@llblab/pi-telegram 0.54.0 → 0.54.2

package/CHANGELOG.md

@@ -4,6 +4,16 @@
 
 ## Unreleased
 
+## 0.54.2: Diagnosable ownership checks and safe app cancellation
+
+- `Ownership checks`: An ownership check that cannot be verified no longer silently stops a live transport. Each such miss is recorded (`ownership-check-failed`) and polling stands down only after two consecutive tolerated misses; a confirmed loss is recorded as `ownership-lost` and stands down at once (#319).
+- `Generative Apps`: A cancelled app method can no longer start a process: an abort that arrives before the method calls `run` previously let the worker spawn a child that its own termination could orphan.
+
+## 0.54.1: Followers go offline when Threaded Mode is turned off
+
+- `Threaded Mode downgrade`: Turning Threaded Mode off in BotFather now takes followers offline instead of looping between `electing` and `disconnected` (and filling the log) against a leader that switched to classic polling; reconnect with `/telegram-connect` after turning it back on. `/telegram-disconnect` on a follower without a live leader now disconnects locally and reports the Thread as kept, and a pending recovery retry no longer re-registers a disconnected follower.
+- `Ownership reads`: A lock-free ownership check that races a concurrent `state.json` replacement is now retried and confirmed through the serialized path before the leader stops polling, so a transient read miss (seen on slow Windows runners) is no longer mistaken for lost ownership. The integration test for a revoked follower provisioning now waits for its asynchronous lease release.
+
 ## 0.54.0: No periodic disk writes while idle
 
 - `Journal serialization`: The update journal no longer borrows the `telegram.json` lock. Journal operations serialize on their own `tmp/pi-telegram/runtime/journals.transaction`, so receiving messages and repairing journals never touch the config file or its guard; only config writes and sender admission still take it. Bus protocol moves to v3 so 0.53.x peers, which serialize on the old lock, cannot register alongside 0.54 writers.

package/dist/lib/bus-follower.d.ts

@@ -231,6 +231,8 @@ export interface TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext> {
     promotionGraceMs?: number;
     /** Bus liveness proof for a live-PID leader that no longer answers; replaces the retired file heartbeat. */
     proveLeaderUnresponsive?: (owner: TelegramLockEntry) => Promise<boolean>;
+    /** Shared bot state says Threaded Mode is off: followers cannot exist, so recovery goes offline instead. */
+    isThreadModeDisabled?: () => boolean | Promise<boolean>;
     recordRuntimeEvent: (category: string, error: unknown, details?: Record<string, unknown>) => void;
 }
 export interface TelegramBusForwardedUpdateReceiverRuntimeDeps<TContext> {
@@ -419,7 +421,12 @@ export declare function createTelegramBusFollowerControlState(): TelegramBusFoll
 export declare function createTelegramBusFollowerRegistrationState(options?: {
     onAvailabilityChanged?: () => void;
 }): TelegramBusFollowerRegistrationState;
-export declare function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(deps: TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext>): (error: unknown, ctx: TContext) => Promise<void>;
+/** Heartbeat-failure recovery that a deliberate local stop halts until the next deliberate registration. */
+export type TelegramBusFollowerHeartbeatRecoveryHandler<TContext> = ((error: unknown, ctx: TContext) => Promise<void>) & {
+    halt: () => void;
+    resume: () => void;
+};
+export declare function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(deps: TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext>): TelegramBusFollowerHeartbeatRecoveryHandler<TContext>;
 export declare function createTelegramBusFollowerRegistrationRuntime<TContext extends {
     cwd?: string;
 }>(deps: TelegramBusFollowerRegistrationRuntimeDeps<TContext>): TelegramBusFollowerRegistrationRuntime<TContext>;

