@llblab/pi-kit 0.29.1 → 0.29.2

package/node_modules/@llblab/pi-telegram/README.md

@@ -61,7 +61,7 @@ The connected Pi instance owns Telegram polling. Use `/telegram-connect <profile
 
 An eligible single-text unbound Thread chooser offers **⛔️ Cancel routing**: the original stays private and is not sent to Pi; its Telegram message and Thread are not deleted. This does not cancel already selected or accepted work. When protected cancellation attempts remain, **Status → ❌ Pending cancellations** lets the owner review and finish them, including after restart. Historical unbound startup text has no main-menu entry or historical-review submenu. Eligible raw unsupported command/media/unknown historical private-Thread originals use a separate retain-only path, including on bound Threads without surviving Restore/temporary membership. Each worker generation reclassifies them after cold forgetting, blocking handler replay, generic Cancel and cold spending. Ordinary bound startup dispatch stops for these originals; same-kind live arrivals and owner/custody paths remain unchanged. Old historical-review buttons are refused without routing or abandoning the original; removal of the UI does not cancel previously accepted work.
 
-New eligible unbound prompt choosers allow **60 minutes to choose a route**, starting at their first positively acknowledged publication. The deadline survives restart and is not renewed by refresh. At expiry, the exact unselected original is retained privately before removal from the pending journal; stale controls cannot dispatch it. TTL neither deletes the Telegram tab nor stops Pi, and does not require detecting a manually removed tab. A validated Reroute/Restore choice freezes expiry before effects; browsing Restore or an unavailable destination does not. Selected, queued, running and uncertain issued work stay protected. Older historical inputs and unconfirmed clock publication acquire no invented deadline; failed retention stays held. Reloading the candidate and live acceptance are separate operator actions.
+Eligible routing choosers and their donor sources share a **fixed 60-minute lifetime** from the first acknowledged publication, preserved across refresh/restart. Expiry drops unselected or unacknowledged routing attempts without privately archiving prompt bodies; nondelivery is accepted, so resend manually if needed. Old controls and late replies cannot replay the source. An expired disposable unbound tab is removed after all its owned groups resolve and fresh protection checks pass. Accepted queues, independent work and restored bound Threads remain intact. Confirmed expiry releases worker custody even if tab metadata fails; retries use only body-free tab/source proof, and uncertain deletion is never repeated. Explicit Cancel retains its separate private-original policy. Historical originals without a saved clock and unconfirmed publication receive no invented deadline. Local candidate checks do not certify live deletion.
 
 `/telegram-connect` keeps working when the shared runtime `state.json` is damaged. If it is malformed, foreign or contains invalid evidence, the connecting leader replaces it with a fresh empty state and continues. Every profile then forgets old Thread bindings, slots, unfinished Restore/temporary work and polling continuity; `telegram.json`, Pi history and the released `tmp/telegram` are untouched. Permission errors still stop connection. See [Damaged-State Reset](./docs/architecture.md#damaged-state-reset-operator-approved).
 
@@ -69,6 +69,8 @@ The prompt queue is session-local. Before a reload or restart, let it drain or k
 
 Journal recovery is a separate existing loss policy, not shared-envelope recovery. A snapshot removed by older broad temp cleanup is rebuilt when its complete segment history proves an empty result, while a revisionless snapshot is repaired from the first surviving segment's exact predecessor when the reconstructed tail validates. Otherwise the damaged snapshot and segments are deleted (their inputs are lost), a fresh journal is published, and startup continues with an informational diagnostic. Unsupported journal versions block recovery without rewriting or quarantining retained files; use a compatible runtime rather than deleting journals. Saved `telegram.json` configuration and runtime diagnostics are outside that journal reset. Startup best-effort removes obsolete current-runtime root/session `recovery/` folders, so those directories are not a preservation location.
 
