@llblab/pi-kit 0.3.2 → 0.4.0

package/node_modules/@llblab/pi-telegram/lib/routing.ts

@@ -281,19 +281,17 @@ function formatTelegramAllTabMenuChooserText(command: string): string {
     "",
     `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.`,
     "Select the Pi thread that should handle it:",
+    "To restore into a new thread, send a plain message in that destination thread first.",
   ].join("\n");
 }
 
 function buildTelegramUnboundRerouteChooserMarkup(
   rerouteId: string,
   records: readonly Threads.TelegramTopicTargetRecord[],
-  _options: {
-    currentLeaderProfileKey?: string;
-    currentInstanceId?: string;
-  } = {},
+  options: { canRestore: boolean },
 ): Menu.TelegramReplyMarkup {
   const activeRecords = records.filter((record) => record.status === "active");
-  const canRestoreAnyLiveThread = activeRecords.length > 0;
+  const canRestoreAnyLiveThread = options.canRestore && activeRecords.length > 0;
   const rows = activeRecords.map((record) => [
     {
       text: getTelegramRouteThreadButtonLabel(record),
@@ -433,6 +431,7 @@ async function deleteReservedTelegramTopicThroughReconciler(
   });
   deps.recordThreadReconciliationPlan?.(plan);
   await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+    isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.threadStore),
     callApi: deps.callApi,
     markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
       deps.threadStore?.markStaleByTarget(
@@ -734,6 +733,8 @@ export function createTelegramInboundRouteRuntime<
         instanceId?: string;
       };
   type PendingUnboundReroute = {
+    sourceTarget: Queue.TelegramQueueTarget;
+    chooserMessageId?: number;
     messages: TMessage[];
     createdAtMs: number;
     dispatchKind: "prompt" | "command";
@@ -842,12 +843,33 @@ export function createTelegramInboundRouteRuntime<
     nextUnboundRerouteId += 1;
     const id = nextUnboundRerouteId.toString(36);
     pendingUnboundReroutes.set(id, {
+      sourceTarget: {
+        chatId: messages[0]!.chat.id,
+        ...(typeof messages[0]!.message_thread_id === "number"
+          ? { threadId: messages[0]!.message_thread_id }
+          : {}),
+      },
       messages,
       createdAtMs: Date.now(),
       dispatchKind,
     });
     return id;
   };
+  const rememberRerouteChooser = (id: string, messageId: number | undefined): void => {
+    const pending = pendingUnboundReroutes.get(id);
+    if (pending) pending.chooserMessageId = messageId;
+  };
+  const matchesRerouteChooser = (
+    pending: PendingUnboundReroute,
+    query: TCallbackQuery,
+  ): boolean => {
+    const message = query.message;
+    return !!message && pending.chooserMessageId !== undefined &&
+      message.message_id === pending.chooserMessageId &&
+      message.chat.id === pending.sourceTarget.chatId &&
+      (message.message_thread_id === undefined ||
+        message.message_thread_id === pending.sourceTarget.threadId);
+  };
   const pendingUnboundRerouteMediaGroups = new Map<
     string,
     {
@@ -951,6 +973,10 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent?.();
     deps.recordThreadReconciliationPlan?.(plan);
     const result = await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+      isCleanupTargetProtected(target) {
+        assertExecutionCurrent?.();
+        return isRerouteTargetProtected(target);
+      },
       callApi: deps.callApi,
       markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
         deps.threadStore?.markStaleByTarget(
@@ -967,6 +993,14 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent?.();
     return (result.incompleteActions?.length ?? 0) === 0;
   };
+  const isRerouteTargetProtected = (target: Queue.TelegramQueueTarget): boolean => {
+    const matches = (candidate: Queue.TelegramQueueTarget): boolean =>
+      candidate.chatId === target.chatId && candidate.threadId === target.threadId;
+    return (deps.getLiveThreadTargets?.() ?? []).some(matches) ||
+      (deps.threadStore?.list() ?? []).some((record) => matches(record.target)) ||
