@llblab/pi-kit 0.34.3 → 0.35.1

package/node_modules/@llblab/pi-telegram/dist/lib/extension.js

@@ -1033,6 +1033,29 @@ export default function (pi) {
         delivery: deliveryLifecycleRuntime,
         api: telegramApiTargetActivityRuntime,
     });
+    const prepareTemporaryThreadJournalInspection = function (target, requiredJournalBindingKeys, ownInputs) {
+        const binding = resolveTelegramUpdateJournalBinding();
+        const botToken = configStore.getBotToken();
+        if (!binding || !botToken)
+            return undefined;
+        const profile = configStore.getActiveProfileName() ?? "default";
+        const botIdentity = Journal.createTelegramUpdateJournalBotIdentity({ botToken, botId: getTelegramBotId() });
+        return {
+            directory: Paths.resolveTelegramTempDir(), profile, botIdentity,
+            pollingPath: telegramLeaderJournalPath.resolve(configStore.getActiveProfileName()),
+            requiredJournalBindingKeys: [binding.recoveryKey, ...requiredJournalBindingKeys],
+            ...(target.threadId !== undefined && ownInputs
+                ? { cleanup: { target: { chatId: target.chatId, threadId: target.threadId }, ownInputs } } : {}),
+            limits: { maxDirectoryEntries: 10_000, maxFiles: 4096, maxBytes: 64 * 1024 * 1024,
+                maxEntries: 10_000, maxWork: 100_000 },
+            withSourceReference(path, operation) {
+                return telegramJournalReferenceRegistry.withReference({
+                    referenceClass: "operator-disposition",
+                    recoveryKey: Journal.createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity }),
+                }, operation);
+            },
+        };
+    };
     const inboundRouteRuntime = Routing.createTelegramInboundRouteRuntime({
         configStore,
         callApi: callTelegramApi,
@@ -1112,53 +1135,24 @@ export default function (pi) {
             });
         },
         inspectTemporaryThreadSources(target, requiredJournalBindingKeys, ownInputs) {
-            const binding = resolveTelegramUpdateJournalBinding();
-            const botToken = configStore.getBotToken();
-            if (!binding || !botToken)
+            const input = prepareTemporaryThreadJournalInspection(target, requiredJournalBindingKeys, ownInputs);
+            if (!input)
                 return undefined;
-            const profile = configStore.getActiveProfileName() ?? "default";
-            const botIdentity = Journal.createTelegramUpdateJournalBotIdentity({
-                botToken,
-                botId: getTelegramBotId(),
-            });
             return withTelegramJournalSourceSerialization(function () {
-                return Journal.isTelegramThreadCleanupJournalNamespaceClear({
-                    directory: Paths.resolveTelegramTempDir(),
-                    profile,
-                    botIdentity,
-                    pollingPath: telegramLeaderJournalPath.resolve(configStore.getActiveProfileName()),
-                    requiredJournalBindingKeys: [
-                        binding.recoveryKey,
-                        ...requiredJournalBindingKeys,
-                    ],
-                    ...(target.threadId !== undefined && ownInputs
-                        ? {
-                            cleanup: {
-                                target: { chatId: target.chatId, threadId: target.threadId },
-                                ownInputs,
-                            },
-                        }
-                        : {}),
-                    limits: {
-                        maxDirectoryEntries: 10_000,
-                        maxFiles: 4096,
-                        maxBytes: 64 * 1024 * 1024,
-                        maxEntries: 10_000,
-                        maxWork: 100_000,
-                    },
-                    withSourceReference(path, operation) {
-                        return telegramJournalReferenceRegistry.withReference({
-                            referenceClass: "operator-disposition",
-                            recoveryKey: Journal.createTelegramUpdateJournalBindingKey({
-                                path,
-                                profileName: profile,
-                                botIdentity,
-                            }),
-                        }, operation);
-                    },
-                })
-                    ? []
-                    : undefined;
+                return Journal.isTelegramThreadCleanupJournalNamespaceClear(input) ? [] : undefined;
+            });
+        },
+        recoverTemporaryThreadDeadQueueOwners(target, requiredJournalBindingKeys, ownInputs, isCurrent) {
+            const input = prepareTemporaryThreadJournalInspection(target, requiredJournalBindingKeys, ownInputs);
+            if (!input || !isCurrent())
+                return 0;
+            return Journal.recoverTelegramThreadCleanupDeadQueueOwners({
+                ...input, isCurrent, withSourceSerialization: withTelegramJournalSourceSerialization,
+                recoveryOwner: {
+                    instanceId: telegramInstanceId, processId: telegramProcessId,
+                    processBirthId: telegramQueueProcessBirthId,
+                    sessionGeneration: telegramSessionContextStore.getGeneration(),
+                },
             });
         },
         hasWorkspaceRestoreAuthority() {
@@ -2485,6 +2479,7 @@ export default function (pi) {
         deleteMessage: deleteTelegramMessage,
         sendGuestReply,
         editGuestReply,
+        editGuestInlineMessage: telegramApiRuntime.editGuestInlineMessage,
         stopGuestPlaceholder: guestPlaceholderRuntime.stop,
         finalizeMarkdownPreview,
         preparePreviewDelivery,