+Ordinary network or admission failures use exponential retry pauses capped at 30 seconds, without permanently stopping after an arbitrary attempt count. The poller recovers when the outage clears. Explicit `/telegram-disconnect` still attempts to stop its captured local transport if Thread cleanup is unavailable; it reports unconfirmed cleanup rather than successful deletion, and an old disconnect cannot stop a new connection. Incomplete stop/release remains visible; check `/telegram-status --debug` and keep Pi open.
+
 Persistent competing `getUpdates` clients cause a bounded transport stand-down rather than endless retries. Accepted local work remains queued/executable, but Telegram delivery stops. Inspect `/telegram-status --debug`, stop the competing client, then reconnect. See [Runtime Ownership](./docs/architecture.md#runtime-ownership).
 
 ### 4. Pair your Telegram account
@@ -214,11 +216,12 @@ Queue policy:
 - Priority and Normal are separate FIFO lanes; Priority dispatches first.
 - Moving `Normal → Priority` removes the prompt from Normal and places it at the Priority tail. Moving `Priority → Normal` removes it from Priority and places it at the Normal tail; no former position is restored.
 - Keep/Skip never changes lane position. Skip preserves durable authority while waiting so Keep remains reversible, then settles that authority and drops the prompt without a model turn when dispatch reaches it. Skipped prompts stay visible at their physical queue position with a struck-through ordinal, but are excluded immediately from the executable queue count shown in both the Pi status bar and Telegram main menu. Graceful session shutdown discards all remaining queued authority, so a new session starts empty.
-- Reactions control two independent dimensions; changing one category preserves the other:
+- For ordinary prompts, reactions control two independent dimensions; changing one category preserves the other:
   - `Positive`: `👍`, `⚡️`, `❤️`, `🕊`, `🔥` — controls Priority.
   - `Negative`: `👎`, `👻`, `💔`, `💩`, `🗑` — controls Skip.
 - Priority and Skip can coexist—for example `👍 + 💩`. Skip wins at dispatch, regardless of which negative emoji is selected.
 - Menu selectors and reactions share queue state, but the bot cannot remove a user's reaction; Keep may clear internal Skip while the user's emoji remains visible until they remove it.
+- A negative reaction to your original standalone `/continue` immediately cancels its exact waiting continuation, even while other work is active. This is irreversible cancellation, not reversible Skip. Positive reactions do not change its control lane; already-dispatched or running work and synthetic model-switch continuations are untouched.
 
 The detailed contract lives in [Priority, Reactions, Keep, and Skip](./docs/architecture.md#priority-reactions-keep-and-skip). If Pi automatically retries a transient provider failure, the active Telegram turn stays bound until the successful reply arrives or Pi confirms that the run has settled.
 

package/node_modules/@llblab/pi-telegram/dist/lib/bindings.js

@@ -34,6 +34,7 @@ export function createTelegramQueueBindingRuntime(deps) {
     };
     const mutation = Queue.createTelegramQueueMutationController({
         ...deps.store,
+        hasPendingDispatch: deps.lifecycle.hasDispatchPending,
         allocateLaneOrder: deps.queue.allocateItemOrder,
         onItemsDiscarded(items, ctx) {
             if (!settleDiscardedItems(items, ctx)) {

package/node_modules/@llblab/pi-telegram/dist/lib/bus-api.js

@@ -4,7 +4,7 @@
  * Wraps the direct Telegram Bot API runtime so follower instances can route outbound calls through the bus leader
  */
 import { markTelegramBusCrossTargetDelivery, stripTelegramBusApiMetadata, } from "./bus.js";
-import { buildTelegramAnswerGuestQueryBody, isTelegramMessageNotModifiedError, } from "./telegram-api.js";
+import { buildTelegramAnswerGuestQueryBody, formatTelegramCallbackAnswerText, isTelegramMessageNotModifiedError, } from "./telegram-api.js";
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -201,15 +201,16 @@ export function createTelegramBusAwareApiRuntime(deps) {
             ]);
         },
         async answerCallbackQuery(callbackQueryId, text) {
+            const answer = formatTelegramCallbackAnswerText(text);
             if (deps.ownsDirect()) {
-                await deps.directRuntime.answerCallbackQuery(callbackQueryId, text);
+                await deps.directRuntime.answerCallbackQuery(callbackQueryId, answer);
                 return;
             }
             await deps.callFollowerApi("call", [
                 "answerCallbackQuery",
                 {
                     callback_query_id: callbackQueryId,
-                    ...(text !== undefined ? { text } : {}),
+                    ...(answer !== undefined ? { text: answer } : {}),
                 },
             ]);
         },