package/dist/lib/bus-follower.js

@@ -190,7 +190,7 @@ export function createTelegramBusFollowerRuntimeAssembly(ports) {
         ...ports.recovery,
         registrationState: ports.registrationState,
         recordRuntimeEvent: ports.recordRuntimeEvent,
-        getRegistrationRuntime: () => registration,
+        getRegistrationRuntime: () => baseRegistration,
     });
     registration = createTelegramBusFollowerRegistrationRuntime({
         ...ports.registration,
@@ -203,6 +203,15 @@ export function createTelegramBusFollowerRuntimeAssembly(ports) {
     const baseRegistration = registration;
     registration = {
         ...baseRegistration,
+        // Public stop is deliberate (disconnect, suspension); recovery keeps the base stop for promotion.
+        stop() {
+            recovery.halt();
+            baseRegistration.stop();
+        },
+        registerWithLeader(ctx, leader, options) {
+            recovery.resume();
+            return baseRegistration.registerWithLeader(ctx, leader, options);
+        },
         async setContext(ctx) {
             const sessionGeneration = ports.registration.getSessionGeneration?.();
             if (ports.registration.isContextActive?.(ctx) === false)
@@ -1214,6 +1223,9 @@ export function createTelegramBusFollowerRegistrationState(options = {}) {
     };
 }
 export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
+    // Promotion stops registration internally and must keep retrying; only an operator stop or a confirmed
+    // switch to classic mode halts recovery, so it never re-registers behind a disconnect.
+    let halted = false;
     const promotionGraceMs = deps.promotionGraceMs ?? TELEGRAM_BUS_FOLLOWER_PROMOTION_GRACE_MS;
     const sleep = deps.sleep ??
         ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -1246,6 +1258,10 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
                 .registerWithLeader(ctx, leader, binding?.target ? { target: binding.target } : undefined);
             if (!restored)
                 return false;
+            if (halted) {
+                deps.getRegistrationRuntime().stop();
+                return false;
+            }
             deps.setLifecyclePhase(undefined);
             safeUpdateStatus(ctx);
             deps.recordRuntimeEvent("bus", "Telegram follower registration restored", {
@@ -1266,6 +1282,8 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
     });
     const scheduleRecovery = (reason, fallbackCtx, binding) => {
         const retry = () => {
+            if (halted)
+                return;
             const activeCtx = deps.getActiveContext
                 ? deps.getActiveContext()
                 : fallbackCtx;
@@ -1336,12 +1354,29 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
         });
     };
     const recover = async (error, ctx, carriedBinding) => {
-        if (promotionPending)
+        if (promotionPending || halted)
             return;
         promotionPending = true;
         deps.registrationState.beginRecovery();
         const initialBinding = carriedBinding ?? snapshotBinding();
         try {
+            let threadModeDisabled = false;
+            try {
+                threadModeDisabled = (await deps.isThreadModeDisabled?.()) === true;
+            }
+            catch (stateError) {
+                deps.recordRuntimeEvent("bus", stateError, {
+                    phase: "follower-thread-mode-read",
+                });
+            }
+            if (threadModeDisabled) {
+                halted = true;
+                deps.getRegistrationRuntime().stop();
+                deps.setLifecyclePhase(undefined);
+                safeUpdateStatus(ctx);
+                deps.recordRuntimeEvent("bus", "Telegram follower went offline: Threaded Mode is off. Run /telegram-connect after turning it back on.", { phase: "follower-thread-mode-disabled" });
+                return;
+            }
             const state = deps.getLeaderState();
             if (state.kind === "active-elsewhere") {
                 clearRegisteredState(ctx);
@@ -1397,7 +1432,14 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
             promotionPending = false;
         }
     };
-    return recover;
+    return Object.assign(recover, {
+        halt() {
+            halted = true;
+        },
+        resume() {
+            halted = false;
+        },
+    });
 }
 export function createTelegramBusFollowerRegistrationRuntime(deps) {
     const getNowMs = deps.getNowMs ?? Date.now;

package/dist/lib/extension.js

@@ -1560,6 +1560,10 @@ export default function (pi) {
         recovery: {
             getLeaderState: lockRuntime.getState,
             proveLeaderUnresponsive: proveTelegramLeaderUnresponsive,
+            async isThreadModeDisabled() {
+                await threadStore.refresh?.();
+                return threadStore.getBotState().threadMode === "disabled";
+            },
             setLifecyclePhase: telegramBusFollowerControlState.setLifecyclePhase,
             updateStatus,
             promoteToLeader: promoteTelegramBusFollowerToLeader,

package/dist/lib/generative-app-worker.mjs

@@ -22,6 +22,11 @@ parentPort.on("message", (message) => {
 });
 
 function runBoundedProcess(input) {
+  // After an abort the parent may terminate this worker before execFile's own abort kill runs, which
+  // would orphan a freshly spawned child; never start a process once cancelled.
+  if (controller.signal.aborted) {
+    return Promise.reject(new Error("Generative App method was cancelled."));
+  }
   if (!input || typeof input !== "object") {
     throw new Error("Generative App run input must be an object.");
   }

package/dist/lib/locks.d.ts

@@ -8,6 +8,8 @@ export declare const TELEGRAM_LOCK_KEY = "default";
 export declare const TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS = 8000;
 export declare const TELEGRAM_OWNERSHIP_CHECK_MS = 1000;
 export declare const TELEGRAM_OWNERSHIP_REFRESH_MS = 2000;
+/** Consecutive unverified ownership checks tolerated before standing down; a concurrent shared-state replacement must not stop an owned transport. */
+export declare const TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE = 2;
 /**
  * Resolve the extension-local owner slot for the active Telegram profile.
  * Default profile → default

