@llblab/pi-kit 0.3.1 → 0.4.0

package/node_modules/@llblab/pi-telegram/lib/bus-leader.ts

@@ -135,6 +135,7 @@ export interface TelegramBusFollowerTargetProvisionerDeps {
 export interface TelegramBusFollowerDisconnectHandlerDeps {
   topicTargetStore: Pick<
     Threads.TelegramTopicTargetStore,
+    | "list"
     | "markStaleByTarget"
     | "persist"
     | "upsertPendingCleanup"
@@ -726,6 +727,7 @@ export function createTelegramBusFollowerTargetProvisioner(
               ],
             }),
             {
+              isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.topicTargetStore),
               callApi: deps.callApi,
               markStaleByTarget(target, syncStatus, lastSyncError) {
                 return deps.topicTargetStore.markStaleByTarget(
@@ -805,16 +807,21 @@ function createTelegramBusFollowerCleanupHandler(
       target: { chatId: target.chatId, threadId: target.threadId },
       requestedAtMs: (deps.getNowMs ?? Date.now)(),
     };
+    const departingRecord = deps.topicTargetStore.list().find((record) => record.instanceId === follower.instanceId &&
+      record.target.chatId === target.chatId && record.target.threadId === target.threadId);
+    const isCleanupTargetProtected = Threads.createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
     deps.topicTargetStore.upsertPendingCleanup(intent);
     await deps.topicTargetStore.persist();
+    const cleanupPlan = ThreadReconciler.planThreadReconciliation({
+      nowMs: (deps.getNowMs ?? Date.now)(),
+      currentLeaderEpoch: leaderEpoch,
+      records: [],
+      pendingCleanups: [intent],
+    });
     const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(
-      ThreadReconciler.planThreadReconciliation({
-        nowMs: (deps.getNowMs ?? Date.now)(),
-        currentLeaderEpoch: leaderEpoch,
-        records: [],
-        pendingCleanups: [intent],
-      }),
+      cleanupPlan,
       {
+        isCleanupTargetProtected,
         callApi: deps.callApi,
         markStaleByTarget: deps.topicTargetStore.markStaleByTarget,
         removeCleanupIntentById: deps.topicTargetStore.removePendingCleanup,
@@ -823,6 +830,7 @@ function createTelegramBusFollowerCleanupHandler(
         recordRuntimeEvent: deps.recordRuntimeEvent,
       },
     );
+    if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) return;
     if (cleanup.incompleteActions?.length) {
       throw new Error(
         "Telegram follower thread deletion was not confirmed; reconnect the leader to retry cleanup.",
@@ -916,6 +924,7 @@ export function createTelegramBusLeaderTargetProvisioner<TContext>(
     });
     deps.recordThreadReconciliationPlan?.(pendingCleanupPlan);
     const cleanupPorts = {
+      isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.topicTargetStore),
       callApi: deps.callApi,
       markStaleByTarget: deps.topicTargetStore.markStaleByTarget,
       removeCleanupIntentById: deps.topicTargetStore.removePendingCleanup,

package/node_modules/@llblab/pi-telegram/lib/bus.ts

@@ -1450,18 +1450,25 @@ export function createTelegramBusFollowerThreadRestoreHandler(
   return async ({ record, target, oldTarget }) => {
     if (!record.instanceId) return false;
     const follower = deps.followerRegistry.get(record.instanceId);
-    if (!follower) return false;
+    if (!follower?.registrationGeneration || !oldTarget ||
+      follower.target?.chatId !== oldTarget.chatId ||
+      follower.target.threadId !== oldTarget.threadId ||
+      target.chatId !== oldTarget.chatId || target.threadId === oldTarget.threadId) return false;
     const replaced = await deps.followerTargetController.replaceTarget({
       follower,
       target,
       oldTarget,
       reason: "thread-restore",
     });
-    if (!replaced) return false;
+    const current = deps.followerRegistry.get(record.instanceId);
+    if (!replaced || !current ||
+      current.registrationGeneration !== follower.registrationGeneration ||
+      current.target?.chatId !== oldTarget.chatId ||
+      current.target.threadId !== oldTarget.threadId) return false;
     deps.followerRegistry.register({
-      ...follower,
+      ...current,
       target,
-      connectedAtMs: follower.connectedAtMs,
+      connectedAtMs: current.connectedAtMs,
     });
     deps.onRestored?.();
     return true;

