@llblab/pi-kit 0.36.0 → 0.36.2

package/node_modules/@llblab/pi-telegram/dist/lib/extension.js

@@ -454,17 +454,32 @@ export default function (pi) {
             return WorkspaceRetirement.isCurrentTelegramWorkspaceBinding(threadStore, binding);
         },
     });
-    const inactiveThreadCleanupReviewRuntime = ThreadCleanupManager.createTelegramInactiveThreadCleanupReviewRuntime({
-        getProfileName() {
-            return configStore.getActiveProfileName() ?? "default";
+    const inactiveThreadCleanupRuntime = ThreadCleanupManager.createTelegramInactiveThreadCleanupRuntime({
+        store: threadStore,
+        captureAuthority() {
+            const ledger = workspaceAdmissionRuntime.resolve();
+            const leaderEpoch = getCurrentLeaderEpoch();
+            const operator = configStore.getAllowedUserId();
+            if (!ledger || leaderEpoch === undefined || operator === undefined)
+                return undefined;
+            const stamp = telegramTransportStampRuntime.getStamp();
+            const generation = telegramSessionContextStore.getGeneration();
+            return {
+                profileName: configStore.getActiveProfileName() ?? "default",
+                leaderEpoch, ledger,
+                isCurrent() {
+                    return getCurrentLeaderEpoch() === leaderEpoch &&
+                        telegramTransportStampRuntime.isActive(stamp) &&
+                        configStore.getAllowedUserId() === operator &&
+                        telegramSessionContextStore.getGeneration() === generation;
+                },
+            };
         },
-        listBindings: threadStore.listWorkspaceBindings,
         getProtection: captureWorkspaceExternalProtection,
-        listReservations: threadStore.listReservations,
-        listPendingProvisions: threadStore.listPendingProvisions,
-        listPendingCleanups: threadStore.listPendingCleanups,
-        getWorkStore() {
-            const profileName = configStore.getActiveProfileName() ?? "default";
+        getProcessLiveness: ProcessIdentity.getTelegramProcessLiveness,
+        runExclusive: telegramWorkspaceOperationRuntime.runExclusive,
+        getWorkStore(authority) {
+            const profileName = authority.profileName;
             const botToken = configStore.getBotToken();
             if (!botToken)
                 throw new Error("Telegram Thread cleanup review requires an active bot token.");
@@ -474,9 +489,16 @@ export default function (pi) {
                 tokenSha256: Journal.createTelegramUpdateJournalBotIdentity({
                     botToken,
                 }).tokenSha256,
+                admissionProfileKey: authority.ledger.getProfileKey(),
             });
         },
         runWorkspaceOperation: telegramWorkspaceOperationRuntime.run,
+        deleteThread(authorize) {
+            return directTelegramApiRuntime.deleteWorkspaceThread(authorize);
+        },
+        onError(error) {
+            recordRuntimeEvent("telegram", error, { phase: "manual-inactive-thread-cleanup" });
+        },
     });
     const updateAdmissionRuntimeBinding = Updates.createTelegramUpdateAdmissionRuntimeBinding({
         isFollowerRegistered: telegramBusFollowerRegistrationState.isRegistered,
@@ -940,7 +962,8 @@ export default function (pi) {
         sendInteractiveMessage,
         answerCallbackQuery,
         ...configControls,
-        reviewInactiveThreads: inactiveThreadCleanupReviewRuntime.review,
+        reviewInactiveThreads: inactiveThreadCleanupRuntime.review,
+        cleanInactiveThreads: inactiveThreadCleanupRuntime.clean,
         getThreadDisplayMode() {
             return threadStore.getBotState().threadMode === "enabled"
                 ? Config.resolveTelegramThreadDisplayMode(configStore.get())
@@ -1377,6 +1400,15 @@ export default function (pi) {
                     return binding.hasAuthority?.() === true;
                 });
             },
+            recoverRejectedRecipientTarget(error) {
+                const rejected = error instanceof TelegramApi.TelegramApiFollowerNotAllowedError
+                    ? error.requestTarget
+                    : undefined;
+                const current = telegramBusFollowerRegistrationState.getTarget();
+                return rejected && current?.threadId !== undefined
+                    ? { rejected, current: { chatId: current.chatId, threadId: current.threadId } }
+                    : undefined;
+            },
             prepareUpdateForExecution(update) {
                 return BusFollower.prepareTelegramBusFollowerJournaledUpdateForExecution(update, textGroupRuntime.prepareForwardedMessage);
             },

