@llblab/pi-telegram 0.42.3 → 0.42.4

package/BACKLOG.md

@@ -2,6 +2,8 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
+- [ ] `Live-thread continuity and recovery`: Make loss and restoration of a live thread truthful and safe without discarding accepted work or deleting a currently owned target; the initial cause of the observed stale-thread API failures remains unproven.
+  - [ ] Complete the remaining operator-coordinated live smoke beyond the operator-confirmed successful leader Restore: verify follower Restore, inaccessible callbacks, already-absent chooser cleanup, direct stale-target diagnostics, and preservation of accepted local work/active-turn target. Use disposable test threads. The successful leader flow does not independently prove these failure paths or establish the initial stale-thread failure cause.
 - [ ] `Operator-confirmed pairing`: Replace first-contact automatic ownership with an explicit pending request that the trusted Pi interface can allow or reject before `allowedUserId` is persisted or any Telegram prompt executes; retain manual preconfiguration, bound pending-request lifetime and multiplicity, fail closed across session/transport replacement, and cover unauthorized-first-contact races.
 - [ ] `Environment-backed bot tokens`: Let each profile store an exact Pi-native `$ENV_VAR` or `${ENV_VAR}` reference in `telegram.json` instead of copying the resolved secret; preserve the originating alias when `/telegram-setup` prefills from a supported environment variable, resolve only at validation/activation boundaries, fail closed with a redacted named-variable diagnostic when unresolved, retain literal-token compatibility, and cover named profiles, reload, persistence, status, and secret-redaction paths.
 - [ ] [`Inference bypass Generative Apps`](./docs/generative-apps.md): Let the agent install and bind one managed JavaScript app owner for a generated-prompt prefix so deterministic controls can bypass model inference without creating another button grammar.

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 > Each release keeps at most 8 outcome records of at most 512 characters.
 
+## 0.42.4: Thread Recovery Hotfix
+
+- `Thread Restore`: Retains validated source and chooser identity when callback messages omit thread metadata, hides Restore in threadless/All choosers and explains how to supply a destination, rejects conflicting Restore instead of forwarding to the old target, and treats confirmed already-deleted chooser cleanup as complete without redispatch.
+- `Target Safety`: Rechecks cleanup ownership before close/delete and local retirement across restore, disconnect, and provisioning paths; a rebound target is not deleted, invalidated, or reserved by obsolete cleanup. Follower restore rechecks registration generation and expected target after IPC, store-load, and persistence waits.
+- `Stale Delivery`: Direct replies, menus, activity, edits, and multipart sends capture exact stale-target authority; guarded invalidation rechecks generation, profile, binding, and snapshot revision at the synchronous durable commit without replaying failed sends or redirecting accepted work.
+- `State Continuity`: Snapshot reads cannot overwrite bindings or cleanup intents admitted while disk I/O was pending; equivalent persisted records retain cleanup authority regardless of property order or omitted optional fields.
+
 ## 0.42.3: Agent Diagnostics Hotfix
 
 - `Agent Diagnostics`: Identifies `/telegram-status` as a Pi TUI command and routes agents without command access directly to the redacted diagnostic files instead of attempting a shell executable; runtime behavior and STT fallback remain unchanged.

package/docs/multi-instance-bus.md

@@ -272,7 +272,7 @@ Non-goal: group detection is not the control-plane model for this extension. Thr
 
 Remaining live-verification points:
 
-- Whether callback query messages always carry `message_thread_id` in private bot threads, or whether generated button callbacks must rely on stored message id -> target ownership.
+- Callback query messages can be `InaccessibleMessage` without `message_thread_id`; reroute controls use stored source/chooser identity, and ordinary generated buttons retain their message-ownership routing. Client-visible Restore and cleanup still require live smoke evidence.
 - Whether message-reaction updates carry thread identity in the current Bot API shape. The reference exposes chat id and message id for reactions, so routing may need stored message ownership.
 - Live client evidence now covers the probe-confirmed single-artifact multipart Rich final through both direct leader and registered follower transport: an assigned follower Telegram turn produced one reply-anchored PNG plus final text without a duplicate upload or notice. Deterministic bus tests additionally cover target-scoped multipart authorization, envelope preservation, and replacement-generation fencing.
 