package/node_modules/@llblab/pi-telegram/lib/outbound-markup.ts

@@ -556,8 +556,40 @@ export function normalizeMarkdownAfterVoiceExtraction(
   return markdown.replace(/\n{3,}/g, "\n\n").trim();
 }
 
+function isTelegramCommentOnlyLinePrefix(value: string): boolean {
+  return /^[ \t]*(?:(?:>[ \t]*)+)?(?:(?:[-+*]|\d+[.)])[ \t]+)?$/u.test(
+    value,
+  );
+}
+
+function stripTelegramHtmlCommentBlocks(markdown: string): string {
+  let result = "";
+  let offset = 0;
+  while (offset < markdown.length) {
+    const start = markdown.indexOf("<!--", offset);
+    if (start === -1) return result + markdown.slice(offset);
+    const close = markdown.indexOf("-->", start + 4);
+    const lineStart = markdown.lastIndexOf("\n", start - 1) + 1;
+    const afterComment = close === -1 ? markdown.length : close + 3;
+    const newlineAfterComment = markdown.indexOf("\n", afterComment);
+    const lineEnd =
+      newlineAfterComment === -1 ? markdown.length : newlineAfterComment;
+    const commentOwnsLine =
+      isTelegramCommentOnlyLinePrefix(markdown.slice(lineStart, start)) &&
+      markdown.slice(afterComment, lineEnd).trim().length === 0;
+    result += markdown.slice(offset, commentOwnsLine ? lineStart : start);
+    if (close === -1) return result;
+    offset = commentOwnsLine
+      ? newlineAfterComment === -1
+        ? markdown.length
+        : newlineAfterComment + 1
+      : afterComment;
+  }
+  return result;
+}
+
 export function stripTelegramCommentMarkupForPreview(markdown: string): string {
-  const withoutClosedBlocks = replaceTopLevelHtmlComments(markdown, () => "");
+  const withoutClosedBlocks = stripTelegramHtmlCommentBlocks(markdown);
   const openBlockIndex =
     findTopLevelOpenOrPartialHtmlCommentIndex(withoutClosedBlocks);
   const previewMarkdown =
@@ -570,7 +602,7 @@ export function stripTelegramCommentMarkupForPreview(markdown: string): string {
 export function stripTelegramCommentMarkupForDelivery(
   markdown: string,
 ): string {
-  const withoutClosedBlocks = replaceTopLevelHtmlComments(markdown, () => "");
+  const withoutClosedBlocks = stripTelegramHtmlCommentBlocks(markdown);
   const openBlockIndex =
     findTopLevelOpenOrPartialHtmlCommentIndex(withoutClosedBlocks);
   const deliveryMarkdown =

package/node_modules/@llblab/pi-telegram/lib/outbound.ts

@@ -26,6 +26,7 @@ import {
 } from "./outbound-buttons.ts";
 import {
   planTelegramVoiceReply,
+  stripTelegramCommentMarkupForDelivery,
   type TelegramVoiceReplyItem,
 } from "./outbound-markup.ts";
 import { createTelegramVoiceReplySender as createTelegramVoiceReplySenderWithPorts } from "./outbound-voice.ts";
@@ -698,7 +699,9 @@ export function createTelegramOutboundTextReplyRuntime<TReplyMarkup = unknown>(
       return deps.sendTextReply(chatId, replyToMessageId, transformed, options);
     },
     sendMarkdownReply: async (chatId, replyToMessageId, markdown, options) => {
-      const transformed = await transformTelegramOutboundTextReply(markdown, {
+      const deliveryMarkdown = stripTelegramCommentMarkupForDelivery(markdown);
+      if (!deliveryMarkdown) return undefined;
+      const transformed = await transformTelegramOutboundTextReply(deliveryMarkdown, {
         handlers: deps.getHandlers?.(),
         cwd: deps.cwd,
         execCommand: deps.execCommand,

