@llblab/pi-telegram 0.53.0 → 0.53.2

package/CHANGELOG.md

@@ -4,6 +4,14 @@
 
 ## Unreleased
 
+## 0.53.2: Idle runtime without lock churn
+
+- `Idle disk load`: Polling-cursor and status reads of the update journal no longer open config and journal transactions, so a connected idle session stops creating `telegram.json.transaction.staged.*` and `inbox.json.transaction.staged.*` guard folders; only reads that need repair take the serialized path. Unchanged runtime status snapshots are compared before locking and skip their `state.json` transaction.
+
+## 0.53.1: Text replies without false voice errors
+
+- `Voice artifacts`: A reply plan without voice content no longer reaches outbound voice artifact delivery, so plain text replies stop recording "every voice synthesis provider failed" delivery errors; explicit `telegram_voice` markup and genuine synthesis failures keep their existing fallback behavior (#318).
+
 ## 0.53.0: Live Thread rebinding, routing tabs and Windows support
 
 - `Live-rebind state`: Atomic same-session Workspace binding/operation publication, fenced recipient application and bounded one-shot cleanup scheduling. Failed/unknown cleanup keeps the new binding without blocking the next attempt; chooser retirement keeps saved inputs. Shared-state retries recheck captured authority before every rename, so a revoked grant cannot overwrite retained state.

package/dist/lib/journal.js

@@ -3221,31 +3221,29 @@ function createJournalStoreCore(options, getInputContext) {
             return { file: reset, exists: true, serializedBytes };
         }
     };
+    const acquireSource = () => sourceAccess
+        ? acquireTelegramUpdateJournalFamily({
+            ...sourceAccess,
+            path,
+            profile,
+            botIdentity: expectedIdentity,
+        }, version)
+        : undefined;
+    const readAcquiredSource = (source) => {
+        const file = source.evidence.kind === "present" ? source.evidence.file : emptyFile();
+        return {
+            file,
+            exists: source.evidence.kind === "present",
+            serializedBytes: assertCapacity(file),
+            source,
+        };
+    };
     const runJournalTransaction = (operation) => {
         try {
             // Acquire before the transaction helper can create parents or staging names.
             // The config continuation excludes participating writers through consumption.
-            const source = sourceAccess
-                ? acquireTelegramUpdateJournalFamily({
-                    ...sourceAccess,
-                    path,
-                    profile,
-                    botIdentity: expectedIdentity,
-                }, version)
-                : undefined;
-            const readSource = () => {
-                if (!source)
-                    return readCurrent();
-                const file = source.evidence.kind === "present"
-                    ? source.evidence.file
-                    : emptyFile();
-                return {
-                    file,
-                    exists: source.evidence.kind === "present",
-                    serializedBytes: assertCapacity(file),
-                    source,
-                };
-            };
+            const source = acquireSource();
+            const readSource = () => source ? readAcquiredSource(source) : readCurrent();
             return withTelegramFileTransaction(`${path}.transaction`, () => operation(readSource));
         }
         catch (error) {
@@ -4091,16 +4089,31 @@ function createJournalStoreCore(options, getInputContext) {
         assertCurrent();
         return { issued, entries: result };
     });
+    const projectRead = (current) => ({
+        ...cloneFile(current.file),
+        exists: current.exists,
+        serializedBytes: current.serializedBytes,
+    });
     const journal = {
         read() {
-            return runMutation((readCurrent) => {
-                const current = readCurrent();
-                return {
-                    ...cloneFile(current.file),
-                    exists: current.exists,
-                    serializedBytes: current.serializedBytes,
-                };
-            });
+            // Atomic publication makes a repair-free read safe without serialization, so idle
+            // status and polling cursor reads create no guards. Any read that needs reconciliation,
+            // or races a compaction, falls back to the serialized path that owns repair.
+            const attempt = () => {
+                try {
+                    const source = acquireSource();
+                    return source ? readAcquiredSource(source) : readCurrentStrict(false);
+                }
+                catch {
+                    return undefined;
+                }
+            };
+            const current = options.withWriterAdmission
+                ? options.withWriterAdmission(attempt)
+                : attempt();
+            return current
+                ? projectRead(current)
+                : runMutation((readCurrent) => projectRead(readCurrent()));
         },
         appendBatch(updates, requestedAcceptedThroughUpdateId) {
             const canonicalUpdates = updates.map((update) => normalizeIncomingJournaledUpdate(update, path));

