@llblab/pi-kit 0.36.2 → 0.36.3

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.36.3: Bundled Package Updates (2026-10-24)
+
+- `Exact pins`: `@llblab/pi-telegram` 0.57.7 → 0.57.11.
+- `Packaging`: Synchronizes the lockfile, bundle aliases and README inventory. Package membership and resource order remain unchanged; packed validation does not certify extension safety or installed-client behavior.
+
 ## 0.36.2: Bundled Package Updates (2026-10-23)
 
 - `Exact pins`: `@llblab/pi-claude-usage` 0.2.2 → 0.2.3; `@llblab/pi-codex-usage` 0.13.1 → 0.13.2; `@llblab/pi-telegram` 0.57.3 → 0.57.7.

package/README.md

@@ -18,7 +18,7 @@ Package links lead to the owning repositories for usage, documentation, issues,
 | [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.2` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.26.5` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
-| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.57.7` | Telegram companion with per-prompt Steer, queued controls, Reroute/Restore, recoverable connections, previews, follower Threads, files, and voice |
+| [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.57.11` | Telegram companion with per-prompt Steer, queued controls, Reroute/Restore, recoverable connections, previews, follower Threads, files, and voice |
 | [`@llblab/skills`](https://github.com/llblab/skills) | `1.15.0` | Portable workflows for engineering, review, design, context maintenance, and other focused tasks |
 
 Versions are exact by design. An upstream release does not change an installed kit until this repository explicitly advances the dependency and publishes a new kit version. Runtime defects and package-specific feature requests belong in the linked repository; package selection and kit installation issues belong here.

package/node_modules/@llblab/pi-telegram/BACKLOG.md

@@ -2,6 +2,11 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
+## 0.57.11 publication checkpoint
+
+- [ ] Validate and publish only the pre-publication follower reply-target fix through the protected dev-to-main release path. Require fresh Ubuntu, Windows and both macOS shard checks before merge, exact candidate/merged-tree equality, one immutable version tag and the repository-owned release workflow.
+- [ ] Confirm the published GitHub Release and public npm version, tag/gitHead identity, release notes and packed runtime/skills before closing this checkpoint. Keep post-refusal recovery and disposable-tab live acceptance open; do not reload the running session.
+
 ## Disposable Thread live acceptance
 
 - [ ] After separate operator authorization, use disposable Telegram tabs to check leader Settings review/Back, one confirmed cleanup of an inactive slotless binding, preservation of its replacement letter holder, and visible outcome/recovery copy. Native filesystem and injected-transport tests do not prove live Telegram/client or native Windows acceptance. Never use production history as the disposable fixture.
@@ -17,7 +22,28 @@ The prompt-cache report remains open for the reporter's offered live Anthropic c
 
 Evidence (2026-10-23 07:11–07:16): a `/start` sent in a former leader tab moved into a follower's journal as a raw original. After that follower's Thread was re-created by the restore probe, every execution attempt failed with `Telegram bus API call is not allowed for this follower` and retried every 60 s indefinitely, because the reply targeted a Thread the follower no longer owned. Terminal settlement alone is unsafe: the same rejection can be a benign race during a live-rebind pre-dispatch.
 
-- [ ] Live acceptance: a forwarded command whose follower Thread was re-created is answered in the current Thread (disposable tabs only).
+### Post-refusal reply-only recovery — deferred contract gate
+
+Remaining scope is recovery after a reply is refused or recipient authority changes during publication, not initial destination selection. The latter is specified under the [reply ownership boundary](./docs/multi-instance-bus.md#reply-recovery-ownership-boundary); its native regression covers a stale source address, not the historical refusal itself or live Telegram restoration.
+
+A target-scoped reply refusal cannot prove that a command made no prior effects. Keep the handler-replay containment while preparing a replacement: unresolved inputs must remain in ordinary durable retry state, not be silently completed or retargeted as whole commands. Ordinary journal execution remains at-least-once, not globally exactly-once.
+
+- [ ] Obtain explicit approval for a post-refusal recipient-delivery contract, then implement recipient-scoped reply-only recovery under the [reply ownership boundary](./docs/multi-instance-bus.md#reply-recovery-ownership-boundary), outside the containment hotfix. No ordinary recipient-scoped send grant is composed today: the local execution fence and queue-owner identity are insufficient, and receipt/admission namespaces cannot substitute for the registered recipient profile key. Ordinary sends return only a message ID, so the menu/delivery owner must participate in any destination change. Reuse selected-menu delivery only with its exact retained live-rebind/source grant; a raw journaled command cannot borrow it. Capture and recheck recipient/profile/session/registration authority at both ends, with no widening of the ordinary proxy.
+- [ ] Prove the reply-only path with the real follower API caller and worker: one replacement send before any reply chunk is acknowledged, consistent callback/message ownership and destination across every chunk, no stale reply anchor, no recovery for deletion/editing/unknown or lost ACKs, and no second send after authority changes. A command effect before a refused reply must execute once within that admission attempt; original journal evidence stays unchanged and diagnostics cannot change a successful outcome. Run typecheck and the full suite at the stable boundary. If these proofs cannot be supplied, retain the input without handler re-entry.
+- [ ] Live acceptance after the reply-only recovery checkpoint: a forwarded command whose follower Thread was re-created is answered in the current Thread (disposable tabs only).
+
+### Remaining routing investigation
+
 - [ ] Find why the temporary tab's selected `/start` stayed unresolved until expiry, and why that Restore moved custody without applying the rebind.
 - [ ] Route an input that arrives in a tab bound to nothing through a fresh temporary routing tab (the All flow) instead of publishing the chooser in the orphan, deleting the orphan with it once nothing unspent remains. Needs its own durable-metadata design.
 - [ ] Live acceptance on disposable tabs only: Cancel on an orphan tab deletes it; a second unspent input keeps it until the last Cancel; a plain `std::map` option button is delivered as an ordinary prompt.
+
+## macOS process-exit test flake
+
+The 0.57.8 tag validation failed `Child process sharing the agent dir does not poll while parent owns Telegram lock` even when that file ran alone: `Child process did not exit. stdout= stderr=` at its existing child deadline. The other seven process tests and the identical pre-merge tree passed. That historical failure has no child-stage trace, so cold import, startup and a retained runtime handle remain competing explanations. Bounded diagnostic sampling is exhausted; passing traces showed imports up to 4.37 seconds against the five-second non-Windows child budget and natural exit within 8–14 ms after the event-loop checkpoint. These traces do not identify the original cause.
+- [ ] Retain bounded child-stage/resource diagnostics for the next genuinely failing passive-child trace; the original timeout is still unexplained. Do not spend more unchanged-head diagnostic samples. The parent records explicit shutdown separately; do not add a shutdown call to the passive child to make it pass. Correct a fixture/runtime cause only when the failing stage evidence supports it, and require fresh platform CI before resuming release recovery. Do not widen deadlines or describe the runner as the proven cause without measurement.
+
+## Windows Workspace-gate fixture timeout
+
+`Leader assembly serializes follower provisioning through its shared Workspace gate` once exceeded its generic one-second bus-response deadline. It sends `follower.register` directly, outside the changed API caller; production registration has a separate budget. The later native standalone witness acknowledged at about 90 ms, and the full suite passed, but the original failure has no gate/persistence trace. A synthetic delayed-write probe verifies diagnostic capture, not the native cause.
+- [ ] Use the next genuinely failing native trace to distinguish gate wait, persistence and acknowledgement delay before correcting this fixture or runtime. Retain its bounded stage evidence and standalone/full-suite execution; do not spend unchanged-head reruns or infer a cause from passing checks. Any deadline-policy correction must be justified against the registration owner's contract, not a guessed larger timeout.