package/node_modules/@llblab/pi-telegram/dist/lib/journal.d.ts

@@ -751,6 +751,13 @@ export declare function isTelegramThreadCleanupJournalNamespaceClear(input: Tele
         }[];
     };
 }): boolean;
+/** Demand-driven recovery only; caller holds temporary-cleanup admission. Never a deletion grant. */
+export declare function recoverTelegramThreadCleanupDeadQueueOwners(input: Parameters<typeof isTelegramThreadCleanupJournalNamespaceClear>[0] & {
+    recoveryOwner: TelegramUpdateJournalQueueOwnerIdentity;
+    isCurrent: () => boolean;
+    withSourceSerialization: NonNullable<TelegramUpdateJournalStoreOptions["withSourceSerialization"]>;
+    getQueueProcessLiveness?: TelegramUpdateJournalStoreOptions["getQueueProcessLiveness"];
+}): number;
 export declare function publishTelegramUpdateJournalSegment(path: string, segment: TelegramUpdateJournalSegment): TelegramUpdateJournalSegmentPublicationResult;
 export declare function createTelegramUpdateQueueHandoffToken(): string;
 export declare function createTelegramUpdateJournalBotIdentity(input: {

package/node_modules/@llblab/pi-telegram/dist/lib/journal.js

@@ -1988,6 +1988,86 @@ export function isTelegramThreadCleanupJournalNamespaceClear(input) {
     return namespace.sources.every((source) => source.evidence.kind === "absent" ||
         source.evidence.file.entries.every((entry) => isUnrelatedPlainInput(entry, source.path)));
 }
+/** Demand-driven recovery only; caller holds temporary-cleanup admission. Never a deletion grant. */
+export function recoverTelegramThreadCleanupDeadQueueOwners(input) {
+    return input.withSourceSerialization(() => {
+        const assertCurrent = () => {
+            if (!input.isCurrent())
+                throw new Error("Temporary cleanup queue recovery lost authority.");
+        };
+        assertCurrent();
+        if (!input.cleanup)
+            return 0;
+        // Validate exact references and complete namespace coverage before considering any mutation.
+        if (isTelegramThreadCleanupJournalNamespaceClear(input))
+            return 0;
+        const namespace = inspectTelegramSessionJournalNamespace(input);
+        if (namespace.retainedInputs?.some(value => value.state !== "committed") ||
+            input.requiredJournalBindingKeys.some(key => !namespace.sources.some(source => source.path === getTelegramUpdateJournalBindingPath(key) && source.evidence.kind === "present")))
+            return 0;
+        const plans = [];
+        for (const source of namespace.sources) {
+            if (source.evidence.kind !== "present")
+                continue;
+            const file = source.evidence.file;
+            if (file.version !== TELEGRAM_UPDATE_JOURNAL_VERSION)
+                continue;
+            const groups = new Map();
+            for (const entry of file.entries) {
+                if (!entry.queueReceiptId)
+                    continue;
+                const group = groups.get(entry.queueReceiptId) ?? [];
+                group.push(entry);
+                groups.set(entry.queueReceiptId, group);
+            }
+            for (const group of groups.values()) {
+                const entry = group[0];
+                if (entry.state !== "queued" || !entry.queueReceiptId || !entry.queueOwner ||
+                    !entry.queueKind || entry.queueHandoff || entry.inputClaim)
+                    continue;
+                if (group.some(value => value.state !== "queued" || value.queueHandoff || value.inputClaim ||
+                    value.queueKind !== entry.queueKind || !isDeepStrictEqual(value.queueOwner, entry.queueOwner)))
+                    continue;
+                plans.push({ path: source.path, recovery: {
+                        queueKind: entry.queueKind, receiptId: entry.queueReceiptId,
+                        sourceUpdateIds: group.map(value => value.updateId).sort((a, b) => a - b),
+                        deadOwner: cloneJournalQueueOwner(entry.queueOwner), recoveryOwner: { ...input.recoveryOwner },
+                    } });
+            }
+        }
+        const liveness = input.getQueueProcessLiveness ?? getTelegramProcessLiveness;
+        const dead = plans.filter(plan => {
+            assertCurrent();
+            const result = liveness(plan.recovery.deadOwner);
+            assertCurrent();
+            return result === "dead";
+        });
+        let removed = 0;
+        for (const plan of dead) {
+            assertCurrent();
+            removed += input.withSourceReference(plan.path, () => {
+                const journal = createTelegramUpdateJournalStore({
+                    path: plan.path, profileName: input.profile, botIdentity: input.botIdentity,
+                    queueRuntimeIdentity: input.recoveryOwner,
+                    // This private synchronous store stays inside the cross-family serializer already held above.
+                    withSourceSerialization(operation) { assertCurrent(); return operation(); },
+                    sourceAccess: { directory: dirname(plan.path), limits: input.limits },
+                    getQueueProcessLiveness(owner) {
+                        assertCurrent();
+                        const result = liveness(owner);
+                        assertCurrent();
+                        return result;
+                    },
+                    withWriterAdmission(operation) { assertCurrent(); return operation(); },
+                });
+                // The journal transaction rechecks whole-group identity, absence of handoff and fresh process-death proof.
+                return journal.recoverDeadQueueOwner(plan.recovery).recoveredUpdateIds.length;
+            });
+        }
+        assertCurrent();
+        return removed;
+    });
+}
 function cloneEntry(entry) {
     return {
         ...entry,

package/node_modules/@llblab/pi-telegram/dist/lib/outbound-attachments.d.ts

@@ -73,6 +73,7 @@ export interface TelegramQueuedOutboundAttachmentView {
 export interface TelegramOutboundAttachmentQueueTargetView {
     queuedAttachments: TelegramQueuedOutboundAttachmentView[];
     guestQueryId?: string;
+    guestInlineMessageId?: string;
 }
 export interface TelegramQueuedOutboundAttachmentTurnView extends TelegramOutboundAttachmentQueueTargetView {
     chatId: number;
@@ -161,6 +162,17 @@ export declare function queueTelegramOutboundAttachments(options: {
 }): Promise<TelegramOutboundAttachmentToolResult>;
 export declare function deliverTelegramGuestCachedAttachment(options: {
     guestQueryId: string;
+    guestInlineMessageId?: string;
+    editGuestInlineMessage?: (inlineMessageId: string, content: {
+        media: {
+            type: "photo" | "document" | "audio";
+            media: string;
+            caption?: string;
+        };
+    }, options: {
+        assertAuthority: () => void;
+    }) => Promise<void>;
+    isDeliveryActive?: () => boolean;
     stagingChatId: number;
     stagingTarget?: TelegramTarget;
     attachment: TelegramQueuedOutboundAttachmentView;

