@llblab/pi-kit 0.19.1 → 0.20.0

package/node_modules/@llblab/pi-telegram/dist/lib/journal.d.ts

@@ -610,6 +610,9 @@ export interface TelegramUpdateJournalRuntimeBinding {
     runtimeKey: string;
     recoveryKey: string;
     journal: TelegramUpdateJournalStore;
+    readForProtection?: () => {
+        entries: readonly TelegramUpdateJournalEntry[];
+    };
 }
 export interface TelegramUpdateJournalRuntimeBindingResolverDeps {
     getProfileName: () => string | undefined;

package/node_modules/@llblab/pi-telegram/dist/lib/journal.js

@@ -1443,6 +1443,19 @@ export function createTelegramUpdateJournalRuntimeBindingResolver(deps) {
                 profileName,
                 botIdentity,
             }),
+            readForProtection() {
+                // Protection must never turn corruption/recovery into empty-work evidence.
+                const evidence = inspectTelegramUpdateJournalFamily({
+                    directory: dirname(path), path, profile: profileName, botIdentity,
+                    limits: {
+                        maxFiles: 1024,
+                        maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
+                        maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES,
+                        maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024,
+                    },
+                });
+                return { entries: evidence.kind === "present" ? evidence.file.entries : [] };
+            },
             journal: createTelegramUpdateJournalStore({
                 path,
                 profileName,

package/node_modules/@llblab/pi-telegram/dist/lib/lifecycle.d.ts

@@ -85,6 +85,7 @@ export interface TelegramBridgeSessionServiceRuntime {
     guestPlaceholder?: {
         stopAll(): void;
     };
+    prepareThreadPreservationOnQuit?: (isSessionCurrent: () => boolean) => (() => Promise<void>) | undefined;
 }
 export interface TelegramBridgeSessionLifecycleAssemblyDeps<TQueueItem, TModel = unknown> {
     contextStore: TelegramSessionContextStore<ExtensionContext>;
@@ -111,6 +112,7 @@ export interface TelegramBridgeSessionLifecyclePorts<TQueueItem, TModel = unknow
         capabilityMonitor: TelegramBridgeSessionServiceRuntime["capabilityMonitor"];
         queueWatchdog: TelegramBridgeSessionServiceRuntime["queueWatchdog"];
         guestPlaceholder?: TelegramBridgeSessionServiceRuntime["guestPlaceholder"];
+        prepareThreadPreservationOnQuit?: TelegramBridgeSessionServiceRuntime["prepareThreadPreservationOnQuit"];
     };
 }
 export declare function createTelegramBridgeSessionLifecycleDeps<TQueueItem, TModel = unknown>(ports: TelegramBridgeSessionLifecyclePorts<TQueueItem, TModel>): TelegramBridgeSessionLifecycleAssemblyDeps<TQueueItem, TModel>;

package/node_modules/@llblab/pi-telegram/dist/lib/lifecycle.js

@@ -91,7 +91,8 @@ export function createTelegramSessionGenerationFence(store, hooks) {
             if (!store.isCurrent(ctx, generation))
                 return;
             await hooks.onSessionShutdown(event, ctx);
-            store.clear(ctx);
+            if (store.isCurrent(ctx, generation))
+                store.clear(ctx);
         },
     };
 }
@@ -115,6 +116,7 @@ export function createTelegramBridgeSessionLifecycleDeps(ports) {
             capabilityMonitor: ports.services.capabilityMonitor,
             queueWatchdog: ports.services.queueWatchdog,
             guestPlaceholder: ports.services.guestPlaceholder,
+            prepareThreadPreservationOnQuit: ports.services.prepareThreadPreservationOnQuit,
         },
     };
 }
@@ -144,18 +146,37 @@ export function createTelegramBridgeSessionLifecycleAssembly(deps) {
             deps.services.queueWatchdog.start(ctx);
         },
         async onSessionShutdown(event, ctx) {
-            if (!isSessionActive(ctx))
+            const generation = deps.contextStore.getGeneration();
+            const isCurrent = () => deps.contextStore.isCurrent(ctx, generation);
+            if (!isCurrent())
                 return;
+            let preserveThread;
+            if (event.reason === "quit") {
+                try {
+                    preserveThread = deps.services.prepareThreadPreservationOnQuit?.(isCurrent);
+                }
+                catch (error) {
+                    deps.follower.recordRuntimeEvent("session", error, { phase: "preserve-thread-on-quit" });
+                }
+            }
             deps.services.guestPlaceholder?.stopAll();
             await deps.services.delivery.onSessionShutdown();
-            if (!isSessionActive(ctx))
+            if (!isCurrent())
                 return;
             deps.services.queueWatchdog.stop();
             deps.services.capabilityMonitor.stop();
             await queueLifecycle.onSessionShutdown(event, ctx);
-            if (!isSessionActive(ctx))
+            if (!isCurrent())
                 return;
             await deps.services.inboundWorker.onSessionShutdown();
+            if (!isCurrent())
+                return;
+            try {
+                await preserveThread?.();
+            }
+            catch (error) {
+                deps.follower.recordRuntimeEvent("session", error, { phase: "preserve-thread-on-quit" });
+            }
         },
     };
     const followerLifecycle = appendTelegramLifecycleHooks(servicesLifecycle, {

