@llblab/pi-kit 0.34.3 → 0.35.1

package/node_modules/@llblab/pi-telegram/lib/commands.ts

@@ -2281,6 +2281,8 @@ export interface TelegramSelectedCommandAdmission {
   /** Independent exact recipient/target lifetime, including inside captured menu transport adapters. */
   assertRecipientCurrent(): void;
   reportCompleted(): boolean;
+  /** Optional recipient release barrier after acceptance; rejection suppresses effects without replay. */
+  beforeEffects?(): Promise<void>;
 }
 
 /**
@@ -3068,7 +3070,8 @@ export function createTelegramCommandHandler<
           ? copySelectedMenuCarrier(original)
           : copySelectedReplyAnchor(original);
     const assertRecipientCurrent = admission.assertRecipientCurrent,
-      report = admission.reportCompleted;
+      report = admission.reportCompleted,
+      beforeEffects = admission.beforeEffects;
     const effects: TelegramHeldCommandEffects<TContext> | undefined =
       parsed.name === "status"
         ? undefined
@@ -3100,8 +3103,11 @@ export function createTelegramCommandHandler<
         throw new Error(`Selected ${parsed.name} plan owner is unavailable.`);
     };
     return issueSelectedOnce(assertCurrent, async () => {
-      if (plan.completion === "before-effect" && !report.call(admission))
-        return false;
+      if (plan.completion === "before-effect") {
+        if (!report.call(admission)) return false;
+        if (beforeEffects) await beforeEffects();
+        assertRecipientCurrent();
+      }
       return prepared.run({
         message,
         command: parsed,
@@ -3137,7 +3143,8 @@ export function createTelegramCommandHandler<
         from: { ...original.from },
       };
       const assertRecipientCurrent = admission.assertRecipientCurrent,
-        reportCompleted = admission.reportCompleted;
+        reportCompleted = admission.reportCompleted,
+        beforeEffects = admission.beforeEffects;
       const assertAdmissionCurrent = createSelectedSemanticGuard(
         admission,
         () => captured.assertExecutionCurrent?.(original),
@@ -3163,7 +3170,7 @@ export function createTelegramCommandHandler<
               );
             },
           },
-          { assertSemanticCurrent, assertRecipientCurrent, reportCompleted },
+          { assertSemanticCurrent, assertRecipientCurrent, reportCompleted, beforeEffects },
         ),
       );
     };
@@ -3607,6 +3614,7 @@ export function createTelegramCommandHandler<
       const assertSourceCurrent = admission.assertSourceCurrent,
         assertRecipientCurrent = admission.assertRecipientCurrent;
       const reportCompleted = admission.reportCompleted,
+        beforeEffects = admission.beforeEffects,
         assertExecutionCurrent = deps.assertExecutionCurrent;
       const assertIssuanceCurrent = () => {
         assertSourceCurrent.call(admission);
@@ -3639,9 +3647,12 @@ export function createTelegramCommandHandler<
       };
       return issueSelectedOnce(
         assertIssuanceCurrent,
-        async () =>
-          reportCompleted.call(admission) &&
-          handleTelegramCommandRuntime(name, message, ctx, recipientDeps, args),
+        async () => {
+          if (!reportCompleted.call(admission)) return false;
+          if (beforeEffects) await beforeEffects();
+          assertRecipientCurrent();
+          return handleTelegramCommandRuntime(name, message, ctx, recipientDeps, args);
+        },
       );
     },
   });
@@ -3766,6 +3777,7 @@ async function handleTelegramHelpCommand<
     assertSemanticCurrent(): void;
     assertRecipientCurrent(): void;
     reportCompleted(): boolean;
+    beforeEffects?(): Promise<void>;
   },
 ): Promise<boolean> {
   const assertSemanticCurrent =
@@ -3788,6 +3800,7 @@ async function handleTelegramHelpCommand<
   if (admission) {
     assertSemanticCurrent();
     if (!admission.reportCompleted()) return false;
+    if (admission.beforeEffects) await admission.beforeEffects();
     admission.assertRecipientCurrent();
   }
   const assertEffectCurrent =