package/node_modules/@llblab/pi-telegram/dist/lib/outbound-attachments.js

@@ -375,6 +375,9 @@ export async function queueTelegramOutboundAttachments(options) {
         maxAttachmentSizeBytes: options.maxAttachmentSizeBytes,
         statPath: options.statPath,
     });
+    if (options.activeTurn.guestInlineMessageId && pendingAttachments.some((attachment) => getTelegramGuestAttachmentTransport(attachment.path).fileField === "voice")) {
+        throw new Error("Telegram Guest Mode cannot replace an inline placeholder with a voice note; no attachment was queued. Use MP3 audio or a normal bot chat.");
+    }
     options.activeTurn.queuedAttachments.push(...pendingAttachments);
     const added = pendingAttachments.map((attachment) => attachment.path);
     return {
@@ -389,6 +392,16 @@ export async function queueTelegramOutboundAttachments(options) {
 }
 export async function deliverTelegramGuestCachedAttachment(options) {
     const transport = getTelegramGuestAttachmentTransport(options.attachment.path);
+    const isActive = () => options.isDeliveryActive?.() !== false;
+    const assertActive = () => {
+        if (!isActive())
+            throw new Error("Guest attachment delivery lost authority.");
+    };
+    if (!isActive())
+        return;
+    if (options.guestInlineMessageId && (!options.editGuestInlineMessage || transport.fileField === "voice")) {
+        throw new Error("Guest inline attachment editing is unavailable for this media.");
+    }
     let stagingMessageId;
     let answerAttempted = false;
     try {
@@ -397,6 +410,8 @@ export async function deliverTelegramGuestCachedAttachment(options) {
             ...getTelegramMultipartTargetFields(options.stagingTarget),
         }, transport.fileField, options.attachment.path, options.attachment.fileName));
         stagingMessageId = message.message_id;
+        if (!isActive())
+            return;
         const caption = options.caption
             ? Array.from(options.caption).slice(0, 1024).join("")
             : undefined;
@@ -446,11 +461,26 @@ export async function deliverTelegramGuestCachedAttachment(options) {
                 ...(caption ? { caption } : {}),
             };
         }
+        if (!isActive())
+            return;
         answerAttempted = true;
-        await options.answerGuestQuery(options.guestQueryId, result);
+        if (options.guestInlineMessageId && options.editGuestInlineMessage) {
+            if (result.type === "voice")
+                throw new Error("Voice notes cannot replace inline placeholders.");
+            const media = result.type === "photo" ? result.photo_file_id
+                : result.type === "audio" ? result.audio_file_id : result.document_file_id;
+            await options.editGuestInlineMessage(options.guestInlineMessageId, {
+                media: { type: result.type, media, ...(caption ? { caption } : {}) },
+            }, { assertAuthority: assertActive });
+        }
+        else {
+            await options.answerGuestQuery(options.guestQueryId, result);
+        }
     }
     catch (error) {
-        if (!answerAttempted && options.answerGuestText && options.fallbackText) {
+        if (!isActive())
+            return;
+        if (!options.guestInlineMessageId && !answerAttempted && options.answerGuestText && options.fallbackText) {
             answerAttempted = true;
             await options.answerGuestText(options.guestQueryId, options.fallbackText);
         }
@@ -459,7 +489,7 @@ export async function deliverTelegramGuestCachedAttachment(options) {
         }
     }
     finally {
-        if (stagingMessageId !== undefined) {
+        if (stagingMessageId !== undefined && isActive()) {
             try {
                 await options.deleteMessage(options.stagingChatId, stagingMessageId);
             }

package/node_modules/@llblab/pi-telegram/dist/lib/queue.d.ts

@@ -506,10 +506,14 @@ export interface TelegramAgentEndRuntimeDeps<TTurn extends PendingTelegramTurn,
     }) => Promise<void>;
     sendGuestReply?: (guestQueryId: string, markdown: string) => Promise<void>;
     /** Replaces the early guest ACK with the final text. */
-    editGuestReply?: (inlineMessageId: string, markdown: string) => Promise<void>;
+    editGuestReply?: (inlineMessageId: string, markdown: string, options?: {
+        assertAuthority?: () => void;
+    }) => Promise<void>;
     /** Cancels the animated guest placeholder before the final edit. */
     stopGuestPlaceholder?: (inlineMessageId: string) => Promise<void>;
-    sendGuestAttachment?: (turn: TTurn, attachment: QueuedAttachment, caption?: string) => Promise<void>;
+    sendGuestAttachment?: (turn: TTurn, attachment: QueuedAttachment, caption?: string, options?: {
+        isDeliveryActive?: () => boolean;
+    }) => Promise<void>;
     sendGuestVoiceReply?: (turn: TTurn, plan: TelegramAgentEndOutboundReplyPlan<TReplyMarkup>, caption?: string) => Promise<void>;
     planOutboundReply?: (markdown: string) => TelegramAgentEndOutboundReplyPlan<TReplyMarkup>;
     sendOutboundReplyArtifacts?: (turn: TTurn, plan: TelegramAgentEndOutboundReplyPlan, options?: {

