@llblab/pi-kit 0.36.1 → 0.36.2

package/node_modules/@llblab/pi-telegram/lib/routing.ts

@@ -2026,6 +2026,8 @@ export function createTelegramInboundRouteRuntime<
   ): boolean =>
     pending.phase.kind !== "waiting" && pending.phase.kind !== "released";
   const pendingUnboundReroutes = new Map<string, PendingUnboundReroute>();
+  // Body-free, bounded warm deduplication: album members can expire through the same chooser.
+  const expiredRoutingViews = new Set<string>();
   const implicitThreadCreations = new Map<
     string,
     {
@@ -2542,6 +2544,20 @@ export function createTelegramInboundRouteRuntime<
                   temporaryDeleteConfirmed = true;
                 return result;
               } catch (error) {
+                const missingTarget = TelegramApi.getTelegramApiErrorRequestTarget(error);
+                if (method === "deleteForumTopic" && missingTarget && error instanceof Error &&
+                    TelegramApi.isTelegramApiRequestRejected(error, method) &&
+                    TelegramApi.isTelegramStaleTargetHttpError(error) &&
+                    ThreadReconciler.isTelegramTopicDeletedErrorMessage(error.message) &&
+                    missingTarget?.chatId === temporaryCleanup.target?.chatId &&
+                    missingTarget?.threadId === temporaryCleanup.target?.threadId &&
+                    missingTarget?.chatId === body.chat_id && missingTarget?.threadId === body.message_thread_id) {
+                  // Only the client's parsed exact-target HTTP 400 absence closes the one-shot grant.
+                  // Closed/denied/foreign/forged responses remain uncertain and never license another request.
+                  assertExecutionCurrent?.();
+                  temporaryDeleteConfirmed = true;
+                  return true as TResponse;
+                }
                 temporaryTransportUncertain = true;
                 throw error;
               }
@@ -8102,7 +8118,11 @@ export function createTelegramInboundRouteRuntime<
     signal: AbortSignal,
   ): Promise<void> => {
     const operator = deps.configStore.getAllowedUserId(),
-      epoch = deps.getCurrentLeaderEpoch?.();
+      epoch = deps.getCurrentLeaderEpoch?.(),
+      generation = deps.getSessionGeneration?.(),
+      instanceId = deps.getCurrentInstanceId?.(),
+      scope = deps.getAdmissionScope?.();
+    const sendTextReply = deps.sendTextReply, editInteractiveMessage = deps.editInteractiveMessage;
     const message = source.original.update.message as
       Partial<TMessage> | undefined;
     const runtimeCurrent = () =>
@@ -8112,6 +8132,9 @@ export function createTelegramInboundRouteRuntime<
       deps.isContextActive?.(ctx) === true &&
       deps.configStore.getAllowedUserId() === operator &&
       deps.getCurrentLeaderEpoch?.() === epoch &&
+      deps.getSessionGeneration?.() === generation &&
+      deps.getCurrentInstanceId?.() === instanceId &&
+      deps.getAdmissionScope?.() === scope &&
       deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
       source.original.routingInput?.operatorUserId === operator &&
       message?.from?.id === operator &&
@@ -8142,6 +8165,13 @@ export function createTelegramInboundRouteRuntime<
         if (!result) return;
         // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
         let movedIntoTab = false;
+        let unissued = source.original.routingInput?.phase === "waiting" &&
+          (!temporary || temporary.forwardProtocol === "one-shot-v1") &&
+          ![...(temporary?.forwardedInputs ?? []), ...(temporary?.completedInputs ?? [])].some(input =>
+            input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId));
+        const views = new Map<string, { chatId: number; threadId?: number; messageId: number }>();
+        const chooser = source.original.routingInput?.chooser;
+        if (chooser) views.set(`${chooser.chatId}:${chooser.messageId}`, { ...chooser });
         for (const [id, pending] of pendingUnboundReroutes) {
           if (
             !Updates.collectTelegramAdmissionSourceUpdateIds(
@@ -8150,32 +8180,55 @@ export function createTelegramInboundRouteRuntime<
           )
             continue;
           movedIntoTab ||= pending.allTabCopiesForwarded !== undefined;
+          unissued &&= isPendingRerouteUntouched(pending) || pending.phase.kind === "released";
+          if (pending.chooserMessageId !== undefined)
+            views.set(`${pending.sourceTarget.chatId}:${pending.chooserMessageId}`, {
+              ...pending.sourceTarget, messageId: pending.chooserMessageId,
+            });
           removePendingReroute(id);
-          if (
-            signal.aborted ||
-            deps.isContextActive?.(ctx) !== true ||
-            deps.configStore.getAllowedUserId() !== operator ||
-            deps.getCurrentLeaderEpoch?.() !== epoch ||
-            deps.getAdmissionJournalBinding?.() !== source.journalBindingKey
-          )
-            continue;
-          if (
-            deps.editInteractiveMessage &&
-            pending.chooserMessageId !== undefined
-          ) {
+        }
+        const notice = unissued
+          ? "<b>⌛ Routing expired; input was not delivered.</b>"
+          : "<b>⌛ Routing expired; delivery is unconfirmed.</b>\nPreviously accepted work may continue.";
+        const noticeKey = `${source.journalBindingKey}:${source.original.routingInput?.expiresAtMs}:${chooser ? `${chooser.chatId}:${chooser.messageId}` : source.original.updateId}`;
+        if (runtimeCurrent() && !expiredRoutingViews.has(noticeKey)) {
+          if (expiredRoutingViews.size >= 100) expiredRoutingViews.delete(expiredRoutingViews.values().next().value!);
+          expiredRoutingViews.add(noticeKey);
+          let visible = false;
+          const assertNoticeAuthority = () => {