package/node_modules/@llblab/pi-telegram/dist/lib/extension.js

@@ -943,6 +943,9 @@ export default function (pi) {
                 return telegramJournalBindingRuntime.inspectSourceAbandonment(journalBindingKey, updateId);
             });
         },
+        inspectRoutingInputGroupExpiry(input) {
+            return telegramJournalReferenceRegistry.withReference({ referenceClass: "operator-disposition", recoveryKey: input.journalBindingKey }, function () { return telegramJournalBindingRuntime.inspectSourceGroupExpiry(input.journalBindingKey, input.updateIds); });
+        },
         inspectTemporaryThreadSources(_target, requiredJournalBindingKeys) {
             const binding = resolveTelegramUpdateJournalBinding();
             const botToken = configStore.getBotToken();
@@ -1548,6 +1551,7 @@ export default function (pi) {
         getSyncState: telegramSyncStateRuntime.getState,
         setSyncState: telegramSyncStateRuntime.setState,
         stopPolling: lockedPollingRuntime.stop,
+        captureStopPolling: lockedPollingRuntime.captureStop,
         suspendPolling: lockedPollingRuntime.suspend,
         recordRuntimeEvent,
         runWorkspaceOperation: telegramWorkspaceOperationRuntime.run,

package/node_modules/@llblab/pi-telegram/dist/lib/journal.d.ts

@@ -374,6 +374,9 @@ export interface TelegramRoutingInputAuthority {
     operatorUserId: number;
     isCurrent(): boolean;
 }
+/** Expiry drops a donor attempt without retaining its body or claiming recipient execution/cancellation. */
+export type TelegramRoutingInputExpiryResult = Omit<TelegramUpdateJournalPendingAbandonmentResult, "retainedPath">;
+export type TelegramRoutingInputExpiryEvidence = Omit<TelegramUpdateJournalAbandonedPendingEvidence, "retainedPath">;
 /** Package-private v1 capability; raw input custody does not expose it. */
 export interface TelegramRoutingInputJournal {
     arm(input: TelegramRoutingInputAuthority & {
@@ -385,7 +388,9 @@ export interface TelegramRoutingInputJournal {
     };
     expire(input: Omit<TelegramRoutingInputAuthority, "entries"> & {
         entry: TelegramUpdateJournalEntry;
-    }): TelegramUpdateJournalPendingAbandonmentResult;
+    }): TelegramRoutingInputExpiryResult;
+    inspectExpiry(updateId: number): TelegramRoutingInputExpiryEvidence | undefined;
+    inspectGroupExpiry(updateIds: readonly number[]): TelegramRoutingInputExpiryEvidence[] | undefined;
 }
 export interface TelegramUpdateJournalStore {
     routingInputs?: TelegramRoutingInputJournal;
@@ -804,6 +809,7 @@ export interface TelegramUpdateJournalBindingRuntime {
     getActiveRecoveryKey: () => string | undefined;
     /** Exact historical proof lookup; no store, admission, execution, recovery or mutation port. */
     inspectSourceAbandonment: (journalBindingKey: string, updateId: number) => TelegramUpdateJournalAbandonedPendingEvidence | undefined;
+    inspectSourceGroupExpiry: (journalBindingKey: string, updateIds: readonly number[]) => TelegramRoutingInputExpiryEvidence[] | undefined;
     inspectSourceCompletion: (journalBindingKey: string, expected: TelegramUpdateJournalSourceCompletion) => TelegramUpdateJournalSourceCompletion | undefined;
     inspectQueuedReceipt: (journalBindingKey: string, expected: TelegramUpdateJournalQueuedCompletion) => TelegramUpdateJournalQueuedReceiptEvidence | undefined;
     /** In-process `/new` succession: move unclaimed predecessor pending inputs into the successor session journal. */