+      (deps.threadStore?.listReservations() ?? []).some((record) => matches(record.target)) ||
+      (deps.threadStore?.listPendingProvisions() ?? []).some((record) => !!record.target && matches(record.target));
+  };
   const dismissRerouteChooserMessage = async (
     query: TCallbackQuery,
     assertExecutionCurrent?: () => void,
@@ -986,6 +1020,7 @@ export function createTelegramInboundRouteRuntime<
       assertExecutionCurrent?.();
       return true;
     } catch (error) {
+      assertExecutionCurrent?.();
       deps.recordRuntimeEvent?.("telegram", error, {
         phase: "reroute-chooser-delete",
         chatId,
@@ -1103,12 +1138,14 @@ export function createTelegramInboundRouteRuntime<
     pending: PendingUnboundReroute,
     query: TCallbackQuery,
     successMessage: string,
-    assertExecutionCurrent?: () => void,
+    assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query),
   ): Promise<void> => {
+    assertExecutionCurrent();
     const dismissed = await dismissRerouteChooserMessage(
       query,
       assertExecutionCurrent,
     );
+    assertExecutionCurrent();
     if (dismissed) {
       pendingUnboundReroutes.delete(rerouteId);
       await deps.answerCallbackQuery(query.id, successMessage);
@@ -1169,6 +1206,8 @@ export function createTelegramInboundRouteRuntime<
       query.data,
     );
     if (!parsed) return false;
+    const assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query);
+    assertExecutionCurrent();
     const chatId = query.message?.chat?.id;
     const messageId = query.message?.message_id;
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
@@ -1176,12 +1215,18 @@ export function createTelegramInboundRouteRuntime<
       typeof chatId !== "number" ||
       typeof messageId !== "number" ||
       !deps.threadStore ||
-      !pending
+      !pending ||
+      !matchesRerouteChooser(pending, query)
     ) {
       await deps.answerCallbackQuery(query.id, "Message route expired.");
       return true;
     }
+    if (pending.sourceTarget.threadId === undefined) {
+      await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
+      return true;
+    }
     await deps.threadStore.load();
+    assertExecutionCurrent();
     const activeRecords = getTelegramRoutableThreadRecords(
       deps.threadStore.list(),
       deps.getLiveThreadTargets?.(),
@@ -1199,19 +1244,17 @@ export function createTelegramInboundRouteRuntime<
         replyMarkup,
       );
     } else if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         chatId,
         formatTelegramUnboundRerouteRestoreChooserText(),
         "html",
         replyMarkup,
-        typeof query.message?.message_thread_id === "number"
-          ? {
-              target: { chatId, threadId: query.message.message_thread_id },
-              replyToMessageId: messageId,
-            }
-          : undefined,
+        { target: pending.sourceTarget, replyToMessageId: messageId },
       );
+      assertExecutionCurrent();
+      rememberRerouteChooser(parsed.rerouteId, chooserId);
     }
+    assertExecutionCurrent();
     await deps.answerCallbackQuery(query.id, "Choose instance to restore.");
     return true;
   };
@@ -1226,7 +1269,8 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent();
     const chatId = query.message?.chat?.id;
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
-    if (typeof chatId !== "number" || !deps.threadStore || !pending) {
+    if (typeof chatId !== "number" || !deps.threadStore || !pending ||
+      !matchesRerouteChooser(pending, query)) {
       await deps.answerCallbackQuery(query.id, "Message route expired.");
       return true;
     }
@@ -1300,10 +1344,23 @@ export function createTelegramInboundRouteRuntime<
       parsed.threadId,
     );
     const sourceTarget =
-      typeof query.message?.message_thread_id === "number"
-        ? { chatId, threadId: query.message.message_thread_id }
+      typeof pending.sourceTarget.threadId === "number"
+        ? { chatId, threadId: pending.sourceTarget.threadId }
         : undefined;