package/node_modules/@llblab/pi-telegram/dist/lib/locks.d.ts

@@ -133,6 +133,7 @@ export interface TelegramLockedPollingRuntime<TContext extends TelegramLockConte
     start: (ctx: TContext, options?: TelegramLockedPollingStartOptions) => Promise<TelegramLockedPollingStartResult>;
     stop: () => Promise<string>;
     suspend: () => Promise<void>;
+    isSuspended: () => boolean;
     onPersistentConflict: (ctx: TContext, count: number) => Promise<void>;
     onSessionStart: (_event: unknown, ctx: TContext) => Promise<void>;
     registerFollowerWithOwner?: (ctx: TContext, owner: TelegramLockEntry) => boolean | undefined | Promise<boolean | undefined>;

package/node_modules/@llblab/pi-telegram/dist/lib/locks.js

@@ -551,7 +551,8 @@ export function isProcessAlive(pid) {
         return true;
     }
     catch (error) {
-        return error.code === "EPERM";
+        // Only an absent PID proves death; permission and unexpected failures do not.
+        return error.code !== "ESRCH";
     }
 }
 export function formatTelegramLockEntry(lock) {
@@ -835,6 +836,9 @@ export function createTelegramLockedPollingRuntime(deps) {
     let takeoverCandidate;
     let sessionAutoStartRun;
     let pollingGeneration = 0;
+    let suspendedGeneration;
+    let suspensionsInFlight = 0;
+    let startupsInFlight = 0;
     const ownershipCheckMs = deps.ownershipCheckMs ?? TELEGRAM_OWNERSHIP_CHECK_MS;
     const ownershipRefreshMs = deps.ownershipRefreshMs ?? TELEGRAM_OWNERSHIP_REFRESH_MS;
     const stopOwnershipWatcher = () => {
@@ -846,20 +850,30 @@ export function createTelegramLockedPollingRuntime(deps) {
         ownershipRefreshInterval = undefined;
     };
     const suspendPolling = async () => {
-        pollingGeneration += 1;
-        activeContext = undefined;
-        deps.transportMonitor?.stop();
-        deps.stopFollowerRegistration?.();
-        stopOwnershipWatcher();
-        if (sessionAutoStartRun) {
-            await sessionAutoStartRun;
+        const generation = ++pollingGeneration;
+        suspensionsInFlight += 1;
+        try {
+            activeContext = undefined;
+            deps.transportMonitor?.stop();
             deps.stopFollowerRegistration?.();
+            stopOwnershipWatcher();
+            if (sessionAutoStartRun) {
+                await sessionAutoStartRun;
+                deps.stopFollowerRegistration?.();
+            }
+            if (ownershipStop) {
+                await ownershipStop;
+                return;
+            }
+            await deps.stopPolling();
+            // Unsettled starts, overlapping stops or stale completion cannot certify quiescence.
+            if (generation === pollingGeneration && suspensionsInFlight === 1 && startupsInFlight === 0) {
+                suspendedGeneration = generation;
+            }
         }
-        if (ownershipStop) {
-            await ownershipStop;
-            return;
+        finally {
+            suspensionsInFlight -= 1;
         }
-        await deps.stopPolling();
     };
     const stopAfterOwnershipLoss = () => {
         if (ownershipStop)
@@ -906,6 +920,7 @@ export function createTelegramLockedPollingRuntime(deps) {
             return false;
         activeContext = ctx;
         startOwnershipWatcher(ctx);
+        startupsInFlight += 1;
         try {
             if (!deps.lock.refresh(snapshotLockContext(ctx))) {
                 stopOwnershipWatcher();
@@ -934,6 +949,9 @@ export function createTelegramLockedPollingRuntime(deps) {
             deps.onTransportAvailabilityChanged?.();
             throw error;
         }
+        finally {
+            startupsInFlight -= 1;
+        }
         if (!isCurrent())
             return false;
         if (deps.lock.owns(ctx)) {
@@ -1075,6 +1093,8 @@ export function createTelegramLockedPollingRuntime(deps) {
             return "Telegram bridge disconnected.";
         },
         suspend: suspendPolling,
+        isSuspended: () => suspendedGeneration === pollingGeneration &&
+            suspensionsInFlight === 0 && startupsInFlight === 0 && !sessionAutoStartRun && !ownershipStop,
         onPersistentConflict: async (ctx, count) => {
             if (activeContext === undefined || ownershipStop)
                 return;