package/node_modules/@llblab/pi-telegram/lib/routing.ts

@@ -281,19 +281,17 @@ function formatTelegramAllTabMenuChooserText(command: string): string {
     "",
     `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.`,
     "Select the Pi thread that should handle it:",
+    "To restore into a new thread, send a plain message in that destination thread first.",
   ].join("\n");
 }
 
 function buildTelegramUnboundRerouteChooserMarkup(
   rerouteId: string,
   records: readonly Threads.TelegramTopicTargetRecord[],
-  _options: {
-    currentLeaderProfileKey?: string;
-    currentInstanceId?: string;
-  } = {},
+  options: { canRestore: boolean },
 ): Menu.TelegramReplyMarkup {
   const activeRecords = records.filter((record) => record.status === "active");
-  const canRestoreAnyLiveThread = activeRecords.length > 0;
+  const canRestoreAnyLiveThread = options.canRestore && activeRecords.length > 0;
   const rows = activeRecords.map((record) => [
     {
       text: getTelegramRouteThreadButtonLabel(record),
@@ -433,6 +431,7 @@ async function deleteReservedTelegramTopicThroughReconciler(
   });
   deps.recordThreadReconciliationPlan?.(plan);
   await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+    isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.threadStore),
     callApi: deps.callApi,
     markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
       deps.threadStore?.markStaleByTarget(
@@ -734,6 +733,8 @@ export function createTelegramInboundRouteRuntime<
         instanceId?: string;
       };
   type PendingUnboundReroute = {
+    sourceTarget: Queue.TelegramQueueTarget;
+    chooserMessageId?: number;
     messages: TMessage[];
     createdAtMs: number;
     dispatchKind: "prompt" | "command";
@@ -842,12 +843,33 @@ export function createTelegramInboundRouteRuntime<
     nextUnboundRerouteId += 1;
     const id = nextUnboundRerouteId.toString(36);
     pendingUnboundReroutes.set(id, {
+      sourceTarget: {
+        chatId: messages[0]!.chat.id,
+        ...(typeof messages[0]!.message_thread_id === "number"
+          ? { threadId: messages[0]!.message_thread_id }
+          : {}),
+      },
       messages,
       createdAtMs: Date.now(),
       dispatchKind,
     });
     return id;
   };
+  const rememberRerouteChooser = (id: string, messageId: number | undefined): void => {
+    const pending = pendingUnboundReroutes.get(id);
+    if (pending) pending.chooserMessageId = messageId;
+  };
+  const matchesRerouteChooser = (
+    pending: PendingUnboundReroute,
+    query: TCallbackQuery,
+  ): boolean => {
+    const message = query.message;
+    return !!message && pending.chooserMessageId !== undefined &&
+      message.message_id === pending.chooserMessageId &&
+      message.chat.id === pending.sourceTarget.chatId &&
+      (message.message_thread_id === undefined ||
+        message.message_thread_id === pending.sourceTarget.threadId);
+  };
   const pendingUnboundRerouteMediaGroups = new Map<
     string,
     {
@@ -951,6 +973,10 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent?.();
     deps.recordThreadReconciliationPlan?.(plan);
     const result = await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+      isCleanupTargetProtected(target) {
+        assertExecutionCurrent?.();
+        return isRerouteTargetProtected(target);
+      },
       callApi: deps.callApi,
       markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
         deps.threadStore?.markStaleByTarget(
@@ -967,6 +993,14 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent?.();
     return (result.incompleteActions?.length ?? 0) === 0;
   };
+  const isRerouteTargetProtected = (target: Queue.TelegramQueueTarget): boolean => {
+    const matches = (candidate: Queue.TelegramQueueTarget): boolean =>
+      candidate.chatId === target.chatId && candidate.threadId === target.threadId;
+    return (deps.getLiveThreadTargets?.() ?? []).some(matches) ||
+      (deps.threadStore?.list() ?? []).some((record) => matches(record.target)) ||