package/node_modules/@llblab/pi-telegram/dist/lib/generative-apps.d.ts

@@ -159,6 +159,7 @@ export interface TelegramBindToolRegistrationDeps extends GenerativeAppRuntimeOp
     recordRuntimeEvent?: (category: string, error: unknown, details?: Record<string, unknown>) => void;
 }
 export declare function resolveGenerativeAppDir(agentDir: string, app: string): string;
+export declare function isGenerativeAppInstalled(agentDir: string, app: string): Promise<boolean>;
 export declare function resolveGenerativeAppModulePath(agentDir: string, app: string): string;
 export declare function invokeGenerativeApp(options: GenerativeAppRuntimeOptions & {
     argument?: unknown;

package/node_modules/@llblab/pi-telegram/dist/lib/generative-apps.js

@@ -86,6 +86,15 @@ export function resolveGenerativeAppDir(agentDir, app) {
     assertAppName(app);
     return join(getAppsRoot(agentDir), app);
 }
+export async function isGenerativeAppInstalled(agentDir, app) {
+    try {
+        await stat(resolveGenerativeAppModulePath(agentDir, app));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function resolveGenerativeAppModulePath(agentDir, app) {
     return join(resolveGenerativeAppDir(agentDir, app), `${app}.mjs`);
 }

package/node_modules/@llblab/pi-telegram/dist/lib/lifecycle.d.ts

@@ -5,7 +5,7 @@
  * Transport authority, durable bindings, and queue custody remain with their owners.
  */
 import * as BusFollower from "./bus-follower.ts";
-import type { AgentEndEvent, AgentSettledEvent, AgentStartEvent, AssistantMessageEvent, BeforeAgentStartEvent, ExtensionAPI, ExtensionContext, InputEvent, MessageEndEvent, SessionBeforeCompactEvent, SessionCompactEvent, SessionCompactFailedEvent, SessionShutdownEvent, SessionStartEvent, ToolExecutionEndEvent, ToolExecutionStartEvent, ToolExecutionUpdateEvent, TurnEndEvent, TurnEndEventResult, UIPromptEndEvent, UIPromptStartEvent } from "./pi.ts";
+import type { AgentEndEvent, AgentSettledEvent, AgentStartEvent, AssistantMessageEvent, BeforeAgentStartEvent, BeforeAgentStartEventResult, ExtensionAPI, ExtensionContext, InputEvent, MessageEndEvent, SessionBeforeCompactEvent, SessionCompactEvent, SessionCompactFailedEvent, SessionShutdownEvent, SessionStartEvent, ToolExecutionEndEvent, ToolExecutionStartEvent, ToolExecutionUpdateEvent, TurnEndEvent, TurnEndEventResult, UIPromptEndEvent, UIPromptStartEvent } from "./pi.ts";
 import * as Machine from "./machine.ts";
 import * as Queue from "./queue.ts";
 export declare function createAgentStartDedupHook(inner: (event: AgentStartEvent, ctx: ExtensionContext) => Promise<void>, resetReplyDedup: () => void, schedulePublication?: (task: () => Promise<void>) => void): (event: AgentStartEvent, ctx: ExtensionContext) => Promise<void>;
@@ -14,6 +14,7 @@ type TelegramBeforeAgentStartEvent = Omit<BeforeAgentStartEvent, "systemPrompt">
 };
 export interface TelegramBeforeAgentStartResult {
     systemPrompt?: string | string[];
+    message?: BeforeAgentStartEventResult["message"];
 }
 type TelegramBeforeAgentStartReturn = Promise<TelegramBeforeAgentStartResult | undefined> | TelegramBeforeAgentStartResult | undefined;
 type TelegramLifecycleModel = ExtensionContext["model"];

package/node_modules/@llblab/pi-telegram/dist/lib/menu-settings.js

@@ -49,7 +49,7 @@ export function buildAutomaticThreadCleanupSettingsText(enabled) {
         "<code>-</code> <code>on</code> (default): delete the bound thread and release Telegram authority on graceful quit.",
         "<code>-</code> <code>off</code>: preserve the tab as a restart hint; manual <code>/telegram-disconnect</code> still confirms and deletes it.",
         "",
-        "Review inactive tabs checks current owner and work evidence. Review never deletes tabs.",
+        "On the leader instance, Review inactive tabs checks current owner and work evidence, including tabs without a letter. Review never deletes tabs.",
     ].join("\n");
 }
 function buildInactiveThreadReviewText(count) {
@@ -58,7 +58,8 @@ function buildInactiveThreadReviewText(count) {
         "",
         `${count} proven inactive tab${count === 1 ? "" : "s"}.`,
         "No tabs were deleted.",
-        "Deletion requires a separate confirmed Clean action.",
+        "Clean inactive tabs deletes these Telegram tabs and all their messages. Pi session history and project files are not removed.",
+        "Clean rechecks owner and work protection; a changed or protected tab is skipped. Choose Back to leave without deleting anything.",
     ].join("\n");
 }
 export function buildInactiveThreadReviewReplyMarkup(operationId, canCleanInactiveThreads = false) {