package/node_modules/@llblab/pi-telegram/lib/config.ts

@@ -146,12 +146,11 @@ const TELEGRAM_THREAD_DISPLAY_MODES: readonly TelegramThreadDisplayMode[] = [
 ];
 
 export function resolveTelegramThreadDisplayMode(
-  config: Pick<TelegramConfig, "threadDisplayMode">,
+  config: Pick<TelegramConfig, "threads">,
 ): TelegramThreadDisplayMode {
-  return TELEGRAM_THREAD_DISPLAY_MODES.includes(
-    config.threadDisplayMode as TelegramThreadDisplayMode,
-  )
-    ? (config.threadDisplayMode as TelegramThreadDisplayMode)
+  const mode = config.threads?.displayMode;
+  return TELEGRAM_THREAD_DISPLAY_MODES.includes(mode as TelegramThreadDisplayMode)
+    ? (mode as TelegramThreadDisplayMode)
     : "letters";
 }
 
@@ -173,8 +172,9 @@ export async function setTelegramThreadDisplayMode(
       "Telegram Thread display setting lost its configured profile.",
     );
   }
+  const latest = store.get();
   await store.persist(
-    { ...store.get(), threadDisplayMode: mode },
+    { ...latest, threads: { ...latest.threads, displayMode: mode } },
     { isCurrent: current },
   );
   if (!current())
@@ -196,8 +196,6 @@ export interface TelegramConfig {
   botId?: number;
   /** @deprecated persisted identity belongs in profiles.default; retained for effective/legacy views */
   allowedUserId?: number;
-  /** Effective view; persisted under profiles.<name>. */
-  threadDisplayMode?: TelegramThreadDisplayMode;
   inboundHandlers?: TelegramInboundHandlerConfig[];
   attachmentHandlers?: TelegramInboundHandlerConfig[];
   outboundHandlers?: TelegramOutboundHandlerConfig[];
@@ -223,23 +221,24 @@ export interface TelegramConfig {
   threads?: {
     /** Delete this instance's bound Telegram thread on graceful Pi quit. */
     automaticCleanup?: boolean;
+    /** Automatic Thread title strategy shared by every profile; absent or invalid resolves to `letters`. */
+    displayMode?: TelegramThreadDisplayMode;
   };
   /** Canonical bot/session profiles, including profiles.default. */
   profiles?: Record<string, TelegramBotProfile>;
 }
 
 /**
- * Per-profile bot/session identity and Thread display preference.
+ * Per-profile bot identity and paired owner only.
  * Stored under `profiles.<name>` in telegram.json.
- * Shared bridge settings (inboundHandlers, outboundHandlers, voice, time,
- * assistant) stay at the top level.
+ * Shared bridge settings (handlers, assistant, voice, time, threads) stay at
+ * the top level and never leak into profiles.
  */
 export interface TelegramBotProfile {
   botToken: string;
   botUsername?: string;
   botId?: number;
   allowedUserId?: number;
-  threadDisplayMode?: TelegramThreadDisplayMode;
 }
 
 interface TelegramLegacyCursorCarrier {
@@ -510,9 +509,6 @@ function pickTelegramRootProfileFields(
     ...(config.allowedUserId !== undefined
       ? { allowedUserId: config.allowedUserId }
       : {}),
-    ...(config.threadDisplayMode !== undefined
-      ? { threadDisplayMode: config.threadDisplayMode }
-      : {}),
     ...(legacyCursor !== undefined ? { lastUpdateId: legacyCursor } : {}),
   };
 }
@@ -523,7 +519,6 @@ function omitTelegramRootProfileFields(config: TelegramConfig): TelegramConfig {
     botUsername: _botUsername,
     botId: _botId,
     allowedUserId: _allowedUserId,
-    threadDisplayMode: _threadDisplayMode,
     lastUpdateId: _lastUpdateId,
     ...sharedConfig
   } = config as TelegramConfig & TelegramLegacyCursorCarrier;
@@ -561,7 +556,6 @@ export function normalizeTelegramDefaultProfileConfig(config: TelegramConfig): {
     "botUsername",
     "botId",
     "allowedUserId",
-    "threadDisplayMode",
     "lastUpdateId",
   ].some((field) => Object.hasOwn(config, field));
   if (!hasLegacyRootProfile) {