package/node_modules/@llblab/pi-telegram/dist/lib/queue.js

@@ -1377,13 +1377,55 @@ export async function handleTelegramAgentEndRuntime(deps) {
                 });
             }
         }
-        if (turn.guestInlineMessageId && deps.editGuestReply) {
-            const experimentText = assistant.errorMessage
+        if (!isDeliveryActive())
+            return;
+        if (turn.guestInlineMessageId) {
+            let experimentText = assistant.errorMessage
                 ? "Telegram bridge: Pi failed while processing the request."
                 : finalText;
+            const [attachment] = turn.queuedAttachments;
+            if (!assistant.errorMessage && attachment) {
+                try {
+                    if (!deps.sendGuestAttachment)
+                        throw new Error("Guest attachment delivery is unavailable.");
+                    await deps.sendGuestAttachment(turn, attachment, finalText || undefined, { isDeliveryActive });
+                    if (isDeliveryActive() && endPlan.shouldDispatchNext)
+                        deps.dispatchNextQueuedTelegramTurn();
+                    return;
+                }
+                catch (error) {
+                    deps.recordRuntimeEvent?.("delivery", error, {
+                        phase: "guest-attachment", guestQueryId: turn.guestQueryId,
+                    });
+                    if (!isDeliveryActive())
+                        return;
+                    if (isTelegramApiCommitUnknownError(error)) {
+                        if (endPlan.shouldDispatchNext)
+                            deps.dispatchNextQueuedTelegramTurn();
+                        return;
+                    }
+                    experimentText = "Telegram bridge could not deliver the requested attachment. Please retry in a normal bot chat.";
+                }
+            }
+            else if (!assistant.errorMessage && hasOutboundArtifacts) {
+                experimentText = [finalText, "Telegram Guest Mode cannot replace an inline placeholder with a voice note. Please request MP3 audio or use a normal bot chat."].filter(Boolean).join("\n\n");
+            }
+            if (!deps.editGuestReply) {
+                deps.recordRuntimeEvent?.("delivery", new Error("Guest inline reply editing is unavailable."), {
+                    phase: "guest-ack-edit", guestQueryId: turn.guestQueryId,
+                });
+                if (endPlan.shouldDispatchNext)
+                    deps.dispatchNextQueuedTelegramTurn();
+                return;
+            }
             if (experimentText) {
                 try {
-                    await deps.editGuestReply(turn.guestInlineMessageId, experimentText);
+                    await deps.editGuestReply(turn.guestInlineMessageId, experimentText, {
+                        assertAuthority() {
+                            if (!isDeliveryActive())
+                                throw new Error("Guest reply edit lost authority.");
+                        },
+                    });
                     deps.recordRuntimeEvent?.("guest", new Error("Guest ACK edited the guest answer"), { phase: "guest-ack-edited", guestQueryId: turn.guestQueryId });
                 }
                 catch (error) {
@@ -1419,7 +1461,7 @@ export async function handleTelegramAgentEndRuntime(deps) {
         const [guestAttachment] = turn.queuedAttachments;
         if (guestAttachment && deps.sendGuestAttachment) {
             try {
-                await deps.sendGuestAttachment(turn, guestAttachment, finalText || undefined);
+                await deps.sendGuestAttachment(turn, guestAttachment, finalText || undefined, { isDeliveryActive });
             }
             catch (error) {
                 deps.recordRuntimeEvent?.("delivery", error, {