package/node_modules/@llblab/pi-telegram/dist/lib/pi.d.ts

@@ -4,8 +4,8 @@
  * Owns direct pi SDK imports and exposes narrow bridge-facing helpers/types for the extension composition layer
  */
 import type { AssistantMessageEvent } from "@earendil-works/pi-ai";
-import { type AgentEndEvent, type AgentSettledEvent, type AgentStartEvent, type BeforeAgentStartEvent, type ExtensionAPI, type ExtensionCommandContext, type ExtensionContext, type InputEvent, type MessageEndEvent, type SessionBeforeCompactEvent, type SessionCompactEvent, type SessionShutdownEvent, type SessionStartEvent, type SlashCommandInfo, type TurnEndEvent, type TurnEndEventResult, type UIPromptEndEvent, type UIPromptStartEvent } from "@earendil-works/pi-coding-agent";
-export type { AgentEndEvent, AgentSettledEvent, AgentStartEvent, AssistantMessageEvent, BeforeAgentStartEvent, ExtensionAPI, ExtensionCommandContext, ExtensionContext, InputEvent, MessageEndEvent, SessionBeforeCompactEvent, SessionCompactEvent, SessionShutdownEvent, SessionStartEvent, SlashCommandInfo, TurnEndEvent, TurnEndEventResult, UIPromptEndEvent, UIPromptStartEvent, };
+import { type AgentEndEvent, type AgentSettledEvent, type AgentStartEvent, type BeforeAgentStartEvent, type BeforeAgentStartEventResult, type ExtensionAPI, type ExtensionCommandContext, type ExtensionContext, type InputEvent, type MessageEndEvent, type SessionBeforeCompactEvent, type SessionCompactEvent, type SessionShutdownEvent, type SessionStartEvent, type SlashCommandInfo, type TurnEndEvent, type TurnEndEventResult, type UIPromptEndEvent, type UIPromptStartEvent } from "@earendil-works/pi-coding-agent";
+export type { AgentEndEvent, AgentSettledEvent, AgentStartEvent, AssistantMessageEvent, BeforeAgentStartEvent, BeforeAgentStartEventResult, ExtensionAPI, ExtensionCommandContext, ExtensionContext, InputEvent, MessageEndEvent, SessionBeforeCompactEvent, SessionCompactEvent, SessionShutdownEvent, SessionStartEvent, SlashCommandInfo, TurnEndEvent, TurnEndEventResult, UIPromptEndEvent, UIPromptStartEvent, };
 export interface SessionCompactFailedEvent {
     type: "session_compact_failed";
     reason: "manual" | "threshold" | "overflow";

package/node_modules/@llblab/pi-telegram/dist/lib/prompts.d.ts

@@ -1,9 +1,9 @@
 /**
  * Telegram prompt injection helpers
  * Zones: pi agent prompts, telegram guidance
- * Owns Telegram-specific system prompt suffixes injected into pi agent turns
+ * Owns stable Telegram guidance, turn-scoped context, and compatibility fallback hooks
  */
-import type { BeforeAgentStartEvent } from "./pi.ts";
+import type { BeforeAgentStartEvent, BeforeAgentStartEventResult } from "./pi.ts";
 export declare const TELEGRAM_CONNECTED_CONTEXT_MESSAGE = "Telegram session connected. Use Telegram features for Telegram-originated turns or explicit Telegram requests; connectivity alone is not user intent.";
 export declare const TELEGRAM_DISCONNECTED_CONTEXT_MESSAGE = "Telegram session disconnected. Do not use Telegram delivery, actions, or Telegram-specific reply features unless the user reconnects it.";
 export declare const TELEGRAM_ATTACH_PROMPT_SNIPPET = "Queue files for the active Telegram reply; outside Telegram turns, send files directly to Telegram.";
@@ -37,6 +37,9 @@ type TelegramBeforeAgentStartEvent = Omit<BeforeAgentStartEvent, "systemPrompt"
 type TelegramBeforeAgentStartResult = {
     systemPrompt: TelegramSystemPrompt;
 };
+type TelegramProactiveBeforeAgentStartResult = Omit<BeforeAgentStartEventResult, "systemPrompt"> & {
+    systemPrompt?: TelegramSystemPrompt;
+};
 type TelegramBeforeAgentStartHook = (event: TelegramBeforeAgentStartEvent) => TelegramBeforeAgentStartResult;
 export declare function buildTelegramBridgeSystemPrompt(options: {
     prompt?: string;
@@ -55,5 +58,5 @@ export interface TelegramProactivePromptHookDeps<TContext> {
     reconcileAvailability?: () => void;
     isAvailable: (ctx: TContext) => boolean;
 }
-export declare function createTelegramProactiveBeforeAgentStartHook<TContext>(deps: TelegramProactivePromptHookDeps<TContext>): (event: TelegramBeforeAgentStartEvent, ctx: TContext) => Promise<TelegramBeforeAgentStartResult>;
+export declare function createTelegramProactiveBeforeAgentStartHook<TContext>(deps: TelegramProactivePromptHookDeps<TContext>): (event: TelegramBeforeAgentStartEvent, ctx: TContext) => Promise<TelegramProactiveBeforeAgentStartResult | undefined>;
 export {};