+      (deps.threadStore?.listReservations() ?? []).some((record) => matches(record.target)) ||
+      (deps.threadStore?.listPendingProvisions() ?? []).some((record) => !!record.target && matches(record.target));
+  };
   const dismissRerouteChooserMessage = async (
     query: TCallbackQuery,
     assertExecutionCurrent?: () => void,
@@ -986,6 +1020,7 @@ export function createTelegramInboundRouteRuntime<
       assertExecutionCurrent?.();
       return true;
     } catch (error) {
+      assertExecutionCurrent?.();
       deps.recordRuntimeEvent?.("telegram", error, {
         phase: "reroute-chooser-delete",
         chatId,
@@ -1103,12 +1138,14 @@ export function createTelegramInboundRouteRuntime<
     pending: PendingUnboundReroute,
     query: TCallbackQuery,
     successMessage: string,
-    assertExecutionCurrent?: () => void,
+    assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query),
   ): Promise<void> => {
+    assertExecutionCurrent();
     const dismissed = await dismissRerouteChooserMessage(
       query,
       assertExecutionCurrent,
     );
+    assertExecutionCurrent();
     if (dismissed) {
       pendingUnboundReroutes.delete(rerouteId);
       await deps.answerCallbackQuery(query.id, successMessage);
@@ -1169,6 +1206,8 @@ export function createTelegramInboundRouteRuntime<
       query.data,
     );
     if (!parsed) return false;
+    const assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query);
+    assertExecutionCurrent();
     const chatId = query.message?.chat?.id;
     const messageId = query.message?.message_id;
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
@@ -1176,12 +1215,18 @@ export function createTelegramInboundRouteRuntime<
       typeof chatId !== "number" ||
       typeof messageId !== "number" ||
       !deps.threadStore ||
-      !pending
+      !pending ||
+      !matchesRerouteChooser(pending, query)
     ) {
       await deps.answerCallbackQuery(query.id, "Message route expired.");
       return true;
     }
+    if (pending.sourceTarget.threadId === undefined) {
+      await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
+      return true;
+    }
     await deps.threadStore.load();
+    assertExecutionCurrent();
     const activeRecords = getTelegramRoutableThreadRecords(
       deps.threadStore.list(),
       deps.getLiveThreadTargets?.(),
@@ -1199,19 +1244,17 @@ export function createTelegramInboundRouteRuntime<
         replyMarkup,
       );
     } else if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         chatId,
         formatTelegramUnboundRerouteRestoreChooserText(),
         "html",
         replyMarkup,
-        typeof query.message?.message_thread_id === "number"
-          ? {
-              target: { chatId, threadId: query.message.message_thread_id },
-              replyToMessageId: messageId,
-            }
-          : undefined,
+        { target: pending.sourceTarget, replyToMessageId: messageId },
       );
+      assertExecutionCurrent();
+      rememberRerouteChooser(parsed.rerouteId, chooserId);
     }
+    assertExecutionCurrent();
     await deps.answerCallbackQuery(query.id, "Choose instance to restore.");
     return true;
   };
@@ -1226,7 +1269,8 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent();
     const chatId = query.message?.chat?.id;
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
-    if (typeof chatId !== "number" || !deps.threadStore || !pending) {
+    if (typeof chatId !== "number" || !deps.threadStore || !pending ||
+      !matchesRerouteChooser(pending, query)) {
       await deps.answerCallbackQuery(query.id, "Message route expired.");
       return true;
     }
@@ -1300,10 +1344,23 @@ export function createTelegramInboundRouteRuntime<
       parsed.threadId,
     );
     const sourceTarget =
-      typeof query.message?.message_thread_id === "number"
-        ? { chatId, threadId: query.message.message_thread_id }
+      typeof pending.sourceTarget.threadId === "number"
+        ? { chatId, threadId: pending.sourceTarget.threadId }
         : undefined;
-    const sourceMessageId = query.message?.message_id;