package/node_modules/@llblab/pi-telegram/dist/lib/replies.d.ts

@@ -163,8 +163,12 @@ export declare function createGuestMarkdownReplyEditor(deps: {
     editGuestInlineMessage: (inlineMessageId: string, content: {
         richMessage?: TelegramInputRichMessage;
         text?: string;
+    }, options?: {
+        assertAuthority?: () => void;
     }) => Promise<void>;
-}): (inlineMessageId: string, markdown: string) => Promise<void>;
+}): (inlineMessageId: string, markdown: string, options?: {
+    assertAuthority?: () => void;
+}) => Promise<void>;
 /**
  * Guest Mode placeholder rotation: the early ACK is the first placeholder
  * frame and the runtime steps the remaining frames once per interval, moving

package/node_modules/@llblab/pi-telegram/dist/lib/replies.js

@@ -578,11 +578,11 @@ export function createGuestMarkdownReplySender(deps) {
  * chat/message pair.
  */
 export function createGuestMarkdownReplyEditor(deps) {
-    return async (inlineMessageId, markdown) => {
+    return async (inlineMessageId, markdown, options) => {
         const [richMarkdown = markdown] = splitTelegramNativeMarkdown(markdown);
         await deps.editGuestInlineMessage(inlineMessageId, {
             richMessage: { markdown: richMarkdown },
-        });
+        }, options);
     };
 }
 /**

package/node_modules/@llblab/pi-telegram/dist/lib/routing.d.ts

@@ -211,6 +211,8 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     canUsePreDispatchRebind?: (recipient?: Threads.TelegramWorkspaceRestoreRecipient) => boolean;
     /** Strict complete namespace plus exact current/historical references; only an empty result clears journal protection. */
     inspectTemporaryThreadSources?: (target: Queue.TelegramQueueTarget, requiredJournalBindingKeys: readonly string[], ownInputs?: readonly Threads.TelegramTemporaryThreadInput[]) => readonly number[] | undefined;
+    /** Explicit cleanup-only recovery; never called by a read-only protection observer. */
+    recoverTemporaryThreadDeadQueueOwners?: (target: Queue.TelegramQueueTarget, requiredJournalBindingKeys: readonly string[], ownInputs: readonly Threads.TelegramTemporaryThreadInput[], isCurrent: () => boolean) => number;
     /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 0 ms. */
     temporaryThreadCleanupDelayMs?: number;
     /** Live-rebind cleanup attempt pacing; the bounded window ends in `not-issued`, never a time-based deletion. */