+            if (!runtimeCurrent()) throw new Error("Routing expiry notice authority changed.");
+          };
+          for (const view of views.values()) {
+            if (!runtimeCurrent() || !editInteractiveMessage || deps.editInteractiveMessage !== editInteractiveMessage) break;
+            if (view.chatId !== message!.chat!.id || !Number.isSafeInteger(view.threadId) || view.threadId! <= 0) continue;
             try {
-              await deps.editInteractiveMessage(
-                pending.sourceTarget.chatId,
-                pending.chooserMessageId,
-                "<b>⌛ Routing choice expired.</b>",
-                "html",
-                { inline_keyboard: [] },
-              );
-            } catch (error) {
-              deps.recordRuntimeEvent?.("routing", error, {
-                phase: "routing-input-expiry-view",
+              await editInteractiveMessage(view.chatId, view.messageId, notice, "html", { inline_keyboard: [] }, {
+                target: { chatId: view.chatId, threadId: view.threadId }, assertAuthority: assertNoticeAuthority,
               });
+              visible = true;
+            } catch (error) {
+              deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-view" });
+            }
+          }
+          // A temporary tab is about to disappear; a cold/missing chooser also needs an independent owned destination.
+          const leader = instanceId ? deps.threadStore?.getActiveByInstanceId(instanceId) : undefined;
+          if ((!visible || temporary?.target) && runtimeCurrent() && leader &&
+              leader.target.chatId === message!.chat!.id && Number.isSafeInteger(leader.target.threadId) && leader.target.threadId! > 0) {
+            const target = { chatId: leader.target.chatId, threadId: leader.target.threadId };
+            try {
+              const assertFallback = () => {
+                assertNoticeAuthority();
+                const active = deps.threadStore?.getActiveByInstanceId(instanceId!);
+                if (deps.sendTextReply !== sendTextReply || active?.target.chatId !== target.chatId || active.target.threadId !== target.threadId)
+                  throw new Error("Routing expiry notice destination changed.");
+              };
+              assertFallback();
+              await sendTextReply(target.chatId, 0, notice, { parseMode: "HTML", target, assertAuthority: assertFallback });
+            } catch (error) {
+              deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-notice" });
             }
+          } else if (!visible && runtimeCurrent()) {
+            deps.recordRuntimeEvent?.("routing", "Routing expiry notice has no current owned Thread.", { phase: "routing-input-expiry-notice-unavailable" });
           }
         }
         // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
@@ -8434,7 +8487,12 @@ export function createTelegramInboundRouteRuntime<
               )
                 continue;
               try {
-                await retireCancellationChooser(id, pending, isCurrent);
+                if (await retireCancellationChooser(id, pending, isCurrent))
+                  await deleteCancelledOrphanTab(
+                    pending,
+                    pending.abandonment!,
+                    isCurrent,
+                  );
               } catch (error) {
                 deps.recordRuntimeEvent?.("routing", error, {
                   phase: "recovered-chooser-cleanup",
@@ -8463,6 +8521,60 @@ export function createTelegramInboundRouteRuntime<
     }
     return true;
   };
+  /**
+   * A cancelled input in an unbound (non-temporary) tab leaves nothing to route: once no chooser, queue, live owner,
+   * Workspace/Restore record or retained journal arrival still names the tab, it is deleted like a routing tab. Any
+   * missing proof or failure keeps the tab; this never retries and never blocks the Cancel outcome.
+   */
+  const deleteCancelledOrphanTab = async (
+    pending: PendingUnboundReroute,
+    cancellation: NonNullable<PendingUnboundReroute["abandonment"]>,
+    isAuthorityCurrent: () => boolean,
+  ): Promise<void> => {
+    const { chatId, threadId } = pending.sourceTarget;
+    if (
+      threadId === undefined ||
+      pending.temporaryThread ||
+      isTemporaryTabTarget({ chatId, threadId }) ||
+      hasPendingRerouteForTarget({ chatId, threadId }) ||
+      !deps.inspectTemporaryThreadSources
+    )
+      return;
+    const target = { chatId, threadId };
+    try {
+      const own = {
+        journalBindingKey: cancellation.journalBindingKey,
+        updateIds: Updates.collectTelegramAdmissionSourceUpdateIds(
+          pending.messages,
+        ),
+      };
+      const assertCurrent = (): void => {
+        if (!isAuthorityCurrent())
+          throw new Error("Unbound tab cleanup authority changed.");
+      };
+      assertCurrent();
+      if (
+        deps.inspectTemporaryThreadSources(
+          target,
+          [cancellation.journalBindingKey],
+          [own],
+        )?.length !== 0
+      )
+        return;
+      assertCurrent();
+      await closeReroutedUnboundTopic(
+        target,
+        pending.chooserMessageId,
+        assertCurrent,
+      );
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, {
+        phase: "unbound-cancel-tab-cleanup",
+        chatId: target.chatId,
+        threadId: target.threadId,
+      });
+    }
+  };
   const handleUnboundRerouteCancelCallback = async (
     query: TCallbackQuery,
     ctx: TContext,
@@ -8580,6 +8692,7 @@ export function createTelegramInboundRouteRuntime<
         await Promise.all([
           deps.answerCallbackQuery(query.id, "Routing cancelled"),
           deleteAllTabCopies(pending!),
+          deleteCancelledOrphanTab(pending!, cancellation!, isAuthorityCurrent),
         ]);
     } catch (error) {
       deps.recordRuntimeEvent?.("routing", error, {