package/node_modules/@llblab/pi-telegram/dist/lib/journal.js

@@ -285,6 +285,27 @@ export const TELEGRAM_ROUTING_INPUT_TTL_MS = 60 * 60 * 1000;
 export function createTelegramUpdateJournalEntryDigest(entry) {
     return { updateId: entry.updateId, sourceSha256: createHash("sha256").update(JSON.stringify(entry)).digest("hex") };
 }
+function inspectRoutingInputExpiry(file, journalBindingKey, updateId) {
+    const disposition = file.operatorDispositions?.find(value => value.updateId === updateId &&
+        "dispositionKind" in value && value.dispositionKind === "legacy-custody" && value.action === "discard" &&
+        value.failureId === `routing-expiry:${value.evidenceSha256}`);
+    if (!disposition || !("operatorAuthorityId" in disposition) || file.entries.some(entry => entry.updateId === updateId))
+        return undefined;
+    return { journalBindingKey, updateId, operatorAuthorityId: disposition.operatorAuthorityId };
+}
+function inspectRoutingGroupExpiry(file, journalBindingKey, updateIds) {
+    if (!Array.isArray(updateIds) || !updateIds.length || updateIds.length > TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES ||
+        updateIds.some((id, index) => !isSafeNonNegativeInteger(id) || (index > 0 && id <= updateIds[index - 1])))
+        return undefined;
+    if (file.entries.some(entry => updateIds.includes(entry.updateId)))
+        return undefined;
+    const expired = updateIds.map(id => inspectRoutingInputExpiry(file, journalBindingKey, id)).filter(value => value !== undefined);
+    if (!expired.length || expired.some(value => value.operatorAuthorityId !== expired[0].operatorAuthorityId))
+        return undefined;
+    // Some members may have been acknowledged earlier. Whole donor absence plus one exact expiry ends this known cohort,
+    // not recipient custody; fresh Thread protection still independently gates deletion.
+    return updateIds.map(updateId => ({ journalBindingKey, updateId, operatorAuthorityId: expired[0].operatorAuthorityId }));
+}
 function createJournalError(code, path, detail, cause) {
     return new TelegramUpdateJournalError(code, path, `Telegram update journal ${detail}: ${path}`, cause === undefined ? undefined : { cause });
 }
@@ -2064,6 +2085,9 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
                 return { journalBindingKey, updateId, retainedPath: original.path, operatorAuthorityId: disposition.operatorAuthorityId };
             });
         },
+        inspectSourceGroupExpiry(journalBindingKey, updateIds) {
+            return inspectHistoricalSource(journalBindingKey, file => inspectRoutingGroupExpiry(file, journalBindingKey, updateIds));
+        },
         inspectSourceCompletion(journalBindingKey, expected) {
             const completion = validateJournalSourceCompletion(expected, getTelegramUpdateJournalBindingPath(journalBindingKey) ?? "journal");
             return inspectHistoricalSource(journalBindingKey, (file, _originals, path) => inspectJournalSourceCompletion(file, completion, path));
@@ -3401,6 +3425,7 @@ function createJournalStoreCore(options, getInputContext) {
                         update: entry.update,
                         admittedAtMs: entry.admittedAtMs,
                         ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+                        ...(entry.routingInput ? { routingInput: { ...entry.routingInput } } : {}),
                         state: "queued",
                         queueKind: receipt.queueKind,
                         queueReceiptId: receipt.receiptId,
@@ -4069,22 +4094,58 @@ function createJournalStoreCore(options, getInputContext) {
             });
         },
     };
-    const abandonRoutingPending = journal.abandonPending.bind(journal);
     if (isTelegramUpdateJournalLegacyFamilyVersion(version))
         journal.routingInputs = {
             arm(input) { return mutateRoutingInputs(input, false, input.publishedAtMs).entries; },
             select(input) { return mutateRoutingInputs(input, true); },
+            inspectExpiry(updateId) {
+                return runMutation(readCurrent => {
+                    if (!isSafeNonNegativeInteger(updateId))
+                        throw createJournalError("invalid", path, "invalid routing expiry update ID");
+                    return inspectRoutingInputExpiry(readCurrent().file, createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity }), updateId);
+                });
+            },
+            inspectGroupExpiry(updateIds) {
+                return runMutation(readCurrent => inspectRoutingGroupExpiry(readCurrent().file, createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity }), updateIds));