package/node_modules/@llblab/pi-telegram/dist/lib/routing.js

@@ -4574,6 +4574,100 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         await promptEnqueue(messages, ctx);
     };
+    /** Local menu acceptance owns a one-shot effect; source removal and cleanup precede its release, never its replay. */
+    const stageTemporaryRerouteMenu = async (pending, command, messages, ctx, assertRecipientCurrent, completion) => {
+        const original = pending.messages[0];
+        const cap = captureTemporaryThreadAuthority(ctx);
+        const temporary = pending.temporaryThread ?? findCreatedTemporaryThread(pending.sourceTarget);
+        if (!cap?.isCurrent() || !temporary)
+            return undefined;
+        let accept, resume;
+        const accepted = new Promise(resolve => { accept = resolve; });
+        const released = new Promise(resolve => { resume = resolve; });
+        const admission = {
+            assertSourceCurrent() {
+                if (!completion.isCurrent())
+                    throw new Error("Rerouted menu source authority changed.");
+            },
+            assertRecipientCurrent,
+            reportCompleted() {
+                const result = completion.reportCompleted();
+                accept(result);
+                return result;
+            },
+            async beforeEffects() {
+                if (!(await released))
+                    throw new Error("Rerouted menu execution was not released.");
+            },
+        };
+        const prepare = command.name === "start" ? commandHandler.prepareSelectedStartCommand
+            : command.name === "help" ? commandHandler.prepareSelectedHelpCommand : commandHandler.prepareSelectedMenuCommand;
+        const dispatch = prepare(command, messages, ctx, admission);
+        if (!dispatch)
+            return undefined;
+        const execution = dispatch().catch(error => {
+            deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-menu-execution" });
+            return false;
+        });
+        if (!(await Promise.race([accepted, execution.then(() => false)]))) {
+            resume(false);
+            await execution;
+            return undefined;
+        }
+        return async () => {
+            let allowEffects = false;
+            try {
+                const confirmed = await new Promise(resolve => {
+                    let done = false, unsubscribe;
+                    const signal = Updates.getTelegramUpdateExecutionFence(original)?.signal;
+                    const finish = (result) => {
+                        if (done)
+                            return;
+                        done = true;
+                        clearTimeout(timer);
+                        unsubscribe?.();
+                        signal?.removeEventListener("abort", abort);
+                        resolve(result);
+                    };
+                    const abort = () => finish(false);
+                    const observe = () => {
+                        if (!cap.isCurrent() || !completion.isCurrent())
+                            finish(false);
+                        else if (completion.inspectCompletion())
+                            finish(true);
+                    };
+                    const timer = setTimeout(abort, deps.liveRebindCommandCompletionTimeoutMs ?? 8_000);
+                    timer.unref?.();
+                    unsubscribe = Updates.subscribeTelegramDeferredSourceCompletion(original, observe);
+                    signal?.addEventListener("abort", abort, { once: true });
+                    if (signal?.aborted)
+                        abort();
+                    else
+                        observe();
+                });
+                if (!confirmed)
+                    throw new Error("Rerouted menu source removal is unconfirmed; execution remains suppressed.");
+                assertRecipientCurrent();
+                cancelTemporaryThreadCleanup(temporary.token);
+                try {
+                    await runTemporaryThreadCleanup(temporary.token, cap, false);
+                }
+                catch (error) {
+                    // Cleanup uncertainty retains its canonical grant, not command execution authority or a retry license.
+                    deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-menu-cleanup" });
+                }
+                assertRecipientCurrent();
+                allowEffects = true;
+            }
+            catch (error) {
+                deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-menu-release" });
+            }
+            finally {
+                resume(allowEffects);
+                await execution;
+            }
+        };
+    };
     const finalizePendingReroute = async (rerouteId, pending, query, successMessage, assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query), retainRecord = false) => {
         assertExecutionCurrent();