package/node_modules/@llblab/pi-telegram/lib/telegram-api.ts

@@ -1049,6 +1049,20 @@ export class TelegramApiStaleTargetError extends Error {
   }
 }
 
+/** The leader's exact refusal of a follower API call outside that follower's own Thread; carries only the requested target. */
+export class TelegramApiFollowerNotAllowedError extends Error {
+  readonly requestTarget: { chatId: number; threadId: number } | undefined;
+
+  constructor(
+    message: string,
+    requestTarget?: { chatId: number; threadId: number },
+  ) {
+    super(message);
+    this.name = "TelegramApiFollowerNotAllowedError";
+    this.requestTarget = requestTarget ? { ...requestTarget } : undefined;
+  }
+}
+
 export function getTelegramApiErrorRequestTarget(
   error: unknown,
 ): { chatId: number; threadId: number } | undefined {

package/node_modules/@llblab/pi-telegram/lib/thread-cleanup-manager.ts

@@ -22,7 +22,14 @@ import type {
   TelegramWorkspaceDeletionPermit,
   TelegramWorkspaceDestructiveFence,
   TelegramWorkspaceRetirementFence,
+  TelegramWorkspaceAdmissionLedger,
+  TelegramWorkspaceAdmissionOwner,
 } from "./workspace-admission.ts";
+import { isTelegramWorkspaceRetirementFence } from "./workspace-admission.ts";
+import type { TelegramTopicTargetStore, TelegramWorkspaceThreadBinding } from "./threads.ts";
+import type { TelegramWorkspaceOperationRunner } from "./workspace-retirement.ts";
+import type { TelegramWorkspaceThreadDeletionTransport } from "./telegram-api.ts";
+import type { TelegramProcessLiveness } from "./process-identity.ts";
 
