v0.5.4 — telegram-dev

• Every skill description now fits a budget of about 300 characters (hub board row B-255 (a)):
  Claude Code lists every installed skill's description each session against a shared budget of
  about 30,000 characters, and the operator's listing measured 51,178, so less-used skills lost
  their descriptions. Measured with whitespace collapsed: telegram-bots 419 → 291,
  telegram-miniapps 461 → 297, telegram-userbots 442 → 297; total 1322 → 885.
• Each description keeps its router sentence, its boundary against sibling skills, the opt-out
  phrase and a short English and Russian trigger list. Every quoted trigger the description
  dropped is kept in the body's ## Triggers section, so the family hook's words stay advertised
  (test/advertised_check.js in the hub).

v0.5.3 — telegram-dev

• The same content as 0.5.2, released under an annotated tag. v0.5.2 was pushed
  as a lightweight tag, which the release workflow refuses before publishing
  anything, and the repository rules keep tags; so v0.5.2 names no release and
  nothing was ever published as 0.5.2.

v0.5.1 — telegram-dev

• Why 0.5.1 and not 0.5.0: a v0.5.0 tag was pushed by mistake on the
  previous main commit, before this change had merged. Its release run was
  cancelled before anything was published (npm stayed at 0.4.0, no GitHub
  release), and the repository rules keep tags, so that tag stays and names no
  release. Nothing was ever published as 0.5.0.

• telegram-bots: new reference references/high-load.md. One slow update
  must not hold every chat. Telegraf 4.16.3 awaits Promise.all over the whole
  batch before the next getUpdates and races each handler against a 90 s
  handlerTimeout (read in its source on 2026-10-23), so one handler waiting on a
  slow Telegram stops the bot for everyone. The page covers a dispatcher behind
  bot.handleUpdate (a queue per chat, a ceiling across chats, a per-chat cap,
  payments outside the ceiling), guards that must measure from arrival once work
  is queued, why a screen must not be superseded at queue time, timeouts that
  free the caller rather than the work, a shutdown that stops the poll first and
  refuses to restart it, and the measurements and non-flapping alarms that show
  the problem before a user does.

• New fixture fixtures/update_pump.py. A discrete-event simulation on a
  virtual clock with nine rules; --self-test removes each and watches its
  invariant fail. Run by npm test.

• Lessons come from the verification rounds of a production bot's dispatcher
  (2026-10-23/24); no project is named.

v0.4.0 — telegram-dev

• Every skill's front-matter description is now a router, not a manual: one
  "Use when" sentence, a "Not for" boundary naming the sibling skill, the opt-out
  phrase (no telegram, без телеграма) and 8 English and Russian triggers.
  Lengths before and after: telegram-bots 958 to 419, telegram-userbots 876 to 442,
  telegram-miniapps 837 to 461 (2,671 to 1,322 chars in total).
• Why: Claude Code shares about 30,000 chars of skill listing across every installed
  skill. Measured on 2026-10-20, the operator's listing held 29,995 chars for 134 skills
  and 81 of them showed no description. Plugin skills cannot be hidden, so description
  length is the only lever.
• Every trigger phrase removed from a description moved verbatim into a new
  ## Triggers section at the end of that skill's body, so the family's routing hook
  still finds each of its words in the skill's text.
• test/validate.py: the house description limit drops from 970 to the family cap of
  500 chars (the standard's 1024 stays the hard limit); the padding plant derives its
  length from the cap and still lands between the two.

v0.3.0 — telegram-dev

Every sentence added below was checked on 2026-10-19 against a primary source
fetched that day; the source list and the candidate claims left out (no primary
source) are in the packet. The Bot API pin
stays at 10.3: the changelog still lists it as the latest release.