package/node_modules/@llblab/pi-telegram/dist/lib/paths.d.ts

@@ -14,6 +14,12 @@ export interface TelegramAgentDirResolutionInput {
  * 3. Fallback: `~/.pi/agent`.
  */
 export declare function resolveAgentDir(input?: TelegramAgentDirResolutionInput): string;
+/**
+ * Pure reference preflight against an independently approved resource path.
+ * Reject aliases; never repair relative historical references or redirect storage.
+ * Equality proves spelling only, not file identity, consumer closure or migration readiness.
+ */
+export declare function requireTelegramStoragePathReference(path: string, expectedPath: string): string;
 /** Telegram bridge configuration file (<agentDir>/telegram.json). */
 export declare function resolveTelegramConfigPath(): string;
 /** Telegram bridge temporary directory (<agentDir>/tmp/telegram). */
@@ -28,12 +34,16 @@ export declare function getTelegramDiagnosticsDisplayPaths(profileName?: string)
 };
 /** Durable Workspace admission ledger (<agentDir>/tmp/telegram/workspace-admission[.<profile>].json). */
 export declare function resolveTelegramWorkspaceAdmissionPath(agentDir?: string, profileName?: string): string;
+/** Profile-only callback shape; binds storage to the configured agent directory. */
+export declare function resolveTelegramWorkspaceAdmissionPathForProfile(profileName?: string): string;
 /** Durable inactive Thread cleanup work-set journal. */
 export declare function resolveTelegramThreadCleanupWorkPath(agentDir?: string, profileName?: string): string;
 /** Durable agent-authored channel post journal. */
 export declare function resolveTelegramChannelPostJournalPath(agentDir?: string, profileName?: string): string;
 /** Durable inbound update journal (<agentDir>/tmp/telegram/inbox[.<profile>].json). */
 export declare function resolveTelegramUpdateJournalPath(agentDir?: string, profileName?: string): string;
+/** Profile-only callback shape; binds storage to the configured agent directory. */
+export declare function resolveTelegramUpdateJournalPathForProfile(profileName?: string): string;
 /** Durable follower delivery journal, isolated by stable recipient binding. */
 export declare function resolveTelegramFollowerJournalPath(recipientBindingKey: string, agentDir?: string, profileName?: string): string;
 /** Runtime event log (<agentDir>/tmp/telegram/logs.jsonl). */

