@llblab/pi-telegram 0.51.0 → 0.51.2

package/dist/lib/telegram-api.js

@@ -900,7 +900,8 @@ export function createTelegramBridgeApiRuntime(deps) {
     const chatActionMinIntervalMs = Math.max(0, deps.chatActionMinIntervalMs ?? 2_000);
     const chatActionMaxGates = Math.max(1, deps.chatActionMaxGates ?? 256);
     const chatActionGates = new Map();
-    const getChatActionKey = (method, body) => {
+    const chatActionChatGates = new Map();
+    const getChatActionKeys = (method, body) => {
         if (method !== "sendChatAction")
             return undefined;
         const chatId = body.chat_id;
@@ -909,32 +910,52 @@ export function createTelegramBridgeApiRuntime(deps) {
             typeof action !== "string") {
             return undefined;
         }
+        const chat = String(chatId);
         const threadId = body.message_thread_id;
-        return `${String(chatId)}:${typeof threadId === "number" || typeof threadId === "string"
-            ? String(threadId)
-            : "all"}:${action}`;
+        return {
+            action: `${chat}:${typeof threadId === "number" || typeof threadId === "string"
+                ? String(threadId)
+                : "all"}:${action}`,
+            chat,
+        };
     };
     const callRecorded = async (method, body, options) => {
         const recoverError = deps.captureRequestErrorHandler?.(body);
-        const chatActionKey = getChatActionKey(method, body);
-        if (chatActionKey) {
+        const chatActionKeys = getChatActionKeys(method, body);
+        if (chatActionKeys) {
             const nowMs = now();
             for (const [key, candidate] of chatActionGates) {
                 if (!candidate.inFlight && nowMs >= candidate.notBeforeMs) {
                     chatActionGates.delete(key);
                 }
             }
-            let gate = chatActionGates.get(chatActionKey);
+            for (const [key, candidate] of chatActionChatGates) {
+                if (!candidate.inFlight && nowMs >= candidate.notBeforeMs) {
+                    chatActionChatGates.delete(key);
+                }
+            }
+            let gate = chatActionGates.get(chatActionKeys.action);
             if (!gate) {
                 if (chatActionGates.size >= chatActionMaxGates)
                     return true;
                 gate = { notBeforeMs: 0 };
-                chatActionGates.set(chatActionKey, gate);
+                chatActionGates.set(chatActionKeys.action, gate);
+            }
+            let chatGate = chatActionChatGates.get(chatActionKeys.chat);
+            if (!chatGate) {
+                if (chatActionChatGates.size >= chatActionMaxGates) {
+                    return true;
+                }
+                chatGate = { notBeforeMs: 0 };
+                chatActionChatGates.set(chatActionKeys.chat, chatGate);
             }
             if (gate.inFlight)
                 return (await gate.inFlight);
-            if (now() < gate.notBeforeMs)
+            if (chatGate.inFlight)
                 return true;
+            if (nowMs < gate.notBeforeMs || nowMs < chatGate.notBeforeMs) {
+                return true;
+            }
             let request;
             request = Promise.resolve()
                 .then(() => deps.client.call(method, body, {
@@ -949,7 +970,9 @@ export function createTelegramBridgeApiRuntime(deps) {
                 await recoverRequestError(recoverError, error);
                 if (error instanceof TelegramApiHttpError && error.status === 429) {
                     const retryAfterMs = Math.max(chatActionMinIntervalMs, (error.retryAfterSeconds ?? 0) * 1_000);
-                    gate.notBeforeMs = now() + retryAfterMs;
+                    const notBeforeMs = now() + retryAfterMs;
+                    gate.notBeforeMs = notBeforeMs;
+                    chatGate.notBeforeMs = Math.max(chatGate.notBeforeMs, notBeforeMs);
                     deps.recordRuntimeEvent("api", error, withTelegramTransportDiagnostics(error, {
                         method,
                         rateLimited: true,
@@ -963,8 +986,11 @@ export function createTelegramBridgeApiRuntime(deps) {
                 .finally(() => {
                 if (gate.inFlight === request)
                     gate.inFlight = undefined;
+                if (chatGate.inFlight === request)
+                    chatGate.inFlight = undefined;
             });
             gate.inFlight = request;
+            chatGate.inFlight = request;
             return request;
         }
         try {

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.51.0",
+  "version": "0.51.2",
   "private": false,
   "publishConfig": {
     "access": "public"