package/node_modules/@llblab/pi-telegram/CHANGELOG.md

@@ -4,6 +4,28 @@
 
 ## Unreleased
 
+## 0.57.11: Follower Reply Target
+
+- `Follower command replies`: Status/model/settings and text replies from an admitted follower command select its acknowledged Thread before publication, not the old input Thread. A changed Thread drops the reply anchor; delivery, menu state and ownership use one destination. The journaled original and explicit selected-menu grants stay intact; no refused-send recovery, handler replay or proxy widening is added.
+
+## 0.57.10: Follower Request Identity
+
+- `Follower request identity`: Follower API arguments use one JSON-wire snapshot before registration waits. Later caller mutation no longer changes the issued method/body or relabels a refused target and slow-call method. Ordinary and multipart calls retain wire JSON semantics and authority fences; refusal evidence still grants no resend or whole-command replay.
+- `Windows CI diagnostics`: The Workspace-gate registration fixture records bounded gate and persistence stage timings, including them in failure context without paths or credentials. It also runs in the standalone Windows lifecycle probe before the full concurrent suite. Existing assertions, response deadline and job budgets are unchanged; instrumentation does not claim to solve the observed timeout.
+
+## 0.57.9: Reply Safety and CI Recovery
+
+- `Recipient safety`: Ships the containment prepared for unpublished 0.57.8: a refused follower reply no longer immediately reruns its whole command handler and repeats earlier effects. The original input stays unchanged in durable retry state, without silent completion. Automatic reply relocation remains withdrawn; stale-Thread commands may still retry and ordinary execution remains at-least-once.
+- `Follower refusals`: Structured bus acknowledgements identify requests blocked before Telegram API delegation, without granting resend authority. Legacy error text, mismatched methods and lost acknowledgements cannot prove non-execution. Reply chunks keep their captured destination and ownership; refused chunks acquire no message ownership.
+- `CI sharding`: macOS distributes its serialized test files across two deterministic jobs to avoid the measured whole-job overrun. A checked inventory includes every file exactly once, with real-process tests isolated and the local Pi CLI on PATH. Assertions, test deadlines and the 30-minute job budget are unchanged; publication requires every platform and shard to pass.
+- `Process diagnostics`: Child-exit checks report bounded lifecycle timings and active resource types without logging fixture credentials or paths or adding referenced timers. Import, startup and natural-exit stages can now distinguish future failures. The original macOS child timeout remains unexplained; passing traces do not establish its cause.
+
+## 0.57.8: Reply Recovery Safety
+
+- `Recipient safety`: A refused follower reply no longer immediately re-runs the whole command handler, which could repeat changes made before the failed send. The original input stays unchanged in durable retry state, without silent completion. Automatic reply relocation is withdrawn pending transport-level safety proof; a stale-Thread command may still retry and ordinary execution remains at-least-once.
+- `Follower refusals`: Structured bus acknowledgements distinguish requests blocked before Telegram API delegation from errors returned after execution. Legacy error text, mismatched methods and lost acknowledgements cannot certify non-execution or authorize a resend. Reply chunks retain their captured destination and ownership; refused chunks acquire no message ownership.
+- `CI`: macOS runs real-process shutdown tests separately and the remaining test files one at a time, keeping the local Pi CLI on PATH. Assertions and deadlines are unchanged. This reduces observed runner-contention failures without claiming the process-exit flake is eliminated.
+
 ## 0.57.7: Routing Cleanup and Recipient Recovery
 
 - `Recipient recovery`: A forwarded input journaled for a follower whose Thread was re-created no longer retries forever against the old Thread. After the leader refuses that reply, the input re-runs once against the follower's current Thread; a second refusal or any other failure keeps the durable retry state, and nothing is dropped.

package/node_modules/@llblab/pi-telegram/dist/lib/bus-follower.js

@@ -955,6 +955,11 @@ export function createTelegramBusFollowerApiCaller(deps) {
         const assertion = localOptions?.assertAuthority;
         const assertCurrent = () => assertTelegramApiCallAuthority(assertion, false);
         assertCurrent();
+        // Match IPC's JSON semantics once, before awaits; send and refusal metadata share this identity.
+        const requestArgs = JSON.parse(JSON.stringify(args));
+        const apiMethod = (method === "call" || method === "callMultipart") && typeof requestArgs[0] === "string"
+            ? requestArgs[0] : method;
+        timing.apiMethod = apiMethod;
         const registration = await resolveTelegramBusFollowerRegistration(deps, timeoutMs);
         timing.registeredAtMs = getNowMs();
         assertCurrent();
@@ -968,17 +973,13 @@ export function createTelegramBusFollowerApiCaller(deps) {
                 instanceId: deps.instanceId,
                 registrationGeneration: registration.generation,
                 method,
-                args,
+                args: requestArgs,
                 sentAtMs: getNowMs(),
             }, assertion ? assertCurrent : undefined);
         }
         catch (error) {
             if (error instanceof TelegramBusLocalAuthorityError)
                 throw new TelegramApiAuthorityError(error.requestIssued);
-            const apiMethod = (method === "call" || method === "callMultipart") &&
-                typeof args[0] === "string"
-                ? args[0]
-                : method;
             if (!isTelegramApiMethodRetrySafe(apiMethod)) {
                 throw new TelegramApiCommitUnknownError(apiMethod, error);
             }
@@ -1002,15 +1003,19 @@ export function createTelegramBusFollowerApiCaller(deps) {
             response.error?.code === "commit-unknown") {
             throw new TelegramApiCommitUnknownError(response.error.method ?? method, new Error(message ?? "Telegram bus API call result is ambiguous."));
         }
-        if (message === TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE) {
-            const body = (method === "call" || method === "callMultipart") && isRecord(args[1])
-                ? args[1]
+        const refusedMethod = response?.kind === "bus.ack" && !response.ok &&
+            response.error?.code === "follower-api-not-allowed" &&
+            response.error.method === apiMethod
+            ? apiMethod : undefined;
+        if (refusedMethod || message === TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE) {
+            const body = (method === "call" || method === "callMultipart") && isRecord(requestArgs[1])
+                ? requestArgs[1]
                 : undefined;
             const chatId = Number(body?.chat_id);
             const threadId = Number(body?.message_thread_id);
-            throw new TelegramApiFollowerNotAllowedError(message, Number.isSafeInteger(chatId) && Number.isSafeInteger(threadId)
+            throw new TelegramApiFollowerNotAllowedError(message ?? TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE, Number.isSafeInteger(chatId) && Number.isSafeInteger(threadId)
                 ? { chatId, threadId }
-                : undefined);
+                : undefined, refusedMethod);
         }
         throw new Error(message ?? "Telegram bus API call failed.");
     };
@@ -1028,10 +1033,7 @@ export function createTelegramBusFollowerApiCaller(deps) {
         finally {
             const elapsedMs = getNowMs() - startedAtMs;
             if (elapsedMs >= slowCallMs) {
-                const apiMethod = (method === "call" || method === "callMultipart") &&
-                    typeof args[0] === "string"
-                    ? args[0]
-                    : method;
+                const apiMethod = timing.apiMethod ?? method;
                 try {
                     deps.recordRuntimeEvent?.("bus", `Telegram bus follower API call was slow (${elapsedMs}ms).`, {
                         phase: "follower-api-slow",

package/node_modules/@llblab/pi-telegram/dist/lib/bus-leader.js

@@ -2770,7 +2770,14 @@ async function handleFollowerApiCall(envelope, deps) {
             method: envelope.method,
             args: envelope.args,
         })) {
-        return rejectTelegramBusRequest(envelope.requestId, TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE);
+        const apiMethod = getFollowerApiMethodAndBody(envelope).apiMethod;
+        return {
+            ...rejectTelegramBusRequest(envelope.requestId, TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE),
+            // Only this pre-dispatch authorizer refusal certifies that the API method was not called.
+            ...(/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(apiMethod)
+                ? { error: { code: "follower-api-not-allowed", method: apiMethod } }
+                : {}),
+        };
     }
     if (!deps.callApi) {
         return rejectTelegramBusRequest(envelope.requestId, "Telegram bus leader does not expose API calling.");

package/node_modules/@llblab/pi-telegram/dist/lib/bus.d.ts

@@ -548,7 +548,7 @@ export type TelegramBusEnvelope = ({
     result?: unknown;
     protocol?: TelegramBusProtocolIdentity;
     error?: {
-        code: "commit-unknown" | "request-id-collision" | "ledger-overloaded" | "incompatible-protocol" | "stale-target" | "workspace-binding-unavailable";
+        code: "commit-unknown" | "request-id-collision" | "ledger-overloaded" | "incompatible-protocol" | "stale-target" | "follower-api-not-allowed" | "workspace-binding-unavailable";
         method?: string;
         chatId?: number;
         threadId?: number;