package/node_modules/@llblab/pi-telegram/lib/extension.ts

@@ -1302,6 +1302,32 @@ export default function (pi: Pi.ExtensionAPI) {
     delivery: deliveryLifecycleRuntime,
     api: telegramApiTargetActivityRuntime,
   });
+  const prepareTemporaryThreadJournalInspection = function (
+    target: Targets.TelegramTarget,
+    requiredJournalBindingKeys: readonly string[],
+    ownInputs?: readonly Threads.TelegramTemporaryThreadInput[],
+  ): Parameters<typeof Journal.isTelegramThreadCleanupJournalNamespaceClear>[0] | undefined {
+    const binding = resolveTelegramUpdateJournalBinding();
+    const botToken = configStore.getBotToken();
+    if (!binding || !botToken) return undefined;
+    const profile = configStore.getActiveProfileName() ?? "default";
+    const botIdentity = Journal.createTelegramUpdateJournalBotIdentity({ botToken, botId: getTelegramBotId() });
+    return {
+      directory: Paths.resolveTelegramTempDir(), profile, botIdentity,
+      pollingPath: telegramLeaderJournalPath.resolve(configStore.getActiveProfileName()),
+      requiredJournalBindingKeys: [binding.recoveryKey, ...requiredJournalBindingKeys],
+      ...(target.threadId !== undefined && ownInputs
+        ? { cleanup: { target: { chatId: target.chatId, threadId: target.threadId }, ownInputs } } : {}),
+      limits: { maxDirectoryEntries: 10_000, maxFiles: 4096, maxBytes: 64 * 1024 * 1024,
+        maxEntries: 10_000, maxWork: 100_000 },
+      withSourceReference(path, operation) {
+        return telegramJournalReferenceRegistry.withReference({
+          referenceClass: "operator-disposition",
+          recoveryKey: Journal.createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity }),
+        }, operation);
+      },
+    };
+  };
   const inboundRouteRuntime = Routing.createTelegramInboundRouteRuntime({
     configStore,
     callApi: callTelegramApi,
@@ -1407,64 +1433,25 @@ export default function (pi: Pi.ExtensionAPI) {
         },
       );
     },
-    inspectTemporaryThreadSources(
-      target,
-      requiredJournalBindingKeys,
-      ownInputs,
-    ) {
-      const binding = resolveTelegramUpdateJournalBinding();
-      const botToken = configStore.getBotToken();
-      if (!binding || !botToken) return undefined;
-      const profile = configStore.getActiveProfileName() ?? "default";
-      const botIdentity = Journal.createTelegramUpdateJournalBotIdentity({
-        botToken,
-        botId: getTelegramBotId(),
-      });
+    inspectTemporaryThreadSources(target, requiredJournalBindingKeys, ownInputs) {
+      const input = prepareTemporaryThreadJournalInspection(target, requiredJournalBindingKeys, ownInputs);
+      if (!input) return undefined;
       return withTelegramJournalSourceSerialization(function () {
-        return Journal.isTelegramThreadCleanupJournalNamespaceClear({
-          directory: Paths.resolveTelegramTempDir(),
-          profile,
-          botIdentity,
-          pollingPath: telegramLeaderJournalPath.resolve(
-            configStore.getActiveProfileName(),
-          ),
-          requiredJournalBindingKeys: [
-            binding.recoveryKey,
-            ...requiredJournalBindingKeys,
-          ],
-          ...(target.threadId !== undefined && ownInputs
-            ? {
-                cleanup: {
-                  target: { chatId: target.chatId, threadId: target.threadId },
-                  ownInputs,
-                },
-              }
-            : {}),
-          limits: {
-            maxDirectoryEntries: 10_000,
-            maxFiles: 4096,
-            maxBytes: 64 * 1024 * 1024,
-            maxEntries: 10_000,
-            maxWork: 100_000,
-          },
-          withSourceReference(path, operation) {
-            return telegramJournalReferenceRegistry.withReference(
-              {
-                referenceClass: "operator-disposition",
-                recoveryKey: Journal.createTelegramUpdateJournalBindingKey({
-                  path,
-                  profileName: profile,
-                  botIdentity,
-                }),
-              },
-              operation,
-            );
-          },
-        })
-          ? []
-          : undefined;
+        return Journal.isTelegramThreadCleanupJournalNamespaceClear(input) ? [] : undefined;
       });
     },
+    recoverTemporaryThreadDeadQueueOwners(target, requiredJournalBindingKeys, ownInputs, isCurrent) {
+      const input = prepareTemporaryThreadJournalInspection(target, requiredJournalBindingKeys, ownInputs);
+      if (!input || !isCurrent()) return 0;
+      return Journal.recoverTelegramThreadCleanupDeadQueueOwners({
+          ...input, isCurrent, withSourceSerialization: withTelegramJournalSourceSerialization,
+          recoveryOwner: {
+            instanceId: telegramInstanceId, processId: telegramProcessId,
+            processBirthId: telegramQueueProcessBirthId,
+            sessionGeneration: telegramSessionContextStore.getGeneration(),
+          },
+        });
+    },
     hasWorkspaceRestoreAuthority() {
       return (
         lockRuntime.owns() &&
@@ -3071,6 +3058,7 @@ export default function (pi: Pi.ExtensionAPI) {
     deleteMessage: deleteTelegramMessage,
     sendGuestReply,
     editGuestReply,
+    editGuestInlineMessage: telegramApiRuntime.editGuestInlineMessage,
     stopGuestPlaceholder: guestPlaceholderRuntime.stop,
     finalizeMarkdownPreview,
     preparePreviewDelivery,