package/dist/lib/locks.js

@@ -14,6 +14,8 @@ export const TELEGRAM_LOCK_KEY = "default";
 export const TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS = 8_000;
 export const TELEGRAM_OWNERSHIP_CHECK_MS = 1_000;
 export const TELEGRAM_OWNERSHIP_REFRESH_MS = 2_000;
+/** Consecutive unverified ownership checks tolerated before standing down; a concurrent shared-state replacement must not stop an owned transport. */
+export const TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE = 2;
 const TELEGRAM_LOCK_WRITE_RETRY_ATTEMPTS = 5;
 const TELEGRAM_LOCK_WRITE_RETRY_DELAY_MS = 25;
 const TELEGRAM_LOCK_TRANSACTION_ATTEMPTS = 80;
@@ -1055,16 +1057,20 @@ export function createTelegramLockRuntime(options = {}) {
         if (!statePath)
             return readLocks(locksPath);
         // Read-only ownership queries fail closed (no owner); acquisition/publication still refuse malformed state.
-        try {
-            const transports = Object.fromEntries(Object.entries(readTelegramRuntimeState(statePath).profiles)
-                .filter(([, value]) => Object.hasOwn(value, "transport"))
-                .map(([profile, value]) => [profile, value.transport]));
-            assertTelegramStateTransport(transports[resolveEffectiveKey()]);
-            return transports;
-        }
-        catch {
-            return {};
+        // A strict read racing a concurrent atomic replace fails transiently, so retry before failing closed.
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            try {
+                const transports = Object.fromEntries(Object.entries(readTelegramRuntimeState(statePath).profiles)
+                    .filter(([, value]) => Object.hasOwn(value, "transport"))
+                    .map(([profile, value]) => [profile, value.transport]));
+                assertTelegramStateTransport(transports[resolveEffectiveKey()]);
+                return transports;
+            }
+            catch {
+                // Retry; a persistent failure falls through to no owner.
+            }
         }
+        return {};
     };
     const transactOwners = (mutate) => {
         if (!statePath)
@@ -1375,6 +1381,7 @@ export function createTelegramLockedPollingRuntime(deps) {
     let ownershipRefreshInterval;
     let ownershipStop;
     let activeContext;
+    let ownershipCheckFailures = 0;
     let takeoverCandidate;
     let sessionAutoStartRun;
     let pollingGeneration = 0;
@@ -1438,25 +1445,42 @@ export function createTelegramLockedPollingRuntime(deps) {
     const startOwnershipWatcher = (ctx) => {
         const owner = snapshotLockContext(ctx);
         stopOwnershipWatcher();
-        ownershipCheckInterval = setInterval(() => {
+        ownershipCheckFailures = 0;
+        // A serialized "not the owner" answer is definitive and stands down at once; only an observation that
+        // cannot be verified at all (both reads failed) counts toward the bounded tolerance.
+        const verifyOwnership = (observe) => {
+            let owned;
+            let failure;
             try {
-                if (deps.lock.owns(owner))
-                    return;
+                owned = observe();
             }
             catch (error) {
-                deps.recordRuntimeEvent?.("lock", error, { phase: "check" });
+                failure = error;
             }
-            stopAfterOwnershipLoss();
-        }, ownershipCheckMs);
-        ownershipRefreshInterval = setInterval(() => {
-            try {
-                if (deps.lock.refresh(owner))
-                    return;
+            if (owned === true) {
+                ownershipCheckFailures = 0;
+                return;
             }
-            catch (error) {
-                deps.recordRuntimeEvent?.("lock", error, { phase: "refresh" });
+            if (owned === false) {
+                deps.recordRuntimeEvent?.("lock", new Error("Telegram bridge ownership moved away from this instance."), { phase: "ownership-lost" });
+                stopAfterOwnershipLoss();
+                return;
             }
-            stopAfterOwnershipLoss();
+            ownershipCheckFailures += 1;
+            deps.recordRuntimeEvent?.("lock", failure, {
+                phase: "ownership-check-failed",
+                consecutiveFailures: ownershipCheckFailures,
+                tolerance: TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE,
+            });
+            if (ownershipCheckFailures > TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE)
+                stopAfterOwnershipLoss();
+        };
+        ownershipCheckInterval = setInterval(() => {
+            // A lock-free miss can be a strict read racing an atomic replace; refresh confirms through the serialized path.
+            verifyOwnership(() => deps.lock.owns(owner) || deps.lock.refresh(owner));
+        }, ownershipCheckMs);
+        ownershipRefreshInterval = setInterval(() => {
+            verifyOwnership(() => deps.lock.refresh(owner));
         }, ownershipRefreshMs);
         ownershipCheckInterval.unref?.();
         ownershipRefreshInterval.unref?.();