         const dismissed = await dismissRerouteChooserMessage(query, assertExecutionCurrent);
@@ -4888,9 +4982,17 @@ export function createTelegramInboundRouteRuntime(deps) {
             if (!cancelledCurrent())
                 return;
             entry = cap.adopt(entry);
-            if (!entry ||
-                !cap.isCurrent() ||
-                isRerouteTargetProtected(target, undefined, entry))
+            if (!entry || !cap.isCurrent())
+                return;
+            if (isRerouteTargetProtected(target, undefined, entry) && deps.recoverTemporaryThreadDeadQueueOwners &&
+                store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary") {
+                const inputs = Threads.getTelegramTemporaryThreadInputs(entry);
+                const removed = deps.recoverTemporaryThreadDeadQueueOwners(target, [cap.journalBindingKey, ...inputs.map(input => input.journalBindingKey)], inputs, cap.isCurrent);
+                if (removed > 0)
+                    deps.recordRuntimeEvent?.("routing", "Discarded historical queue receipts from confirmed-dead owners before temporary Thread cleanup.", { phase: "temporary-thread-dead-owner-recovery", removedUpdateCount: removed });
+            }
+            // Recovery is not deletion authority: recapture every ordinary protection after the journal CAS.
+            if (!cap.isCurrent() || isRerouteTargetProtected(target, undefined, entry))
                 return;
             const issued = store.issueTemporaryThreadCleanup(entry, cap.authority);
             if (!issued || !cap.isCurrent())
@@ -5911,7 +6013,7 @@ export function createTelegramInboundRouteRuntime(deps) {
         await deps.answerCallbackQuery(query.id);
         return true;
     };
-    const executeUnboundRerouteCallbackOperation = async (query, ctx) => {
+    const executeUnboundRerouteCallbackOperation = async (query, ctx, afterAdmission) => {
         const parsed = parseTelegramUnboundRerouteCallbackData(query.data);
         if (!parsed)
             return false;
@@ -6432,7 +6534,21 @@ export function createTelegramInboundRouteRuntime(deps) {
         const localMessages = pending.rerouteCopies
             ? cloneTelegramMessagesForThread(pending.messages, parsed.threadId, pending.rerouteCopies.bySourceUpdateId)
             : reroutedMessages;
-        await dispatchPendingRerouteMessages(pending, localMessages, ctx);
+        const command = pending.dispatchKind === "command"
+            ? getLiveRebindMenu(localMessages) ?? getLiveRebindHelp(localMessages) : undefined;
+        const completion = pending.rerouteCopies && command
+            ? Updates.prepareTelegramDeferredSourceCompletion(pending.messages[0]) : undefined;
+        if (command && completion) {
+            const release = await stageTemporaryRerouteMenu(pending, command, localMessages, ctx, assertRerouteCurrent, completion);
+            if (!release) {
+                await deps.answerCallbackQuery(query.id, "Command acceptance unconfirmed; not resending");
+                return true;
+            }
+            afterAdmission(release);
+        }
+        else {
+            await dispatchPendingRerouteMessages(pending, localMessages, ctx);
+        }
         assertRerouteCurrent();
         pending.messages = [];
         return completeRoutedReroute();
@@ -6441,14 +6557,22 @@ export function createTelegramInboundRouteRuntime(deps) {
         const parsed = parseTelegramUnboundRerouteCallbackData(query.data);
         if (!parsed)
             return false;
-        return withPendingRerouteSelection(parsed.rerouteId, query, () => {
-            if (!deps.runWorkspaceOperation)
-                return executeUnboundRerouteCallbackOperation(query, ctx);
-            return deps.runWorkspaceOperation({
-                operationId: `workspace-reroute:${query.id}`,
-                operationKind: "workspace.route-unbound-thread",
-                scopes: [{ kind: "profile" }],
-            }, () => executeUnboundRerouteCallbackOperation(query, ctx));
+        return withPendingRerouteSelection(parsed.rerouteId, query, async () => {
+            let release;
+            const operation = () => executeUnboundRerouteCallbackOperation(query, ctx, value => { release = value; });
+            try {
+                if (!deps.runWorkspaceOperation)
+                    return await operation();
+                return await deps.runWorkspaceOperation({
+                    operationId: `workspace-reroute:${query.id}`,
+                    operationKind: "workspace.route-unbound-thread",
+                    scopes: [{ kind: "profile" }],
+                }, operation);
+            }
+            finally {
+                // Keep the exact source references, but release the non-reentrant Workspace gate before cleanup.
+                await release?.();
+            }
         });
     };
     const handleUnboundRerouteCallback = async (query, ctx) => {