package/node_modules/@llblab/pi-telegram/lib/journal.ts

@@ -3741,6 +3741,86 @@ export function isTelegramThreadCleanupJournalNamespaceClear(
   );
 }
 
+/** Demand-driven recovery only; caller holds temporary-cleanup admission. Never a deletion grant. */
+export function recoverTelegramThreadCleanupDeadQueueOwners(
+  input: Parameters<typeof isTelegramThreadCleanupJournalNamespaceClear>[0] & {
+    recoveryOwner: TelegramUpdateJournalQueueOwnerIdentity;
+    isCurrent: () => boolean;
+    withSourceSerialization: NonNullable<TelegramUpdateJournalStoreOptions["withSourceSerialization"]>;
+    getQueueProcessLiveness?: TelegramUpdateJournalStoreOptions["getQueueProcessLiveness"];
+  },
+): number {
+  return input.withSourceSerialization(() => {
+    const assertCurrent = () => {
+      if (!input.isCurrent()) throw new Error("Temporary cleanup queue recovery lost authority.");
+    };
+    assertCurrent();
+    if (!input.cleanup) return 0;
+    // Validate exact references and complete namespace coverage before considering any mutation.
+    if (isTelegramThreadCleanupJournalNamespaceClear(input)) return 0;
+    const namespace = inspectTelegramSessionJournalNamespace(input);
+    if (namespace.retainedInputs?.some(value => value.state !== "committed") ||
+        input.requiredJournalBindingKeys.some(key => !namespace.sources.some(source =>
+          source.path === getTelegramUpdateJournalBindingPath(key) && source.evidence.kind === "present"))) return 0;
+    const plans: Array<{ path: string; recovery: TelegramUpdateJournalDeadQueueOwnerRecoveryInput }> = [];
+    for (const source of namespace.sources) {
+      if (source.evidence.kind !== "present") continue;
+      const file = source.evidence.file;
+      if (file.version !== TELEGRAM_UPDATE_JOURNAL_VERSION) continue;
+      const groups = new Map<string, TelegramUpdateJournalEntry[]>();
+      for (const entry of file.entries) {
+        if (!entry.queueReceiptId) continue;
+        const group = groups.get(entry.queueReceiptId) ?? [];
+        group.push(entry);
+        groups.set(entry.queueReceiptId, group);
+      }
+      for (const group of groups.values()) {
+        const entry = group[0]!;
+        if (entry.state !== "queued" || !entry.queueReceiptId || !entry.queueOwner ||
+            !entry.queueKind || entry.queueHandoff || entry.inputClaim) continue;
+        if (group.some(value => value.state !== "queued" || value.queueHandoff || value.inputClaim ||
+            value.queueKind !== entry.queueKind || !isDeepStrictEqual(value.queueOwner, entry.queueOwner))) continue;
+        plans.push({ path: source.path, recovery: {
+          queueKind: entry.queueKind, receiptId: entry.queueReceiptId,
+          sourceUpdateIds: group.map(value => value.updateId).sort((a, b) => a - b),
+          deadOwner: cloneJournalQueueOwner(entry.queueOwner), recoveryOwner: { ...input.recoveryOwner },