package/dist/lib/sync.js

@@ -140,6 +140,7 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
         assertCurrent();
         const currentRecord = deps.getCurrentThreadRecord();
         let cleanupPending = false;
+        let followerThreadKept = false;
         if (currentRecord?.target.threadId) {
             const isManualFollower = currentRecord.owner?.kind === "manual-follower";
             const leaderEpoch = deps.getCurrentLeaderEpoch?.();
@@ -150,9 +151,8 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
                 if (deps.disconnectFollowerThread) {
                     const disconnected = await deps.disconnectFollowerThread();
                     assertCurrent();
-                    if (!disconnected) {
-                        throw new Error("Telegram follower thread deletion requires a live leader registration.");
-                    }
+                    // Without a live leader the Thread cannot be deleted; still stop locally and never claim deletion.
+                    followerThreadKept = !disconnected;
                 }
             }
             else {
@@ -223,6 +223,8 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
         }
         assertCurrent();
         const stopped = await deps.stopPolling();
+        if (followerThreadKept)
+            return "Telegram bridge disconnected. Thread kept: no live leader could delete it.";
         return cleanupPending
             ? `${stopped} Telegram thread cleanup remains pending for the next leader.`
             : stopped;

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.54.0",
+  "version": "0.54.2",
   "private": false,
   "publishConfig": {
     "access": "public"

package/docs/architecture.md

@@ -362,7 +362,7 @@ Read-only migration probes constrain that comparison. Publishing a v2 snapshot o
 - Session replacement through `reload`, `new`, `resume`, or `fork` suspends polling/watchers without releasing ownership or publishing inactivity so the next session in the same process can resume. Late shutdown cannot clear a replacement context even when its identity is reused: the captured session generation must still match. For replacements other than `/resume`, a registered follower snapshots its assigned target into a short-lived same-process handoff, stops the old receiver/heartbeat, and re-registers through the live leader without marking or replacing its Telegram thread. Local `/resume` suppresses that source-target handoff and selects the destination session's binding instead. Hard process termination cannot run graceful teardown, so stale recovery retains its restart-hint path.
 - Live external owners require explicit takeover confirmation. Long-lived timers compare against snapshotted owner identity and stop local transport work when the slot no longer matches.
 - The profile's `transport` section owns only Telegram transport control. Local extension and accepted queue state remain per Pi instance when ownership moves, but previews, final delivery, dispatch transport mutations, and delayed Bot API work fail closed until exact direct or follower authority becomes valid again.
-- Exact ownership remains checked every second and re-confirmed every two seconds by lock-free reads; the leader writes no heartbeat, and a live owner is replaceable only by dead-PID or bus liveness proof (see [Leader Election](./multi-instance-bus.md)). Every acquisition, entry migration, release, takeover, and stale recovery is one `transport`-section transaction through the shared `runtime/state.json.transaction` guard (see [Consolidated Runtime Root](#consolidated-runtime-root)); it fences stale recovery and delayed release against replacement-owner ABA and fails closed on malformed state, unverifiable ownership, contention timeout, or unsupported filesystem behavior. Publication uses private staging below `runtime/` and atomic rename.
+- Exact ownership remains checked every second and re-confirmed every two seconds by lock-free reads. A lock-free miss is confirmed through the serialized refresh path: a serialized not-owner answer records `ownership-lost` and stands down at once, while an observation that cannot be verified at all records `ownership-check-failed` and stands down only after two consecutive tolerated misses; the leader writes no heartbeat, and a live owner is replaceable only by dead-PID or bus liveness proof (see [Leader Election](./multi-instance-bus.md)). Every acquisition, entry migration, release, takeover, and stale recovery is one `transport`-section transaction through the shared `runtime/state.json.transaction` guard (see [Consolidated Runtime Root](#consolidated-runtime-root)); it fences stale recovery and delayed release against replacement-owner ABA and fails closed on malformed state, unverifiable ownership, contention timeout, or unsupported filesystem behavior. Publication uses private staging below `runtime/` and atomic rename.
 - `state.json` is authoritative and private: `transport` (ownership), `workspace` (canonical Workspace/Restore evidence) and `admission` per profile. The non-canonical runtime/roster/diagnostics projection is the `runtime` section, published only by the transport owner without touching canonical sections; it and `logs.jsonl` never grant routing authority. The leader reads optional follower slot hints from it; a missing or malformed projection is ignored. Followers remain authenticated bus registrations rather than transport/Workspace/runtime writers; they may publish their process-owned admission leases.
 - Ordinary ownership and state mutations fail closed on a malformed or foreign `state.json`; read-only ownership queries report no owner, not proof of process absence. The legacy whole-file reset is not wired for the shared envelope. A non-election leader start performs the [damaged-state reset](#damaged-state-reset-operator-approved); section-scoped recovery is not planned. Startup best-effort removes obsolete current-runtime root/session `recovery/` directories, never the pre-0.52.0 tree.
 