package/node_modules/@llblab/pi-telegram/dist/lib/bus.js

@@ -2657,9 +2657,15 @@ function parseAckEnvelope(value, requestId) {
             code === "ledger-overloaded" ||
             code === "incompatible-protocol" ||
             code === "stale-target" ||
+            code === "follower-api-not-allowed" ||
             code === "workspace-binding-unavailable") {
             const chatId = value.error.chatId;
             const threadId = value.error.threadId;
+            if (code === "follower-api-not-allowed" &&
+                (value.ok || Object.hasOwn(value, "result") ||
+                    typeof value.error.method !== "string" ||
+                    !/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(value.error.method)))
+                return undefined;
             if (code === "stale-target" &&
                 (!Number.isSafeInteger(chatId) || !Number.isSafeInteger(threadId))) {
                 return undefined;

package/node_modules/@llblab/pi-telegram/dist/lib/commands.d.ts

@@ -11,6 +11,7 @@ import type { TelegramPromptTemplateCommand } from "./prompt-templates.ts";
 import { createTelegramControlItemBuilder, type PendingTelegramControlItem, type TelegramControlQueueController, type TelegramControlQueueControllerDeps, type TelegramQueueAdmissionReceipt } from "./queue.ts";
 import { type TelegramBridgeStatusLineOptions } from "./status.ts";
 import { type TelegramApiCallOptions } from "./telegram-api.ts";
+import type { TelegramTarget } from "./target.ts";
 import type { TelegramSessionReplacementIntent } from "./threads.ts";
 import { type TelegramDeferredSourceEvidence, type TelegramLiveSourceCompletionReadiness, type TelegramQueueAdmissionReceiptLike } from "./updates.ts";
 export type TelegramHeldCommandName = "status" | "start" | "help" | "abort" | "stop" | "next" | "continue";
@@ -383,11 +384,13 @@ export interface TelegramCommandTargetRuntimeDeps<TContext> {
     enqueueControlItem: (target: TelegramCommandMessageTarget, ctx: TContext, controlType: TelegramControlCommandType, statusSummary: string, execute: (ctx: TContext) => Promise<void>, admissionReceipts?: TelegramQueueAdmissionReceipt[], onQueued?: (item: PendingTelegramControlItem<TContext>) => void) => void;
     getAdmissionScope?: () => string | undefined;
     getAdmissionJournalBinding?: () => string | undefined;
+    /** Ordinary reply destination selected before publication, not resend authority. */
+    getReplyTarget?: (message: TelegramCommandRuntimeMessage) => TelegramTarget | undefined;
     onControlQueued?: (message: TelegramCommandRuntimeMessage, receipt: TelegramQueueAdmissionReceipt) => void;
-    showStatus: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
-    openModelMenu: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
-    openSettingsMenu?: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
-    sendTextReply: (chatId: number, replyToMessageId: number, text: string, options?: {
+    showStatus: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    openModelMenu: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    openSettingsMenu?: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    sendTextReply: (chatId: number, replyToMessageId: number | undefined, text: string, options?: {
         parseMode?: "HTML";
         target?: {
             chatId: number;

package/node_modules/@llblab/pi-telegram/dist/lib/commands.js

@@ -629,6 +629,7 @@ export function createTelegramCommandTargetQueueRuntime(deps) {
             createControlItem,
             enqueueControlItem: controlQueueController.enqueue,
         }),
+        getReplyTarget: deps.getReplyTarget,
         getAdmissionScope: deps.getAdmissionScope,
         getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
         onControlQueued: deps.onControlQueued,
@@ -639,6 +640,22 @@ export function createTelegramCommandTargetQueueRuntime(deps) {
     });
 }
 export function createTelegramCommandTargetRuntime(deps) {
+    const getReplyTarget = (message, options) => {
+        const source = getTelegramCommandMessageTarget(message);
+        const recipient = options?.assertAuthority
+            ? undefined
+            : deps.getReplyTarget?.(message);
+        if (!recipient)
+            return source;
+        if (recipient.chatId !== source.chatId)
+            throw new Error("Telegram command reply cannot change its recipient chat.");
+        if (source.threadId !== undefined && recipient.threadId === undefined)
+            throw new Error("Telegram command cannot move a Thread reply to All.");
+        return {
+            ...recipient,
+            replyToMessageId: recipient.threadId === source.threadId ? source.replyToMessageId : undefined,
+        };
+    };
     return {
         enqueueControlItem: (message, ctx, controlType, statusSummary, execute) => {
             const sourceUpdateId = message.pi_telegram_source_update_id;
@@ -659,15 +676,15 @@ export function createTelegramCommandTargetRuntime(deps) {
             deps.enqueueControlItem(getTelegramCommandMessageTarget(message), ctx, controlType, statusSummary, execute, receipt ? [receipt] : undefined, receipt ? () => deps.onControlQueued?.(message, receipt) : undefined);
         },
         showStatus: (message, ctx, options) => {
-            const target = getTelegramCommandMessageTarget(message);
+            const target = getReplyTarget(message, options);
             return deps.showStatus(target.chatId, target.replyToMessageId, ctx, target.threadId, options);
         },
         openModelMenu: (message, ctx, options) => {
-            const target = getTelegramCommandMessageTarget(message);
+            const target = getReplyTarget(message, options);
             return deps.openModelMenu(target.chatId, target.replyToMessageId, ctx, target.threadId, options);
         },
         openSettingsMenu: async (message, ctx, options) => {
-            const target = getTelegramCommandMessageTarget(message);
+            const target = getReplyTarget(message, options);
             if (!deps.openSettingsMenu) {
                 await deps.sendTextReply(target.chatId, target.replyToMessageId, formatTelegramInformationHeading("🚫", "Settings menu is unavailable."), { target, parseMode: "HTML" });
                 return;
@@ -675,7 +692,7 @@ export function createTelegramCommandTargetRuntime(deps) {
             await deps.openSettingsMenu(target.chatId, target.replyToMessageId, ctx, target.threadId, options);
         },
         sendTextReply: async (message, text, options) => {
-            const target = getTelegramCommandMessageTarget(message);
+            const target = getReplyTarget(message, options);
             const assertAuthority = options?.assertAuthority, send = deps.sendTextReply;
             const capturedOptions = { ...options, target };
             assertAuthority?.();
@@ -1061,6 +1078,7 @@ export function createTelegramCommandHandlerTargetRuntime(deps) {
         }),
         appendControlItem: deps.appendControlItem,
         dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
+        getReplyTarget: deps.getReplyTarget,
         getAdmissionScope: deps.getAdmissionScope,
         getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
         onControlQueued: deps.onControlQueued,

package/node_modules/@llblab/pi-telegram/dist/lib/extension.js

@@ -1093,6 +1093,25 @@ export default function (pi) {
         },
         getAdmissionScope: getTelegramUpdateAdmissionScope,
         getAdmissionJournalBinding: getTelegramQueueJournalBinding,
+        getCommandReplyTarget(message) {
+            if (message.chat.type !== "private" ||
+                "business_connection_id" in message ||
+                !Updates.getTelegramUpdateExecutionFence(message) ||
+                lockRuntime.owns())
+                return undefined;
+            Updates.assertTelegramUpdateExecutionCurrent(message);
+            const binding = resolveTelegramFollowerJournalBinding();
+            const target = telegramBusFollowerRegistrationState.getTarget();
+            if (!telegramBusFollowerRegistrationState.isRegistered() ||
+                !binding ||
+                binding.recoveryKey !==
+                    followerAdmissionLifecycleRuntime.getJournalBindingKey() ||
+                !target ||
+                (threadStore.getBotState().threadMode === "enabled" &&
+                    target.threadId === undefined))
+                throw new Error("Telegram command reply lost its registered recipient.");
+            return { ...target };
+        },
         beginCommandEffectWork: publicationRuntime.beginWork,
         getMessageOwnership: messageOwnershipRuntime.getForwardOwnership,
         recordMessageOwnership: messageOwnershipRuntime.recordRouted,
@@ -1400,15 +1419,6 @@ export default function (pi) {
                     return binding.hasAuthority?.() === true;
                 });
             },
-            recoverRejectedRecipientTarget(error) {
-                const rejected = error instanceof TelegramApi.TelegramApiFollowerNotAllowedError
-                    ? error.requestTarget
-                    : undefined;
-                const current = telegramBusFollowerRegistrationState.getTarget();
-                return rejected && current?.threadId !== undefined
-                    ? { rejected, current: { chatId: current.chatId, threadId: current.threadId } }
-                    : undefined;
-            },
             prepareUpdateForExecution(update) {
                 return BusFollower.prepareTelegramBusFollowerJournaledUpdateForExecution(update, textGroupRuntime.prepareForwardedMessage);
             },