+        } });
+      }
+    }
+    const liveness = input.getQueueProcessLiveness ?? getTelegramProcessLiveness;
+    const dead = plans.filter(plan => {
+      assertCurrent();
+      const result = liveness(plan.recovery.deadOwner);
+      assertCurrent();
+      return result === "dead";
+    });
+    let removed = 0;
+    for (const plan of dead) {
+      assertCurrent();
+      removed += input.withSourceReference(plan.path, () => {
+        const journal = createTelegramUpdateJournalStore({
+          path: plan.path, profileName: input.profile, botIdentity: input.botIdentity,
+          queueRuntimeIdentity: input.recoveryOwner,
+          // This private synchronous store stays inside the cross-family serializer already held above.
+          withSourceSerialization(operation) { assertCurrent(); return operation(); },
+          sourceAccess: { directory: dirname(plan.path), limits: input.limits },
+          getQueueProcessLiveness(owner) {
+            assertCurrent();
+            const result = liveness(owner);
+            assertCurrent();
+            return result;
+          },
+          withWriterAdmission(operation) { assertCurrent(); return operation(); },
+        });
+        // The journal transaction rechecks whole-group identity, absence of handoff and fresh process-death proof.
+        return journal.recoverDeadQueueOwner(plan.recovery).recoveredUpdateIds.length;
+      });
+    }
+    assertCurrent();
+    return removed;
+  });
+}
+
 function cloneEntry(
   entry: TelegramUpdateJournalEntry,
 ): TelegramUpdateJournalEntry {

package/node_modules/@llblab/pi-telegram/lib/outbound-attachments.ts

@@ -130,6 +130,7 @@ export interface TelegramQueuedOutboundAttachmentView {
 export interface TelegramOutboundAttachmentQueueTargetView {
   queuedAttachments: TelegramQueuedOutboundAttachmentView[];
   guestQueryId?: string;
+  guestInlineMessageId?: string;
 }
 
 export interface TelegramQueuedOutboundAttachmentTurnView extends TelegramOutboundAttachmentQueueTargetView {
@@ -718,6 +719,11 @@ export async function queueTelegramOutboundAttachments(options: {
     maxAttachmentSizeBytes: options.maxAttachmentSizeBytes,
     statPath: options.statPath,
   });
+  if (options.activeTurn.guestInlineMessageId && pendingAttachments.some(
+    (attachment) => getTelegramGuestAttachmentTransport(attachment.path).fileField === "voice",
+  )) {
+    throw new Error("Telegram Guest Mode cannot replace an inline placeholder with a voice note; no attachment was queued. Use MP3 audio or a normal bot chat.");
+  }
   options.activeTurn.queuedAttachments.push(...pendingAttachments);
   const added = pendingAttachments.map((attachment) => attachment.path);
   return {
@@ -733,6 +739,13 @@ export async function queueTelegramOutboundAttachments(options: {
 