@@ -422,7 +422,7 @@ The reset deliberately forgets every profile's polling cursor/journal pointer, b
 
 The runtime sections and log have different authority and write pressure. Preserve that distinction when optimizing them:
 
-- The `transport` section is safety-critical authority. Acquire, release, takeover, stale recovery, and two-second leader lease refresh mutate it. The steady-state baseline is one cached atomic rewrite every two seconds per active profile, or 43,200 refreshes/day; one-second ownership checks are read-only. Every mutation serializes the full cross-process read/check/write through the shared `runtime/state.json.transaction` guard and replaces only that profile's section.
+- The `transport` section is safety-critical authority. Acquire, release, takeover, stale recovery, and entry migration mutate it. Since 0.54 the steady-state baseline is zero rewrites: the one- and two-second ownership checks are lock-free reads. Every mutation serializes the full cross-process read/check/write through the shared `runtime/state.json.transaction` guard and replaces only that profile's section.
 - The `workspace` section holds recovery-critical thread/capability state. Every explicit thread-store `persist()` builds a semantic snapshot, but an unchanged payload skips directory preparation, temporary-name generation, file creation, and rename after comparing JSON values independently of object-key order and ignoring `writtenAtMs`; array order, value types, and explicit null remain significant, and changed snapshots retain the full atomic replacement path. No-op saves still read and compare current disk state, rather than trusting a cache that could hide another owner's publication. Diagnostics scheduling coalesces requests across a bounded 100 ms window and writes only the `runtime` section (`persistStatus()`, skipped when the JSON value is unchanged), so an idle leader's polling snapshots never rewrite the canonical `workspace` section. Only the exact transport owner commits either section; non-owners reload current state instead of publishing.
 - `logs.jsonl` is fail-soft observational evidence, never routing authority. Runtime events admitted in one JavaScript turn batch by captured profile path into one size check, one profile-wide file transaction, and one append while preserving event order. Batching adds no timer or shutdown-loss window; separate profiles remain isolated, and one failed group does not drop another. Scope reset and rotation retain their serialized copy/replace path. The 5 MiB value is a rotation threshold: an authorized writer rotates between batched records before the next record crosses it, so overshoot is bounded to one admitted record plus reset metadata; a writer without reset authority defers rotation to the owner.
 

package/docs/multi-instance-bus.md

@@ -502,7 +502,7 @@ Named bots use sibling `profiles.<name>` entries. Shared bridge settings remain
 
 Rules:
 
-- Classic mode is selected by Telegram capability: when private-chat threads are unavailable or disabled, the polling owner uses ordinary single-DM behavior and blocked instances do not register as followers. During a live downgrade from Threaded Mode, the current bus leader becomes the classic polling owner after two 2.5-second capability-monitor probes and followers disconnect; if classic polling restore fails transiently, later monitor ticks retry the restore instead of allowing a follower takeover. Followers must not turn the downgrade into a takeover while active thread bindings prove the singleton owner was already established by the bus leader.
+- Classic mode is selected by Telegram capability: when private-chat threads are unavailable or disabled, the polling owner uses ordinary single-DM behavior and blocked instances do not register as followers. During a live downgrade from Threaded Mode, the current bus leader becomes the classic polling owner after two 2.5-second capability-monitor probes and followers disconnect; if classic polling restore fails transiently, later monitor ticks retry the restore instead of allowing a follower takeover. Followers must not turn the downgrade into a takeover while active thread bindings prove the singleton owner was already established by the bus leader. A follower that loses its leader reads the leader-persisted `threadMode`; when it is `disabled`, the follower halts recovery and goes offline with one diagnostic instead of retrying registration, keeping its Thread binding. It stays offline after Threaded Mode returns until the operator runs `/telegram-connect`. A deliberate local stop halts recovery the same way, and `/telegram-disconnect` without a live leader still stops locally, reporting the Thread as kept rather than deleted.
 - Telegram private-chat Threaded Mode enables local leader/follower behavior automatically. The leader owns `getUpdates`; registered followers route Telegram API work through the leader. `/telegram-connect` registers as follower when a live leader exists and does not offer manual takeover in that state. The TUI status bar keeps `telegram connected`, `telegram leader`, or `telegram follower` as stable transport identity during work; active work and queued items share the green Queue count instead of replacing that identity with an `active` processing label. Follower registration is unique by live profile/target: a reload or session replacement must replace stale registry entries rather than leaving multiple routable ids for one Telegram thread, and fallback target ownership must not classify leader records as followers.
 - The thread chat is the owner's private bot DM (`allowedUserId`); no `topics.chatId` config is needed. Thread names are assigned by the bridge from a baked compact per-slot palette. There is no agent-facing `telegram_rename_thread` tool and no separate user-facing slash command for manual thread renames.
 - Thread reuse is extension-owned through profile-scoped Workspace bindings; there is no separate `topics` config surface in the active private-chat thread model. Leader/follower record keys remain live role projections, while normalized exact-`cwd` bindings preserve identity and deterministic same-directory process suffixes across role and process changes.