-    const sourceMessageId = query.message?.message_id;
+    const sourceMessageId = pending.chooserMessageId;
+    if (parsed.useNewSlot && !sourceTarget) {
+      await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
+      return true;
+    }
+    if (parsed.useNewSlot && sourceTarget && record.target.chatId === sourceTarget.chatId &&
+      record.target.threadId === sourceTarget.threadId) {
+      await deps.answerCallbackQuery(query.id, "🚫 Selected thread is already the destination.");
+      return true;
+    }
+    if (parsed.useNewSlot && sourceTarget && isRerouteTargetProtected(sourceTarget)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Thread restore source is already owned.");
+      return true;
+    }
     const currentInstanceId = deps.getCurrentInstanceId?.();
     const leaderProfileKey = getLeaderTopicProfileKey(ctx, currentInstanceId);
     const isCurrentLeaderRecord = isCurrentLeaderTopicRecord(
@@ -1507,6 +1564,7 @@ export function createTelegramInboundRouteRuntime<
         rerouteConfirmedAtMs: nowMs,
       });
       await deps.threadStore.persist();
+      assertExecutionCurrent();
       deps.setCurrentLeaderIdentity?.({
         target: sourceTarget,
         slot,
@@ -1944,7 +2002,7 @@ export function createTelegramInboundRouteRuntime<
   };
   const sendUnboundRerouteChooserNow = async (
     messages: TMessage[],
-    ctx: TContext,
+    _ctx: TContext,
     reportDeferred = true,
   ): Promise<void> => {
     const message = messages[0];
@@ -1988,20 +2046,13 @@ export function createTelegramInboundRouteRuntime<
     const text = formatTelegramUnboundRerouteChooserText(activeRecords, {
       includeGuidance,
     });
-    const currentInstanceId = deps.getCurrentInstanceId?.();
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
-      {
-        currentLeaderProfileKey: getLeaderTopicProfileKey(
-          ctx,
-          currentInstanceId,
-        ),
-        currentInstanceId,
-      },
+      { canRestore: sourceTarget !== undefined },
     );
     if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         message.chat.id,
         text,
         "html",
@@ -2010,12 +2061,14 @@ export function createTelegramInboundRouteRuntime<
           ? { target: sourceTarget, replyToMessageId: message.message_id }
           : { replyToMessageId: message.message_id },
       );
+      rememberRerouteChooser(rerouteId, chooserId);
       return;
     }
-    await deps.sendTextReply(message.chat.id, message.message_id, text, {
+    const chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
       parseMode: "HTML",
       target: sourceTarget,
     });
+    rememberRerouteChooser(rerouteId, chooserId);
   };
   const sendUnboundRerouteChooser = async (
     message: TMessage,
@@ -2080,9 +2133,10 @@ export function createTelegramInboundRouteRuntime<
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
+      { canRestore: typeof message.message_thread_id === "number" },
     );
     if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         message.chat.id,
         text,
         "html",
@@ -2096,10 +2150,11 @@ export function createTelegramInboundRouteRuntime<
             }
           : undefined,
       );
+      rememberRerouteChooser(rerouteId, chooserId);
       return true;
     }
     if (deps.callApi) {
-      await deps.callApi("sendMessage", {
+      const chooser = await deps.callApi<{ message_id?: number }>("sendMessage", {
         chat_id: message.chat.id,
         text,
         parse_mode: "HTML",
@@ -2116,12 +2171,14 @@ export function createTelegramInboundRouteRuntime<
             }
           : {}),
       });
+      rememberRerouteChooser(rerouteId, chooser?.message_id);
       return true;
     }
-    await deps.sendTextReply(message.chat.id, message.message_id, text, {
+    const chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
       parseMode: "HTML",
       target: options.target,
     });
+    rememberRerouteChooser(rerouteId, chooserId);
     return true;
   };
   const commandOrPrompt = Commands.createTelegramCommandOrPromptRuntime<