package/node_modules/@llblab/pi-telegram/dist/lib/paths.js

@@ -9,7 +9,7 @@
  */
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { isAbsolute, join, resolve } from "node:path";
 export const TELEGRAM_DEFAULT_PROFILE_NAME = "default";
 /**
  * Resolve the agent data directory for the current Pi-compatible runtime.
@@ -33,6 +33,19 @@ export function resolveAgentDir(input = {}) {
     }
     return join(homedir(), ".pi", "agent");
 }
+/**
+ * Pure reference preflight against an independently approved resource path.
+ * Reject aliases; never repair relative historical references or redirect storage.
+ * Equality proves spelling only, not file identity, consumer closure or migration readiness.
+ */
+export function requireTelegramStoragePathReference(path, expectedPath) {
+    if (typeof path !== "string" || typeof expectedPath !== "string" ||
+        !isAbsolute(path) || resolve(path) !== path ||
+        !isAbsolute(expectedPath) || resolve(expectedPath) !== expectedPath || path !== expectedPath) {
+        throw new Error("Telegram storage reference does not match its approved absolute path.");
+    }
+    return path;
+}
 /** Telegram bridge configuration file (<agentDir>/telegram.json). */
 export function resolveTelegramConfigPath() {
     return join(resolveAgentDir(), "telegram.json");
@@ -65,6 +78,10 @@ export function getTelegramDiagnosticsDisplayPaths(profileName) {
 export function resolveTelegramWorkspaceAdmissionPath(agentDir = resolveAgentDir(), profileName) {
     return resolveTelegramProfileTempFilePath("workspace-admission", "json", agentDir, profileName);
 }
+/** Profile-only callback shape; binds storage to the configured agent directory. */
+export function resolveTelegramWorkspaceAdmissionPathForProfile(profileName) {
+    return resolveTelegramWorkspaceAdmissionPath(resolveAgentDir(), profileName);
+}
 /** Durable inactive Thread cleanup work-set journal. */
 export function resolveTelegramThreadCleanupWorkPath(agentDir = resolveAgentDir(), profileName) {
     return resolveTelegramProfileTempFilePath("thread-cleanup", "json", agentDir, profileName);
@@ -77,6 +94,10 @@ export function resolveTelegramChannelPostJournalPath(agentDir = resolveAgentDir
 export function resolveTelegramUpdateJournalPath(agentDir = resolveAgentDir(), profileName) {
     return resolveTelegramProfileTempFilePath("inbox", "json", agentDir, profileName);
 }
+/** Profile-only callback shape; binds storage to the configured agent directory. */
+export function resolveTelegramUpdateJournalPathForProfile(profileName) {
+    return resolveTelegramUpdateJournalPath(resolveAgentDir(), profileName);
+}
 /** Durable follower delivery journal, isolated by stable recipient binding. */
 export function resolveTelegramFollowerJournalPath(recipientBindingKey, agentDir = resolveAgentDir(), profileName) {
     if (!recipientBindingKey) {

package/node_modules/@llblab/pi-telegram/dist/lib/polling.js

@@ -16,8 +16,8 @@ const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS = 1_000;
 const TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS = 3_000;
 const TELEGRAM_POLLING_RETRY_MS = 3_000;
 export const TELEGRAM_GET_UPDATES_GRACE_MS = 10_000;
-// Standard Telegram DM polling does not expose ordinary message-deletion events,
-// so queue removal stays reaction-driven while delete-like business updates remain defensive-only.
+// Standard Telegram DM polling does not expose ordinary message-deletion events.
+// Business deletions belong to a separate namespace and default routing ignores them.
 export const TELEGRAM_ALLOWED_UPDATES = [
     "message",
     "edited_message",

package/node_modules/@llblab/pi-telegram/dist/lib/queue.d.ts

@@ -474,7 +474,7 @@ export interface TelegramAgentEndHookRuntimeDeps<TTurn extends PendingTelegramTu
     getActiveTurn: () => TTurn | undefined;
     loadConfig?: () => Promise<void>;
     extractAssistant: (messages: readonly TMessage[]) => TelegramAgentEndAssistantResult;
-    isRecoveredAssistantAlreadyPublished?: (assistant: TelegramAgentEndAssistantResult) => boolean;
+    isAssistantAlreadyPublished?: (assistant: TelegramAgentEndAssistantResult) => boolean;
     getFoldQueuedPromptsIntoHistory: () => boolean;
     resetRuntimeState: () => void;
     isSessionActive?: (ctx: TContext) => boolean;

package/node_modules/@llblab/pi-telegram/dist/lib/queue.js

@@ -869,8 +869,7 @@ export function createTelegramAgentEndHook(deps) {
             return;
         const turn = deps.getActiveTurn();
         const extractedAssistant = assistantOverride ?? (turn ? deps.extractAssistant(event.messages) : {});
-        const assistant = extractedAssistant.recoveredFromEarlier &&
-            deps.isRecoveredAssistantAlreadyPublished?.(extractedAssistant)
+        const assistant = deps.isAssistantAlreadyPublished?.(extractedAssistant)
             ? { stopReason: extractedAssistant.stopReason }
             : extractedAssistant;
         const hasPublication = !!assistant.text || assistant.stopReason === "error" || !!turn?.queuedAttachments.length;