package/node_modules/@llblab/pi-telegram/dist/lib/prompts.js

@@ -1,7 +1,7 @@
 /**
  * Telegram prompt injection helpers
  * Zones: pi agent prompts, telegram guidance
- * Owns Telegram-specific system prompt suffixes injected into pi agent turns
+ * Owns stable Telegram guidance, turn-scoped context, and compatibility fallback hooks
  */
 import { TELEGRAM_PREFIX } from "./turns.js";
 export const TELEGRAM_CONNECTED_CONTEXT_MESSAGE = "Telegram session connected. Use Telegram features for Telegram-originated turns or explicit Telegram requests; connectivity alone is not user intent.";
@@ -107,8 +107,17 @@ export function createTelegramModelContextAvailabilityRuntime(deps) {
         },
     };
 }
-export function buildTelegramBridgeSystemPrompt(options) {
-    const basePrompt = options.systemPrompt ?? "";
+// Returning any systemPrompt makes Pi replace its prompt, which defeats prompt
+// caching; return an override only when the computed prompt actually differs.
+function overrideSystemPromptIfChanged(incoming, computed) {
+    const base = incoming ?? "";
+    const unchanged = Array.isArray(base) && Array.isArray(computed)
+        ? base.length === computed.length &&
+            base.every((block, index) => block === computed[index])
+        : base === computed;
+    return unchanged ? undefined : { systemPrompt: computed };
+}
+function buildTelegramTurnSuffix(options) {
     const telegramPrefix = options.telegramPrefix ?? TELEGRAM_PREFIX;
     const telegramHead = telegramPrefix.endsWith("]")
         ? telegramPrefix.slice(0, -1)
@@ -116,9 +125,13 @@ export function buildTelegramBridgeSystemPrompt(options) {
     const trimmedPrompt = options.prompt?.trimStart() ?? "";
     const telegramTurn = trimmedPrompt.startsWith(`${telegramHead}]`) ||
         trimmedPrompt.startsWith(`${telegramHead}|`);
-    const telegramSuffix = telegramTurn
+    return telegramTurn
         ? `${options.telegramTurnSystemPromptSuffix}\n- The current user message came from Telegram.`
         : "";
+}
+export function buildTelegramBridgeSystemPrompt(options) {
+    const basePrompt = options.systemPrompt ?? "";
+    const telegramSuffix = buildTelegramTurnSuffix(options);
     return {
         systemPrompt: Array.isArray(basePrompt)
             ? [...basePrompt, options.localSystemPromptSuffix + telegramSuffix]
@@ -148,15 +161,43 @@ function stripTelegramToolMetadataFromSystemPrompt(systemPrompt) {
         ? systemPrompt.map(stripTelegramToolMetadataFromString)
         : stripTelegramToolMetadataFromString(systemPrompt);
 }
+const TELEGRAM_TOOL_NAMES = ["telegram_attach", "telegram_message"];
+// Sections cannot modify an opaque prompt owned by an earlier handler.
+// Preserve append/strip compatibility there instead of silently losing guidance.
+function applyTelegramPromptSections(event, available) {
+    const options = event.systemPromptOptions;
+    const sections = options?.sections;
+    if (typeof sections !== "object" || sections === null || options?.forceSystemPrompt !== undefined)
+        return false;
+    if (available) {
+        sections.telegram = LOCAL_SYSTEM_PROMPT_SUFFIX.trim();
+        return true;
+    }
+    delete sections.telegram;
+    for (const name of TELEGRAM_TOOL_NAMES) {
+        if (options?.toolSnippets)
+            delete options.toolSnippets[name];
+        if (options?.toolGuidelines)
+            delete options.toolGuidelines[name];
+    }
+    return true;
+}
 export function createTelegramProactiveBeforeAgentStartHook(deps) {
     const baseHook = deps.baseHook ?? createTelegramBeforeAgentStartHook();
     return async (event, ctx) => {
         deps.reconcileAvailability?.();
-        if (!deps.isAvailable(ctx)) {
-            return {
-                systemPrompt: stripTelegramToolMetadataFromSystemPrompt(event.systemPrompt),
-            };
+        const available = deps.isAvailable(ctx);
+        // A caller-supplied baseHook owns its own prompt text, so it stays on the forced-prompt path.
+        if (!deps.baseHook && applyTelegramPromptSections(event, available)) {
+            const turnSuffix = available ? buildTelegramTurnSuffix({
+                prompt: event.messageType === "custom" ? undefined : event.prompt,
+                telegramTurnSystemPromptSuffix: TELEGRAM_TURN_SYSTEM_PROMPT_SUFFIX,
+            }).trim() : "";
+            return turnSuffix ? { message: { customType: "telegram-turn", content: turnSuffix, display: false } } : undefined;
+        }
+        if (!available) {
+            return overrideSystemPromptIfChanged(event.systemPrompt, stripTelegramToolMetadataFromSystemPrompt(event.systemPrompt));
         }
-        return baseHook(event);
+        return overrideSystemPromptIfChanged(event.systemPrompt, baseHook(event).systemPrompt);
     };
 }