package/node_modules/@llblab/pi-telegram/lib/sync.ts

@@ -4,10 +4,11 @@
  * Owns pure contracts for deciding when local Telegram mirror state should be refreshed without querying Telegram on every action
  */
 
-import { getTelegramApiErrorRequestTarget } from "./telegram-api.ts";
+import { getTelegramApiErrorRequestTarget, isTelegramStaleTargetHttpError } from "./telegram-api.ts";
 import { getTelegramTargetKey, type TelegramTarget } from "./target.ts";
 import * as ThreadReconciler from "./thread-reconciler.ts";
 import {
+  createTelegramCleanupTargetProtection,
   getTelegramTargetFromApiBody,
   isTelegramTopicTargetStaleError,
   provisionOwnBusTopic,
@@ -121,6 +122,7 @@ export interface TelegramManualThreadDisconnectDeps<TSyncState> {
     | undefined;
   topicTargetStore: Pick<
     TelegramTopicTargetStore,
+    | "list"
     | "markStaleByTarget"
     | "persist"
     | "upsertPendingCleanup"
@@ -247,16 +249,21 @@ export function createTelegramManualThreadDisconnectHandler<
           target,
           requestedAtMs: (deps.getNowMs ?? Date.now)(),
         };
+        const departingRecord = deps.topicTargetStore.list().find((record) => record.instanceId === currentRecord.instanceId &&
+          record.target.chatId === target.chatId && record.target.threadId === target.threadId);
+        const isCleanupTargetProtected = createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
         deps.topicTargetStore.upsertPendingCleanup(intent);
         await deps.topicTargetStore.persist();
+        const cleanupPlan = ThreadReconciler.planThreadReconciliation({
+          nowMs: (deps.getNowMs ?? Date.now)(),
+          currentLeaderEpoch: leaderEpoch,
+          records: [],
+          pendingCleanups: [intent],
+        });
         const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(
-          ThreadReconciler.planThreadReconciliation({
-            nowMs: (deps.getNowMs ?? Date.now)(),
-            currentLeaderEpoch: leaderEpoch,
-            records: [],
-            pendingCleanups: [intent],
-          }),
+          cleanupPlan,
           {
+            isCleanupTargetProtected,
             callApi(method, body) {
               return deps.callApi(method, body);
             },
@@ -277,6 +284,9 @@ export function createTelegramManualThreadDisconnectHandler<
             recordRuntimeEvent: deps.recordRuntimeEvent,
           },
         );
+        if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) {
+          return "Thread disconnect superseded by a new binding.";
+        }
         cleanupPending = Boolean(cleanup.incompleteActions?.length);
       }
       const leaderTarget = deps.getLeaderTarget();
@@ -404,7 +414,7 @@ export interface TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> {
   topicTargetStore: Pick<
     TelegramTopicTargetStore,
     "load" | "markStaleByTarget" | "persist"
-  >;
+  > & Partial<Pick<TelegramTopicTargetStore, "invalidateTarget">>;
   getSyncState: () => TSyncState;
   setSyncState: (state: TSyncState) => void;
   recordEvent: (
@@ -413,6 +423,46 @@ export interface TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> {
     details?: Record<string, unknown>,
   ) => void;
   getNowMs?: () => number;
+  isCurrent?: () => boolean;
+  isAuthorityCurrent?: () => boolean;
+}
+
+export function captureTelegramStaleTargetRequestRecovery<TSyncState extends TelegramSyncState>(
+  body: Record<string, unknown>,
+  deps: TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> & {
+    topicTargetStore: Pick<TelegramTopicTargetStore, "load" | "list" | "markStaleByTarget" | "persist" | "invalidateTarget">;
+    getCurrentLeaderEpoch: () => number | string | undefined;
+    getSessionGeneration: () => number;
+    getProfileName: () => string | undefined;
+    onRecovered: () => void;
+  },
+): ((error: unknown) => Promise<void>) | undefined {
+  const target = getTelegramTargetFromApiBody(body);
+  const epoch = deps.getCurrentLeaderEpoch();
+  if (!target || epoch === undefined) return undefined;
+  const key = getTelegramTargetKey(target);
+  const record = deps.topicTargetStore.list().find((candidate) => getTelegramTargetKey(candidate.target) === key);
+  if (!record) return undefined;
+  const generation = deps.getSessionGeneration();
+  const profile = deps.getProfileName();
+  const isAuthorityCurrent = (): boolean => deps.getCurrentLeaderEpoch() === epoch &&
+    deps.getSessionGeneration() === generation && deps.getProfileName() === profile;
+  const isCurrent = (): boolean => {
+    const current = deps.topicTargetStore.list().find((candidate) => getTelegramTargetKey(candidate.target) === key);
+    return isAuthorityCurrent() &&
+      current?.instanceId === record.instanceId && current?.profileKey === record.profileKey &&
+      current?.updatedAtMs === record.updatedAtMs && current?.createdAtMs === record.createdAtMs;
+  };
+  return async (error) => {
+    const requestTarget = getTelegramApiErrorRequestTarget(error);
+    if (!isTelegramStaleTargetHttpError(error) || !requestTarget ||
+      getTelegramTargetKey(requestTarget) !== key || !isCurrent()) return;
+    if (await recoverStaleTelegramTopicApiError(
+      { chat_id: target.chatId, message_thread_id: target.threadId }, error, { ...deps, isCurrent, isAuthorityCurrent },
+    )) {
+      deps.onRecovered();
+    }
+  };
 }
 