package/dist/lib/outbound.js

@@ -449,6 +449,10 @@ export function createTelegramOutboundReplyArtifactSender(deps) {
             : plan.voiceText
                 ? [{ text: plan.voiceText, lang: plan.lang, rate: plan.rate }]
                 : [];
+        // A plan without voice content has nothing to deliver; absence of
+        // content is not a synthesis failure.
+        if (voiceReplies.length === 0)
+            return;
         let anyDelivered = false;
         for (const reply of voiceReplies) {
             if (!isDeliveryActive())

package/dist/lib/queue.js

@@ -1384,7 +1384,9 @@ export async function handleTelegramAgentEndRuntime(deps) {
         }
         if (!isDeliveryActive())
             return;
-        if (outboundReply && deps.sendOutboundReplyArtifacts) {
+        if (outboundReply &&
+            hasOutboundArtifacts &&
+            deps.sendOutboundReplyArtifacts) {
             try {
                 await deps.sendOutboundReplyArtifacts(turn, outboundReply, {
                     replyToPrompt: !finalText,

package/dist/lib/status.js

@@ -434,15 +434,26 @@ export function createTelegramRuntimeProjectionStore(options) {
                 throw new Error("Telegram runtime projection is malformed.");
             delete semantic.diagnostics.recentRuntimeEvents;
             const isCurrent = () => getPath() === path && getProfile() === profile && authority() === true;
+            const isUnchanged = (current) => {
+                if (!isRuntimeProjection(current))
+                    return false;
+                const { writtenAtMs: _writtenAtMs, ...existing } = current;
+                return isDeepStrictEqual(existing, semantic);
+            };
             const publication = publicationQueue.then(() => {
                 if (!isCurrent())
                     return false;
+                // Observational state needs no transaction when the published projection already matches.
+                try {
+                    if (isUnchanged(read({ path, profile })))
+                        return false;
+                }
+                catch {
+                    // An unreadable envelope stays with the transactional publisher's fail-closed path.
+                }
                 return (publish({ path, profile }, (current) => {
-                    if (isRuntimeProjection(current)) {
-                        const { writtenAtMs: _writtenAtMs, ...existing } = current;
-                        if (isDeepStrictEqual(existing, semantic))
-                            return { value: current, changed: false };
-                    }
+                    if (isUnchanged(current))
+                        return { value: current, changed: false };
                     const writtenAtMs = getNowMs();
                     if (!Number.isSafeInteger(writtenAtMs) || writtenAtMs < 0)
                         throw new Error("Telegram runtime projection timestamp is invalid.");

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.53.0",
+  "version": "0.53.2",
   "private": false,
   "publishConfig": {
     "access": "public"

package/docs/architecture.md

@@ -273,7 +273,7 @@ Source audit confirms that canonical inventory is not yet usable as a production
 The opt-in journal-store composition now separates continuations rather than adding a second prepared-worker projection. Independent review covers all 12 stateful methods, source-callback rejection before journal locking/read/recovery, actual contention, publication-failure release/retry and unchanged receipt CAS:
 