+            },
             expire(input) {
-                const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
-                if (!lifetime || lifetime.phase !== "waiting" || lifetime.operatorUserId !== input.operatorUserId ||
-                    !isSafePositiveInteger(input.operatorUserId) || typeof input.isCurrent !== "function") {
-                    throw createJournalError("conflict", path, "routing input expiry lacks exact waiting authority");
-                }
-                const current = () => { const now = getNowMs(); return isSafeNonNegativeInteger(now) && now >= lifetime.expiresAtMs && input.isCurrent(); };
-                if (!current())
-                    throw createJournalError("conflict", path, "routing input has not expired under current authority");
-                return abandonRoutingPending({ journalBindingKey: input.journalBindingKey, entry: original,
-                    operatorAuthorityId: `telegram-owner:${input.operatorUserId}`, isCurrent: current });
+                return runMutation(readCurrent => {
+                    const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
+                    const binding = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+                    if (!lifetime || original.state !== "pending" || original.inputClaim || original.inputProvenance || original.queueOwner ||
+                        original.queueReceiptId || original.queueHandoff || original.failure || input.journalBindingKey !== binding ||
+                        lifetime.operatorUserId !== input.operatorUserId || !isSafePositiveInteger(input.operatorUserId) || typeof input.isCurrent !== "function") {
+                        throw createJournalError("conflict", path, "routing expiry requires an exact unclaimed chooser source");
+                    }
+                    const assertCurrent = () => {
+                        const now = getNowMs();
+                        if (!isSafeNonNegativeInteger(now) || now < lifetime.expiresAtMs || !input.isCurrent())
+                            throw createJournalError("conflict", path, "routing source has not expired under current authority");
+                    };
+                    assertCurrent();
+                    const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
+                    const evidenceSha256 = createHash("sha256").update(JSON.stringify(original)).digest("hex");
+                    const failureId = `routing-expiry:${evidenceSha256}`;
+                    const existing = current.file.operatorDispositions?.find(value => value.updateId === original.updateId);
+                    const entry = current.file.entries.find(value => value.updateId === original.updateId);
+                    if (existing) {
+                        if (entry || !("dispositionKind" in existing) || existing.dispositionKind !== "legacy-custody" || existing.action !== "discard" ||
+                            existing.failureId !== failureId || existing.evidenceSha256 !== evidenceSha256 || existing.operatorAuthorityId !== `telegram-owner:${input.operatorUserId}`)
+                            throw createJournalError("conflict", path, "routing source has contradictory expiry evidence");
+                        assertCurrent();
+                        return { disposition: existing, duplicate: true, entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    }
+                    if (!entry || !isDeepStrictEqual(entry, original))
+                        throw createJournalError("conflict", path, "routing source changed before expiry");
+                    // A discard tombstone prevents old readers and delayed reports from replaying; no prompt-body archive is written.
+                    const now = getNowMs();
+                    const disposition = { dispositionKind: "legacy-custody", failureId,
+                        updateId: original.updateId, action: "discard", committedAtMs: now, authorizedAtMs: now, evidenceSha256,
+                        operatorAuthorityId: `telegram-owner:${input.operatorUserId}` };
+                    const published = publishMutation(current, current.file.entries.filter(value => value.updateId !== original.updateId), true, [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId, (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
+                    assertCurrent();
+                    return { disposition, duplicate: false, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                });
             },
         };
     if (!getInputContext)