 export function createTelegramStaleTopicApiErrorRecoveryRuntime<
@@ -448,12 +498,16 @@ export async function recoverStaleTelegramTopicApiError<
   deps: TelegramStaleTopicApiErrorRecoveryDeps<TSyncState>,
 ): Promise<boolean> {
   const target = getTelegramTargetFromApiBody(apiBody);
-  if (!target || !isTelegramTopicTargetStaleError(error)) return false;
-  await deps.topicTargetStore.load();
-  if (
-    !deps.topicTargetStore.markStaleByTarget(target, "deleted", String(error))
-  ) {
-    return false;
+  if (!target || !isTelegramTopicTargetStaleError(error) || deps.isCurrent?.() === false) return false;
+  if (deps.isCurrent) {
+    if (!deps.topicTargetStore.invalidateTarget || !await deps.topicTargetStore.invalidateTarget(
+      target, deps.isCurrent, String(error),
+    )) return false;
+    if (deps.isAuthorityCurrent?.() === false) return false;
+  } else {
+    await deps.topicTargetStore.load();
+    if (!deps.topicTargetStore.markStaleByTarget(target, "deleted", String(error))) return false;
+    await deps.topicTargetStore.persist();
   }
   const nowMs = (deps.getNowMs ?? Date.now)();
   let state = markTelegramSyncSliceSuspect(deps.getSyncState(), "topic-state", {
@@ -466,8 +520,12 @@ export async function recoverStaleTelegramTopicApiError<
     reason: "stale-api-error",
     action: "topic-target-stale",
   }) as TSyncState;
+  state = markTelegramSyncSliceSuspect(state, "target-bindings", {
+    nowMs,
+    reason: "stale-api-error",
+    action: "topic-target-stale",
+  }) as TSyncState;
   deps.setSyncState(state);
-  await deps.topicTargetStore.persist();
   deps.recordEvent("bus", error, {
     phase: "topic-target-stale",
     chatId: target.chatId,
@@ -606,6 +664,7 @@ export async function ensureTelegramLeaderThreadBinding(
   });
   deps.recordThreadReconciliationPlan?.(replacementPlan);
   await ThreadReconciler.applyThreadReconciliationPlan(replacementPlan, {
+    isCleanupTargetProtected: createTelegramCleanupTargetProtection(deps.topicTargetStore),
     callApi: deps.callApi,
     markStaleByTarget: (target, syncStatus, lastSyncError) =>
       deps.topicTargetStore.markStaleByTarget(