@@ -412,11 +412,23 @@ All files containing routing, chat ids, thread ids, or process details use priva
 - Destructive follower thread teardown belongs to confirmed `/telegram-disconnect`, graceful Pi quit, or confirmed reconciliation actions, not generic heartbeat pruning. Manual disconnect retains its destructive confirmation and clears restart ownership; quit deletes the tab without prompting when Thread cleanup is enabled (default) but preserves the owner slot independently so a same-directory restart can reclaim leadership. Confirmed leader/follower teardown first persists an exact target/runtime-generation cleanup intent. The active leader attempts deletion under its current epoch; interruption preserves the intent so that leader or a successor can replay it under current authority, and confirmed deletion removes the binding plus intent in the same persisted state transition. If the graceful request is missed, stale heartbeat plus OS-confirmed absence of the exact registered PID may authorize the same cleanup while enabled; this action serializes ahead of replacement registration. Disabled cleanup, silence, heartbeat expiry alone, IPC/auth failure, and live or unknown process liveness remain non-destructive. Incomplete cleanup preserves durable intent for retry. A promoted leader uses its current owned leader epoch even when the inherited record still carries a historical `manual-follower` owner label.
 - Explicit stale/deleted/offline observations invalidate reuse. Process absence affects reuse only through the enabled, exact-PID confirmed-dead cleanup path.
 
-### Thread is deleted
+### Stale thread delivery
 
-- Target mapping becomes stale.
-- On next outbound failure or reconnect, leader records a diagnostic.
-- Depending on policy, recreate a thread or mark the instance as needing operator action.
+Local regression evidence covers continuity and cleanup authority; operator-coordinated live Restore verification remains tracked in [BACKLOG.md](../BACKLOG.md).
+
+- Direct replies, menus, activity, target-aware edits, and multipart transport capture the request target and local authority before sending. Exact typed HTTP 400 stale-thread evidence stages invalidation of only the matching unchanged binding. The thread store rechecks leader/session/profile authority, binding identity, snapshot revisions, and destination path at the synchronous owner-fenced rename; no staged invalidation enters the live projection before durable commit, and a rejected commit preserves newer state.
+- Shared recovery marks topic, target-binding, and transport freshness suspect and schedules a diagnostic snapshot. Accepted local work and its active-turn target remain unchanged; a failed send is not replayed or redirected, and recovery does not create a replacement thread or probe on every send. Errors without a proven request target do not authorize invalidation.
+- Reconnect and explicit Restore remain separate authority-bearing operations. A stale API response proves target failure, not who deleted or closed the thread.
+
+### Restore controls and cleanup
+
+Operator-confirmed client flow: send ordinary text from the **All** tab; Telegram creates a new thread containing that text. Choose **Replace/restore thread…** and the existing Pi instance. Successful leader Restore binds and renames the new thread, dispatches the original message to the same Pi, and removes the old thread. The resulting prompt's thread-name label reflects the restored destination, not proof that the user typed in the old thread. A threadless `/start` is not equivalent to this ordinary-text flow.
+
+The bounded pending reroute owns its original source target and the returned chooser message ID independently from remaining messages. Authenticated callbacks must match the stored chat/chooser and any supplied thread field. `InaccessibleMessage` may omit the thread field; a missing callback message, unknown chooser, conflicting identity, threadless source, or already-owned Restore source fails closed rather than forwarding to the old target. Restart or expiry without that pending identity does not authorize reconstruction from callback data alone. When the original input itself has no thread ID (including an All-tab `/start`), the chooser offers routing only, not Restore; old Restore callbacks explain that a plain message must first be sent in the destination thread. Client tab selection is not inferred from recent topic creation or from the chosen Pi instance.
+
+After dispatch, cleanup retries retain source identity but never redispatch accepted messages. Confirmed typed HTTP 400 `message to delete not found` completes message deletion idempotently; permission and transient failures remain errors. Reroute cleanup rechecks current bindings, live targets, reservations, and pending provisions before close, before delete, and on retry. Other destructive cleanup origins use the shared synchronous target-protection policy: explicit retirement permits only its unchanged departing binding, persisted shutdown intent permits only its original pre-intent binding, and reservation/provision cleanup permits only the corresponding unchanged claim. Protection checks also guard post-API local invalidation, reservation, and disconnect completion. A newly protected target cancels remaining cleanup. Already-issued remote operations cannot be undone by a later local ownership change; checks prevent subsequent effects, not retroactive cancellation.
+
+Follower Restore requires exact registration generation and expected old target both before and after awaited IPC acknowledgement/store loading. Completion also rechecks the restored target and generation after persistence before publishing status or acknowledging success. A mismatched, replaced, or same-target request cannot overwrite the current registration.
 