package/node_modules/@llblab/pi-telegram/dist/lib/locks.d.ts

@@ -215,6 +215,11 @@ type TelegramLockedPollingStartResult = {
 export interface TelegramLockedPollingRuntime<TContext extends TelegramLockContext> {
     start: (ctx: TContext, options?: TelegramLockedPollingStartOptions) => Promise<TelegramLockedPollingStartResult>;
     stop: () => Promise<string>;
+    /** Capture one disconnect attempt before cleanup awaits; a newer start revokes it. */
+    captureStop: () => {
+        isCurrent: () => boolean;
+        stop: () => Promise<string>;
+    };
     suspend: () => Promise<void>;
     isSuspended: () => boolean;
     /** Fence one owned polling generation; suspension, restart, conflict or lock loss revokes it. */

package/node_modules/@llblab/pi-telegram/dist/lib/locks.js

@@ -1210,6 +1210,8 @@ export function createTelegramLockedPollingRuntime(deps) {
             stopOwnershipWatcher();
             if (sessionAutoStartRun) {
                 await sessionAutoStartRun;
+                if (generation !== pollingGeneration)
+                    return;
                 deps.stopFollowerRegistration?.();
             }
             if (ownershipStop) {
@@ -1325,6 +1327,21 @@ export function createTelegramLockedPollingRuntime(deps) {
     const canStartPolling = (ctx) => deps.canStartPolling?.(ctx) ?? true;
     const formatStartBlockedMessage = (ctx) => deps.formatStartBlockedMessage?.(ctx) ??
         "Telegram polling is unavailable in this Pi run mode.";
+    const stop = async () => {
+        const generation = pollingGeneration + 1;
+        await suspendPolling();
+        if (generation !== pollingGeneration)
+            throw new Error("Telegram disconnect was superseded by a new connection.");
+        const state = deps.lock.release();
+        deps.onTransportAvailabilityChanged?.();
+        if (state.kind === "active-elsewhere") {
+            return `Telegram bridge is active in another Pi instance (${formatTelegramLockEntry(state.lock)}).`;
+        }
+        if (state.kind === "stale") {
+            return `Removed stale Telegram bridge lock (${formatTelegramLockEntry(state.lock)}).`;
+        }
+        return "Telegram bridge disconnected.";
+    };
     return {
         start: async (ctx, options = {}) => {
             if (!deps.hasBotToken()) {
@@ -1440,17 +1457,18 @@ export function createTelegramLockedPollingRuntime(deps) {
             const staleSuffix = acquired.replacedStale ? " Replaced stale lock." : "";
             return { ok: true, message: `Telegram bridge connected.${staleSuffix}` };
         },
-        stop: async () => {
-            await suspendPolling();
-            const state = deps.lock.release();
-            deps.onTransportAvailabilityChanged?.();
-            if (state.kind === "active-elsewhere") {
-                return `Telegram bridge is active in another Pi instance (${formatTelegramLockEntry(state.lock)}).`;
-            }
-            if (state.kind === "stale") {
-                return `Removed stale Telegram bridge lock (${formatTelegramLockEntry(state.lock)}).`;
-            }
-            return "Telegram bridge disconnected.";
+        stop,
+        captureStop() {
+            const generation = pollingGeneration;
+            const isCurrent = () => generation === pollingGeneration;
+            return {
+                isCurrent,
+                async stop() {
+                    if (!isCurrent())
+                        throw new Error("Telegram disconnect was superseded by a new connection.");
+                    return stop();
+                },
+            };
         },
         suspend: suspendPolling,
         captureTransportAuthority(ctx) {

package/node_modules/@llblab/pi-telegram/dist/lib/polling.d.ts

@@ -28,6 +28,8 @@ export declare class TelegramPersistentGetUpdatesConflictError extends Error {
     readonly count: number;
     constructor(count: number);
 }
+/** Exponential backoff for non-conflict polling/admission failures. */
+export declare function getTelegramPollingRetryDelayMs(consecutiveFailures: number): number;
 export declare class TelegramGetUpdatesTimeoutError extends Error {
     readonly timeoutMs: number;
     constructor(timeoutMs: number);