package/docs/architecture.md

@@ -518,7 +518,7 @@ Immediate controls:
 - `/start` opens the main inline application menu.
 - `/model`, `/thinking`, `/queue`, and `/settings` are hidden shortcuts to menu sections.
 - `/compact` opens an inline confirmation dialog and then runs compaction when the bridge is idle.
-- `/next` dispatches the next queued turn, aborting Pi first when needed. Active-turn settlement delivers its abort notice to the interrupted prompt before queue dispatch continues. The queue owner then emits `Dispatching next queued turn.` against the exact selected prompt's chat/thread/reply id before its one model dispatch; skipped, inactive, pending-mutation, and admission-blocked candidates never receive it. The `/next` command itself is never a lifecycle-notice reply target. Aborted pending assistant text is not projected as a second reply, while already completed intermediate output remains visible.
+- `/next` dispatches the next queued turn, aborting Pi first when needed. Target-bound command composition must forward the announcement request, exact-turn marker, superseding cancellation, and deferred-dispatch ports rather than silently dropping them. Active-turn settlement attempts its abort notice against the interrupted prompt before queue dispatch continues; definite or ambiguous notice failure is recorded but cannot block the selected turn. The queue owner then emits `Dispatching next queued turn.` against the exact selected prompt's chat/thread/reply id before its one model dispatch; skipped, inactive, pending-mutation, and admission-blocked candidates never receive it. A successful dispatch notice carries its reply-dedup anchor through the following agent-start reset, so later messages in that turn do not repeat the queued-prompt reply header. A later `/abort` or `/stop` cancels both pending `/next` notices before taking ownership, preventing duplicate abort results and stale future dispatch announcements. The `/next` command itself is never a lifecycle-notice reply target. Aborted pending assistant text is not projected as a second reply, while already completed intermediate output remains visible.
 - `/abort` aborts active work while preserving queued items. Abort-history preservation is enabled only for Telegram-owned active turns; later local/non-Telegram agent starts clear stale abort-history mode so the next Telegram prompt appends instead of absorbing old queued turns as history.
 - `/stop` aborts and clears waiting Telegram queue items.
 
@@ -526,7 +526,7 @@ Queued controls:
 
 - `/continue` creates a priority Telegram-owned `continue` prompt.
 - Prompt-template commands expand Telegram-safe Pi template aliases before entering the prompt queue.
-- Model-switch continuation uses the control lane when an in-flight Telegram-owned run must be stopped and resumed.
+- Model-switch continuation uses the control lane when any interruptible in-flight agent run in the current Pi session must be stopped and resumed. A Telegram-owned run retains its prompt target; otherwise the exact model-menu chat/Thread/message supplies continuation and reply ownership.
 
 Queue and menu mutations are reachable through Telegram updates handled by the current polling owner. After ownership moves, the old instance keeps processing its accepted local queue, but it no longer receives new menu callbacks or control updates for remote mutation. UI label, navigation, tab, toggle, card, and dialog rules are defined in [UI Style](./ui-style.md). Callback prefix ownership is defined in [Callback Namespaces](./callback-namespaces.md).
 
@@ -539,10 +539,10 @@ Native typing during compaction follows connected-instance activity rather than
 - Confirmed manual `/compact` starts a native `typing` keepalive in the command target and stops it on completion/failure.
 - Automatic/session compaction with an active Telegram turn reuses that turn's target.
 - Automatic/session compaction without an active Telegram turn uses the connected instance's assigned target; an unconnected instance sends nothing.
-- Thread-targeted typing is sent to the concrete thread and mirrored to `All` as the aggregate activity surface; completion, native failure, timeout, and shutdown stop the keyed loop.
+- Thread-targeted typing is sent only to the concrete thread. Aggregate `All` mirroring is intentionally omitted because duplicating every keepalive multiplies shared-chat flood pressure. Compaction completion, failure, or timeout stops only a loop actually started by the compaction observer; a pre-existing agent-owned loop remains active. Authority loss and shutdown still stop the keyed loop.
 - Pi `ui_prompt_start` pauses typing while an extension-owned local prompt waits for the operator; `ui_prompt_end` emits the matching Activity boundary and resumes typing whenever agent or compaction work remains unsettled.
 
-At every connected instance `agent_start`, the lifecycle binding starts Telegram's native `…typing` indicator in that instance's assigned target, whether the run came from Telegram, the local TUI, or an autonomous continuation such as Grow Loop. Terminal `Active` remains Telegram-turn-specific; the native indicator answers the separate question of whether the instance is doing agent work. Each loop keeps one action in flight, while the leader API runtime coalesces identical chat/thread/action calls across local and follower traffic for two seconds; expired gates prune opportunistically and at most 256 currently active keys are retained. A Telegram 429 response opens the exact action's shared `retry_after` suppression window without scheduling delayed retries or projecting expected activity throttling as a terminal status error. Assistant message start/update hooks still re-arm it during Telegram-owned turns so transient provider/model errors do not leave a continuing run without activity feedback, and agent/session completion stops it.
+At every connected instance `agent_start`, the lifecycle binding starts Telegram's native `…typing` indicator in that instance's assigned target, whether the run came from Telegram, the local TUI, or an autonomous continuation such as Grow Loop. Terminal `Active` remains Telegram-turn-specific; the native indicator answers the separate question of whether the instance is doing agent work. Each loop refreshes its exact target every three seconds and keeps one action in flight. The leader API runtime coalesces identical chat/thread/action calls for two seconds, permits at most one concurrent chat action per chat, and shares a Telegram 429 `retry_after` fence across every Thread key in that chat; expired gates prune opportunistically and each gate family retains at most 256 active keys. Suppression never schedules a delayed retry. A failed typing action remains a structured diagnostic but cannot project `error` onto an otherwise healthy connected/leader/follower status. Assistant message start/update hooks still re-arm typing during Telegram-owned turns so transient provider/model errors do not leave a continuing run without activity feedback, and agent/session completion stops it.
 
 ### Rendering And Delivery
 
@@ -625,14 +625,14 @@ Telegram prompt guidance is context- and authority-aware. The package and source
 
 ## In-Flight Model Switching
 
-When `/model` is used during an active Telegram-owned run, the bridge can emulate Pi's interactive stop/switch/continue workflow:
+When `/model` is used during an interruptible active agent run in the current Pi session, the bridge emulates Pi's interactive stop/switch/continue workflow:
 
 1. Apply the selected model immediately.
-2. Queue or stage a synthetic Telegram continuation turn.
-3. Abort the active Telegram turn immediately, or wait for the current tool to finish before aborting.
-4. Dispatch the continuation after abort completion.
+2. Queue or stage a synthetic Telegram continuation turn before aborting.
+3. Abort immediately, or wait for every active tool execution to finish before aborting.
+4. Dispatch the continuation in the same session context under the selected model.
 