package/node_modules/@llblab/pi-telegram/dist/lib/menu-settings.d.ts

@@ -52,7 +52,7 @@ export interface TelegramSettingsMenuCallbackDeps extends TelegramSettingsMutati
     sectionRegistry?: TelegramSectionRegistry;
 }
 export interface TelegramSettingsMenuRuntime<TContext> {
-    openSettingsMenu: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    openSettingsMenu: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
     handleCallbackQuery: (query: {
         id: string;
         data?: string;

package/node_modules/@llblab/pi-telegram/dist/lib/menu.d.ts

@@ -87,7 +87,7 @@ export interface TelegramMenuActionRuntimeDeps<TContext, TModel extends MenuMode
     storeModelMenuState: (state: TelegramModelMenuState<TModel>) => void;
     isIdle: (ctx: TContext) => boolean;
     canOfferInFlightModelSwitch: (ctx: TContext) => boolean;
-    sendTextReply: (chatId: number, replyToMessageId: number, text: string, options?: {
+    sendTextReply: (chatId: number, replyToMessageId: number | undefined, text: string, options?: {
         target?: {
             chatId: number;
             threadId?: number;
@@ -102,9 +102,9 @@ export interface TelegramMenuActionRuntime<TContext, TModel extends MenuModel =
     updateModelMenuMessage: (state: TelegramModelMenuState<TModel>, ctx: TContext) => Promise<void>;
     updateThinkingMenuMessage: (state: TelegramModelMenuState<TModel>, ctx: TContext) => Promise<void>;
     updateStatusMessage: (state: TelegramModelMenuState<TModel>, ctx: TContext) => Promise<void>;
-    sendStatusMessage: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
-    openModelMenu: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
-    openThinkingMenu: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    sendStatusMessage: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    openModelMenu: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    openThinkingMenu: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
 }
 export declare function handleTelegramMenuCallbackEntry(callbackQueryId: string, data: string | undefined, state: TelegramModelMenuState | undefined, deps: TelegramMenuCallbackEntryDeps): Promise<void>;
 export declare function handleStoredTelegramMenuCallback<TModel extends MenuModel = MenuModel>(query: MenuCallbackQuery, deps: StoredTelegramMenuCallbackDeps<TModel>): Promise<void>;

package/node_modules/@llblab/pi-telegram/dist/lib/routing.d.ts

@@ -174,6 +174,7 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     getCurrentInstanceId?: () => string | undefined;
     getAdmissionScope?: () => string | undefined;
     getAdmissionJournalBinding?: () => string | undefined;
+    getCommandReplyTarget?: Commands.TelegramCommandTargetRuntimeDeps<TContext>["getReplyTarget"];
     getMessageOwnership?: Updates.TelegramMessageOwnershipLookup;
     getTargetOwnership?: Updates.TelegramTargetOwnershipLookup;
     recordMessageOwnership?: Updates.TelegramMessageOwnershipRecorder;
@@ -256,7 +257,7 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     isVoiceReplyActive?: () => boolean;
     updateSettingsMenuMessage?: (state: Menu.TelegramModelMenuState<TModel>, ctx: TContext) => Promise<void>;
     openQueueMenu: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
-    openSettingsMenu?: (chatId: number, replyToMessageId: number, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
+    openSettingsMenu?: (chatId: number, replyToMessageId: number | undefined, ctx: TContext, threadId?: number, options?: Pick<TelegramApiCallOptions, "assertAuthority">) => Promise<void>;
     settingsMenuCallbackHandler?: (query: TCallbackQuery, ctx: TContext) => Promise<boolean>;
     queueMenuCallbackHandler: (query: TCallbackQuery, ctx: TContext) => Promise<boolean>;
     buttonActionStore?: OutboundHandlers.TelegramButtonActionStore;
@@ -303,7 +304,7 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     }) => Promise<string | undefined>;
     /** Starts the animated placeholder on an answered guest inline message. */
     startGuestPlaceholder?: (inlineMessageId: string) => void;
-    sendTextReply: (chatId: number, replyToMessageId: number, text: string, options?: {
+    sendTextReply: (chatId: number, replyToMessageId: number | undefined, text: string, options?: {
         parseMode?: "HTML";
         target?: Queue.TelegramQueueTarget;
         assertAuthority?: TelegramApiCallOptions["assertAuthority"];

package/node_modules/@llblab/pi-telegram/dist/lib/routing.js

@@ -7139,6 +7139,7 @@ export function createTelegramInboundRouteRuntime(deps) {
         appendControlItem: deps.queueMutationRuntime.append,
         getAdmissionScope: deps.getAdmissionScope,
         getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
+        getReplyTarget: deps.getCommandReplyTarget,
         onControlQueued: (message, receipt) => reportQueueAdmission([message], [receipt]),
         showStatus: deps.menuActions.sendStatusMessage,
         openModelMenu: deps.menuActions.openModelMenu,

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.d.ts

@@ -505,16 +505,18 @@ export declare class TelegramApiStaleTargetError extends Error {
         threadId: number;
     });
 }
-/** The leader's exact refusal of a follower API call outside that follower's own Thread; carries only the requested target. */
+/** A follower API refusal; legacy text alone does not prove the request was rejected before execution. */
 export declare class TelegramApiFollowerNotAllowedError extends Error {
     readonly requestTarget: {
         chatId: number;
         threadId: number;
     } | undefined;
+    /** Present only after a structured pre-execution refusal matches the requested API method. */
+    readonly rejectedRequestMethod: string | undefined;
     constructor(message: string, requestTarget?: {
         chatId: number;
         threadId: number;
-    });
+    }, rejectedRequestMethod?: string);
 }
 export declare function getTelegramApiErrorRequestTarget(error: unknown): {
     chatId: number;

package/node_modules/@llblab/pi-telegram/dist/lib/telegram-api.js

@@ -338,13 +338,16 @@ export class TelegramApiStaleTargetError extends Error {
         this.requestTarget = { ...requestTarget };
     }
 }
-/** The leader's exact refusal of a follower API call outside that follower's own Thread; carries only the requested target. */
+/** A follower API refusal; legacy text alone does not prove the request was rejected before execution. */
 export class TelegramApiFollowerNotAllowedError extends Error {
     requestTarget;
-    constructor(message, requestTarget) {
+    /** Present only after a structured pre-execution refusal matches the requested API method. */
+    rejectedRequestMethod;
+    constructor(message, requestTarget, rejectedRequestMethod) {
         super(message);
         this.name = "TelegramApiFollowerNotAllowedError";
         this.requestTarget = requestTarget ? { ...requestTarget } : undefined;
+        this.rejectedRequestMethod = rejectedRequestMethod;
     }
 }
 export function getTelegramApiErrorRequestTarget(error) {

package/node_modules/@llblab/pi-telegram/dist/lib/updates.d.ts

@@ -1487,7 +1487,7 @@ export interface TelegramUpdateAdmissionLifecycleAssemblyDeps<TUpdate extends Te
     runtimeBinding: TelegramUpdateAdmissionRuntimeBinding<TContext>;
     inputCustodyBus?: TelegramInputCustodyBusBindingRuntime<TContext>;
     acquireSourceReference?: (role: "leader" | "follower", binding: TelegramUpdateAdmissionLifecycleJournalBinding) => () => void;
-    worker: Omit<TelegramUpdateAdmissionWorkerRuntimeDeps<TUpdate, TContext>, "journal" | "getJournalBindingKey" | "getRecipientBindingKey" | "hasAuthority" | "prepareUpdateForExecution" | "recoverRejectedRecipientTarget">;
+    worker: Omit<TelegramUpdateAdmissionWorkerRuntimeDeps<TUpdate, TContext>, "journal" | "getJournalBindingKey" | "getRecipientBindingKey" | "hasAuthority" | "prepareUpdateForExecution">;
     leader: {
         resolveBinding: () => TelegramUpdateAdmissionLifecycleJournalBinding | undefined;
         hasAuthority: (ctx: TContext) => boolean;
@@ -1497,7 +1497,6 @@ export interface TelegramUpdateAdmissionLifecycleAssemblyDeps<TUpdate extends Te
         isRegistered: () => boolean;
         getGeneration: () => string | undefined;
         prepareUpdateForExecution: (update: TUpdate) => TUpdate;
-        recoverRejectedRecipientTarget?: NonNullable<TelegramUpdateAdmissionWorkerRuntimeDeps<TUpdate, TContext>["recoverRejectedRecipientTarget"]>;
         /** Session succession before worker creation, under the exact generation-fenced binding. */
         prepareBinding?: (binding: TelegramUpdateAdmissionLifecycleJournalBinding & {
             hasAuthority?: () => boolean;
@@ -1509,19 +1508,6 @@ export type TelegramUpdateAdmissionWorkerRuntimeDeps<TUpdate extends TelegramJou
     inputCustody?: TelegramCustodyExecutionJournal;
     defaultHandle: (update: TUpdate, ctx: TContext, execution?: TelegramUpdateExecutionFence) => Promise<void>;
     prepareUpdateForExecution?: (update: TUpdate) => TUpdate;
-    /**
-     * Recipient-only recovery for a journaled message whose own Thread changed (for example after its Thread was re-created):
-     * classifies a leader refusal of a reply to the original Thread and returns that Thread plus the owner's current one.
-     */
-    recoverRejectedRecipientTarget?: (error: unknown) => {
-        rejected: {
-            chatId: number;
-            threadId: number;
-        };
-        current: TelegramTarget & {
-            threadId: number;
-        };
-    } | undefined;
     registry?: TelegramUpdateHandlerRegistry;
 };
 /** Compose source-bound routing and late grouped settlement under one worker. */