package/node_modules/@llblab/pi-telegram/dist/lib/routing.js

@@ -1052,6 +1052,8 @@ export function createTelegramInboundRouteRuntime(deps) {
     /** A frozen destination pauses All-command expiry until routing finishes or releases it. */
     const isPendingRerouteDestinationHeld = (pending) => pending.phase.kind !== "waiting" && pending.phase.kind !== "released";
     const pendingUnboundReroutes = new Map();
+    // Body-free, bounded warm deduplication: album members can expire through the same chooser.
+    const expiredRoutingViews = new Set();
     const implicitThreadCreations = new Map();
     const guidedUnboundTopicKeys = new Set();
     let nextUnboundRerouteId = 0;
@@ -1409,6 +1411,20 @@ export function createTelegramInboundRouteRuntime(deps) {
                         return result;
                     }
                     catch (error) {
+                        const missingTarget = TelegramApi.getTelegramApiErrorRequestTarget(error);
+                        if (method === "deleteForumTopic" && missingTarget && error instanceof Error &&
+                            TelegramApi.isTelegramApiRequestRejected(error, method) &&
+                            TelegramApi.isTelegramStaleTargetHttpError(error) &&
+                            ThreadReconciler.isTelegramTopicDeletedErrorMessage(error.message) &&
+                            missingTarget?.chatId === temporaryCleanup.target?.chatId &&
+                            missingTarget?.threadId === temporaryCleanup.target?.threadId &&
+                            missingTarget?.chatId === body.chat_id && missingTarget?.threadId === body.message_thread_id) {
+                            // Only the client's parsed exact-target HTTP 400 absence closes the one-shot grant.
+                            // Closed/denied/foreign/forged responses remain uncertain and never license another request.
+                            assertExecutionCurrent?.();
+                            temporaryDeleteConfirmed = true;
+                            return true;
+                        }
                         temporaryTransportUncertain = true;
                         throw error;
                     }
@@ -5524,7 +5540,8 @@ export function createTelegramInboundRouteRuntime(deps) {
         return formatTelegramRoutingInputPreview(message);
     };
     const expireRoutingInput = async (source, ctx, signal) => {
-        const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.();
+        const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.(), generation = deps.getSessionGeneration?.(), instanceId = deps.getCurrentInstanceId?.(), scope = deps.getAdmissionScope?.();
+        const sendTextReply = deps.sendTextReply, editInteractiveMessage = deps.editInteractiveMessage;
         const message = source.original.update.message;
         const runtimeCurrent = () => !signal.aborted &&
             operator !== undefined &&
@@ -5532,6 +5549,9 @@ export function createTelegramInboundRouteRuntime(deps) {
             deps.isContextActive?.(ctx) === true &&
             deps.configStore.getAllowedUserId() === operator &&
             deps.getCurrentLeaderEpoch?.() === epoch &&
+            deps.getSessionGeneration?.() === generation &&
+            deps.getCurrentInstanceId?.() === instanceId &&
+            deps.getAdmissionScope?.() === scope &&
             deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
             source.original.routingInput?.operatorUserId === operator &&
             message?.from?.id === operator &&
@@ -5559,27 +5579,73 @@ export function createTelegramInboundRouteRuntime(deps) {
                 return;
             // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
             let movedIntoTab = false;
+            let unissued = source.original.routingInput?.phase === "waiting" &&
+                (!temporary || temporary.forwardProtocol === "one-shot-v1") &&
+                ![...(temporary?.forwardedInputs ?? []), ...(temporary?.completedInputs ?? [])].some(input => input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId));
+            const views = new Map();
+            const chooser = source.original.routingInput?.chooser;
+            if (chooser)
+                views.set(`${chooser.chatId}:${chooser.messageId}`, { ...chooser });
             for (const [id, pending] of pendingUnboundReroutes) {
                 if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
                     continue;
                 movedIntoTab ||= pending.allTabCopiesForwarded !== undefined;
+                unissued &&= isPendingRerouteUntouched(pending) || pending.phase.kind === "released";
+                if (pending.chooserMessageId !== undefined)
+                    views.set(`${pending.sourceTarget.chatId}:${pending.chooserMessageId}`, {
+                        ...pending.sourceTarget, messageId: pending.chooserMessageId,
+                    });
                 removePendingReroute(id);
-                if (signal.aborted ||
-                    deps.isContextActive?.(ctx) !== true ||
-                    deps.configStore.getAllowedUserId() !== operator ||
-                    deps.getCurrentLeaderEpoch?.() !== epoch ||
-                    deps.getAdmissionJournalBinding?.() !== source.journalBindingKey)
-                    continue;
-                if (deps.editInteractiveMessage &&
-                    pending.chooserMessageId !== undefined) {
+            }
+            const notice = unissued
+                ? "<b>⌛ Routing expired; input was not delivered.</b>"
+                : "<b>⌛ Routing expired; delivery is unconfirmed.</b>\nPreviously accepted work may continue.";
+            const noticeKey = `${source.journalBindingKey}:${source.original.routingInput?.expiresAtMs}:${chooser ? `${chooser.chatId}:${chooser.messageId}` : source.original.updateId}`;
+            if (runtimeCurrent() && !expiredRoutingViews.has(noticeKey)) {
+                if (expiredRoutingViews.size >= 100)
+                    expiredRoutingViews.delete(expiredRoutingViews.values().next().value);
+                expiredRoutingViews.add(noticeKey);
+                let visible = false;
+                const assertNoticeAuthority = () => {
+                    if (!runtimeCurrent())