package/node_modules/@llblab/pi-telegram/dist/lib/polling.js

@@ -14,7 +14,8 @@ export const TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT = 10;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_LIMIT = 3;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS = 1_000;
 const TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS = 3_000;
-const TELEGRAM_POLLING_RETRY_MS = 3_000;
+const TELEGRAM_POLLING_RETRY_BASE_MS = 1_000;
+const TELEGRAM_POLLING_RETRY_MAX_MS = 30_000;
 const TELEGRAM_GET_UPDATES_GRACE_MS = 10_000;
 // Standard Telegram DM polling does not expose ordinary message-deletion events.
 // Business deletions belong to a separate namespace and default routing ignores them.
@@ -51,6 +52,11 @@ export class TelegramPersistentGetUpdatesConflictError extends Error {
         this.count = count;
     }
 }
+/** Exponential backoff for non-conflict polling/admission failures. */
+export function getTelegramPollingRetryDelayMs(consecutiveFailures) {
+    const exponent = Math.max(0, Math.min(consecutiveFailures - 1, 16));
+    return Math.min(TELEGRAM_POLLING_RETRY_BASE_MS * 2 ** exponent, TELEGRAM_POLLING_RETRY_MAX_MS);
+}
 export class TelegramGetUpdatesTimeoutError extends Error {
     timeoutMs;
     constructor(timeoutMs) {
@@ -1103,6 +1109,7 @@ export async function runTelegramPollLoop(deps) {
     if (!deps.config.botToken)
         return;
     let consecutiveGetUpdatesConflicts = 0;
+    let consecutiveFailures = 0;
     const retryConflict = async () => {
         consecutiveGetUpdatesConflicts += 1;
         if (consecutiveGetUpdatesConflicts >= TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT) {
@@ -1171,6 +1178,7 @@ export async function runTelegramPollLoop(deps) {
                 onPhaseChange: deps.onPhaseChange,
                 recordRuntimeEvent: deps.recordRuntimeEvent,
             });
+            consecutiveFailures = 0;
             currentUpdateId = undefined;
         }
         catch (error) {
@@ -1190,8 +1198,10 @@ export async function runTelegramPollLoop(deps) {
                     : {}),
             });
             consecutiveGetUpdatesConflicts = 0;
+            consecutiveFailures += 1;
             deps.onErrorStatus(getTelegramPollingErrorMessage(error));
-            await deps.sleep(TELEGRAM_POLLING_RETRY_MS, deps.signal);
+            // Cap the pause, not retry count: outages must recover without manual reconnect.
+            await deps.sleep(getTelegramPollingRetryDelayMs(consecutiveFailures), deps.signal);
             if (deps.signal.aborted)
                 return;
             deps.onStatusReset();

package/node_modules/@llblab/pi-telegram/dist/lib/queue.d.ts

@@ -613,11 +613,13 @@ export type TelegramSessionLifecycleHookEvent = unknown;
 export declare function createTelegramSessionStateApplier<TQueueItem, TModel>(deps: TelegramSessionStateApplierDeps<TQueueItem, TModel>): TelegramSessionStateApplier<TQueueItem, TModel>;
 export interface TelegramQueueMutationRuntimeDeps<TContext> extends TelegramQueueStore<TContext>, TelegramRuntimeEventRecorderPort {
     ctx: TContext;
+    hasPendingDispatch?: () => boolean;
     allocateLaneOrder?: () => number;
     onItemsDiscarded?: (items: readonly TelegramQueueItem<TContext>[], ctx: TContext) => void;
     updateStatus: (ctx: TContext) => void;
 }
 export interface TelegramQueueMutationControllerDeps<TContext> extends TelegramQueueStore<TContext>, TelegramRuntimeEventRecorderPort {
+    hasPendingDispatch?: () => boolean;
     allocateLaneOrder?: () => number;
     onItemsDiscarded?: (items: readonly TelegramQueueItem<TContext>[], ctx: TContext) => void;
     updateStatus: (ctx: TContext) => void;