package/node_modules/@llblab/pi-telegram/dist/lib/updates.js

@@ -6359,7 +6359,6 @@ export function createTelegramUpdateAdmissionWorkerRuntime(deps) {
             const typedUpdate = update;
             const prepared = deps.prepareUpdateForExecution?.(typedUpdate) ?? typedUpdate;
             // Journal/source evidence remains the original; only the warm released handler projection changes destination.
-            // Journal/source evidence remains the original; only the warm released handler projection changes destination.
             const projectTo = (destination) => ({ ...prepared,
                 ...(prepared.message ? { message: prepared.message.message_thread_id === destination.threadId ? { ...prepared.message }
                         : withoutTelegramTurnReplyAnchor({ ...prepared.message, message_thread_id: destination.threadId, reply_to_message: undefined }) } : {}),
@@ -6374,17 +6373,8 @@ export function createTelegramUpdateAdmissionWorkerRuntime(deps) {
                 if (await deps.settleTerminalExecutionFailure?.(error)) {
                     return { kind: "complete" };
                 }
-                // The leader refused a reply to a Thread this recipient no longer owns (re-created after the input was journaled).
-                // Re-run once against its current Thread; any other failure, or a second refusal, keeps the ordinary retry state.
-                const recovery = !target ? deps.recoverRejectedRecipientTarget?.(error) : undefined;
-                const message = prepared.message ?? prepared.edited_message;
-                if (recovery && message && message.message_thread_id === recovery.rejected.threadId &&
-                    message.chat?.id === recovery.rejected.chatId && recovery.current.chatId === recovery.rejected.chatId &&
-                    recovery.current.threadId !== recovery.rejected.threadId) {
-                    deps.recordRuntimeEvent?.("inbound-worker", error, { phase: "recipient-target-recovery", updateId: update.update_id,
-                        chatId: recovery.current.chatId, staleThreadId: recovery.rejected.threadId, threadId: recovery.current.threadId });
-                    return await executeUpdate(projectTo(recovery.current), ctx, signal);
-                }
+                // A refused reply proves only that send was not issued, not that the handler made no prior effects.
+                // Leave failure settlement to the worker's retry policy; never re-enter the handler to recover delivery here.
                 throw error;
             }
         },
@@ -6457,9 +6447,6 @@ export function createTelegramUpdateAdmissionLifecycleAssembly(deps) {
                 spendHistoricalInput: undefined,
                 onHeldSourcesPrepared: undefined,
                 prepareUpdateForExecution: deps.follower.prepareUpdateForExecution,
-                ...(deps.follower.recoverRejectedRecipientTarget
-                    ? { recoverRejectedRecipientTarget: deps.follower.recoverRejectedRecipientTarget }
-                    : {}),
             });
         },
         recordRuntimeEvent: deps.recordRuntimeEvent,

package/node_modules/@llblab/pi-telegram/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.57.7",
+  "version": "0.57.11",
   "private": false,
   "publishConfig": {
     "access": "public"

package/node_modules/@llblab/pi-telegram/docs/multi-instance-bus.md

@@ -673,12 +673,26 @@ This inspection authorizes no reload/restart, live-state mutation, fault injecti
 ## Security Boundaries
 
 - Messages, edits, callbacks, and reactions check user authorization, not only chat/thread membership.
-- Followers authenticate to the local leader IPC with a leader-minted capability secret carried in the active lock entry; registration, heartbeat, forwarded updates, and follower API calls without the secret are rejected. Registration rejections are surfaced verbatim in the follower `/telegram-connect` result, registration waits through leader-side Telegram thread provisioning, and successful registrations send an immediate heartbeat before the interval ticker so the leader does not prune a live follower before its first scheduled heartbeat. The local bus socket is also created under a private `0700` directory with `0600` socket permissions as a first local-only boundary. A reply refused because it targets a Thread other than the follower's own surfaces as the typed `TelegramApiFollowerNotAllowedError` carrying only the requested target. A journaled recipient input whose Thread was since re-created re-runs exactly once against the follower's current Thread (reply anchor cleared, diagnostic `recipient-target-recovery`); a second refusal or any other failure keeps the ordinary durable `retry-wait`.
+- Followers authenticate to the local leader IPC with a leader-minted capability secret carried in the active lock entry; registration, heartbeat, forwarded updates, and follower API calls without the secret are rejected. Registration rejections are surfaced verbatim in the follower `/telegram-connect` result, registration waits through leader-side Telegram thread provisioning, and successful registrations send an immediate heartbeat before the interval ticker so the leader does not prune a live follower before its first scheduled heartbeat. The local bus socket is also created under a private `0700` directory with `0600` socket permissions as a first local-only boundary. Follower API authorization refusal surfaces as `TelegramApiFollowerNotAllowedError` with the requested target when available. Only the leader's structured `follower-api-not-allowed` negative acknowledgement, emitted before API delegation and matched to the requested method, populates `rejectedRequestMethod`. Legacy error text, identical text thrown after delegation, a mismatched method or a lost acknowledgement supplies no such proof; old peers continue to receive the same human-readable rejection. The structured refusal proves only that the rejected API request was not executed, not that the command had no earlier effects. Admission therefore never immediately re-enters the handler or retargets its source to recover a reply. The original input remains in durable `retry-wait`; ordinary retries retain their documented at-least-once semantics. Safe reply-request recovery for re-created recipient Threads remains open in the backlog.
 - Follower Bot API proxying is allowlisted and target-scoped where applicable. Ordinary sends remain confined to the follower's assigned thread; trusted runtime-marked `telegram_message` cross-target sends may address only a different thread inside the same paired chat, and the leader strips the internal marker before calling Telegram. This preserves requested inter-thread delivery without granting arbitrary bot or cross-chat control.
 - Button and section callbacks verify authorized `from.id` and owning target/instance.
 - Generated artifacts stay scoped to the owning thread after leader failover.
 - Diagnostics redact bot tokens, large prompts, attachment paths, and handler output.
 