package/node_modules/@llblab/pi-telegram/lib/telegram-api.ts

@@ -466,6 +466,8 @@ export interface TelegramApiClient {
 }
 
 export interface TelegramBridgeApiRuntimeDeps {
+  captureRequestErrorHandler?: (body: Record<string, unknown>) =>
+    ((error: unknown) => Promise<void>) | undefined;
   client: TelegramApiClient;
   tempDir: string;
   maxFileSizeBytes: number;
@@ -634,6 +636,11 @@ export function getTelegramApiErrorRequestTarget(
   return target ? { ...target } : undefined;
 }
 
+export function isTelegramStaleTargetHttpError(error: unknown): boolean {
+  if (!(error instanceof TelegramApiHttpError) || error.status !== 400) return false;
+  return /^Telegram API \w+ failed: HTTP 400: Bad Request: (message thread not found|thread not found|topic not found|topic deleted|topic closed|thread closed|forum topic closed|message thread closed|topic_id_invalid|topic_closed)$/i.test(error.message);
+}
+
 export function isTelegramMessageNotModifiedError(error: unknown): boolean {
   return (
     error instanceof Error && error.message.includes("message is not modified")
@@ -1438,6 +1445,7 @@ export function createTelegramAssistantDraftSender(deps: {
 export function createDefaultTelegramBridgeApiRuntime(deps: {
   getBotToken: () => string | undefined;
   recordRuntimeEvent: TelegramBridgeApiRuntimeDeps["recordRuntimeEvent"];
+  captureRequestErrorHandler?: TelegramBridgeApiRuntimeDeps["captureRequestErrorHandler"];
 }): TelegramBridgeApiRuntime {
   return createTelegramBridgeApiRuntime({
     client: createTelegramApiClient(deps.getBotToken, {
@@ -1447,12 +1455,23 @@ export function createDefaultTelegramBridgeApiRuntime(deps: {
     maxFileSizeBytes: TELEGRAM_INBOUND_FILE_MAX_BYTES,
     tempFileMaxAgeMs: TELEGRAM_TEMP_FILE_MAX_AGE_MS,
     recordRuntimeEvent: deps.recordRuntimeEvent,
+    captureRequestErrorHandler: deps.captureRequestErrorHandler,
   });
 }
 