+    const sourceMessageId = pending.chooserMessageId;
+    if (parsed.useNewSlot && !sourceTarget) {
+      await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
+      return true;
+    }
+    if (parsed.useNewSlot && sourceTarget && record.target.chatId === sourceTarget.chatId &&
+      record.target.threadId === sourceTarget.threadId) {
+      await deps.answerCallbackQuery(query.id, "🚫 Selected thread is already the destination.");
+      return true;
+    }
+    if (parsed.useNewSlot && sourceTarget && isRerouteTargetProtected(sourceTarget)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Thread restore source is already owned.");
+      return true;
+    }
     const currentInstanceId = deps.getCurrentInstanceId?.();
     const leaderProfileKey = getLeaderTopicProfileKey(ctx, currentInstanceId);
     const isCurrentLeaderRecord = isCurrentLeaderTopicRecord(
@@ -1507,6 +1564,7 @@ export function createTelegramInboundRouteRuntime<
         rerouteConfirmedAtMs: nowMs,
       });
       await deps.threadStore.persist();
+      assertExecutionCurrent();
       deps.setCurrentLeaderIdentity?.({
         target: sourceTarget,
         slot,
@@ -1944,7 +2002,7 @@ export function createTelegramInboundRouteRuntime<
   };
   const sendUnboundRerouteChooserNow = async (
     messages: TMessage[],
-    ctx: TContext,
+    _ctx: TContext,
     reportDeferred = true,
   ): Promise<void> => {
     const message = messages[0];
@@ -1988,20 +2046,13 @@ export function createTelegramInboundRouteRuntime<
     const text = formatTelegramUnboundRerouteChooserText(activeRecords, {
       includeGuidance,
     });
-    const currentInstanceId = deps.getCurrentInstanceId?.();
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
-      {
-        currentLeaderProfileKey: getLeaderTopicProfileKey(
-          ctx,
-          currentInstanceId,
-        ),
-        currentInstanceId,
-      },
+      { canRestore: sourceTarget !== undefined },
     );
     if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         message.chat.id,
         text,
         "html",
@@ -2010,12 +2061,14 @@ export function createTelegramInboundRouteRuntime<
           ? { target: sourceTarget, replyToMessageId: message.message_id }
           : { replyToMessageId: message.message_id },
       );
+      rememberRerouteChooser(rerouteId, chooserId);
       return;
     }
-    await deps.sendTextReply(message.chat.id, message.message_id, text, {
+    const chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
       parseMode: "HTML",
       target: sourceTarget,
     });
+    rememberRerouteChooser(rerouteId, chooserId);
   };
   const sendUnboundRerouteChooser = async (
     message: TMessage,
@@ -2080,9 +2133,10 @@ export function createTelegramInboundRouteRuntime<
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
+      { canRestore: typeof message.message_thread_id === "number" },
     );
     if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         message.chat.id,
         text,
         "html",
@@ -2096,10 +2150,11 @@ export function createTelegramInboundRouteRuntime<
             }
           : undefined,
       );
+      rememberRerouteChooser(rerouteId, chooserId);
       return true;
     }
     if (deps.callApi) {
-      await deps.callApi("sendMessage", {
+      const chooser = await deps.callApi<{ message_id?: number }>("sendMessage", {
         chat_id: message.chat.id,
         text,
         parse_mode: "HTML",
@@ -2116,12 +2171,14 @@ export function createTelegramInboundRouteRuntime<
             }
           : {}),
       });
+      rememberRerouteChooser(rerouteId, chooser?.message_id);
       return true;
     }
-    await deps.sendTextReply(message.chat.id, message.message_id, text, {
+    const chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
       parseMode: "HTML",
       target: options.target,
     });
+    rememberRerouteChooser(rerouteId, chooserId);
     return true;
   };
   const commandOrPrompt = Commands.createTelegramCommandOrPromptRuntime<