+                        throw new Error("Routing expiry notice authority changed.");
+                };
+                for (const view of views.values()) {
+                    if (!runtimeCurrent() || !editInteractiveMessage || deps.editInteractiveMessage !== editInteractiveMessage)
+                        break;
+                    if (view.chatId !== message.chat.id || !Number.isSafeInteger(view.threadId) || view.threadId <= 0)
+                        continue;
                     try {
-                        await deps.editInteractiveMessage(pending.sourceTarget.chatId, pending.chooserMessageId, "<b>⌛ Routing choice expired.</b>", "html", { inline_keyboard: [] });
+                        await editInteractiveMessage(view.chatId, view.messageId, notice, "html", { inline_keyboard: [] }, {
+                            target: { chatId: view.chatId, threadId: view.threadId }, assertAuthority: assertNoticeAuthority,
+                        });
+                        visible = true;
                     }
                     catch (error) {
-                        deps.recordRuntimeEvent?.("routing", error, {
-                            phase: "routing-input-expiry-view",
-                        });
+                        deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-view" });
+                    }
+                }
+                // A temporary tab is about to disappear; a cold/missing chooser also needs an independent owned destination.
+                const leader = instanceId ? deps.threadStore?.getActiveByInstanceId(instanceId) : undefined;
+                if ((!visible || temporary?.target) && runtimeCurrent() && leader &&
+                    leader.target.chatId === message.chat.id && Number.isSafeInteger(leader.target.threadId) && leader.target.threadId > 0) {
+                    const target = { chatId: leader.target.chatId, threadId: leader.target.threadId };
+                    try {
+                        const assertFallback = () => {
+                            assertNoticeAuthority();
+                            const active = deps.threadStore?.getActiveByInstanceId(instanceId);
+                            if (deps.sendTextReply !== sendTextReply || active?.target.chatId !== target.chatId || active.target.threadId !== target.threadId)
+                                throw new Error("Routing expiry notice destination changed.");
+                        };
+                        assertFallback();
+                        await sendTextReply(target.chatId, 0, notice, { parseMode: "HTML", target, assertAuthority: assertFallback });
                     }
+                    catch (error) {
+                        deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-notice" });
+                    }
+                }
+                else if (!visible && runtimeCurrent()) {
+                    deps.recordRuntimeEvent?.("routing", "Routing expiry notice has no current owned Thread.", { phase: "routing-input-expiry-notice-unavailable" });
                 }
             }
             // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
@@ -5780,7 +5846,8 @@ export function createTelegramInboundRouteRuntime(deps) {
                         if (!recordRecoveredRerouteSource(pending, source.original.updateId, source.result))
                             continue;
                         try {
-                            await retireCancellationChooser(id, pending, isCurrent);
+                            if (await retireCancellationChooser(id, pending, isCurrent))
+                                await deleteCancelledOrphanTab(pending, pending.abandonment, isCurrent);
                         }
                         catch (error) {
                             deps.recordRuntimeEvent?.("routing", error, {
@@ -5809,6 +5876,43 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         return true;
     };
+    /**
+     * A cancelled input in an unbound (non-temporary) tab leaves nothing to route: once no chooser, queue, live owner,
+     * Workspace/Restore record or retained journal arrival still names the tab, it is deleted like a routing tab. Any
+     * missing proof or failure keeps the tab; this never retries and never blocks the Cancel outcome.
+     */
+    const deleteCancelledOrphanTab = async (pending, cancellation, isAuthorityCurrent) => {
+        const { chatId, threadId } = pending.sourceTarget;
+        if (threadId === undefined ||
+            pending.temporaryThread ||
+            isTemporaryTabTarget({ chatId, threadId }) ||
+            hasPendingRerouteForTarget({ chatId, threadId }) ||
+            !deps.inspectTemporaryThreadSources)
+            return;
+        const target = { chatId, threadId };
+        try {
+            const own = {
+                journalBindingKey: cancellation.journalBindingKey,
+                updateIds: Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages),
+            };
+            const assertCurrent = () => {
+                if (!isAuthorityCurrent())
+                    throw new Error("Unbound tab cleanup authority changed.");
+            };
+            assertCurrent();
+            if (deps.inspectTemporaryThreadSources(target, [cancellation.journalBindingKey], [own])?.length !== 0)
+                return;
+            assertCurrent();
+            await closeReroutedUnboundTopic(target, pending.chooserMessageId, assertCurrent);
+        }
+        catch (error) {
+            deps.recordRuntimeEvent?.("routing", error, {
+                phase: "unbound-cancel-tab-cleanup",
+                chatId: target.chatId,
+                threadId: target.threadId,
+            });
+        }
+    };
     const handleUnboundRerouteCancelCallback = async (query, ctx) => {
         if (!query.data?.startsWith(TELEGRAM_UNBOUND_REROUTE_CANCEL_CALLBACK_PREFIX))
             return false;
@@ -5890,6 +5994,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                 await Promise.all([
                     deps.answerCallbackQuery(query.id, "Routing cancelled"),
                     deleteAllTabCopies(pending),
+                    deleteCancelledOrphanTab(pending, cancellation, isAuthorityCurrent),
                 ]);
         }
         catch (error) {