package/node_modules/@llblab/pi-telegram/dist/lib/queue.js

@@ -582,7 +582,7 @@ function removeTelegramQueuedGuestPromptByOrder(items, queueOrder) {
 export function applyTelegramQueuePromptReactionDisposition(items, messageId, disposition, destinationLaneOrder, scope) {
     let nextItems = items;
     for (const [index, item] of items.entries()) {
-        if (!isPendingTelegramTurn(item) ||
+        if (!isPendingTelegramTurn(item) || item.queueLane === "control" ||
             !isTelegramQueueItemInMessageScope(item, scope) ||
             !item.sourceMessageIds.includes(messageId)) {
             continue;
@@ -1550,7 +1550,15 @@ function updateTelegramQueueStatusRuntime(deps) {
     }
 }
 function commitReorderedTelegramQueueItemsRuntime(items, deps) {
-    deps.setQueuedItems([...items].sort(compareTelegramQueueItems));
+    const pendingHead = deps.hasPendingDispatch?.() ? deps.getQueuedItems()[0] : undefined;
+    const ordered = [...items].sort(compareTelegramQueueItems);
+    if (pendingHead) {
+        const index = ordered.findIndex(item => item.queueOrder === pendingHead.queueOrder && item.kind === pendingHead.kind &&
+            item.chatId === pendingHead.chatId && item.replyToMessageId === pendingHead.replyToMessageId);
+        if (index > 0)
+            ordered.unshift(ordered.splice(index, 1)[0]);
+    }
+    deps.setQueuedItems(ordered);
     updateTelegramQueueStatusRuntime(deps);
 }
 function appendTelegramQueueItemRuntime(item, deps) {
@@ -1602,8 +1610,22 @@ function removeTelegramQueuedGuestPromptByOrderRuntime(queueOrder, deps) {
 }
 export function applyTelegramQueuePromptReactionDispositionRuntime(messageId, disposition, deps, scope) {
     const queuedItems = deps.getQueuedItems();
+    const suppression = disposition.kind === "reaction-transition" ? disposition.suppressionEmoji :
+        disposition.kind === "suppressed" ? disposition.emoji : disposition.kind === "priority-suppressed" ? disposition.suppressionEmoji : undefined;
+    // Source-addressed control-lane prompts are explicit continuations. Synthetic model-switch turns have no source IDs.
+    // A Pi-owned dispatched head cannot be removed: agent_start must consume that exact item, not its successor.
+    const cancelled = suppression && deps.hasPendingDispatch ? queuedItems.filter((item, index) => isPendingTelegramTurn(item) && item.queueLane === "control" && isTelegramQueueItemInMessageScope(item, scope) &&
+        item.sourceMessageIds.includes(messageId) && !(index === 0 && deps.hasPendingDispatch())) : [];
+    if (cancelled.length) {
+        if (cancelled.some(item => (item.admissionReceipts?.length ?? 0) > 0) && !deps.onItemsDiscarded)
+            return false;
+        deps.onItemsDiscarded?.(cancelled, deps.ctx);
+        deps.setQueuedItems(queuedItems.filter(item => !cancelled.includes(item)));
+        updateTelegramQueueStatusRuntime(deps);
+        return true;
+    }
     const changesLane = queuedItems.some((item) => {
-        if (!isPendingTelegramTurn(item) ||
+        if (!isPendingTelegramTurn(item) || item.queueLane === "control" ||
             !isTelegramQueueItemInMessageScope(item, scope) ||
             !item.sourceMessageIds.includes(messageId)) {
             return false;

package/node_modules/@llblab/pi-telegram/dist/lib/routing.d.ts

@@ -121,6 +121,7 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     captureWorkspaceExternalProtection?: ReturnType<typeof createTelegramWorkspaceExternalProtectionCapture>;
     /** Strict committed abandonment plus retained original; shared by Restore and temporary-input cancellation. */
     inspectRestoreSourceAbandonment?: (updateId: number, journalBindingKey: string) => Threads.TelegramTemporaryThreadCancellationEvidence | undefined;
+    inspectRoutingInputGroupExpiry?: (input: Threads.TelegramTemporaryThreadInput) => readonly Threads.TelegramTemporaryThreadCancellationEvidence[] | undefined;
     /** Strict active-journal observation only; a hint or missing source never substitutes for this ACK. */
     inspectRestoreSourceCompletion?: (expected: Updates.TelegramDeferredSourceEvidence & {
         completionSha256: string;