binding.inactiveSinceMs === cleanupSnapshot.inactiveSinceMs &&
@@ -2612,10 +2694,17 @@ export function createTelegramTopicTargetStore(
         : [...localReservedSlots, "invalid"];
       return { bindings, reservedSlots };
     },
-    hasWorkspaceBinding(cwd) {
+    hasWorkspaceBinding(cwd, sessionId) {
       const normalizedCwd = normalizeTelegramWorkspacePath(cwd);
-      return !!normalizedCwd && Array.from(workspaceBindings.values()).some(
-        (binding) => binding.cwd === normalizedCwd,
+      const normalizedSessionId = sessionId === undefined
+        ? undefined
+        : normalizeTelegramSessionId(sessionId);
+      if (!normalizedCwd || (sessionId !== undefined && !normalizedSessionId)) {
+        return false;
+      }
+      return Array.from(workspaceBindings.values()).some(
+        (binding) => binding.cwd === normalizedCwd &&
+          binding.sessionId === normalizedSessionId,
       );
     },
     setWorkspaceDisplayTitle(expected, title) {
@@ -2651,18 +2740,29 @@ export function createTelegramTopicTargetStore(
       }
       return false;
     },
-    getWorkspaceBinding(cwd, instanceSlot = "a") {
+    getWorkspaceBinding(cwd, instanceSlot = "a", sessionId) {
       const normalizedCwd = normalizeTelegramWorkspacePath(cwd);
-      if (!normalizedCwd || !/^[a-z]+$/u.test(instanceSlot)) return undefined;
-      const binding = workspaceBindings.get(
-        getWorkspaceBindingMapKey({ cwd: normalizedCwd, instanceSlot }),
-      );
+      const normalizedSessionId = sessionId === undefined
+        ? undefined
+        : normalizeTelegramSessionId(sessionId);
+      if (!normalizedCwd || !/^[a-z]+$/u.test(instanceSlot) ||
+          (sessionId !== undefined && !normalizedSessionId)) return undefined;
+      const mapKey = getWorkspaceBindingMapKey({
+        cwd: normalizedCwd,
+        instanceSlot,
+        ...(normalizedSessionId ? { sessionId: normalizedSessionId } : {}),
+      });
+      const binding = workspaceBindings.get(mapKey);
       return binding ? cloneWorkspaceBinding(binding) : undefined;
     },
     claimWorkspaceIdentity(cwd, instanceId, previousInstanceId, options) {
       if (workspaceRetirementCommitInFlight) return undefined;
       const normalizedCwd = normalizeTelegramWorkspacePath(cwd);
+      const normalizedSessionId = options?.sessionId === undefined
+        ? undefined
+        : normalizeTelegramSessionId(options.sessionId);
       if (!normalizedCwd || !instanceId ||
+          (options?.sessionId !== undefined && !normalizedSessionId) ||
           hasWorkspaceRetirementConflict({ cwd: normalizedCwd })) return undefined;
       const externalReservedSlots = captureExternalReservedSlots();
       if (!externalReservedSlots) {
@@ -2674,7 +2774,9 @@ export function createTelegramTopicTargetStore(
       );
       for (const claim of workspaceClaims.values()) {
         if (claim.instanceId !== instanceId) continue;
-        if (claim.identity.cwd !== normalizedCwd || !claim.identity.slot ||
+        if (claim.identity.cwd !== normalizedCwd ||
+            claim.identity.sessionId !== normalizedSessionId ||
+            !claim.identity.slot ||
             externalReservedSlotKeys.includes(claim.identity.slot.toLowerCase())) {
           return undefined;
         }
@@ -2686,11 +2788,13 @@ export function createTelegramTopicTargetStore(
       }
       const workspaceKey = resolveWorkspaceKey(normalizedCwd);
       if (!workspaceKey) return undefined;
-      let legacyRecord = findLegacyWorkspaceMigrationRecord(
-        normalizedCwd,
-        instanceId,
-        previousInstanceId,
-      );
+      let legacyRecord = normalizedSessionId
+        ? undefined
+        : findLegacyWorkspaceMigrationRecord(
+            normalizedCwd,
+            instanceId,
+            previousInstanceId,
+          );
       const legacyTarget = legacyRecord?.target;
       const targetBinding = legacyTarget
         ? Array.from(workspaceBindings.values()).find(
@@ -2772,12 +2876,16 @@ export function createTelegramTopicTargetStore(
         }
         if (!slot || !/^[A-Z]$/u.test(slot)) return undefined;
         const claimedIdentity = { ...identity, slot };
-        workspaceClaims.set(mapKey, { identity: claimedIdentity, instanceId });
+        workspaceClaims.set(mapKey, {
+          identity: claimedIdentity,
+          instanceId,
+        });
         return { ...claimedIdentity };
       };
       if (options?.existingBindingOnly) {
         const candidates = Array.from(workspaceBindings.values())
-          .filter((binding) => binding.cwd === normalizedCwd)
+          .filter((binding) => binding.cwd === normalizedCwd &&
+            binding.sessionId === normalizedSessionId)
           .sort((left, right) =>