 export async function deliverTelegramGuestCachedAttachment(options: {
   guestQueryId: string;
+  guestInlineMessageId?: string;
+  editGuestInlineMessage?: (
+    inlineMessageId: string,
+    content: { media: { type: "photo" | "document" | "audio"; media: string; caption?: string } },
+    options: { assertAuthority: () => void },
+  ) => Promise<void>;
+  isDeliveryActive?: () => boolean;
   stagingChatId: number;
   stagingTarget?: TelegramTarget;
   attachment: TelegramQueuedOutboundAttachmentView;
@@ -750,6 +763,14 @@ export async function deliverTelegramGuestCachedAttachment(options: {
   const transport = getTelegramGuestAttachmentTransport(
     options.attachment.path,
   );
+  const isActive = () => options.isDeliveryActive?.() !== false;
+  const assertActive = () => {
+    if (!isActive()) throw new Error("Guest attachment delivery lost authority.");
+  };
+  if (!isActive()) return;
+  if (options.guestInlineMessageId && (!options.editGuestInlineMessage || transport.fileField === "voice")) {
+    throw new Error("Guest inline attachment editing is unavailable for this media.");
+  }
   let stagingMessageId: number | undefined;
   let answerAttempted = false;
   try {
@@ -764,6 +785,7 @@ export async function deliverTelegramGuestCachedAttachment(options: {
       options.attachment.fileName,
     )) as TelegramGuestStagingMessage;
     stagingMessageId = message.message_id;
+    if (!isActive()) return;
     const caption = options.caption
       ? Array.from(options.caption).slice(0, 1024).join("")
       : undefined;
@@ -810,17 +832,28 @@ export async function deliverTelegramGuestCachedAttachment(options: {
         ...(caption ? { caption } : {}),
       };
     }
+    if (!isActive()) return;
     answerAttempted = true;
-    await options.answerGuestQuery(options.guestQueryId, result);
+    if (options.guestInlineMessageId && options.editGuestInlineMessage) {
+      if (result.type === "voice") throw new Error("Voice notes cannot replace inline placeholders.");
+      const media = result.type === "photo" ? result.photo_file_id
+        : result.type === "audio" ? result.audio_file_id : result.document_file_id;
+      await options.editGuestInlineMessage(options.guestInlineMessageId, {
+        media: { type: result.type, media, ...(caption ? { caption } : {}) },
+      }, { assertAuthority: assertActive });
+    } else {
+      await options.answerGuestQuery(options.guestQueryId, result);
+    }
   } catch (error) {
-    if (!answerAttempted && options.answerGuestText && options.fallbackText) {
+    if (!isActive()) return;
+    if (!options.guestInlineMessageId && !answerAttempted && options.answerGuestText && options.fallbackText) {
       answerAttempted = true;
       await options.answerGuestText(options.guestQueryId, options.fallbackText);
     } else {
       throw error;
     }
   } finally {
-    if (stagingMessageId !== undefined) {
+    if (stagingMessageId !== undefined && isActive()) {
       try {
         await options.deleteMessage(options.stagingChatId, stagingMessageId);
       } catch (error) {