package/node_modules/@llblab/pi-telegram/dist/lib/sync.d.ts

@@ -97,6 +97,15 @@ export interface TelegramManualThreadDisconnectDeps<TSyncState> {
 export declare function markTelegramConfigSyncChange<TSyncState extends TelegramSyncState>(state: TSyncState, action: string, options?: {
     nowMs?: number;
 }): TSyncState;
+export declare function createTelegramPreservedLeaderQuitHandler(deps: {
+    instanceId: string;
+    topicTargetStore: Pick<TelegramTopicTargetStore, "load" | "list" | "listPendingCleanups" | "detachTargetOwner">;
+    getCurrentLeaderEpoch: () => number | string | undefined;
+    getProfileName: () => string | undefined;
+    isPollingSuspended: () => boolean;
+    resolveAutomaticThreadCleanupEnabled: () => boolean | Promise<boolean>;
+    runWorkspaceOperation: TelegramSyncWorkspaceOperationRunner;
+}): (isSessionCurrent: () => boolean) => (() => Promise<void>) | undefined;
 export interface TelegramSessionRestartThreadCleanupDeps<TSyncState extends TelegramSyncState> extends Omit<TelegramManualThreadDisconnectDeps<TSyncState>, "stopPolling"> {
     suspendPolling: () => Promise<void>;
 }

package/node_modules/@llblab/pi-telegram/dist/lib/sync.js

@@ -6,6 +6,7 @@
 import { getTelegramApiErrorRequestTarget, isTelegramStaleTargetHttpError } from "./telegram-api.js";
 import { getTelegramTargetKey } from "./target.js";
 import * as ThreadReconciler from "./thread-reconciler.js";
+import { TelegramWorkspaceSlotUnavailableError } from "./workspace-slots.js";
 import { createTelegramWorkspaceAdmissionOperationId, runWithTelegramWorkspaceAdmissionsAsync, } from "./workspace-admission.js";
 import { createTelegramCleanupTargetProtection, commitTelegramWorkspaceProvisionBinding, getTelegramTargetFromApiBody, getTelegramThreadOwnerKey, isSameTelegramProcessInstance, isTelegramTopicTargetStaleError, normalizeTelegramWorkspacePath, provisionOwnBusTopic, } from "./threads.js";
 export function markTelegramConfigSyncChange(state, action, options) {
@@ -24,6 +25,42 @@ export function markTelegramConfigSyncChange(state, action, options) {
     });
     return nextState;
 }
+export function createTelegramPreservedLeaderQuitHandler(deps) {
+    return (isSessionCurrent) => {
+        const epoch = deps.getCurrentLeaderEpoch();
+        const profile = deps.getProfileName();
+        if (epoch === undefined || !isSessionCurrent())
+            return undefined;
+        const isCurrent = () => isSessionCurrent() && deps.getCurrentLeaderEpoch() === epoch &&
+            deps.getProfileName() === profile && deps.isPollingSuspended();
+        return async () => {
+            if (!isCurrent() || await deps.resolveAutomaticThreadCleanupEnabled() !== false)
+                return;
+            if (!isCurrent())
+                return;
+            await deps.runWorkspaceOperation({
+                operationId: createTelegramWorkspaceAdmissionOperationId(),
+                operationKind: "workspace.preserve-leader-quit",
+                scopes: [{ kind: "profile" }],
+            }, async () => {
+                if (!isCurrent())
+                    return;
+                await deps.topicTargetStore.load();
+                if (!isCurrent())
+                    return;
+                const records = deps.topicTargetStore.list().filter((record) => record.instanceId === deps.instanceId && (record.status === "active" || record.status === "starting"));
+                if (records.length !== 1)
+                    return;
+                const record = records[0];
+                if (deps.topicTargetStore.listPendingCleanups().some((intent) => intent.target.chatId === record.target.chatId && intent.target.threadId === record.target.threadId))
+                    return;
+                if (!await deps.topicTargetStore.detachTargetOwner(record, isCurrent) && isCurrent()) {
+                    throw new Error("Telegram preserved leader detachment was not committed.");
+                }
+            });
+        };
+    };
+}
 export function createTelegramSessionRestartThreadCleanupHandler(deps) {
     return createTelegramManualThreadDisconnectHandler({
         ...deps,
@@ -353,10 +390,13 @@ export async function ensureTelegramLeaderThreadBinding(deps) {
     };
     const leaderProfileKey = getTelegramThreadOwnerKey(leaderOwner);
     const legacyLeaderRecord = deps.topicTargetStore.getByProfileKey(leaderProfileKey);
+    let capacityUnavailable = false;
     const workspaceIdentity = normalizedLeaderCwd
-        ? deps.topicTargetStore.claimWorkspaceIdentity(normalizedLeaderCwd, deps.instanceId, legacyLeaderRecord?.instanceId, { sessionId: deps.sessionId })
+        ? deps.topicTargetStore.claimWorkspaceIdentity(normalizedLeaderCwd, deps.instanceId, legacyLeaderRecord?.instanceId, { sessionId: deps.sessionId, onCapacityUnavailable() { capacityUnavailable = true; } })
         : undefined;
     if (deps.cwd && !workspaceIdentity) {
+        if (capacityUnavailable)
+            throw new TelegramWorkspaceSlotUnavailableError();
         throw new Error("Telegram Workspace identity is already claimed.");
     }
     const commitWorkspaceBinding = async (result) => {