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.d.ts

@@ -343,6 +343,12 @@ export interface TelegramAnswerGuestQueryOptions {
     result?: TelegramGuestCachedMediaResult;
 }
 export interface TelegramEditGuestInlineMessageContent {
+    /** Cached media only: inline edits cannot upload a new local file. */
+    media?: {
+        type: "photo" | "document" | "audio";
+        media: string;
+        caption?: string;
+    };
     text?: string;
     richMessage?: TelegramInputRichMessage;
     parseMode?: "HTML";
@@ -465,13 +471,12 @@ export interface TelegramBridgeApiRuntime extends Pick<TelegramApiClient, "call"
     answerCallbackQuery: (callbackQueryId: string, text?: string, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
     answerGuestQuery: (guestQueryId: string, text?: string, options?: TelegramAnswerGuestQueryOptions) => Promise<void>;
     /**
-     * Temporary Guest Mode ACK experiment: answers the guest query and returns
-     * the sent inline message id so the final answer can edit that early reply.
-     * Requires direct transport ownership; Telegram does not document editing
-     * guest answers, so this exists only to falsify that behavior live.
+     * Answers the guest query and retains the sent inline message id for final
+     * text or cached-media replacement. Requires direct transport ownership;
+     * actual guest-media rendering remains live-client gated.
      */
     answerGuestQueryForInlineMessage: (guestQueryId: string, text?: string, options?: TelegramAnswerGuestQueryOptions) => Promise<string | undefined>;
-    editGuestInlineMessage: (inlineMessageId: string, content: TelegramEditGuestInlineMessageContent) => Promise<void>;
+    editGuestInlineMessage: (inlineMessageId: string, content: TelegramEditGuestInlineMessageContent, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
     deleteMessage: (chatId: number, messageId: number) => Promise<void>;
     prepareTempDir: () => Promise<number>;
 }