 export interface TelegramThreadCleanupBindingSnapshot {
   cwd: string;
@@ -56,7 +63,8 @@ export interface TelegramThreadCleanupCandidate {
   sessionId?: string;
   sessionKey?: string;
   instanceSlot: string;
-  slot: string;
+  /** Null is explicit absence in reviewed work; it never denotes a reusable letter. */
+  slot: string | null;
   target: { chatId: number; threadId: number };
   inactiveSinceMs: number;
   bindingUpdatedAtMs: number;
@@ -116,8 +124,7 @@ export function planTelegramInactiveThreadCleanup(input: {
       !binding.cwd ||
       !binding.workspaceKey ||
       !binding.instanceSlot ||
-      typeof slot !== "string" ||
-      !slot ||
+      (slot !== undefined && (typeof slot !== "string" || !/^[A-Z]$/u.test(slot))) ||
       !validSessionIdentity(binding) ||
       !validTarget(binding.target) ||
       bindingKeys.has(binding.bindingKey) ||
@@ -152,8 +159,6 @@ export function planTelegramInactiveThreadCleanup(input: {
     const inactiveSinceMs = binding.inactiveSinceMs;
     const slot = binding.slot;
     if (
-      typeof slot !== "string" ||
-      !slot ||
       !Number.isSafeInteger(inactiveSinceMs) ||
       inactiveSinceMs === undefined ||
       inactiveSinceMs < 0 ||
@@ -180,7 +185,7 @@ export function planTelegramInactiveThreadCleanup(input: {
         ? { sessionId: binding.sessionId, sessionKey: binding.sessionKey }
         : {}),
       instanceSlot: binding.instanceSlot,
-      slot,
+      slot: slot ?? null,
       target: { ...binding.target },
       inactiveSinceMs,
       bindingUpdatedAtMs: binding.updatedAtMs,
@@ -409,8 +414,7 @@ function validateWorkSet(
       !validSessionIdentity(raw) ||
       typeof raw.instanceSlot !== "string" ||
       !raw.instanceSlot ||
-      typeof raw.slot !== "string" ||
-      !raw.slot ||
+      (raw.slot !== null && (typeof raw.slot !== "string" || !/^[A-Z]$/u.test(raw.slot))) ||
       !isObject(raw.target) ||
       !onlyKeys(raw.target, ["chatId", "threadId"]) ||
       !validTarget(
@@ -509,7 +513,11 @@ function sameCandidates(
   left: readonly TelegramThreadCleanupCandidate[],
   right: readonly TelegramThreadCleanupCandidate[],
 ): boolean {
-  return JSON.stringify(left) === JSON.stringify(right);
+  const keys = ["profileName", "bindingKey", "cwd", "workspaceKey", "sessionId", "sessionKey", "instanceSlot", "slot", "inactiveSinceMs", "bindingUpdatedAtMs"] as const;
+  return left.length === right.length && left.every((candidate, index) => {
+    const other = right[index]!;
+    return keys.every(key => candidate[key] === other[key]) && targetKey(candidate.target) === targetKey(other.target);
+  });
 }
 
 function parseTelegramThreadCleanupWorkFile(
@@ -544,6 +552,8 @@ export function createTelegramThreadCleanupWorkStore(options: {
   runtimeDir?: string;
   profileName: string;
   tokenSha256: string;
+  /** Exact captured ledger identity; standalone fixtures may use the plain profile identity. */
+  admissionProfileKey?: string;
   maxWorkSets?: number;
   maxBytes?: number;
   getNowMs?: () => number;
@@ -680,12 +690,12 @@ export function createTelegramThreadCleanupWorkStore(options: {
           !entry ||
           entry.bindingUpdatedAtMs !== input.bindingUpdatedAtMs ||
           permit.destructiveKind !== "manual-thread-cleanup" ||
-          permit.profileKey !== entry.profileName ||
+          permit.profileKey !== (options.admissionProfileKey ?? entry.profileName) ||
           permit.bindingKey !== entry.bindingKey ||
           permit.slot !== entry.slot ||
           targetKey(permit.target) !== targetKey(entry.target) ||
           !permit.operationId ||
-          !permit.retirementIntentId ||
+          permit.retirementIntentId !== workSet.operationId ||
           !safeTime(permit.issuedAtMs)
         )
           throw new Error(
@@ -842,12 +852,13 @@ export async function executeTelegramInactiveThreadCleanup(input: {
 