+### Reply Recovery Ownership Boundary
+
+A destination belongs to the complete delivery operation, not just the outgoing Bot API body. `replies.sendTelegramChunkSequence` captures one target for all chunks and records message ownership against it. Menu state independently retains `chatId`, `threadId` and the returned message ID through `menu-model.createTelegramMenuDelivery`. Its numeric send result cannot report a relocated Thread to the menu owner. Rewriting only a refused send's `message_thread_id` would therefore separate actual delivery from ownership and callback state; moving only later chunks would also split one reply across tabs.
+
+Follower API arguments use one private JSON-wire snapshot made before registration waits. Issued method/body, refusal target/method and slow-call diagnostics derive from that same snapshot; later caller mutations cannot relabel the attempt. Caller serialization runs once, with local authority checked before capture and again before issuance.
+
+Admission and recipient identity are separate. The local update execution fence carries its admission generation, update ID and abort signal; the queue-owner snapshot carries instance, process/birth and session-generation identity. Neither contains a complete recipient/session/profile/registration/target grant. Receipt and Workspace-admission namespaces are not the follower's registered profile key: selected-menu composition supplies that registered key separately, while the leader independently captures its active Workspace scope. No ordinary recipient-scoped reply-delivery lease joins these views today.
+
+Pre-publication destination selection is separate from refused-send recovery. For an executing private-DM follower journal, the status/model/settings and text-reply target adapters select the acknowledged recipient target while the active profile/session journal binding still matches the worker. The execution fence checks admission currency; it does not grant delivery. The selected target is passed to the menu owner before state construction and to the existing reply sender before chunking, with the old reply anchor removed on a Thread change. The original input and its journal are not rewritten. A different chat, a Thread-to-All fallback or missing recipient binding refuses selection; explicit selected-menu authority keeps its original fixed destination. The ordinary leader-side API authorization remains unchanged. This prevents a stale source address from choosing the initial reply destination; it neither relocates an issued request nor supplies the missing reply-recovery lease.
+
+Structured refusal is evidence about one API attempt, not a delivery or command recovery grant. Current delivery propagates that refusal without a replacement send, without editing the target or reply anchor, and without replaying acknowledged chunks. Already acknowledged messages keep their original ownership; the refused message acquires none. This applies to interactive HTML menus, split native Markdown and single Rich Message sections.
+
+Guarded follower delivery must use a recipient-scoped transport that enforces authority at the leader, not serialize a local callback through the ordinary proxy. The existing selected-menu channel is bound to an exact live-rebind operation, source cohort and recipient; a raw journaled command with no matching retained operation cannot borrow that grant. Any future reply-only recovery must establish its own exact authority, keep the destination consistent in delivery and menu ownership, clear stale reply metadata, and refuse relocation after partial publication or an unknown outcome. Handler-replay containment stays enabled until that boundary is proven; this is not an automatic recovery feature.
+
 ## Acceptance Criteria
 
 - [x] The lock semantics are redesigned as Telegram bus leadership with liveness proof and stale takeover rules.

package/node_modules/@llblab/pi-telegram/lib/bus-follower.ts

@@ -1919,11 +1919,16 @@ export function createTelegramBusFollowerApiCaller(
     method: string,
     args: unknown[],
     localOptions: Pick<TelegramApiCallOptions, "assertAuthority"> | undefined,
-    timing: { registeredAtMs?: number },
+    timing: { registeredAtMs?: number; apiMethod?: string },
   ): Promise<unknown> => {
     const assertion = localOptions?.assertAuthority;
     const assertCurrent = () => assertTelegramApiCallAuthority(assertion, false);
     assertCurrent();
+    // Match IPC's JSON semantics once, before awaits; send and refusal metadata share this identity.
+    const requestArgs = JSON.parse(JSON.stringify(args)) as unknown[];
+    const apiMethod = (method === "call" || method === "callMultipart") && typeof requestArgs[0] === "string"
+      ? requestArgs[0] : method;
+    timing.apiMethod = apiMethod;
     const registration = await resolveTelegramBusFollowerRegistration(
       deps,
       timeoutMs,
@@ -1943,18 +1948,13 @@ export function createTelegramBusFollowerApiCaller(
           instanceId: deps.instanceId,
           registrationGeneration: registration.generation,
           method,
-          args,
+          args: requestArgs,
           sentAtMs: getNowMs(),
         },
         assertion ? assertCurrent : undefined,
       );
     } catch (error) {
       if (error instanceof TelegramBusLocalAuthorityError) throw new TelegramApiAuthorityError(error.requestIssued);
-      const apiMethod =
-        (method === "call" || method === "callMultipart") &&
-        typeof args[0] === "string"
-          ? args[0]
-          : method;
       if (!isTelegramApiMethodRetrySafe(apiMethod)) {
         throw new TelegramApiCommitUnknownError(apiMethod, error);
       }
@@ -1988,25 +1988,30 @@ export function createTelegramBusFollowerApiCaller(
         new Error(message ?? "Telegram bus API call result is ambiguous."),
       );
     }
-    if (message === TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE) {
+    const refusedMethod = response?.kind === "bus.ack" && !response.ok &&
+      response.error?.code === "follower-api-not-allowed" &&
+      response.error.method === apiMethod
+      ? apiMethod : undefined;
+    if (refusedMethod || message === TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE) {
       const body =
-        (method === "call" || method === "callMultipart") && isRecord(args[1])
-          ? args[1]
+        (method === "call" || method === "callMultipart") && isRecord(requestArgs[1])
+          ? requestArgs[1]
           : undefined;
       const chatId = Number(body?.chat_id);
       const threadId = Number(body?.message_thread_id);
       throw new TelegramApiFollowerNotAllowedError(
-        message,
+        message ?? TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE,
         Number.isSafeInteger(chatId) && Number.isSafeInteger(threadId)
           ? { chatId, threadId }
           : undefined,
+        refusedMethod,
       );
     }
     throw new Error(message ?? "Telegram bus API call failed.");
   };
   return async (method, args, localOptions) => {
     const startedAtMs = getNowMs();
-    const timing: { registeredAtMs?: number } = {};
+    const timing: { registeredAtMs?: number; apiMethod?: string } = {};
     let outcome = "ok";
     try {
       return await caller(method, args, localOptions, timing);
@@ -2016,11 +2021,7 @@ export function createTelegramBusFollowerApiCaller(
     } finally {
       const elapsedMs = getNowMs() - startedAtMs;
       if (elapsedMs >= slowCallMs) {
-        const apiMethod =
-          (method === "call" || method === "callMultipart") &&
-          typeof args[0] === "string"
-            ? args[0]
-            : method;
+        const apiMethod = timing.apiMethod ?? method;
         try {
           deps.recordRuntimeEvent?.(
             "bus",

package/node_modules/@llblab/pi-telegram/lib/bus-leader.ts

@@ -4189,10 +4189,17 @@ async function handleFollowerApiCall(
       args: envelope.args,
     })
   ) {
-    return rejectTelegramBusRequest(
-      envelope.requestId,
-      TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE,
-    );
+    const apiMethod = getFollowerApiMethodAndBody(envelope).apiMethod;
+    return {
+      ...rejectTelegramBusRequest(
+        envelope.requestId,
+        TELEGRAM_BUS_FOLLOWER_API_NOT_ALLOWED_MESSAGE,
+      ),
+      // Only this pre-dispatch authorizer refusal certifies that the API method was not called.
+      ...(/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(apiMethod)
+        ? { error: { code: "follower-api-not-allowed" as const, method: apiMethod } }
+        : {}),
+    };
   }
   if (!deps.callApi) {
     return rejectTelegramBusRequest(

package/node_modules/@llblab/pi-telegram/lib/bus.ts

@@ -1260,6 +1260,7 @@ export type TelegramBusEnvelope = (
           | "ledger-overloaded"
           | "incompatible-protocol"
           | "stale-target"
+          | "follower-api-not-allowed"
           | "workspace-binding-unavailable";
         method?: string;
         chatId?: number;
@@ -4148,10 +4149,17 @@ function parseAckEnvelope(
       code === "ledger-overloaded" ||
       code === "incompatible-protocol" ||
       code === "stale-target" ||
+      code === "follower-api-not-allowed" ||
       code === "workspace-binding-unavailable"
     ) {
       const chatId = value.error.chatId;
       const threadId = value.error.threadId;
+      if (
+        code === "follower-api-not-allowed" &&
+        (value.ok || Object.hasOwn(value, "result") ||
+          typeof value.error.method !== "string" ||
+          !/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(value.error.method))
+      ) return undefined;
       if (
         code === "stale-target" &&
         (!Number.isSafeInteger(chatId) || !Number.isSafeInteger(threadId))