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.d.ts

@@ -484,6 +484,8 @@ export declare function getTelegramApiErrorRequestTarget(error: unknown): {
     threadId: number;
 } | undefined;
 export declare function isTelegramStaleTargetHttpError(error: unknown): boolean;
+/** Only a parsed Telegram rejection of this method proves a request had no effect. */
+export declare function isTelegramApiRequestRejected(error: unknown, method: string): boolean;
 export declare function isTelegramMessageNotModifiedError(error: unknown): boolean;
 export declare function isTelegramApiMethodRetrySafe(method: string): boolean;
 export declare function isRetryableTelegramApiError(error: unknown): boolean;
@@ -522,13 +524,19 @@ export declare function createTelegramAssistantDraftSender(deps: {
     sendRichMessageDraft: TelegramBridgeApiRuntime["sendRichMessageDraft"];
 }): TelegramBridgeApiRuntime["sendMessageDraft"];
 export declare function buildTelegramAnswerGuestQueryBody(guestQueryId: string, text?: string, options?: TelegramAnswerGuestQueryOptions): Record<string, unknown>;
+export type TelegramWorkspaceThreadDeletionTransport = (authorize: () => {
+    chatId: number;
+    threadId: number;
+}) => Promise<void>;
 export declare function createDefaultTelegramBridgeApiRuntime(deps: {
     getBotToken: () => string | undefined;
     recordRuntimeEvent: TelegramBridgeApiRuntimeDeps["recordRuntimeEvent"];
     captureRequestErrorHandler?: TelegramBridgeApiRuntimeDeps["captureRequestErrorHandler"];
     targetActivity?: TelegramApiTargetActivityRuntime;
     workspaceAdmission?: TelegramApiWorkspaceAdmissionPort | (() => TelegramApiWorkspaceAdmissionPort | undefined);
-}): TelegramBridgeApiRuntime;
+}): TelegramBridgeApiRuntime & {
+    deleteWorkspaceThread: TelegramWorkspaceThreadDeletionTransport;
+};
 export declare function createTelegramBridgeApiRuntime(deps: TelegramBridgeApiRuntimeDeps): TelegramBridgeApiRuntime;
 /**
  * Creates a low-level Telegram Bot API client.