package/lib/bus-follower.ts

@@ -572,6 +572,8 @@ export interface TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext> {
   promotionGraceMs?: number;
   /** Bus liveness proof for a live-PID leader that no longer answers; replaces the retired file heartbeat. */
   proveLeaderUnresponsive?: (owner: TelegramLockEntry) => Promise<boolean>;
+  /** Shared bot state says Threaded Mode is off: followers cannot exist, so recovery goes offline instead. */
+  isThreadModeDisabled?: () => boolean | Promise<boolean>;
   recordRuntimeEvent: (
     category: string,
     error: unknown,
@@ -759,7 +761,7 @@ export function createTelegramBusFollowerRuntimeAssembly<
     ...ports.recovery,
     registrationState: ports.registrationState,
     recordRuntimeEvent: ports.recordRuntimeEvent,
-    getRegistrationRuntime: () => registration,
+    getRegistrationRuntime: () => baseRegistration,
   });
   registration = createTelegramBusFollowerRegistrationRuntime({
     ...ports.registration,
@@ -772,6 +774,15 @@ export function createTelegramBusFollowerRuntimeAssembly<
   const baseRegistration = registration;
   registration = {
     ...baseRegistration,
+    // Public stop is deliberate (disconnect, suspension); recovery keeps the base stop for promotion.
+    stop() {
+      recovery.halt();
+      baseRegistration.stop();
+    },
+    registerWithLeader(ctx, leader, options) {
+      recovery.resume();
+      return baseRegistration.registerWithLeader(ctx, leader, options);
+    },
     async setContext(ctx) {
       const sessionGeneration = ports.registration.getSessionGeneration?.();
       if (ports.registration.isContextActive?.(ctx) === false) return;
@@ -2206,9 +2217,18 @@ export function createTelegramBusFollowerRegistrationState(
   };
 }
 
+/** Heartbeat-failure recovery that a deliberate local stop halts until the next deliberate registration. */
+export type TelegramBusFollowerHeartbeatRecoveryHandler<TContext> = ((
+  error: unknown,
+  ctx: TContext,
+) => Promise<void>) & { halt: () => void; resume: () => void };
+
 export function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(
   deps: TelegramBusFollowerHeartbeatRecoveryHandlerDeps<TContext>,
-): (error: unknown, ctx: TContext) => Promise<void> {
+): TelegramBusFollowerHeartbeatRecoveryHandler<TContext> {
+  // Promotion stops registration internally and must keep retrying; only an operator stop or a confirmed
+  // switch to classic mode halts recovery, so it never re-registers behind a disconnect.
+  let halted = false;
   const promotionGraceMs =
     deps.promotionGraceMs ?? TELEGRAM_BUS_FOLLOWER_PROMOTION_GRACE_MS;
   const sleep =
@@ -2250,6 +2270,10 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(
           binding?.target ? { target: binding.target } : undefined,
         );
       if (!restored) return false;
+      if (halted) {
+        deps.getRegistrationRuntime().stop();
+        return false;
+      }
       deps.setLifecyclePhase(undefined);
       safeUpdateStatus(ctx);
       deps.recordRuntimeEvent(
@@ -2277,6 +2301,7 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(
     binding: TelegramBusFollowerPromotedBinding,
   ) => {
     const retry = () => {
+      if (halted) return;
       const activeCtx = deps.getActiveContext
         ? deps.getActiveContext()
         : fallbackCtx;
@@ -2376,11 +2401,31 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(
     ctx: TContext,
     carriedBinding?: TelegramBusFollowerPromotedBinding,
   ): Promise<void> => {
-    if (promotionPending) return;
+    if (promotionPending || halted) return;
     promotionPending = true;
     deps.registrationState.beginRecovery();
     const initialBinding = carriedBinding ?? snapshotBinding();
     try {
+      let threadModeDisabled = false;
+      try {
+        threadModeDisabled = (await deps.isThreadModeDisabled?.()) === true;
+      } catch (stateError) {
+        deps.recordRuntimeEvent("bus", stateError, {
+          phase: "follower-thread-mode-read",
+        });
+      }
+      if (threadModeDisabled) {
+        halted = true;
+        deps.getRegistrationRuntime().stop();
+        deps.setLifecyclePhase(undefined);
+        safeUpdateStatus(ctx);
+        deps.recordRuntimeEvent(
+          "bus",
+          "Telegram follower went offline: Threaded Mode is off. Run /telegram-connect after turning it back on.",
+          { phase: "follower-thread-mode-disabled" },
+        );
+        return;
+      }
       const state = deps.getLeaderState();
       if (state.kind === "active-elsewhere") {
         clearRegisteredState(ctx);
@@ -2456,7 +2501,14 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler<TContext>(
       promotionPending = false;
     }
   };
-  return recover;
+  return Object.assign(recover, {
+    halt() {
+      halted = true;
+    },
+    resume() {
+      halted = false;
+    },
+  });
 }
 