package/node_modules/@llblab/pi-telegram/lib/commands.ts

@@ -36,6 +36,7 @@ import {
   TelegramApiAuthorityError,
   type TelegramApiCallOptions,
 } from "./telegram-api.ts";
+import type { TelegramTarget } from "./target.ts";
 import type { TelegramSessionReplacementIntent } from "./threads.ts";
 import {
   acquireTelegramUpdateRouting,
@@ -1194,34 +1195,38 @@ export interface TelegramCommandTargetRuntimeDeps<TContext> {
   ) => void;
   getAdmissionScope?: () => string | undefined;
   getAdmissionJournalBinding?: () => string | undefined;
+  /** Ordinary reply destination selected before publication, not resend authority. */
+  getReplyTarget?: (
+    message: TelegramCommandRuntimeMessage,
+  ) => TelegramTarget | undefined;
   onControlQueued?: (
     message: TelegramCommandRuntimeMessage,
     receipt: TelegramQueueAdmissionReceipt,
   ) => void;
   showStatus: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   openModelMenu: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   openSettingsMenu?: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   sendTextReply: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     text: string,
     options?: {
       parseMode?: "HTML";
@@ -1336,6 +1341,7 @@ export function createTelegramCommandTargetQueueRuntime<
       createControlItem,
       enqueueControlItem: controlQueueController.enqueue,
     }),
+    getReplyTarget: deps.getReplyTarget,
     getAdmissionScope: deps.getAdmissionScope,
     getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
     onControlQueued: deps.onControlQueued,
@@ -1352,6 +1358,25 @@ export function createTelegramCommandTargetRuntime<
 >(
   deps: TelegramCommandTargetRuntimeDeps<TContext>,
 ): TelegramCommandTargetRuntime<TMessage, TContext> {
+  const getReplyTarget = (
+    message: TMessage,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => {
+    const source = getTelegramCommandMessageTarget(message);
+    const recipient = options?.assertAuthority
+      ? undefined
+      : deps.getReplyTarget?.(message);
+    if (!recipient) return source;
+    if (recipient.chatId !== source.chatId)
+      throw new Error("Telegram command reply cannot change its recipient chat.");
+    if (source.threadId !== undefined && recipient.threadId === undefined)
+      throw new Error("Telegram command cannot move a Thread reply to All.");
+    return {
+      ...recipient,
+      replyToMessageId:
+        recipient.threadId === source.threadId ? source.replyToMessageId : undefined,
+    };
+  };
   return {
     enqueueControlItem: (message, ctx, controlType, statusSummary, execute) => {
       const sourceUpdateId = message.pi_telegram_source_update_id;
@@ -1381,7 +1406,7 @@ export function createTelegramCommandTargetRuntime<
       );
     },
     showStatus: (message, ctx, options) => {
-      const target = getTelegramCommandMessageTarget(message);
+      const target = getReplyTarget(message, options);
       return deps.showStatus(
         target.chatId,
         target.replyToMessageId,
@@ -1391,7 +1416,7 @@ export function createTelegramCommandTargetRuntime<
       );
     },
     openModelMenu: (message, ctx, options) => {
-      const target = getTelegramCommandMessageTarget(message);
+      const target = getReplyTarget(message, options);
       return deps.openModelMenu(
         target.chatId,
         target.replyToMessageId,
@@ -1401,7 +1426,7 @@ export function createTelegramCommandTargetRuntime<
       );
     },
     openSettingsMenu: async (message, ctx, options) => {
-      const target = getTelegramCommandMessageTarget(message);
+      const target = getReplyTarget(message, options);
       if (!deps.openSettingsMenu) {
         await deps.sendTextReply(
           target.chatId,
@@ -1423,7 +1448,7 @@ export function createTelegramCommandTargetRuntime<
       );
     },
     sendTextReply: async (message, text, options) => {
-      const target = getTelegramCommandMessageTarget(message);
+      const target = getReplyTarget(message, options);
       const assertAuthority = options?.assertAuthority,
         send = deps.sendTextReply;
       const capturedOptions = { ...options, target };
@@ -2217,6 +2242,7 @@ export function createTelegramCommandHandlerTargetRuntime<
     }),
     appendControlItem: deps.appendControlItem,
     dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
+    getReplyTarget: deps.getReplyTarget,
     getAdmissionScope: deps.getAdmissionScope,
     getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
     onControlQueued: deps.onControlQueued,

package/node_modules/@llblab/pi-telegram/lib/extension.ts

@@ -1364,6 +1364,27 @@ export default function (pi: Pi.ExtensionAPI) {
     },
     getAdmissionScope: getTelegramUpdateAdmissionScope,
     getAdmissionJournalBinding: getTelegramQueueJournalBinding,
+    getCommandReplyTarget(message) {
+      if (
+        message.chat.type !== "private" ||
+        "business_connection_id" in message ||
+        !Updates.getTelegramUpdateExecutionFence(message) ||
+        lockRuntime.owns()
+      ) return undefined;
+      Updates.assertTelegramUpdateExecutionCurrent(message);
+      const binding = resolveTelegramFollowerJournalBinding();
+      const target = telegramBusFollowerRegistrationState.getTarget();
+      if (
+        !telegramBusFollowerRegistrationState.isRegistered() ||
+        !binding ||
+        binding.recoveryKey !==
+          followerAdmissionLifecycleRuntime.getJournalBindingKey() ||
+        !target ||
+        (threadStore.getBotState().threadMode === "enabled" &&
+          target.threadId === undefined)
+      ) throw new Error("Telegram command reply lost its registered recipient.");
+      return { ...target };
+    },
     beginCommandEffectWork: publicationRuntime.beginWork,
     getMessageOwnership: messageOwnershipRuntime.getForwardOwnership,
     recordMessageOwnership: messageOwnershipRuntime.recordRouted,
@@ -1763,16 +1784,6 @@ export default function (pi: Pi.ExtensionAPI) {
           },
         );
       },
-      recoverRejectedRecipientTarget(error) {
-        const rejected =
-          error instanceof TelegramApi.TelegramApiFollowerNotAllowedError
-            ? error.requestTarget
-            : undefined;
-        const current = telegramBusFollowerRegistrationState.getTarget();
-        return rejected && current?.threadId !== undefined
-          ? { rejected, current: { chatId: current.chatId, threadId: current.threadId } }
-          : undefined;
-      },
       prepareUpdateForExecution(update) {
         return BusFollower.prepareTelegramBusFollowerJournaledUpdateForExecution(
           update,

package/node_modules/@llblab/pi-telegram/lib/menu-settings.ts

@@ -90,7 +90,7 @@ export interface TelegramSettingsMenuCallbackDeps extends TelegramSettingsMutati
 export interface TelegramSettingsMenuRuntime<TContext> {
   openSettingsMenu: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,

package/node_modules/@llblab/pi-telegram/lib/menu.ts

@@ -264,7 +264,7 @@ export interface TelegramMenuActionRuntimeDeps<
   canOfferInFlightModelSwitch: (ctx: TContext) => boolean;
   sendTextReply: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     text: string,
     options?: {
       target?: { chatId: number; threadId?: number };
@@ -294,21 +294,21 @@ export interface TelegramMenuActionRuntime<
   ) => Promise<void>;
   sendStatusMessage: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   openModelMenu: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   openThinkingMenu: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,

package/node_modules/@llblab/pi-telegram/lib/routing.ts

@@ -1499,6 +1499,8 @@ export interface TelegramInboundRouteRuntimeDeps<
   getCurrentInstanceId?: () => string | undefined;
   getAdmissionScope?: () => string | undefined;
   getAdmissionJournalBinding?: () => string | undefined;
+  getCommandReplyTarget?:
+    Commands.TelegramCommandTargetRuntimeDeps<TContext>["getReplyTarget"];
   getMessageOwnership?: Updates.TelegramMessageOwnershipLookup;
   getTargetOwnership?: Updates.TelegramTargetOwnershipLookup;
   recordMessageOwnership?: Updates.TelegramMessageOwnershipRecorder;
@@ -1640,7 +1642,7 @@ export interface TelegramInboundRouteRuntimeDeps<
   ) => Promise<void>;
   openSettingsMenu?: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     ctx: TContext,
     threadId?: number,
     options?: Pick<TelegramApiCallOptions, "assertAuthority">,
@@ -1728,7 +1730,7 @@ export interface TelegramInboundRouteRuntimeDeps<
   startGuestPlaceholder?: (inlineMessageId: string) => void;
   sendTextReply: (
     chatId: number,
-    replyToMessageId: number,
+    replyToMessageId: number | undefined,
     text: string,
     options?: {
       parseMode?: "HTML";
@@ -10181,6 +10183,7 @@ export function createTelegramInboundRouteRuntime<
     appendControlItem: deps.queueMutationRuntime.append,
     getAdmissionScope: deps.getAdmissionScope,
     getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
+    getReplyTarget: deps.getCommandReplyTarget,
     onControlQueued: (message, receipt) =>
       reportQueueAdmission([message], [receipt]),
     showStatus: deps.menuActions.sendStatusMessage,

package/node_modules/@llblab/pi-telegram/lib/telegram-api.ts

@@ -1049,17 +1049,21 @@ export class TelegramApiStaleTargetError extends Error {
   }
 }
 