-This is limited to Telegram-owned runs. If Pi is busy with non-Telegram work, the bridge refuses the switch instead of hijacking unrelated activity.
+A Telegram-originated run retains its active prompt target and reply anchor. For local/TUI or autonomous work without an active Telegram turn, the exact authorized model-menu chat, Thread, and message become the continuation target and reply anchor. Merely busy non-agent lifecycle work remains ineligible because no active agent abort handler exists. Pending selection and fallback-target state clear together on cancellation, new agent start, settlement, or session replacement.
 
 ## Shutdown And Timer Lifecycle
 

package/docs/multi-instance-bus.md

@@ -336,7 +336,7 @@ In Telegram private-chat Threaded Mode:
 - Prompts typed in a thread route to the owning instance.
 - Replies, previews, files, voice, and buttons stay in that thread.
 - Queue controls and reactions affect only that instance target.
-- Telegram's native `…typing` indicator for real agent work is sent to that instance thread and mirrored to `All`; `All` is the aggregate surface and should show activity when any bound instance is running a Telegram turn, local prompt, or autonomous continuation. Terminal `Active` remains Telegram-turn-specific. Startup/connect/reload/recovery must not send activity by themselves.
+- Telegram's native `…typing` indicator for real agent work is refreshed only in that instance's exact Thread. Aggregate `All` mirroring is intentionally omitted because it duplicates every keepalive against the shared chat and amplifies Telegram flood control. Telegram turns, local prompts, and autonomous continuations all use the exact instance target. Terminal `Active` remains Telegram-turn-specific. Startup/connect/reload/recovery must not send activity by themselves.
 - Generic heartbeat pruning remains silent and preserves the thread as a restart hint. With cleanup enabled, a later exact-PID death confirmation may delete it without posting an `Instance offline` notice. With cleanup disabled, a fenced owner-detachment commit records inactivity but retains the Thread and its Workspace slot for restoration or fully guarded capacity rotation. Confirmed deletion removes live routing authority but retains the Workspace binding's friendly name and uppercase ordering slot; a later authenticated reopen probes the old target, replaces it only on exact stale/deleted evidence, and carries that name and slot onto the new Thread.
 - If the same binding identity returns, authenticated registration can reclaim the thread after the required visibility proof.
 
@@ -406,7 +406,7 @@ Threaded Mode should make follower threads behave like normal Telegram instance
 | Replies/finals                   | Final replies land in the same thread                                                                                                                                                                                                                 | Follower finals go through leader transport into follower thread                                                                                                                                                                                                | Outbound calls carry target and inject `message_thread_id`                                                                                                                                                                                          | Reply delivery and bus API tests                                                                                          |
 | Previews/Rich Drafts             | Draft previews use the active thread target                                                                                                                                                                                                           | Follower previews use the same native draft lifecycle through the leader                                                                                                                                                                                        | Preview transport preserves target and draft id                                                                                                                                                                                                     | Preview thread-target tests                                                                                               |
 | Attachments/voice                | Files and voice upload in the instance thread                                                                                                                                                                                                         | Follower uploads route through leader multipart transport                                                                                                                                                                                                       | Multipart calls are target-scoped and follower-authorized                                                                                                                                                                                           | Bus allowlist and outbound delivery tests                                                                                 |
-| Native activity status           | `sendChatAction(typing)` renders Telegram's native `…typing` indicator in the assigned thread and mirrors aggregate `All` for every agent run, including local and autonomous work; terminal identity remains `connected`, with active work included in the green Queue count | Followers route one thread action and one aggregate action through leader transport for any agent run while retaining their stable terminal `follower` identity and green activity count                                                                                       | Agent lifecycle targets the active Telegram turn when present and otherwise the instance binding; one keyed loop avoids duplicate aggregate sends/rate-limit pressure                                                                               | Agent-start binding, typing-loop, target-routing, and terminal-status regressions                                         |
+| Native activity status           | `sendChatAction(typing)` refreshes Telegram's native `…typing` indicator only in the assigned Thread for every agent run, including local and autonomous work; aggregate `All` is not mirrored, terminal identity remains `connected`, and active work stays included in the green Queue count | Followers route the exact Thread action through leader transport while retaining their stable terminal `follower` identity and green activity count; the leader admits one concurrent action per chat and shares Telegram 429 cooldown across that chat's Thread keys                                                                                       | Agent lifecycle targets the active Telegram turn when present and otherwise the instance binding; one keyed loop avoids duplicate aggregate sends/rate-limit pressure                                                                               | Agent-start binding, typing-loop, target-routing, and terminal-status regressions                                         |
 | Leader election / promotion      | Current leader keeps its thread across reload                                                                                                                                                                                                         | A promoted follower keeps its existing thread, slot, and name when elected and after later reload                                                                                                                                                               | Promotion converts the current follower binding into the leader profile before forced lock acquisition, so leader startup reuses it instead of provisioning a new thread                                                                            | Follower heartbeat recovery passes binding snapshot into promotion; own-topic provisioner reuses promoted bindings        |
 | `/start` command/menu bootstrap  | Registers visible bot commands and opens the menu                                                                                                                                                                                                     | Follower `/start` can refresh the bot command menu through the leader and open its local menu without warnings                                                                                                                                                  | Bot command registration is a validated global Bot API call allowed through trusted follower bus transport                                                                                                                                          | Bus allowlist regression for `setMyCommands`                                                                              |
 | Follower reconnect               | Existing leader binding is reused only when still usable                                                                                                                                                                                              | Same-process `/new` or `/reload` suspends the old follower socket/context and automatically re-registers the new session to the exact prior target; explicit reconnect to a genuinely closed/stale Telegram tab still recreates a visible thread before success | A short-lived handoff carries the assigned target across session replacement, and the leader transfers that binding to the new runtime instance id by stable manual-follower identity; stale Bot API errors remain the proof for fresh provisioning | Session handoff/refresh, leader binding-transfer, persisted leader-reload reuse, and stale-target replacement regressions |
@@ -485,7 +485,7 @@ All files containing routing, chat ids, thread ids, or process details use priva
 