package/node_modules/@llblab/pi-telegram/lib/queue.ts

@@ -1983,13 +1983,18 @@ export interface TelegramAgentEndRuntimeDeps<
   ) => Promise<void>;
   sendGuestReply?: (guestQueryId: string, markdown: string) => Promise<void>;
   /** Replaces the early guest ACK with the final text. */
-  editGuestReply?: (inlineMessageId: string, markdown: string) => Promise<void>;
+  editGuestReply?: (
+    inlineMessageId: string,
+    markdown: string,
+    options?: { assertAuthority?: () => void },
+  ) => Promise<void>;
   /** Cancels the animated guest placeholder before the final edit. */
   stopGuestPlaceholder?: (inlineMessageId: string) => Promise<void>;
   sendGuestAttachment?: (
     turn: TTurn,
     attachment: QueuedAttachment,
     caption?: string,
+    options?: { isDeliveryActive?: () => boolean },
   ) => Promise<void>;
   sendGuestVoiceReply?: (
     turn: TTurn,
@@ -2350,13 +2355,46 @@ export async function handleTelegramAgentEndRuntime<
         });
       }
     }
-    if (turn.guestInlineMessageId && deps.editGuestReply) {
-      const experimentText = assistant.errorMessage
+    if (!isDeliveryActive()) return;
+    if (turn.guestInlineMessageId) {
+      let experimentText = assistant.errorMessage
         ? "Telegram bridge: Pi failed while processing the request."
         : finalText;
+      const [attachment] = turn.queuedAttachments;
+      if (!assistant.errorMessage && attachment) {
+        try {
+          if (!deps.sendGuestAttachment) throw new Error("Guest attachment delivery is unavailable.");
+          await deps.sendGuestAttachment(turn, attachment, finalText || undefined, { isDeliveryActive });
+          if (isDeliveryActive() && endPlan.shouldDispatchNext) deps.dispatchNextQueuedTelegramTurn();
+          return;
+        } catch (error) {
+          deps.recordRuntimeEvent?.("delivery", error, {
+            phase: "guest-attachment", guestQueryId: turn.guestQueryId,
+          });
+          if (!isDeliveryActive()) return;
+          if (isTelegramApiCommitUnknownError(error)) {
+            if (endPlan.shouldDispatchNext) deps.dispatchNextQueuedTelegramTurn();
+            return;
+          }
+          experimentText = "Telegram bridge could not deliver the requested attachment. Please retry in a normal bot chat.";
+        }
+      } else if (!assistant.errorMessage && hasOutboundArtifacts) {
+        experimentText = [finalText, "Telegram Guest Mode cannot replace an inline placeholder with a voice note. Please request MP3 audio or use a normal bot chat."].filter(Boolean).join("\n\n");
+      }
+      if (!deps.editGuestReply) {
+        deps.recordRuntimeEvent?.("delivery", new Error("Guest inline reply editing is unavailable."), {
+          phase: "guest-ack-edit", guestQueryId: turn.guestQueryId,
+        });
+        if (endPlan.shouldDispatchNext) deps.dispatchNextQueuedTelegramTurn();
+        return;
+      }
       if (experimentText) {
         try {
-          await deps.editGuestReply(turn.guestInlineMessageId, experimentText);
+          await deps.editGuestReply(turn.guestInlineMessageId, experimentText, {
+            assertAuthority() {
+              if (!isDeliveryActive()) throw new Error("Guest reply edit lost authority.");
+            },
+          });
           deps.recordRuntimeEvent?.(
             "guest",
             new Error("Guest ACK edited the guest answer"),
@@ -2401,6 +2439,7 @@ export async function handleTelegramAgentEndRuntime<
           turn,
           guestAttachment,
           finalText || undefined,
+          { isDeliveryActive },
         );
       } catch (error) {
         deps.recordRuntimeEvent?.("delivery", error, {

package/node_modules/@llblab/pi-telegram/lib/replies.ts

@@ -1033,13 +1033,14 @@ export function createGuestMarkdownReplyEditor(deps: {
   editGuestInlineMessage: (
     inlineMessageId: string,
     content: { richMessage?: TelegramInputRichMessage; text?: string },
+    options?: { assertAuthority?: () => void },
   ) => Promise<void>;
 }) {
-  return async (inlineMessageId: string, markdown: string) => {
+  return async (inlineMessageId: string, markdown: string, options?: { assertAuthority?: () => void }) => {
     const [richMarkdown = markdown] = splitTelegramNativeMarkdown(markdown);
     await deps.editGuestInlineMessage(inlineMessageId, {
       richMessage: { markdown: richMarkdown },
-    });
+    }, options);
   };
 }