             left.instanceSlot.length - right.instanceSlot.length ||
             left.instanceSlot.localeCompare(right.instanceSlot),
@@ -2786,6 +2894,9 @@ export function createTelegramTopicTargetStore(
           const claimed = claimIdentity({
             cwd: binding.cwd,
             workspaceKey: binding.workspaceKey,
+            ...(binding.sessionId && binding.sessionKey
+              ? { sessionId: binding.sessionId, sessionKey: binding.sessionKey }
+              : {}),
             instanceSlot: binding.instanceSlot,
             bindingKey: binding.bindingKey,
           });
@@ -2811,6 +2922,7 @@ export function createTelegramTopicTargetStore(
           normalizedCwd,
           workspaceKey,
           ordinal,
+          normalizedSessionId,
         );
         if (!identity) return undefined;
         const mapKey = getWorkspaceBindingMapKey(identity);
@@ -2850,6 +2962,8 @@ export function createTelegramTopicTargetStore(
       const next = normalizeWorkspaceBindingRecord(binding);
       if (next && hasWorkspaceRetirementConflict(next)) return undefined;
       if (!next) return undefined;
+      const nextMapKey = getWorkspaceBindingMapKey(next);
+      const claim = workspaceClaims.get(nextMapKey);
       if (next.slot && Array.from(workspaceBindings.values()).some((existing) =>
         existing.bindingKey !== next.bindingKey && existing.slot === next.slot,
       )) return undefined;
@@ -2861,9 +2975,11 @@ export function createTelegramTopicTargetStore(
           return undefined;
         }
       }
-      const nextMapKey = getWorkspaceBindingMapKey(next);
       const previous = workspaceBindings.get(nextMapKey);
       if (previous?.showSlotSuffix) next.showSlotSuffix = true;
+      if (previous?.threadName && !next.threadName) {
+        next.threadName = previous.threadName;
+      }
       if (previous?.manualThreadName && !next.manualThreadName) {
         next.manualThreadName = previous.manualThreadName;
       }
@@ -2884,7 +3000,6 @@ export function createTelegramTopicTargetStore(
         if (previous.displayTitle) next.displayTitle = previous.displayTitle;
         if (previous.inactiveSinceMs !== undefined) next.inactiveSinceMs = previous.inactiveSinceMs;
       }
-      const claim = workspaceClaims.get(nextMapKey);
       if (claimInstanceId) {
         if (claim?.instanceId !== claimInstanceId) return undefined;
         if (next.slot !== undefined && claim.identity.slot !== next.slot) return undefined;
@@ -3460,6 +3575,7 @@ export interface TelegramPromoteFollowerBindingToLeaderDeps {
   store: TelegramTopicTargetStore;
   instanceId: string;
   cwd?: string;
+  sessionId?: string;
   telegramProfile?: string;
   target?: TelegramTarget;
   slot?: string;
@@ -3483,11 +3599,15 @@ export async function promoteTelegramFollowerBindingToLeader(
     );
   const workspaceIdentity = deps.cwd
     ? deps.store.claimWorkspaceIdentity(deps.cwd, deps.instanceId,
-        existing?.instanceId, { existingBindingOnly: true })
+        existing?.instanceId, {
+          existingBindingOnly: true,
+          sessionId: deps.sessionId,
+        })
     : undefined;
   const workspaceBinding = workspaceIdentity
     ? deps.store.getWorkspaceBinding(
         workspaceIdentity.cwd, workspaceIdentity.instanceSlot,
+        workspaceIdentity.sessionId,
       )
     : undefined;
   const exactWorkspaceBinding = workspaceBinding &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.45.11",
+  "version": "0.46.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/skills/show-me/SKILL.md

@@ -10,7 +10,7 @@ Help the user understand the current topic. Skip the preamble and keep prose bri
 - Infer the subject from the conversation and honor an explicitly requested format. With plain `show me`, choose the form that best explains the subject.
 - Markdown in the reply is a complete output format for both chat and terminal surfaces. Use headings, emphasis, lists, and focused code blocks to explain outcomes, comparisons, and reasoning; add a diagram when relationships need one.
 - `Show me markdown` requests a rendered Markdown reply. Create a Markdown file only when the user asks for a saved document or file artifact.
-- `Show me html` requests a focused HTML file. Save file artifacts in the project or filesystem as appropriate and deliver them through the active environment's file-delivery mechanism; open locally when that is the requested surface.
+- `Show me html` requests a focused HTML file. Prefer an accessible, art-directed interactive infographic when timelines, comparisons, layers, or progressive disclosure clarify the subject; otherwise stay static. Preserve truthful labels and reduced motion. Save and deliver the artifact through the active environment; open it locally when requested.
 
 ### Surface Routing