 ### Follower heartbeat is missed
 
-- Leader tolerates up to 15 seconds without a follower heartbeat before pruning it from the live registry, so short local event-loop or IPC stalls do not create false routing gaps. A follower response deadline defers its final timeout through one socket poll phase: an acknowledgement already buffered while the Pi/TUI event loop was blocked wins, while a genuinely silent peer still fails in the same event-loop turn. Heartbeat pruning remains liveness bookkeeping. One leader generation owns at most one prune operation; stop makes late endpoint, policy, and cleanup settlement inert, while durable-profile mutation serialization prevents replacement registration from crossing confirmed-dead cleanup.
+- Leader tolerates up to 15 seconds without a follower heartbeat before pruning it from the live registry, so short local event-loop or IPC stalls do not create false routing gaps. Follower heartbeat requests use a dedicated eight-second response deadline aligned with leader stale-liveness policy rather than the generic one-second local-RPC default. The deadline also defers its final timeout through one socket poll phase: an acknowledgement already buffered while the Pi/TUI event loop was blocked wins, while a genuinely silent peer still fails in the same event-loop turn. Heartbeat pruning remains liveness bookkeeping. One leader generation owns at most one prune operation; stop makes late endpoint, policy, and cleanup settlement inert, while durable-profile mutation serialization prevents replacement registration from crossing confirmed-dead cleanup.
 - A missed heartbeat does not delete, close, mark offline, or send a disconnected notice for the follower's Telegram thread binding because the common cause may be leader reload, IPC handoff, or transient reconnect rather than a dead follower.
 - After removal from live routing, the current leader retains at most 26 volatile preservation observations with exact registered PID, generation, target, profile and leader epoch. The existing prune loop rechecks alive/unverifiable PIDs and retries non-destructive publication only after fresh explicit absence and a known disabled-cleanup policy. Missing identity or overflow stays protected. Observations never answer heartbeat/API/forwarding requests, launch processes, or authorize deletion. Enabling cleanup cancels deferred preservation rather than promoting it into destructive work; the existing first-prune cleanup path is not retried by this mechanism.
 - Registry registration invalidates overlapping instance/profile-owner/target observations, even if that replacement is removed before the next prune. Admitted same-instance provisioning cancels the old observation before its store writes can precede live registration. Profile/epoch drift, registry clear and leader stop invalidate it; late old completion cannot erase a replacement runtime's observation. No observation survives leader restart, reconstructs a PID from an opaque instance ID, or invents legacy inactivity.

package/docs/public-api.md

@@ -53,7 +53,7 @@ Stable commands inside the paired Telegram DM:
 - `/start` — pair when needed and open the main application menu.
 - `/new` — after idle and empty-queue checks, request a new Pi session in the current classic chat or Thread. The bridge acknowledges the callback, deletes its confirmation, completes and removes the exact durable update, then dispatches one runtime-armed typed action through the internal `/telegram-internal` Pi gateway using `pi.sendUserMessage(..., { expandPromptTemplates: true })`. Manual invocation reports that the gateway cannot be run manually; the armed handler receives a real `ExtensionCommandContext` and calls `ctx.newSession()`; one discriminated durable intent preserves either exact classic Profile/CWD/session/chat continuity or the Thread binding with slot/name re-key. The successor CAS-claims that intent before sending one terminal result. Busy, identity-mismatch, and unavailable-host paths fail closed.
 - `/compact` — open confirmation and compact when idle.
-- `/next` — abort active work first when needed, let the interrupted prompt receive its abort notice, then reply `Dispatching next queued turn.` to the exact queued prompt selected for the next model turn. The command itself is never the lifecycle-notice reply target, and aborted pending assistant text is suppressed.
+- `/next` — abort active work first when needed, attempt the interrupted prompt's abort notice, then reply `Dispatching next queued turn.` to the exact queued prompt selected for the next model turn. That dispatch notice owns the turn's one reply header; later answer messages do not reply to the same prompt again. Abort-notice failure is diagnostic and cannot block dispatch. A later `/abort` or `/stop` cancels both pending transition notices before taking ownership. The `/next` command itself is never the lifecycle-notice reply target, and aborted pending assistant text is suppressed.
 - `/continue` — enqueue a priority `continue` prompt.
 - `/abort` — abort active work and keep the queue; abort-history is scoped to Telegram-owned active turns.
 - `/stop` — abort active Telegram-owned work and clear waiting Telegram queue items.