-/** The leader's exact refusal of a follower API call outside that follower's own Thread; carries only the requested target. */
+/** A follower API refusal; legacy text alone does not prove the request was rejected before execution. */
 export class TelegramApiFollowerNotAllowedError extends Error {
   readonly requestTarget: { chatId: number; threadId: number } | undefined;
+  /** Present only after a structured pre-execution refusal matches the requested API method. */
+  readonly rejectedRequestMethod: string | undefined;
 
   constructor(
     message: string,
     requestTarget?: { chatId: number; threadId: number },
+    rejectedRequestMethod?: string,
   ) {
     super(message);
     this.name = "TelegramApiFollowerNotAllowedError";
     this.requestTarget = requestTarget ? { ...requestTarget } : undefined;
+    this.rejectedRequestMethod = rejectedRequestMethod;
   }
 }
 

package/node_modules/@llblab/pi-telegram/lib/updates.ts

@@ -10495,7 +10495,6 @@ export interface TelegramUpdateAdmissionLifecycleAssemblyDeps<
     | "getRecipientBindingKey"
     | "hasAuthority"
     | "prepareUpdateForExecution"
-    | "recoverRejectedRecipientTarget"
   >;
   leader: {
     resolveBinding: () =>
@@ -10508,9 +10507,6 @@ export interface TelegramUpdateAdmissionLifecycleAssemblyDeps<
     isRegistered: () => boolean;
     getGeneration: () => string | undefined;
     prepareUpdateForExecution: (update: TUpdate) => TUpdate;
-    recoverRejectedRecipientTarget?: NonNullable<
-      TelegramUpdateAdmissionWorkerRuntimeDeps<TUpdate, TContext>["recoverRejectedRecipientTarget"]
-    >;
     /** Session succession before worker creation, under the exact generation-fenced binding. */
     prepareBinding?: (
       binding: TelegramUpdateAdmissionLifecycleJournalBinding & {
@@ -10535,13 +10531,6 @@ export type TelegramUpdateAdmissionWorkerRuntimeDeps<
     execution?: TelegramUpdateExecutionFence,
   ) => Promise<void>;
   prepareUpdateForExecution?: (update: TUpdate) => TUpdate;
-  /**
-   * Recipient-only recovery for a journaled message whose own Thread changed (for example after its Thread was re-created):
-   * classifies a leader refusal of a reply to the original Thread and returns that Thread plus the owner's current one.
-   */
-  recoverRejectedRecipientTarget?: (error: unknown) =>
-    | { rejected: { chatId: number; threadId: number }; current: TelegramTarget & { threadId: number } }
-    | undefined;
   registry?: TelegramUpdateHandlerRegistry;
 };
 
@@ -10668,7 +10657,6 @@ export function createTelegramUpdateAdmissionWorkerRuntime<
       const typedUpdate = update as TUpdate;
       const prepared = deps.prepareUpdateForExecution?.(typedUpdate) ?? typedUpdate;
       // Journal/source evidence remains the original; only the warm released handler projection changes destination.
-      // Journal/source evidence remains the original; only the warm released handler projection changes destination.
       const projectTo = (destination: TelegramTarget & { threadId: number }): TUpdate => ({ ...prepared,
         ...(prepared.message ? { message: prepared.message.message_thread_id === destination.threadId ? { ...prepared.message }
           : withoutTelegramTurnReplyAnchor({ ...prepared.message, message_thread_id: destination.threadId, reply_to_message: undefined }) } : {}),
@@ -10686,17 +10674,8 @@ export function createTelegramUpdateAdmissionWorkerRuntime<
         if (await deps.settleTerminalExecutionFailure?.(error)) {
           return { kind: "complete" };
         }
-        // The leader refused a reply to a Thread this recipient no longer owns (re-created after the input was journaled).
-        // Re-run once against its current Thread; any other failure, or a second refusal, keeps the ordinary retry state.
-        const recovery = !target ? deps.recoverRejectedRecipientTarget?.(error) : undefined;
-        const message = prepared.message ?? prepared.edited_message;
-        if (recovery && message && message.message_thread_id === recovery.rejected.threadId &&
-            message.chat?.id === recovery.rejected.chatId && recovery.current.chatId === recovery.rejected.chatId &&
-            recovery.current.threadId !== recovery.rejected.threadId) {
-          deps.recordRuntimeEvent?.("inbound-worker", error, { phase: "recipient-target-recovery", updateId: update.update_id,
-            chatId: recovery.current.chatId, staleThreadId: recovery.rejected.threadId, threadId: recovery.current.threadId });
-          return await executeUpdate(projectTo(recovery.current), ctx, signal);
-        }
+        // A refused reply proves only that send was not issued, not that the handler made no prior effects.
+        // Leave failure settlement to the worker's retry policy; never re-enter the handler to recover delivery here.
         throw error;
       }
     },
@@ -10777,9 +10756,6 @@ export function createTelegramUpdateAdmissionLifecycleAssembly<
         spendHistoricalInput: undefined,
         onHeldSourcesPrepared: undefined,
         prepareUpdateForExecution: deps.follower.prepareUpdateForExecution,
-        ...(deps.follower.recoverRejectedRecipientTarget
-          ? { recoverRejectedRecipientTarget: deps.follower.recoverRejectedRecipientTarget }
-          : {}),
       });
     },
     recordRuntimeEvent: deps.recordRuntimeEvent,

package/node_modules/@llblab/pi-telegram/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.57.7",
+  "version": "0.57.11",
   "private": false,
   "publishConfig": {
     "access": "public"

package/node_modules/@llblab/pi-telegram/scripts/run-macos-tests.mjs

@@ -0,0 +1,43 @@
+/**
+ * Deterministic macOS CI test shards
+ * Zones: CI, test execution
+ * Keeps real-process tests isolated and partitions the remaining files without changing test deadlines.
+ */
+import { spawnSync } from "node:child_process";
+import { readdirSync } from "node:fs";
+import { delimiter, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const [shard, phase, mode, ...extra] = process.argv.slice(2);
+if (!["0", "1"].includes(shard) || !["process", "remaining"].includes(phase) ||
+    (mode !== undefined && mode !== "--list") || extra.length) {
+  throw new Error("Usage: run-macos-tests.mjs <0|1> <process|remaining> [--list]");
+}
+const root = fileURLToPath(new URL("..", import.meta.url));
+const entries = readdirSync(join(root, "tests"), { withFileTypes: true })
+  .filter((entry) => entry.name.endsWith(".test.ts"));
+if (entries.some((entry) => !entry.isFile()))
+  throw new Error("The CI test inventory must contain only regular test files.");
+const names = entries.map((entry) => entry.name).sort();
+const processTest = "process-shutdown.test.ts";
+if (!names.includes(processTest)) throw new Error("The real-process test suite is missing.");
+const files = (phase === "process"
+  ? (shard === "0" ? [processTest] : [])
+  : names.filter((name) => name !== processTest).filter((_, index) => index % 2 === Number(shard)))
+  .map((name) => `tests/${name}`);
+if (mode === "--list") {
+  console.log(JSON.stringify(files));
+} else if (files.length) {
+  console.log(`macOS shard ${Number(shard) + 1}/2 ${phase}: ${files.length} test file(s)`);
+  const result = spawnSync(process.execPath, [
+    "--experimental-strip-types", "--import", "./tests/fixtures/canonical-tmpdir.ts",
+    "--test", "--test-concurrency=1", `--test-reporter=${phase === "process" ? "spec" : "dot"}`,
+    ...files,
+  ], {
+    cwd: root,
+    stdio: "inherit",
+    env: { ...process.env, PATH: [join(root, "node_modules", ".bin"), process.env.PATH].filter(Boolean).join(delimiter) },
+  });
+  if (result.error) throw result.error;
+  process.exitCode = result.status ?? 1;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-kit",
-  "version": "0.36.2",
+  "version": "0.36.3",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -50,7 +50,7 @@
     "@llblab/pi-codex-usage": "0.13.2",
     "@llblab/pi-grow-loop": "0.9.0",
     "@llblab/pi-state-flow": "0.26.5",
-    "@llblab/pi-telegram": "0.57.7",
+    "@llblab/pi-telegram": "0.57.11",
     "@llblab/skills": "1.15.0"
   },
   "bundledDependencies": [