 export function createTelegramBusFollowerRegistrationRuntime<

package/lib/extension.ts

@@ -1996,6 +1996,10 @@ export default function (pi: Pi.ExtensionAPI) {
       recovery: {
         getLeaderState: lockRuntime.getState,
         proveLeaderUnresponsive: proveTelegramLeaderUnresponsive,
+        async isThreadModeDisabled() {
+          await threadStore.refresh?.();
+          return threadStore.getBotState().threadMode === "disabled";
+        },
         setLifecyclePhase: telegramBusFollowerControlState.setLifecyclePhase,
         updateStatus,
         promoteToLeader: promoteTelegramBusFollowerToLeader,

package/lib/generative-app-worker.mjs

@@ -22,6 +22,11 @@ parentPort.on("message", (message) => {
 });
 
 function runBoundedProcess(input) {
+  // After an abort the parent may terminate this worker before execFile's own abort kill runs, which
+  // would orphan a freshly spawned child; never start a process once cancelled.
+  if (controller.signal.aborted) {
+    return Promise.reject(new Error("Generative App method was cancelled."));
+  }
   if (!input || typeof input !== "object") {
     throw new Error("Generative App run input must be an object.");
   }

package/lib/locks.ts

@@ -38,6 +38,8 @@ export const TELEGRAM_LOCK_KEY = "default";
 export const TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS = 8_000;
 export const TELEGRAM_OWNERSHIP_CHECK_MS = 1_000;
 export const TELEGRAM_OWNERSHIP_REFRESH_MS = 2_000;
+/** Consecutive unverified ownership checks tolerated before standing down; a concurrent shared-state replacement must not stop an owned transport. */
+export const TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE = 2;
 const TELEGRAM_LOCK_WRITE_RETRY_ATTEMPTS = 5;
 const TELEGRAM_LOCK_WRITE_RETRY_DELAY_MS = 25;
 const TELEGRAM_LOCK_TRANSACTION_ATTEMPTS = 80;
@@ -1521,17 +1523,21 @@ export function createTelegramLockRuntime<TContext extends TelegramLockContext>(
   const readOwners = (): Record<string, unknown> => {
     if (!statePath) return readLocks(locksPath);
     // Read-only ownership queries fail closed (no owner); acquisition/publication still refuse malformed state.
-    try {
-      const transports = Object.fromEntries(
-        Object.entries(readTelegramRuntimeState(statePath).profiles)
-          .filter(([, value]) => Object.hasOwn(value, "transport"))
-          .map(([profile, value]) => [profile, value.transport]),
-      );
-      assertTelegramStateTransport(transports[resolveEffectiveKey()]);
-      return transports;
-    } catch {
-      return {};
+    // A strict read racing a concurrent atomic replace fails transiently, so retry before failing closed.
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      try {
+        const transports = Object.fromEntries(
+          Object.entries(readTelegramRuntimeState(statePath).profiles)
+            .filter(([, value]) => Object.hasOwn(value, "transport"))
+            .map(([profile, value]) => [profile, value.transport]),
+        );
+        assertTelegramStateTransport(transports[resolveEffectiveKey()]);
+        return transports;
+      } catch {
+        // Retry; a persistent failure falls through to no owner.
+      }
     }
+    return {};
   };
   const transactOwners = <T>(
     mutate: (locks: Record<string, unknown>) => { result: T; changed: boolean },
@@ -2035,6 +2041,7 @@ export function createTelegramLockedPollingRuntime<
   let ownershipRefreshInterval: ReturnType<typeof setInterval> | undefined;
   let ownershipStop: Promise<void> | undefined;
   let activeContext: TContext | undefined;
+  let ownershipCheckFailures = 0;
   let takeoverCandidate: TelegramLockEntry | undefined;
   let sessionAutoStartRun: Promise<void> | undefined;
   let pollingGeneration = 0;
@@ -2098,21 +2105,45 @@ export function createTelegramLockedPollingRuntime<
   const startOwnershipWatcher = (ctx: TContext) => {