package/lib/bindings.ts

@@ -52,6 +52,7 @@ export interface TelegramQueueBindingRuntime<TContext> {
   mutation: Queue.TelegramQueueMutationController<TContext>;
   dispatchNext: (ctx: TContext) => void;
   requestNextDispatchAnnouncement: () => void;
+  cancelNextDispatchAnnouncement: () => void;
   watchdog: Queue.TelegramQueueDispatchWatchdogRuntime<TContext>;
 }
 
@@ -96,6 +97,9 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
   updateStatus: (ctx: TContext, error?: string) => void;
   sendTextReply: Queue.TelegramQueueDispatchRuntimeDeps<TContext>["sendTextReply"];
   sendUserMessage: Queue.TelegramQueueDispatchRuntimeDeps<TContext>["sendUserMessage"];
+  reconcileNextDispatchAnnouncementReplyOwnership?: (
+    item: Queue.PendingTelegramTurn,
+  ) => void;
   recordRuntimeEvent?: TelegramRuntimeEventRecorder;
 }): TelegramQueueBindingRuntime<TContext> {
   const settleDiscardedItems = (
@@ -159,6 +163,8 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
     },
     updateStatus: deps.updateStatus,
     sendTextReply: deps.sendTextReply,
+    reconcileNextDispatchAnnouncementReplyOwnership:
+      deps.reconcileNextDispatchAnnouncementReplyOwnership,
     recordRuntimeEvent: deps.recordRuntimeEvent,
     ...deps.promptDispatch,
     sendUserMessage: deps.sendUserMessage,
@@ -167,6 +173,7 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
     mutation,
     dispatchNext: dispatch.dispatchNext,
     requestNextDispatchAnnouncement: dispatch.requestNextDispatchAnnouncement,
+    cancelNextDispatchAnnouncement: dispatch.cancelNextDispatchAnnouncement,
     watchdog: Queue.createTelegramQueueDispatchWatchdogRuntime({
       hasQueuedItems: deps.store.hasQueuedItems,
       dispatchNextQueuedTelegramTurn: dispatch.dispatchNext,
@@ -1196,10 +1203,13 @@ export function registerTelegramLifecycleRuntimeHooks({
     if (uiPromptActive || !canSendAgentActivity(ctx)) return false;
     const turn = activeTurnRuntime.get();
     const target = turn?.target ?? proactivePushTargetGetter();
-    promptDispatchRuntime.startTypingLoop(ctx, turn?.chatId ?? target?.chatId, {
-      target,
-    });
-    return true;
+    return (
+      promptDispatchRuntime.startTypingLoop(
+        ctx,
+        turn?.chatId ?? target?.chatId,
+        { target },
+      ) !== false
+    );
   };
   const startActiveTurnTypingLoop = (ctx: Pi.ExtensionContext): void => {
     if (uiPromptActive) return;

package/lib/bus-api.ts

@@ -82,13 +82,6 @@ function rejectTelegramDirectOwnership(method: string): Promise<never> {
   );
 }
 
-export function createTelegramAggregateTypingActionSender(
-  runtime: Pick<TelegramBridgeApiRuntime, "call">,
-): (chatId: number) => Promise<unknown> {
-  return (chatId) =>
-    runtime.call("sendChatAction", { chat_id: chatId, action: "typing" });
-}
-
 export function createTelegramBusAwareApiRuntime(
   deps: TelegramBusAwareApiRuntimeDeps,
 ): TelegramBridgeApiRuntime {

package/lib/bus-follower.ts

@@ -11,7 +11,11 @@ import { basename } from "node:path";
 import * as Sync from "./sync.ts";
 import * as Threads from "./threads.ts";
 import { parseTelegramUpdateJournalQueueOwner, type TelegramUpdateJournalStoreOptions } from "./journal.ts";
-import type { TelegramLockEntry, TelegramLockState } from "./locks.ts";
+import {
+  TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS,
+  type TelegramLockEntry,
+  type TelegramLockState,
+} from "./locks.ts";
 import type {
   TelegramQueueHandoffPayload,
   TelegramQueueHandoffStageResult,
@@ -60,6 +64,8 @@ export const TELEGRAM_BUS_FOLLOWER_PROMOTION_GRACE_MS = 2_500;
 export const TELEGRAM_FOLLOWER_SESSION_HANDOFF_TTL_MS = 30_000;
 export const TELEGRAM_BUS_FOLLOWER_CLIENT_TIMEOUT_MS = 30_000;
 export const TELEGRAM_BUS_FOLLOWER_REGISTRATION_WAIT_MS = 30_000;
+export const TELEGRAM_BUS_FOLLOWER_HEARTBEAT_TIMEOUT_MS =
+  TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS;
 export const TELEGRAM_BUS_FOLLOWER_REGISTRATION_RETRY_ATTEMPTS =
   TELEGRAM_BUS_REGISTRATION_RETRY.attempts;
 export const TELEGRAM_BUS_FOLLOWER_REGISTRATION_RETRY_DELAY_MS =
@@ -301,6 +307,7 @@ export interface TelegramBusFollowerRegistrationRuntimeDeps<
   registrationRetryAttempts?: number;
   registrationRetryDelayMs?: number;
   heartbeatMs?: number;
+  heartbeatTimeoutMs?: number;
   recordRuntimeEvent?: (
     category: string,
     error: unknown,
@@ -1619,6 +1626,10 @@ export function createTelegramBusFollowerRegistrationRuntime<
   const getNowMs = deps.getNowMs ?? Date.now;
   const getPid = deps.getPid ?? (() => process.pid);
   const heartbeatMs = deps.heartbeatMs ?? 1000;
+  const heartbeatTimeoutMs =
+    deps.heartbeatTimeoutMs ??
+    deps.timeoutMs ??
+    TELEGRAM_BUS_FOLLOWER_HEARTBEAT_TIMEOUT_MS;
   const registrationTimeoutMs =
     deps.registrationTimeoutMs ?? deps.timeoutMs ?? 30000;
   const registrationRetryAttempts =
@@ -1679,7 +1690,7 @@ export function createTelegramBusFollowerRegistrationRuntime<
     try {
       const response = await sendTelegramBusLocalEnvelope({
         socketPath: leaderSocketPath,
-        timeoutMs: deps.timeoutMs,
+        timeoutMs: heartbeatTimeoutMs,
         retry: getTelegramBusTransportRetryPolicy({
           endpoint: leaderSocketPath,
           operation: "operation",