• telegram-userbots: what logging out ends. auth.logOut may return a
  future_auth_token that skips the next login code, so the two-step password
  is the real gate. Sessions are listed with account.getAuthorizations and
  terminated with account.resetAuthorization / auth.resetAuthorizations,
  which refuse from a session under 24 hours old. A new login reaches the other
  sessions as updateNewAuthorization and confirms itself after
  authorization_autoconfirm_period. tg://login?token= logs in whoever
  generated the token; t.me/login/<code> carries the code. +888 numbers get
  their code on Fragment, behind the wallet. Telethon 1.44.0 class names given.
  The checklist gains a sixth item.
• telegram-miniapps: the host and the device. A threat-model line from
  Don't Trust the Super-App (arXiv:2609.11814): a super-app host can capture
  a mini-app's UI, read its storage and inject script, so the client is trusted
  by construction. Secrets go to SecureStorage (Keychain or Keystore, 10
  items), not DeviceStorage or localStorage, with the TENET storage findings
  (arXiv:2608.17538). TON Connect 5.0 is a renumbering of ui 3.1.0, whose typed
  errors and error.name change break handlers written for 3.0.x. The
  checklist gains a sixth item.
• telegram-bots: the official Markdown docs and a second channel.
  core.telegram.org/bots/api.md and per-method .md files are the official
  machine-readable form (Markdown, not a JSON schema). A practice note on
  keeping a second channel when the audience can lose access to Telegram.
  payments-stars.md gains the native gift purchase offer (payment reserved,
  UniqueGiftInfo.origin = "offer" since Bot API 9.3) and the accept-is-a-send
  trap it replaces.
• Descriptions, routing triggers, fixtures and the installer are unchanged.

v0.2.4 — telegram-dev

• Validate the owner board's table shape, unique task IDs and immediate Markdown
  separator before accepting a change.
• Validate the release job's full-history checkout and refusing ancestry check;
  reject unsupported or ambiguous workflow shapes. Forty-two process controls
  cover hostile edits and valid board/workflow forms.
• Run complete hosted validation nightly at 23:00 Europe/Warsaw or once for an
  explicitly frozen draft-to-ready candidate. Tag releases retain their existing
  validation and publication checks.

v0.2.3 — telegram-dev

• The release refuses a lightweight tag. release.yml gains one step, right after
  checkout and before any gate: git cat-file -t on the tag must print tag; a commit
  fails the job with the remedy (git tag -a <tag> -m '<release>' at the same commit)
  before anything is published. git describe and git submodule status see annotated
  tags only, and the 2026-10-09 family wave cut four lightweight member tags that the
  umbrella then read as each member's previous release. The step is identical across the
  family (umbrella plan 2026-10-10, T5 / REQ-6). Published tags are not re-cut.
• No skill, reference or installer change.

v0.2.2 — telegram-dev

The 2026-10-08 family routing audit found that a request written with the inflected or
Latin-script name of a bot — «добавь Telegram-бота» — loaded no skill at all. The
telegram-bots description carried «телеграм бот» with a space and nothing else, and
a match on words cannot see one form inside another.

• telegram-bots now names «Telegram-бот», «Telegram-бота» and «телеграм-бота» in
  its first sentence, beside "Telegram bot". They lead rather than join the trigger
  list at the end, because harness listings cut long descriptions and the cut falls
  well before the Triggers - clause. The description is 958 characters, inside the
  970 house limit.
• The trigger corpus gains q13 («добавь Telegram-бота в проект», should trigger),
  held out in the validation split. It is data for the next measured run, not a result:
  test/evals/RESULTS.md still records no model runs.
• The house-limit plant now derives its padding. It appended a fixed run of words,
  which at 905 characters landed between 970 and 1024; at 958 it overshot the 1024 cap,
  and npm run test:negatives reported the plant BROKEN because the validator refused
  it for the cap rather than the house limit. The plant now computes the length that
  lands midway between the two limits, so the next description edit cannot silence it.

v0.2.1 — telegram-dev

Hygiene from the 2026-09-13 family audit (HK-11). The install section showed four
channels and no invocation form, so a reader who installed the pack had nothing telling
them what to type. Both forms are written — /telegram-dev:<skill> and /<skill> —
because which one resolves depends on how the pack was installed, and promising one is
how a reader concludes the skill is not there.

v0.2.0 — telegram-dev

Sherlock external-v3 (12 findings) plus the House audit gap that surfaced with them.

• telegram-userbots/references/rate-and-flood.md passed 100 lines and had no
  ## Contents list. FloodWait pacing, the sanctioned takeout path and the
  errors worth handling by name were all past the fold an agent previews.
• CI now MEASURES the token budget with a real tokenizer instead of estimating it.