 export function createTelegramBridgeApiRuntime(
   deps: TelegramBridgeApiRuntimeDeps,
 ): TelegramBridgeApiRuntime {
+  const recoverRequestError = async (
+    handler: ((error: unknown) => Promise<void>) | undefined,
+    error: unknown,
+  ): Promise<void> => {
+    try {
+      await handler?.(error);
+    } catch (recoveryError) {
+      deps.recordRuntimeEvent("api", recoveryError, { phase: "stale-target-recovery" });
+    }
+  };
   const now = deps.now ?? Date.now;
   const chatActionMinIntervalMs = Math.max(
     0,
@@ -1488,6 +1507,7 @@ export function createTelegramBridgeApiRuntime(
     body: Record<string, unknown>,
     options?: TelegramApiCallOptions,
   ): Promise<TResponse> => {
+    const recoverError = deps.captureRequestErrorHandler?.(body);
     const chatActionKey = getChatActionKey(method, body);
     if (chatActionKey) {
       const nowMs = now();
@@ -1516,7 +1536,8 @@ export function createTelegramBridgeApiRuntime(
           gate.notBeforeMs = now() + chatActionMinIntervalMs;
           return result;
         })
-        .catch((error: unknown) => {
+        .catch(async (error: unknown) => {
+          await recoverRequestError(recoverError, error);
           if (error instanceof TelegramApiHttpError && error.status === 429) {
             const retryAfterMs = Math.max(
               chatActionMinIntervalMs,
@@ -1550,6 +1571,12 @@ export function createTelegramBridgeApiRuntime(
     try {
       return await deps.client.call<TResponse>(method, body, options);
     } catch (error) {
+      await recoverRequestError(recoverError, error);
+      if (method === "deleteMessage" && error instanceof TelegramApiHttpError &&
+        error.status === 400 && error.message ===
+          "Telegram API deleteMessage failed: HTTP 400: Bad Request: message to delete not found") {
+        return true as TResponse;
+      }
       deps.recordRuntimeEvent(
         "api",
         error,
@@ -1574,6 +1601,7 @@ export function createTelegramBridgeApiRuntime(
       fileName,
       options,
     ) => {
+      const recoverError = deps.captureRequestErrorHandler?.(fields);
       try {
         return await deps.client.callMultipart(
           method,
@@ -1584,6 +1612,7 @@ export function createTelegramBridgeApiRuntime(
           options,
         );
       } catch (error) {
+        await recoverRequestError(recoverError, error);
         deps.recordRuntimeEvent(
           "multipart",
           error,
@@ -1676,11 +1705,13 @@ export function createTelegramBridgeApiRuntime(
     sendRichMessageDraft: (body) =>
       callRecorded<boolean>("sendRichMessageDraft", body),
     editMessageText: async (body) => {
+      const recoverError = deps.captureRequestErrorHandler?.(body);
       try {
         await deps.client.call("editMessageText", body);
         return "edited";
       } catch (error) {
         if (isTelegramMessageNotModifiedError(error)) return "unchanged";
+        await recoverRequestError(recoverError, error);
         deps.recordRuntimeEvent(
           "api",
           error,

package/node_modules/@llblab/pi-telegram/lib/thread-reconciler.ts

@@ -202,6 +202,7 @@ export interface ThreadReconciliationApplyResult {
 }
 
 export interface ThreadReconciliationApplyPorts {
+  isCleanupTargetProtected?: (target: ThreadTarget, action: ThreadReconciliationAction) => boolean;
   callApi?: <TResponse>(
     method: string,
     body: Record<string, unknown>,
@@ -576,6 +577,7 @@ export async function applyThreadReconciliationPlan(
         incompleteActions.push(action);
         continue;
       }
+      if (ports.isCleanupTargetProtected?.(action.target, action)) continue;
       let closeConfirmed = false;
       try {
         await ports.callApi("closeForumTopic", {
@@ -598,6 +600,7 @@ export async function applyThreadReconciliationPlan(
         incompleteActions.push(action);
         continue;
       }
+      if (ports.isCleanupTargetProtected?.(action.target, action)) continue;
       const changed =
         ports.markStaleByTarget?.(action.target, "closed") ?? false;
       if (changed) persistFences.push(action);
@@ -632,7 +635,12 @@ export async function applyThreadReconciliationPlan(
         continue;
       }
       let deleteConfirmed = false;
+      let superseded = false;
       for (const method of ["closeForumTopic", "deleteForumTopic"]) {
+        if (ports.isCleanupTargetProtected?.(action.target, action)) {
+          superseded = true;
+          break;
+        }
         if (shouldSkipForStaleLeaderEpoch(action, ports)) break;
         try {
           await ports.callApi(method, {
@@ -660,6 +668,15 @@ export async function applyThreadReconciliationPlan(
         incompleteActions.push(action);
         continue;
       }
+      if (superseded || ports.isCleanupTargetProtected?.(action.target, action)) {
+        ports.recordRuntimeEvent?.("telegram", "Cancelled cleanup of a protected Telegram target", {
+          phase: "thread-reconciler-cleanup-target-reused",
+          action: action.kind,
+          chatId: action.target.chatId,
+          threadId: action.target.threadId,
+        });
+        continue;
+      }
       if (!deleteConfirmed) {
         ports.recordRuntimeEvent?.(
           "telegram",