 - `Append`: Canonicalize once → Workspace admission → choose polling observation or paired-human admission → private journal transaction. Without a sender-admission mode, use the lock-only continuation when configured. Do not wrap an admission callback in another config transaction.
-- `Other store operations`: Lock-only config serialization → opt-in `sourceAccess` family acquisition → private journal transaction → direct consumption of that operation-local evidence. The same ordering applies after append's selected admission continuation. Acquiring before journal staging is valid only when source serialization excludes all participating family writers through consumption. Without `sourceAccess`, ordinary recovery-capable `readCurrent()` remains unchanged. Receipt/owner/handoff CAS and process-birth proof stay authoritative; no caller-supplied lock-held bypass or ambient reentrancy depth is exposed.
+- `Other store operations`: Lock-only config serialization → opt-in `sourceAccess` family acquisition → private journal transaction → direct consumption of that operation-local evidence. The same ordering applies after append's selected admission continuation. Acquiring before journal staging is valid only when source serialization excludes all participating family writers through consumption. Without `sourceAccess`, ordinary recovery-capable `readCurrent()` remains unchanged. Ordinary `read()` is optimistic: it first runs the same strict, repair-free evidence read without config or journal guards, because atomic publication makes it safe; only a refused or reconciliation-requiring read retries once through this serialized path, which owns repair. Receipt/owner/handoff CAS and process-birth proof stay authoritative; no caller-supplied lock-held bypass or ambient reentrancy depth is exposed.
 - `Resource binding`: Participating continuations must use the same actual config resource. Arbitrary injected callbacks cannot prove that themselves; real factory/operation tests must establish one acquisition per operation. The dispatcher is implemented and locally reviewed. `sourceAccess` requires the lock-only continuation and captures an independently approved directory plus physical inspection limits; its store integration is independently reviewed, including generated-state refusal remediation. Production wiring remains absent.
 - `Evidence`: Real isolated probes show an outer observation plus existing admitted append times out on nested config acquisition. Current-token admission can reject an otherwise valid old-source receipt completion after token rotation; a lock-only transaction still permits exact receipt CAS while rejecting a wrong acquisition ID. Current observation also permits profile-switch/revocation cases, so it is not a lifetime fence. A journal `read()` can repair an empty foreign snapshot while another process holds config, proving append-only coverage is insufficient. These are storage/order witnesses, not permission for obsolete handlers to execute.
 - `Remaining gates`: Serialization does not provide exact reference reconciliation, old-token migration policy, settled-handler or legacy-snapshot barriers, executable receipt freshness, whole-root quiescence, all-writer closure or final-grant readiness. The whole-root census cannot run inside a journal transaction. Final grant requires an internal already-in-config-transaction check, not reacquisition of this wrapper. Production stores, inspectors and UI remain disconnected from this candidate.

package/lib/journal.ts

@@ -5591,36 +5591,40 @@ function createJournalStoreCore(
     }
   };
 
+  const acquireSource = (): JournalSourceAcquisition | undefined =>
+    sourceAccess
+      ? acquireTelegramUpdateJournalFamily(
+          {
+            ...sourceAccess,
+            path,
+            profile,
+            botIdentity: expectedIdentity,
+          },
+          version,
+        )
+      : undefined;
+  const readAcquiredSource = (
+    source: JournalSourceAcquisition,
+  ): ReadTelegramUpdateJournalResult => {
+    const file =
+      source.evidence.kind === "present" ? source.evidence.file : emptyFile();
+    return {
+      file,
+      exists: source.evidence.kind === "present",
+      serializedBytes: assertCapacity(file),
+      source,
+    };
+  };
+
   const runJournalTransaction = <T>(
     operation: (read: typeof readCurrent) => T,
   ): T => {
     try {
       // Acquire before the transaction helper can create parents or staging names.
       // The config continuation excludes participating writers through consumption.
-      const source = sourceAccess
-        ? acquireTelegramUpdateJournalFamily(
-            {
-              ...sourceAccess,
-              path,
-              profile,
-              botIdentity: expectedIdentity,
-            },
-            version,
-          )
-        : undefined;
-      const readSource = (): ReadTelegramUpdateJournalResult => {
-        if (!source) return readCurrent();
-        const file =
-          source.evidence.kind === "present"
-            ? source.evidence.file
-            : emptyFile();
-        return {
-          file,
-          exists: source.evidence.kind === "present",
-          serializedBytes: assertCapacity(file),
-          source,
-        };
-      };
+      const source = acquireSource();
+      const readSource = (): ReadTelegramUpdateJournalResult =>
+        source ? readAcquiredSource(source) : readCurrent();
       return withTelegramFileTransaction(`${path}.transaction`, () =>
         operation(readSource),
       );
@@ -7024,16 +7028,30 @@ function createJournalStoreCore(
       assertCurrent();
       return { issued, entries: result };
     });
+  const projectRead = (current: ReadTelegramUpdateJournalResult) => ({
+    ...cloneFile(current.file),
+    exists: current.exists,
+    serializedBytes: current.serializedBytes,
+  });
   const journal: TelegramUpdateJournalStore = {
     read() {
-      return runMutation((readCurrent) => {
-        const current = readCurrent();
-        return {
-          ...cloneFile(current.file),
-          exists: current.exists,
-          serializedBytes: current.serializedBytes,
-        };
-      });
+      // Atomic publication makes a repair-free read safe without serialization, so idle
+      // status and polling cursor reads create no guards. Any read that needs reconciliation,
+      // or races a compaction, falls back to the serialized path that owns repair.
+      const attempt = (): ReadTelegramUpdateJournalResult | undefined => {
+        try {
+          const source = acquireSource();
+          return source ? readAcquiredSource(source) : readCurrentStrict(false);
+        } catch {
+          return undefined;
+        }
+      };
+      const current = options.withWriterAdmission
+        ? options.withWriterAdmission(attempt)
+        : attempt();
+      return current
+        ? projectRead(current)
+        : runMutation((readCurrent) => projectRead(readCurrent()));
     },
     appendBatch(updates, requestedAcceptedThroughUpdateId) {
       const canonicalUpdates = updates.map((update) =>