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.js

@@ -231,11 +231,13 @@ export function isTelegramApiCommitUnknownError(error) {
 class TelegramApiHttpError extends Error {
     status;
     retryAfterSeconds;
+    rejectedRequestMethod;
     requestTarget;
-    constructor(message, status, retryAfterSeconds) {
+    constructor(message, status, retryAfterSeconds, rejectedRequestMethod) {
         super(message);
         this.status = status;
         this.retryAfterSeconds = retryAfterSeconds;
+        this.rejectedRequestMethod = rejectedRequestMethod;
     }
 }
 function attachTelegramApiRequestTarget(error, body) {
@@ -267,6 +269,11 @@ export function isTelegramStaleTargetHttpError(error) {
         return false;
     return /^Telegram API \w+ failed: HTTP 400: Bad Request: (message thread not found|thread not found|topic not found|topic deleted|topic closed|thread closed|forum topic closed|message thread closed|topic_id_invalid|topic_closed)$/i.test(error.message);
 }
+/** Only a parsed Telegram rejection of this method proves a request had no effect. */
+export function isTelegramApiRequestRejected(error, method) {
+    return error instanceof TelegramApiHttpError && error.rejectedRequestMethod !== undefined &&
+        error.rejectedRequestMethod === method;
+}
 export function isTelegramMessageNotModifiedError(error) {
     return (error instanceof Error && error.message.includes("message is not modified"));
 }
@@ -398,7 +405,8 @@ async function parseTelegramApiResponse(response, method) {
         const retryAfterHeader = response.headers?.get("retry-after");
         const retryAfterSeconds = data?.parameters?.retry_after ??
             (retryAfterHeader ? Number.parseInt(retryAfterHeader, 10) : undefined);
-        throw new TelegramApiHttpError(`Telegram API ${method} failed: ${status}${description}`, response.status, Number.isFinite(retryAfterSeconds) ? retryAfterSeconds : undefined);
+        throw new TelegramApiHttpError(`Telegram API ${method} failed: ${status}${description}`, response.status, Number.isFinite(retryAfterSeconds) ? retryAfterSeconds : undefined, data?.ok === false && data.error_code === response.status &&
+            [400, 401, 403, 404, 429].includes(response.status) ? method : undefined);
     }
     if (!data) {
         throw new TelegramApiMalformedSuccessError(method, "returned invalid JSON");
@@ -856,7 +864,7 @@ export function createDefaultTelegramBridgeApiRuntime(deps) {
             },
         })
         : client;
-    return createTelegramBridgeApiRuntime({
+    const runtime = createTelegramBridgeApiRuntime({
         client: deps.targetActivity
             ? createTelegramApiTargetTrackingClient(admittedClient, deps.targetActivity)
             : admittedClient,
@@ -866,6 +874,18 @@ export function createDefaultTelegramBridgeApiRuntime(deps) {
         recordRuntimeEvent: deps.recordRuntimeEvent,
         captureRequestErrorHandler: deps.captureRequestErrorHandler,
     });
+    return {
+        ...runtime,
+        async deleteWorkspaceThread(authorize) {
+            // The exclusive deletion permit replaces ordinary target admission.
+            const target = authorize();
+            const deleted = await client.call("deleteForumTopic", {
+                chat_id: target.chatId, message_thread_id: target.threadId,
+            }, { maxAttempts: 1, retrySafety: "non-idempotent" });
+            if (deleted !== true)
+                throw new Error("Telegram Workspace Thread deletion was not confirmed.");
+        },
+    };
 }
 export function createTelegramBridgeApiRuntime(deps) {
     const recoverRequestError = async (handler, error) => {

package/node_modules/@llblab/pi-telegram/dist/lib/thread-cleanup-manager.js

@@ -342,7 +342,9 @@ export function createTelegramThreadCleanupWorkStore(options) {
                 return { confirmed: true, entry: structuredClone(entry) };
             });
         },
-        list() { return structuredClone(read().workSets); },
+        list() {
+            return structuredClone(withTelegramFileTransaction(`${options.path}.transaction`, () => read().workSets));
+        },
     };
 }
 export async function commitTelegramInactiveThreadCleanup(input) {
@@ -401,7 +403,10 @@ export function createTelegramThreadCleanupPermitRuntime(deps) {
             if (!deps.canAdoptFence(fence))
                 return undefined;
             try {
-                fence = deps.ledger.adoptThreadCleanupFence(fence, { owner, leaderEpoch });
+                const adopted = deps.ledger.adoptThreadCleanupFence(fence, { owner, leaderEpoch });
+                if (adopted.destructiveKind !== "manual-thread-cleanup")
+                    return undefined;
+                fence = adopted;
             }
             catch {
                 return undefined;

package/node_modules/@llblab/pi-telegram/dist/lib/threads.d.ts

@@ -212,6 +212,8 @@ export interface TelegramTopicTargetStore {
     refresh?: () => Promise<void>;
     persist: () => Promise<void>;
     invalidateTarget: (target: TelegramTarget, isCurrent: () => boolean, lastSyncError: string) => Promise<boolean>;
+    /** Caller proves owner detachment; this does not assert Telegram Thread absence. */
+    detachTargetOwner: (expected: TelegramTopicTargetRecord, isCurrent: () => boolean) => Promise<boolean>;
     list: () => TelegramTopicTargetRecord[];
     getFollowerRecoveryHintByTarget?: (target: TelegramTarget) => {
         slot?: string;