package/lib/commands.ts

@@ -711,6 +711,7 @@ export interface TelegramCommandActionDeps<TMessage, TContext> {
 export interface TelegramStopCommandDeps {
   hasAbortHandler: () => boolean;
   clearPendingModelSwitch: () => void;
+  cancelNextTransitionAnnouncements?: () => void;
   clearQueuedTelegramItems: () => number;
   setFoldQueuedPromptsIntoHistory: (fold: boolean) => void;
   abortCurrentTurn: () => void;
@@ -1146,6 +1147,8 @@ export interface TelegramCommandRuntimeDeps<
   isContextActive?: (ctx: TContext) => boolean;
   dispatchNextQueuedTelegramTurn: (ctx: TContext) => void;
   requestNextDispatchAnnouncement?: () => void;
+  markActiveTurnNextAbortAnnouncement?: () => boolean;
+  cancelNextTransitionAnnouncements?: () => void;
   requestDeferredDispatchNextQueuedTelegramTurn?: (
     dispatch: (ctx: TContext) => void,
   ) => void;
@@ -1352,6 +1355,7 @@ export async function handleTelegramStopCommand(
   deps: TelegramStopCommandDeps,
 ): Promise<void> {
   deps.clearPendingModelSwitch();
+  deps.cancelNextTransitionAnnouncements?.();
   const clearedCount = deps.clearQueuedTelegramItems();
   deps.setFoldQueuedPromptsIntoHistory(false);
   if (!deps.hasAbortHandler()) {
@@ -1385,6 +1389,7 @@ export async function handleTelegramAbortCommand(deps: {
   hasAbortHandler: () => boolean;
   hasActiveTelegramTurn: () => boolean;
   clearPendingModelSwitch: () => void;
+  cancelNextTransitionAnnouncements?: () => void;
   abortCurrentTurn: () => void;
   setFoldQueuedPromptsIntoHistory: (fold: boolean) => void;
   updateStatus: () => void;
@@ -1394,6 +1399,7 @@ export async function handleTelegramAbortCommand(deps: {
   ) => Promise<void>;
 }): Promise<void> {
   deps.clearPendingModelSwitch();
+  deps.cancelNextTransitionAnnouncements?.();
   if (!deps.hasAbortHandler()) {
     await deps.sendTextReply(
       formatTelegramInformationHeading("💤", "No active turn."),
@@ -1418,6 +1424,7 @@ export async function handleTelegramNextCommand(deps: {
   abortCurrentTurn: () => void;
   dispatchNextQueuedTurn: () => void;
   requestNextDispatchAnnouncement?: () => void;
+  markActiveTurnNextAbortAnnouncement?: () => boolean;
   clearFoldForDispatch: () => void;
   updateStatus: () => void;
   sendTextReply: (
@@ -1439,6 +1446,7 @@ export async function handleTelegramNextCommand(deps: {
   if (!deps.isIdle() && deps.hasAbortHandler()) {
     deps.clearFoldForDispatch();
     deps.requestNextDispatchAnnouncement?.();
+    deps.markActiveTurnNextAbortAnnouncement?.();
     deps.abortCurrentTurn();
     deps.updateStatus();
     return;
@@ -1880,6 +1888,11 @@ export function createTelegramCommandHandlerTargetRuntime<
     updateStatus: deps.updateStatus,
     isContextActive: deps.isContextActive,
     dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
+    requestNextDispatchAnnouncement: deps.requestNextDispatchAnnouncement,
+    markActiveTurnNextAbortAnnouncement:
+      deps.markActiveTurnNextAbortAnnouncement,
+    cancelNextTransitionAnnouncements:
+      deps.cancelNextTransitionAnnouncements,
     startTypingLoop: deps.startTypingLoop,
     stopTypingLoop: deps.stopTypingLoop,
     enqueueContinueTurn: deps.enqueueContinueTurn,
@@ -2037,6 +2050,8 @@ async function handleTelegramCommandRuntime<
         await handleTelegramStopCommand({
           hasAbortHandler: deps.hasAbortHandler,
           clearPendingModelSwitch: deps.clearPendingModelSwitch,
+          cancelNextTransitionAnnouncements:
+            deps.cancelNextTransitionAnnouncements,
           clearQueuedTelegramItems: () =>
             deps.clearQueuedTelegramItems(commandCtx),
           setFoldQueuedPromptsIntoHistory: deps.setFoldQueuedPromptsIntoHistory,
@@ -2113,6 +2128,8 @@ async function handleTelegramCommandRuntime<
           hasAbortHandler: deps.hasAbortHandler,
           hasActiveTelegramTurn: deps.hasActiveTelegramTurn,
           clearPendingModelSwitch: deps.clearPendingModelSwitch,
+          cancelNextTransitionAnnouncements:
+            deps.cancelNextTransitionAnnouncements,
           abortCurrentTurn: deps.abortCurrentTurn,
           setFoldQueuedPromptsIntoHistory: deps.setFoldQueuedPromptsIntoHistory,
           updateStatus: updateStatusFor(commandCtx),
@@ -2129,6 +2146,8 @@ async function handleTelegramCommandRuntime<
           dispatchNextQueuedTurn: () =>
             deps.dispatchNextQueuedTelegramTurn(commandCtx),
           requestNextDispatchAnnouncement: deps.requestNextDispatchAnnouncement,
+          markActiveTurnNextAbortAnnouncement:
+            deps.markActiveTurnNextAbortAnnouncement,
           clearFoldForDispatch: () =>
             deps.setFoldQueuedPromptsIntoHistory(false),
           updateStatus: updateStatusFor(commandCtx),