package/node_modules/@llblab/pi-telegram/lib/sync.ts

@@ -4,10 +4,11 @@
  * Owns pure contracts for deciding when local Telegram mirror state should be refreshed without querying Telegram on every action
  */
 
-import { getTelegramApiErrorRequestTarget } from "./telegram-api.ts";
+import { getTelegramApiErrorRequestTarget, isTelegramStaleTargetHttpError } from "./telegram-api.ts";
 import { getTelegramTargetKey, type TelegramTarget } from "./target.ts";
 import * as ThreadReconciler from "./thread-reconciler.ts";
 import {
+  createTelegramCleanupTargetProtection,
   getTelegramTargetFromApiBody,
   isTelegramTopicTargetStaleError,
   provisionOwnBusTopic,
@@ -121,6 +122,7 @@ export interface TelegramManualThreadDisconnectDeps<TSyncState> {
     | undefined;
   topicTargetStore: Pick<
     TelegramTopicTargetStore,
+    | "list"
     | "markStaleByTarget"
     | "persist"
     | "upsertPendingCleanup"
@@ -247,16 +249,21 @@ export function createTelegramManualThreadDisconnectHandler<
           target,
           requestedAtMs: (deps.getNowMs ?? Date.now)(),
         };
+        const departingRecord = deps.topicTargetStore.list().find((record) => record.instanceId === currentRecord.instanceId &&
+          record.target.chatId === target.chatId && record.target.threadId === target.threadId);
+        const isCleanupTargetProtected = createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
         deps.topicTargetStore.upsertPendingCleanup(intent);
         await deps.topicTargetStore.persist();
+        const cleanupPlan = ThreadReconciler.planThreadReconciliation({
+          nowMs: (deps.getNowMs ?? Date.now)(),
+          currentLeaderEpoch: leaderEpoch,
+          records: [],
+          pendingCleanups: [intent],
+        });
         const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(
-          ThreadReconciler.planThreadReconciliation({
-            nowMs: (deps.getNowMs ?? Date.now)(),
-            currentLeaderEpoch: leaderEpoch,
-            records: [],
-            pendingCleanups: [intent],
-          }),
+          cleanupPlan,
           {
+            isCleanupTargetProtected,
             callApi(method, body) {
               return deps.callApi(method, body);
             },
@@ -277,6 +284,9 @@ export function createTelegramManualThreadDisconnectHandler<
             recordRuntimeEvent: deps.recordRuntimeEvent,
           },
         );
+        if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) {
+          return "Thread disconnect superseded by a new binding.";
+        }
         cleanupPending = Boolean(cleanup.incompleteActions?.length);
       }
       const leaderTarget = deps.getLeaderTarget();
@@ -404,7 +414,7 @@ export interface TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> {
   topicTargetStore: Pick<
     TelegramTopicTargetStore,
     "load" | "markStaleByTarget" | "persist"
-  >;
+  > & Partial<Pick<TelegramTopicTargetStore, "invalidateTarget">>;
   getSyncState: () => TSyncState;
   setSyncState: (state: TSyncState) => void;
   recordEvent: (
@@ -413,6 +423,46 @@ export interface TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> {
     details?: Record<string, unknown>,
   ) => void;
   getNowMs?: () => number;
+  isCurrent?: () => boolean;
+  isAuthorityCurrent?: () => boolean;
+}
+
+export function captureTelegramStaleTargetRequestRecovery<TSyncState extends TelegramSyncState>(
+  body: Record<string, unknown>,
+  deps: TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> & {
+    topicTargetStore: Pick<TelegramTopicTargetStore, "load" | "list" | "markStaleByTarget" | "persist" | "invalidateTarget">;
+    getCurrentLeaderEpoch: () => number | string | undefined;
+    getSessionGeneration: () => number;
+    getProfileName: () => string | undefined;
+    onRecovered: () => void;
+  },
+): ((error: unknown) => Promise<void>) | undefined {
+  const target = getTelegramTargetFromApiBody(body);
+  const epoch = deps.getCurrentLeaderEpoch();
+  if (!target || epoch === undefined) return undefined;
+  const key = getTelegramTargetKey(target);
+  const record = deps.topicTargetStore.list().find((candidate) => getTelegramTargetKey(candidate.target) === key);
+  if (!record) return undefined;
+  const generation = deps.getSessionGeneration();
+  const profile = deps.getProfileName();
+  const isAuthorityCurrent = (): boolean => deps.getCurrentLeaderEpoch() === epoch &&
+    deps.getSessionGeneration() === generation && deps.getProfileName() === profile;
+  const isCurrent = (): boolean => {
+    const current = deps.topicTargetStore.list().find((candidate) => getTelegramTargetKey(candidate.target) === key);
+    return isAuthorityCurrent() &&
+      current?.instanceId === record.instanceId && current?.profileKey === record.profileKey &&
+      current?.updatedAtMs === record.updatedAtMs && current?.createdAtMs === record.createdAtMs;
+  };
+  return async (error) => {
+    const requestTarget = getTelegramApiErrorRequestTarget(error);
+    if (!isTelegramStaleTargetHttpError(error) || !requestTarget ||
+      getTelegramTargetKey(requestTarget) !== key || !isCurrent()) return;
+    if (await recoverStaleTelegramTopicApiError(
+      { chat_id: target.chatId, message_thread_id: target.threadId }, error, { ...deps, isCurrent, isAuthorityCurrent },
+    )) {
+      deps.onRecovered();
+    }
+  };
 }
 