 export function createTelegramThreadCleanupPermitRuntime(deps: {
   ledger: {
+    getProfileKey(): string;
     read(): { fence?: TelegramWorkspaceDestructiveFence };
     acquireThreadCleanupFence(input: {
       operationId: string;
       cleanupWorkSetId: string;
       bindingKey: string;
-      slot: string;
+      slot: string | null;
       target: { chatId: number; threadId: number };
       leaderEpoch: number | string;
       cleanupRequestedAtMs: number;
@@ -930,7 +941,7 @@ export function createTelegramThreadCleanupPermitRuntime(deps: {
     const fence = deps.ledger.read().fence;
     return fence?.operationId === operationId &&
       fence.destructiveKind === "manual-thread-cleanup" &&
-      fence.profileKey === candidate.profileName &&
+      fence.profileKey === deps.ledger.getProfileKey() &&
       fence.retirementIntentId === workSetId &&
       fence.bindingKey === candidate.bindingKey &&
       fence.slot === candidate.slot &&
@@ -1045,8 +1056,17 @@ export function createTelegramThreadCleanupPermitRuntime(deps: {
         : { kind: "already-issued" };
     },
     async settleDeleted(fence, commit) {
+      const assertAuthority = () => {
+        const owner = deps.getOwner();
+        if (deps.getLeaderEpoch() !== fence.leaderEpoch ||
+            owner.processId !== fence.owner.processId || owner.processBirthId !== fence.owner.processBirthId)
+          throw new Error("Telegram Thread cleanup settlement authority changed.");
+      };
+      assertAuthority();
       const ready = deps.ledger.confirmThreadCleanupAbsence(fence);
-      if (!(await commit())) return "commit-pending";
+      const committed = await commit();
+      assertAuthority();
+      if (!committed) return "commit-pending";
       deps.ledger.completeThreadCleanupFence(ready);
       return "completed";
     },
@@ -1069,6 +1089,138 @@ export interface TelegramInactiveThreadCleanupCoordinatorDeps<TBinding> {
   ): Promise<boolean>;
 }
 