package/lib/extension.ts

@@ -667,8 +667,6 @@ export default function (pi: Pi.ExtensionAPI) {
     typing,
     getDefaultChatId: proactivePushChatIdGetter,
     sendTypingAction,
-    sendAggregateTypingAction:
-      BusApi.createTelegramAggregateTypingActionSender(telegramApiRuntime),
     updateStatus,
     isContextActive: telegramSessionContextStore.isCurrent,
     getTransportAuthority() {
@@ -820,6 +818,7 @@ export default function (pi: Pi.ExtensionAPI) {
     mutation: queueMutationRuntime,
     dispatchNext: dispatchNextQueuedTelegramTurn,
     requestNextDispatchAnnouncement,
+    cancelNextDispatchAnnouncement,
     watchdog: queueDispatchWatchdogRuntime,
   } = Bindings.createTelegramQueueBindingRuntime({
     store: telegramQueueStore,
@@ -835,6 +834,13 @@ export default function (pi: Pi.ExtensionAPI) {
     updateStatus,
     sendTextReply,
     sendUserMessage,
+    reconcileNextDispatchAnnouncementReplyOwnership(item) {
+      Replies.preserveTransportReplyDedupOnNextReset(
+        item.chatId,
+        item.replyToMessageId,
+        item.target,
+      );
+    },
     recordRuntimeEvent,
   });
   const { finalizeMarkdownPreview, preparePreviewDelivery } =
@@ -1093,6 +1099,7 @@ export default function (pi: Pi.ExtensionAPI) {
     isContextActive: telegramSessionContextStore.isCurrent,
     dispatchNextQueuedTelegramTurn,
     requestNextDispatchAnnouncement,
+    cancelNextDispatchAnnouncement,
     requestDeferredDispatchNextQueuedTelegramTurn:
       deferredQueueDispatchRuntime.request,
     hasDeferredDispatchContext: deferredQueueDispatchRuntime.isBound,
@@ -1619,7 +1626,7 @@ export default function (pi: Pi.ExtensionAPI) {
         loadConfig: configStore.load,
         setQueuedItems: telegramQueueStore.setQueuedItems,
         setCurrentModel: currentModelRuntime.set,
-        setPendingModelSwitch: pendingModelSwitchStore.set,
+        setPendingModelSwitch: modelSwitchController.clearPendingSwitch,
         syncCounters: queue.syncCounters,
         syncFlags: lifecycle.syncFlags,
         bindDeferredDispatchContext: deferredQueueDispatchRuntime.bind,

package/lib/menu-model.ts

@@ -13,6 +13,7 @@ import {
   resolveScopedModelPatterns,
   type ScopedTelegramModel,
   sortScopedModels,
+  type TelegramModelSwitchContinuationSource,
   type ThinkingLevel,
 } from "./model.ts";
 
@@ -157,9 +158,13 @@ export type TelegramModelMenuCallbackDeps<
   setModel: (model: TModel) => Promise<boolean>;
   setCurrentModel: (model: TModel) => void;
   setThinkingLevel: (level: ThinkingLevel) => void;
-  stagePendingModelSwitch: (selection: ScopedTelegramModel<TModel>) => void;
+  stagePendingModelSwitch: (
+    selection: ScopedTelegramModel<TModel>,
+    continuationTurn: TelegramModelSwitchContinuationSource,
+  ) => void;
   restartInterruptedTelegramTurn: (
     selection: ScopedTelegramModel<TModel>,
+    continuationTurn: TelegramModelSwitchContinuationSource,
   ) => Promise<boolean> | boolean;
 };
 