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.d.ts

@@ -505,6 +505,17 @@ export declare class TelegramApiStaleTargetError extends Error {
         threadId: number;
     });
 }
+/** The leader's exact refusal of a follower API call outside that follower's own Thread; carries only the requested target. */
+export declare class TelegramApiFollowerNotAllowedError extends Error {
+    readonly requestTarget: {
+        chatId: number;
+        threadId: number;
+    } | undefined;
+    constructor(message: string, requestTarget?: {
+        chatId: number;
+        threadId: number;
+    });
+}
 export declare function getTelegramApiErrorRequestTarget(error: unknown): {
     chatId: number;
     threadId: number;

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.js

@@ -338,6 +338,15 @@ export class TelegramApiStaleTargetError extends Error {
         this.requestTarget = { ...requestTarget };
     }
 }
+/** The leader's exact refusal of a follower API call outside that follower's own Thread; carries only the requested target. */
+export class TelegramApiFollowerNotAllowedError extends Error {
+    requestTarget;
+    constructor(message, requestTarget) {
+        super(message);
+        this.name = "TelegramApiFollowerNotAllowedError";
+        this.requestTarget = requestTarget ? { ...requestTarget } : undefined;
+    }
+}
 export function getTelegramApiErrorRequestTarget(error) {
     const target = error instanceof TelegramApiHttpError ||
         error instanceof TelegramApiStaleTargetError