+export interface TelegramInactiveThreadCleanupAuthority {
+  profileName: string;
+  leaderEpoch: number | string;
+  ledger: TelegramWorkspaceAdmissionLedger;
+  isCurrent(): boolean;
+}
+
+/** Review owns ordinary admission; confirmed cleanup uses the shared gate and its exclusive manual fence instead. */
+export function createTelegramInactiveThreadCleanupRuntime(deps: {
+  store: Pick<TelegramTopicTargetStore, "load" | "listWorkspaceBindings" | "listReservations" | "listPendingProvisions" | "listPendingCleanups" | "commitInactiveWorkspaceCleanup">;
+  captureAuthority(): TelegramInactiveThreadCleanupAuthority | undefined;
+  getWorkStore(authority: TelegramInactiveThreadCleanupAuthority): TelegramThreadCleanupWorkStore;
+  getProtection(binding: TelegramWorkspaceThreadBinding): {
+    liveOwner: TelegramThreadCleanupProtectionState;
+    acceptedWork: TelegramThreadCleanupProtectionState;
+    deliveryAuthority: TelegramThreadCleanupProtectionState;
+  };
+  getProcessLiveness(owner: TelegramWorkspaceAdmissionOwner): TelegramProcessLiveness;
+  runExclusive<T>(operation: () => Promise<T>): Promise<T>;
+  runWorkspaceOperation: TelegramWorkspaceOperationRunner;
+  deleteThread: TelegramWorkspaceThreadDeletionTransport;
+  onError?: (error: unknown) => void;
+}): {
+  review(): Promise<{ count: number; operationId?: string }>;
+  clean(operationId: string): Promise<TelegramInactiveThreadCleanupResult>;
+} {
+  const capture = () => {
+    const authority = deps.captureAuthority();
+    if (!authority || !authority.isCurrent())
+      throw new Error("Inactive Thread cleanup requires current leader authority.");
+    const ledgerKey = authority.ledger.getProfileKey();
+    const owner = authority.ledger.getOwner();
+    const assertCurrent = () => {
+      if (!authority.isCurrent() || authority.ledger.getProfileKey() !== ledgerKey)
+        throw new Error("Inactive Thread cleanup authority changed.");
+    };
+    const evidence = () => {
+      assertCurrent();
+      return captureTelegramInactiveThreadCleanupEvidence({
+        profileName: authority.profileName,
+        listBindings: deps.store.listWorkspaceBindings,
+        getProtection: deps.getProtection,
+        listReservations: deps.store.listReservations,
+        listPendingProvisions: deps.store.listPendingProvisions,
+        listPendingCleanups: deps.store.listPendingCleanups,
+      });
+    };
+    return { authority, owner, assertCurrent, evidence };
+  };
+  return {
+    async review() {
+      const scope = capture();
+      return createTelegramInactiveThreadCleanupReviewRuntime({
+        getProfileName: () => scope.authority.profileName,
+        listBindings: deps.store.listWorkspaceBindings,
+        getProtection: deps.getProtection,
+        listReservations: deps.store.listReservations,
+        listPendingProvisions: deps.store.listPendingProvisions,
+        listPendingCleanups: deps.store.listPendingCleanups,
+        getWorkStore() { scope.assertCurrent(); return deps.getWorkStore(scope.authority); },
+        runWorkspaceOperation(metadata, operation) {
+          return deps.runWorkspaceOperation(metadata, async () => {
+            scope.assertCurrent();
+            await deps.store.load();
+            scope.assertCurrent();
+            return operation();
+          });
+        },
+      }).review();
+    },
+    async clean(operationId) {
+      const scope = capture();
+      return deps.runExclusive(async () => {
+        scope.assertCurrent();
+        const { authority } = scope;
+        const work = deps.getWorkStore(authority);
+        const exactBinding = (candidate: TelegramThreadCleanupCandidate) => {
+          const fresh = planTelegramInactiveThreadCleanup(scope.evidence()).find(binding => binding.bindingKey === candidate.bindingKey);
+          if (!fresh || !sameCandidates([fresh], [candidate])) return undefined;
+          return deps.store.listWorkspaceBindings().find(binding => binding.bindingKey === fresh.bindingKey);
+        };
+        const loadExactBinding = async (candidate: TelegramThreadCleanupCandidate) => {
+          scope.assertCurrent();
+          await deps.store.load();
+          scope.assertCurrent();
+          return exactBinding(candidate);
+        };
+        const permitRuntime = createTelegramThreadCleanupPermitRuntime({
+          ledger: authority.ledger,
+          getLeaderEpoch: () => authority.isCurrent() ? authority.leaderEpoch : undefined,
+          getProfileName: () => authority.profileName,
+          getOwner: () => scope.owner,
+          canAdoptFence: fence => authority.isCurrent() && deps.getProcessLiveness(fence.owner) === "dead",
+          revalidateUnderFence: async candidate => !!(await loadExactBinding(candidate)),
+        });
+        return cleanReviewedInactiveThreads({
+          store: work, operationId, permitRuntime,
+          resolveFullBinding: loadExactBinding,
+          async deleteWithPermit(permit, candidate) {
+            try {
+              await deps.deleteThread(() => {
+                scope.assertCurrent();
+                const fence = authority.ledger.read().fence;
+                if (!fence || !isTelegramWorkspaceRetirementFence(fence) ||
+                    fence.destructiveKind !== "manual-thread-cleanup" || fence.phase !== "deletion-issued" ||
+                    fence.operationId !== permit.operationId || fence.retirementIntentId !== operationId ||
+                    fence.profileKey !== permit.profileKey || fence.bindingKey !== candidate.bindingKey ||
+                    fence.slot !== candidate.slot || fence.deletionIssuedAtMs !== permit.issuedAtMs ||
+                    fence.leaderEpoch !== authority.leaderEpoch || fence.owner.processId !== scope.owner.processId ||
+                    fence.owner.processBirthId !== scope.owner.processBirthId ||
+                    targetKey(fence.target) !== targetKey(permit.target) || !exactBinding(candidate))
+                  throw new Error("Inactive Thread cleanup deletion permit is stale.");
+                return { ...permit.target };
+              });
+              scope.assertCurrent();
+            } catch (error) {
+              deps.onError?.(error);
+              throw error;
+            }
+          },
+          async commitBinding(candidate) {
+            scope.assertCurrent();
+            await deps.store.load();
+            scope.assertCurrent();
+            return deps.store.commitInactiveWorkspaceCleanup(candidate, authority.isCurrent);
+          },
+        });
+      });
+    },
+  };
+}
+
 export function createTelegramInactiveThreadCleanupSettingsPort<TBinding>(
   deps: TelegramInactiveThreadCleanupCoordinatorDeps<TBinding>,
 ): (operationId: string) => Promise<TelegramInactiveThreadCleanupResult> {
@@ -1105,9 +1257,13 @@ export async function cleanReviewedInactiveThreads<TBinding>(
         entry,
         input.operationId,
       );
-      if (ready)
-        await input.permitRuntime.settleDeleted(ready, async () => true);
-      deleted += 1;
+      if (ready) {
+        const settlement = await input.permitRuntime.settleDeleted(ready, async () => true);
+        if (settlement === "completed") deleted += 1;
+        else outcomeUnknown += 1;
+      } else if (input.permitRuntime.diagnoseRecovery(entry, input.operationId) !== "none") {
+        outcomeUnknown += 1;
+      } else deleted += 1;
       continue;
     }
     if (entry.state === "outcome-unknown") {