     const owner = snapshotLockContext(ctx);
     stopOwnershipWatcher();
-    ownershipCheckInterval = setInterval(() => {
+    ownershipCheckFailures = 0;
+    // A serialized "not the owner" answer is definitive and stands down at once; only an observation that
+    // cannot be verified at all (both reads failed) counts toward the bounded tolerance.
+    const verifyOwnership = (observe: () => boolean): void => {
+      let owned: boolean | undefined;
+      let failure: unknown;
       try {
-        if (deps.lock.owns(owner)) return;
+        owned = observe();
       } catch (error) {
-        deps.recordRuntimeEvent?.("lock", error, { phase: "check" });
+        failure = error;
+      }
+      if (owned === true) {
+        ownershipCheckFailures = 0;
+        return;
       }
-      stopAfterOwnershipLoss();
+      if (owned === false) {
+        deps.recordRuntimeEvent?.(
+          "lock",
+          new Error("Telegram bridge ownership moved away from this instance."),
+          { phase: "ownership-lost" },
+        );
+        stopAfterOwnershipLoss();
+        return;
+      }
+      ownershipCheckFailures += 1;
+      deps.recordRuntimeEvent?.("lock", failure, {
+        phase: "ownership-check-failed",
+        consecutiveFailures: ownershipCheckFailures,
+        tolerance: TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE,
+      });
+      if (ownershipCheckFailures > TELEGRAM_OWNERSHIP_CHECK_FAILURE_TOLERANCE)
+        stopAfterOwnershipLoss();
+    };
+    ownershipCheckInterval = setInterval(() => {
+      // A lock-free miss can be a strict read racing an atomic replace; refresh confirms through the serialized path.
+      verifyOwnership(() => deps.lock.owns(owner) || deps.lock.refresh(owner));
     }, ownershipCheckMs);
     ownershipRefreshInterval = setInterval(() => {
-      try {
-        if (deps.lock.refresh(owner)) return;
-      } catch (error) {
-        deps.recordRuntimeEvent?.("lock", error, { phase: "refresh" });
-      }
-      stopAfterOwnershipLoss();
+      verifyOwnership(() => deps.lock.refresh(owner));
     }, ownershipRefreshMs);
     ownershipCheckInterval.unref?.();
     ownershipRefreshInterval.unref?.();

package/lib/sync.ts

@@ -376,6 +376,7 @@ export function createTelegramManualThreadDisconnectHandler<
     assertCurrent();
     const currentRecord = deps.getCurrentThreadRecord();
     let cleanupPending = false;
+    let followerThreadKept = false;
     if (currentRecord?.target.threadId) {
       const isManualFollower = currentRecord.owner?.kind === "manual-follower";
       const leaderEpoch = deps.getCurrentLeaderEpoch?.();
@@ -386,11 +387,8 @@ export function createTelegramManualThreadDisconnectHandler<
         if (deps.disconnectFollowerThread) {
           const disconnected = await deps.disconnectFollowerThread();
           assertCurrent();
-          if (!disconnected) {
-            throw new Error(
-              "Telegram follower thread deletion requires a live leader registration.",
-            );
-          }
+          // Without a live leader the Thread cannot be deleted; still stop locally and never claim deletion.
+          followerThreadKept = !disconnected;
         }
       } else {
         const target = currentRecord.target as TelegramTarget & {
@@ -483,6 +481,8 @@ export function createTelegramManualThreadDisconnectHandler<
     }
     assertCurrent();
     const stopped = await deps.stopPolling();
+    if (followerThreadKept)
+      return "Telegram bridge disconnected. Thread kept: no live leader could delete it.";
     return cleanupPending
       ? `${stopped} Telegram thread cleanup remains pending for the next leader.`
       : stopped;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.54.0",
+  "version": "0.54.2",
   "private": false,
   "publishConfig": {
     "access": "public"