package/node_modules/@llblab/pi-telegram/dist/lib/thread-cleanup-manager.d.ts

@@ -3,7 +3,11 @@
  * Zones: telegram threads, workspace lifecycle
  * Owns fail-closed cleanup eligibility projection without persistence or Bot API effects
  */
-import type { TelegramWorkspaceDeletionPermit, TelegramWorkspaceDestructiveFence, TelegramWorkspaceRetirementFence } from "./workspace-admission.ts";
+import type { TelegramWorkspaceDeletionPermit, TelegramWorkspaceDestructiveFence, TelegramWorkspaceRetirementFence, TelegramWorkspaceAdmissionLedger, TelegramWorkspaceAdmissionOwner } from "./workspace-admission.ts";
+import type { TelegramTopicTargetStore, TelegramWorkspaceThreadBinding } from "./threads.ts";
+import type { TelegramWorkspaceOperationRunner } from "./workspace-retirement.ts";
+import type { TelegramWorkspaceThreadDeletionTransport } from "./telegram-api.ts";
+import type { TelegramProcessLiveness } from "./process-identity.ts";
 export interface TelegramThreadCleanupBindingSnapshot {
     cwd: string;
     workspaceKey: string;
@@ -38,7 +42,8 @@ export interface TelegramThreadCleanupCandidate {
     sessionId?: string;
     sessionKey?: string;
     instanceSlot: string;
-    slot: string;
+    /** Null is explicit absence in reviewed work; it never denotes a reusable letter. */
+    slot: string | null;
     target: {
         chatId: number;
         threadId: number;
@@ -155,6 +160,8 @@ export declare function createTelegramThreadCleanupWorkStore(options: {
     runtimeDir?: string;
     profileName: string;
     tokenSha256: string;
+    /** Exact captured ledger identity; standalone fixtures may use the plain profile identity. */
+    admissionProfileKey?: string;
     maxWorkSets?: number;
     maxBytes?: number;
     getNowMs?: () => number;
@@ -185,6 +192,7 @@ export declare function executeTelegramInactiveThreadCleanup(input: {
 }>;
 export declare function createTelegramThreadCleanupPermitRuntime(deps: {
     ledger: {
+        getProfileKey(): string;
         read(): {
             fence?: TelegramWorkspaceDestructiveFence;
         };
@@ -192,7 +200,7 @@ export declare function createTelegramThreadCleanupPermitRuntime(deps: {
             operationId: string;
             cleanupWorkSetId: string;
             bindingKey: string;
-            slot: string;
+            slot: string | null;
             target: {
                 chatId: number;
                 threadId: number;
@@ -256,6 +264,34 @@ export interface TelegramInactiveThreadCleanupCoordinatorDeps<TBinding> {
     deleteWithPermit(permit: TelegramThreadCleanupDeletionPermit, candidate: TelegramThreadCleanupCandidate): Promise<void>;
     commitBinding(candidate: TelegramThreadCleanupCandidate, currentBinding?: TBinding): Promise<boolean>;
 }
+export interface TelegramInactiveThreadCleanupAuthority {
+    profileName: string;
+    leaderEpoch: number | string;
+    ledger: TelegramWorkspaceAdmissionLedger;
+    isCurrent(): boolean;
+}
+/** Review owns ordinary admission; confirmed cleanup uses the shared gate and its exclusive manual fence instead. */
+export declare function createTelegramInactiveThreadCleanupRuntime(deps: {
+    store: Pick<TelegramTopicTargetStore, "load" | "listWorkspaceBindings" | "listReservations" | "listPendingProvisions" | "listPendingCleanups" | "commitInactiveWorkspaceCleanup">;
+    captureAuthority(): TelegramInactiveThreadCleanupAuthority | undefined;
+    getWorkStore(authority: TelegramInactiveThreadCleanupAuthority): TelegramThreadCleanupWorkStore;
+    getProtection(binding: TelegramWorkspaceThreadBinding): {
+        liveOwner: TelegramThreadCleanupProtectionState;
+        acceptedWork: TelegramThreadCleanupProtectionState;
+        deliveryAuthority: TelegramThreadCleanupProtectionState;
+    };
+    getProcessLiveness(owner: TelegramWorkspaceAdmissionOwner): TelegramProcessLiveness;
+    runExclusive<T>(operation: () => Promise<T>): Promise<T>;
+    runWorkspaceOperation: TelegramWorkspaceOperationRunner;
+    deleteThread: TelegramWorkspaceThreadDeletionTransport;
+    onError?: (error: unknown) => void;
+}): {
+    review(): Promise<{
+        count: number;
+        operationId?: string;
+    }>;
+    clean(operationId: string): Promise<TelegramInactiveThreadCleanupResult>;
+};
 export declare function createTelegramInactiveThreadCleanupSettingsPort<TBinding>(deps: TelegramInactiveThreadCleanupCoordinatorDeps<TBinding>): (operationId: string) => Promise<TelegramInactiveThreadCleanupResult>;
 export interface TelegramInactiveThreadCleanupResult {
     deleted: number;