package/node_modules/@llblab/pi-telegram/lib/thread-display.ts

@@ -174,8 +174,12 @@ export function resolveTelegramWorkspaceDisplayNames(
       : undefined;
     if (manualName) {
       labels.set(binding.bindingKey, boundedLabel(manualName));
+    } else if (!slot) {
+      // A displaced binding retains its generated identity, not the letter now owned elsewhere.
+      const name = binding.threadName ? labelText(binding.threadName) : undefined;
+      if (name) labels.set(binding.bindingKey, boundedLabel(name));
     } else if (mode === "letters") {
-      if (slot) labels.set(binding.bindingKey, slot);
+      labels.set(binding.bindingKey, slot);
     } else if (mode === "names") {
       const name = binding.threadName ? labelText(binding.threadName) : slot;
       if (name) labels.set(binding.bindingKey, boundedLabel(name));
@@ -191,12 +195,11 @@ export function resolveTelegramWorkspaceDisplayNames(
             bindings.filter((candidate) => candidate.cwd === binding.cwd)
               .length > 1
           : (liveDirectoryCounts.get(binding.cwd) ?? 0) > 1;
-      if (showSuffix && !slot) continue;
       const suffix = !showSuffix
         ? ""
         : mode === "directory-title"
           ? ` ${slot}`
-          : `_${slot!.toLowerCase()}`;
+          : `_${slot.toLowerCase()}`;
       labels.set(binding.bindingKey, boundedLabel(base, suffix));
     }
   }
@@ -378,9 +381,9 @@ export function createTelegramThreadDisplaySettingsRuntime(deps: {
 /** Caller owns triggering and reporting; no timer or background retry is created. */
 export function createTelegramThreadDisplayReconciler(
   deps: TelegramThreadDisplayReconcilerDeps,
-): { reconcile(): Promise<{ changed: number }> } {
+): { reconcile(bindingKey?: string): Promise<{ changed: number }> } {
   let tail: Promise<unknown> = Promise.resolve();
-  const apply = async (): Promise<{ changed: number }> => {
+  const apply = async (bindingKey?: string): Promise<{ changed: number }> => {
     const epoch = deps.getLeaderEpoch();
     const profile = deps.getProfileKey();
     const mode = deps.getMode();
@@ -406,6 +409,7 @@ export function createTelegramThreadDisplayReconciler(
     );
     let changed = 0;
     for (const binding of bindings) {
+      if (bindingKey !== undefined && binding.bindingKey !== bindingKey) continue;
       const isBindingCurrent = deps.captureBindingAuthority(binding);
       if (!isBindingCurrent) continue;
       const title = titles.get(binding.bindingKey);
@@ -426,7 +430,7 @@ export function createTelegramThreadDisplayReconciler(
       };
       assertBinding(binding);
       if ((binding.displayTitle ?? binding.threadName) === title) continue;
-      await deps.callApi(
+      const acknowledged = await deps.callApi<boolean>(
         "editForumTopic",
         {
           chat_id: binding.target.chatId,
@@ -436,6 +440,8 @@ export function createTelegramThreadDisplayReconciler(
         { maxAttempts: 1 },
       );
       assertBinding(binding);
+      if (acknowledged !== true)
+        throw new Error("Telegram Thread display update was not acknowledged.");
       if (!deps.store.setWorkspaceDisplayTitle(binding, title)) {
         throw new Error(
           "Telegram Thread display binding changed before title commit.",
@@ -452,8 +458,8 @@ export function createTelegramThreadDisplayReconciler(
     return { changed };
   };
   return {
-    reconcile() {
-      const run = tail.then(apply);
+    reconcile(bindingKey) {
+      const run = tail.then(() => apply(bindingKey));
       tail = run.catch(() => undefined);
       return run;
     },