package/lib/outbound.ts

@@ -900,6 +900,9 @@ export function createTelegramOutboundReplyArtifactSender(
       : plan.voiceText
         ? [{ text: plan.voiceText, lang: plan.lang, rate: plan.rate }]
         : [];
+    // A plan without voice content has nothing to deliver; absence of
+    // content is not a synthesis failure.
+    if (voiceReplies.length === 0) return;
 
     let anyDelivered = false;
 

package/lib/queue.ts

@@ -2356,7 +2356,11 @@ export async function handleTelegramAgentEndRuntime<
       }
     }
     if (!isDeliveryActive()) return;
-    if (outboundReply && deps.sendOutboundReplyArtifacts) {
+    if (
+      outboundReply &&
+      hasOutboundArtifacts &&
+      deps.sendOutboundReplyArtifacts
+    ) {
       try {
         await deps.sendOutboundReplyArtifacts(turn, outboundReply, {
           replyToPrompt: !finalText,

package/lib/status.ts

@@ -1010,17 +1010,27 @@ export function createTelegramRuntimeProjectionStore(
       delete semantic.diagnostics.recentRuntimeEvents;
       const isCurrent = (): boolean =>
         getPath() === path && getProfile() === profile && authority() === true;
+      const isUnchanged = (
+        current: unknown,
+      ): current is TelegramStoredRuntimeProjection => {
+        if (!isRuntimeProjection(current)) return false;
+        const { writtenAtMs: _writtenAtMs, ...existing } = current;
+        return isDeepStrictEqual(existing, semantic);
+      };
       const publication = publicationQueue.then(() => {
         if (!isCurrent()) return false;
+        // Observational state needs no transaction when the published projection already matches.
+        try {
+          if (isUnchanged(read({ path, profile }))) return false;
+        } catch {
+          // An unreadable envelope stays with the transactional publisher's fail-closed path.
+        }
         return (
           publish(
             { path, profile },
             (current) => {
-              if (isRuntimeProjection(current)) {
-                const { writtenAtMs: _writtenAtMs, ...existing } = current;
-                if (isDeepStrictEqual(existing, semantic))
-                  return { value: current, changed: false };
-              }
+              if (isUnchanged(current))
+                return { value: current, changed: false };
               const writtenAtMs = getNowMs();
               if (!Number.isSafeInteger(writtenAtMs) || writtenAtMs < 0)
                 throw new Error(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.53.0",
+  "version": "0.53.2",
   "private": false,
   "publishConfig": {
     "access": "public"