@@ -961,14 +966,28 @@ export async function handleTelegramModelMenuCallbackAction<
   if (plan.selection.thinkingLevel) {
     deps.setThinkingLevel(plan.selection.thinkingLevel);
   }
-  await deps.updateModelMenuMessage();
+  const continuationTurn: TelegramModelSwitchContinuationSource = {
+    chatId: params.state.chatId,
+    replyToMessageId: params.state.messageId,
+    target: {
+      chatId: params.state.chatId,
+      ...(params.state.threadId === undefined
+        ? {}
+        : { threadId: params.state.threadId }),
+    },
+  };
   if (plan.mode === "restart-after-tool") {
-    deps.stagePendingModelSwitch(plan.selection);
+    deps.stagePendingModelSwitch(plan.selection, continuationTurn);
+    await deps.updateModelMenuMessage();
     await deps.answerCallbackQuery(callbackQueryId, plan.callbackText);
     return true;
   }
   if (plan.mode === "restart-now") {
-    const restarted = await deps.restartInterruptedTelegramTurn(plan.selection);
+    const restarted = await deps.restartInterruptedTelegramTurn(
+      plan.selection,
+      continuationTurn,
+    );
+    await deps.updateModelMenuMessage();
     if (!restarted) {
       await deps.answerCallbackQuery(
         callbackQueryId,
@@ -976,6 +995,8 @@ export async function handleTelegramModelMenuCallbackAction<
       );
       return true;
     }
+  } else {
+    await deps.updateModelMenuMessage();
   }
   await deps.answerCallbackQuery(callbackQueryId, plan.callbackText);
   return true;

package/lib/menu.ts

@@ -30,6 +30,7 @@ import {
 import {
   type MenuModel,
   type ScopedTelegramModel,
+  type TelegramModelSwitchContinuationSource,
   type ThinkingLevel,
 } from "./model.ts";
 import type { TelegramInputRichMessage } from "./telegram-api.ts";
@@ -194,7 +195,6 @@ export interface TelegramMenuCallbackRuntimeDeps<
     text?: string,
   ) => Promise<void>;
   isIdle: (ctx: TContext) => boolean;
-  hasActiveTelegramTurn: () => boolean;
   hasAbortHandler: () => boolean;
   hasActiveToolExecutions: () => boolean;
   persistScopedModelPatterns?: (
@@ -206,10 +206,12 @@ export interface TelegramMenuCallbackRuntimeDeps<
   stagePendingModelSwitch: (
     selection: ScopedTelegramModel<TModel>,
     ctx: TContext,
+    continuationTurn: TelegramModelSwitchContinuationSource,
   ) => void;
   restartInterruptedTelegramTurn: (
     selection: ScopedTelegramModel<TModel>,
     ctx: TContext,
+    continuationTurn: TelegramModelSwitchContinuationSource,
   ) => Promise<boolean> | boolean;
   sectionRegistry?: TelegramSectionRegistry;
   editInteractiveMessage?: (
@@ -452,7 +454,6 @@ export interface TelegramMenuCallbackRuntimeAdapterDeps<
     text?: string,
   ) => Promise<void>;
   isIdle: (ctx: TContext) => boolean;
-  hasActiveTelegramTurn: () => boolean;
   hasAbortHandler: () => boolean;
   getActiveToolExecutions: () => number;
   persistScopedModelPatterns?: (
@@ -464,10 +465,12 @@ export interface TelegramMenuCallbackRuntimeAdapterDeps<
   stagePendingModelSwitch: (
     selection: ScopedTelegramModel<TModel>,
     ctx: TContext,
+    continuationTurn: TelegramModelSwitchContinuationSource,
   ) => void;
   restartInterruptedTelegramTurn: (
     selection: ScopedTelegramModel<TModel>,
     ctx: TContext,
+    continuationTurn: TelegramModelSwitchContinuationSource,
   ) => Promise<boolean> | boolean;
   sectionRegistry?: TelegramSectionRegistry;
   editInteractiveMessage?: (
@@ -527,7 +530,6 @@ export function createTelegramMenuCallbackHandlerForContext<
     updateSettingsMenuMessage: deps.updateSettingsMenuMessage,
     answerCallbackQuery: deps.answerCallbackQuery,
     isIdle: deps.isIdle,
-    hasActiveTelegramTurn: deps.hasActiveTelegramTurn,
     hasAbortHandler: deps.hasAbortHandler,
     hasActiveToolExecutions: () => deps.getActiveToolExecutions() > 0,
     persistScopedModelPatterns: deps.persistScopedModelPatterns,
@@ -715,8 +717,7 @@ export async function handleTelegramMenuCallbackRuntime<
             activeModel: deps.getActiveModel(ctx),
             currentThinkingLevel: deps.getThinkingLevel(),
             isIdle: deps.isIdle(ctx),
-            canRestartBusyRun:
-              deps.hasActiveTelegramTurn() && deps.hasAbortHandler(),
+            canRestartBusyRun: deps.hasAbortHandler(),
             hasActiveToolExecutions: deps.hasActiveToolExecutions(),
           },
           {
@@ -733,11 +734,15 @@ export async function handleTelegramMenuCallbackRuntime<
               deps.setThinkingLevel(level);
               deps.updateStatus(ctx);
             },
-            stagePendingModelSwitch: (selection) => {
-              deps.stagePendingModelSwitch(selection, ctx);
+            stagePendingModelSwitch: (selection, continuationTurn) => {
+              deps.stagePendingModelSwitch(selection, ctx, continuationTurn);
             },
-            restartInterruptedTelegramTurn: (selection) =>
-              deps.restartInterruptedTelegramTurn(selection, ctx),
+            restartInterruptedTelegramTurn: (selection, continuationTurn) =>
+              deps.restartInterruptedTelegramTurn(
+                selection,
+                ctx,
+                continuationTurn,
+              ),
           },
         );
       } catch (error) {