 export function createTelegramStaleTopicApiErrorRecoveryRuntime<
@@ -448,12 +498,16 @@ export async function recoverStaleTelegramTopicApiError<
   deps: TelegramStaleTopicApiErrorRecoveryDeps<TSyncState>,
 ): Promise<boolean> {
   const target = getTelegramTargetFromApiBody(apiBody);
-  if (!target || !isTelegramTopicTargetStaleError(error)) return false;
-  await deps.topicTargetStore.load();
-  if (
-    !deps.topicTargetStore.markStaleByTarget(target, "deleted", String(error))
-  ) {
-    return false;
+  if (!target || !isTelegramTopicTargetStaleError(error) || deps.isCurrent?.() === false) return false;
+  if (deps.isCurrent) {
+    if (!deps.topicTargetStore.invalidateTarget || !await deps.topicTargetStore.invalidateTarget(
+      target, deps.isCurrent, String(error),
+    )) return false;
+    if (deps.isAuthorityCurrent?.() === false) return false;
+  } else {
+    await deps.topicTargetStore.load();
+    if (!deps.topicTargetStore.markStaleByTarget(target, "deleted", String(error))) return false;
+    await deps.topicTargetStore.persist();
   }
   const nowMs = (deps.getNowMs ?? Date.now)();
   let state = markTelegramSyncSliceSuspect(deps.getSyncState(), "topic-state", {
@@ -466,8 +520,12 @@ export async function recoverStaleTelegramTopicApiError<
     reason: "stale-api-error",
     action: "topic-target-stale",
   }) as TSyncState;
+  state = markTelegramSyncSliceSuspect(state, "target-bindings", {
+    nowMs,
+    reason: "stale-api-error",
+    action: "topic-target-stale",
+  }) as TSyncState;
   deps.setSyncState(state);
-  await deps.topicTargetStore.persist();
   deps.recordEvent("bus", error, {
     phase: "topic-target-stale",
     chatId: target.chatId,
@@ -606,6 +664,7 @@ export async function ensureTelegramLeaderThreadBinding(
   });
   deps.recordThreadReconciliationPlan?.(replacementPlan);
   await ThreadReconciler.applyThreadReconciliationPlan(replacementPlan, {
+    isCleanupTargetProtected: createTelegramCleanupTargetProtection(deps.topicTargetStore),
     callApi: deps.callApi,
     markStaleByTarget: (target, syncStatus, lastSyncError) =>
       deps.topicTargetStore.markStaleByTarget(