 ### Split brain
 

package/index.ts

@@ -400,6 +400,15 @@ export default function (pi: Pi.ExtensionAPI) {
     TelegramApi.createDefaultTelegramBridgeApiRuntime({
       getBotToken: configStore.getBotToken,
       recordRuntimeEvent,
+      captureRequestErrorHandler(body) {
+        return Sync.captureTelegramStaleTargetRequestRecovery(body, {
+          ...staleTopicApiErrorRecoveryDeps,
+          getCurrentLeaderEpoch,
+          getSessionGeneration: telegramSessionContextStore.getGeneration,
+          getProfileName: configStore.getActiveProfileName,
+          onRecovered: runtimeDiagnostics.scheduleSnapshotPersist,
+        });
+      },
     });
   const telegramBusFollowerClients =
     BusFollower.createTelegramBusFollowerClientRuntime<

package/lib/bus-follower.ts

@@ -390,9 +390,8 @@ export interface TelegramBusFollowerTargetReplacementHandlerDeps<TContext> {
   >;
   registrationState: Pick<
     TelegramBusFollowerRegistrationState,
-    "getTarget" | "setRegistered"
-  > &
-    Partial<Pick<TelegramBusFollowerRegistrationState, "getGeneration">>;
+    "getTarget" | "setRegistered" | "getGeneration"
+  >;
   instanceId: string;
   getManualFollowerProfileKey: () => string;
   manualFollowerOwnerId: string;
@@ -471,6 +470,7 @@ export interface TelegramBusForwardedUpdateReceiverRuntimeDeps<TContext> {
       target: TelegramTarget & { threadId: number };
       oldTarget?: TelegramTarget & { threadId: number };
       reason: "thread-restore";
+      registrationGeneration: string;
     },
     ctx: TContext,
   ) => Promise<void> | void;
@@ -569,26 +569,35 @@ export function createTelegramBusFollowerTargetReplacementHandler<TContext>(
 > {
   const getNowMs = deps.getNowMs ?? Date.now;
   return async (input, ctx) => {
+    const assertCurrent = (expectedTarget = input.oldTarget): void => {
+      const target = deps.registrationState.getTarget();
+      if (!input.registrationGeneration ||
+        deps.registrationState.getGeneration() !== input.registrationGeneration ||
+        !input.oldTarget || !expectedTarget || target?.chatId !== expectedTarget.chatId ||
+        target.threadId !== expectedTarget.threadId ||
+        input.target.chatId !== input.oldTarget.chatId ||
+        input.target.threadId === input.oldTarget.threadId) {
+        throw new Error("Stale Telegram follower target replacement authority.");
+      }
+    };
+    assertCurrent();
     await deps.topicTargetStore.load();
+    assertCurrent();
     const nowMs = getNowMs();
     const currentRecord = Threads.findCurrentTelegramInstanceThreadRecord({
       records: deps.topicTargetStore.list(),
       instanceId: deps.instanceId,
-      preferredTarget: input.oldTarget ?? deps.registrationState.getTarget(),
+      preferredTarget: input.oldTarget,
     });
-    if (input.oldTarget) {
-      deps.topicTargetStore.markStaleByTarget(
-        input.oldTarget,
-        "deleted",
-        "Follower thread was replaced by thread restore.",
-      );
-    } else if (currentRecord) {
-      deps.topicTargetStore.markStaleByTarget(
-        currentRecord.target,
-        "deleted",
-        "Follower thread was replaced by thread restore.",
-      );
+    if (currentRecord && (currentRecord.target.chatId !== input.oldTarget!.chatId ||
+      currentRecord.target.threadId !== input.oldTarget!.threadId)) {
+      throw new Error("Stale Telegram follower binding replacement target.");
     }
+    deps.topicTargetStore.markStaleByTarget(
+      input.oldTarget!,
+      "deleted",
+      "Follower thread was replaced by thread restore.",
+    );
     const profileKey =
       currentRecord?.profileKey ?? deps.getManualFollowerProfileKey();
     deps.topicTargetStore.upsert({
@@ -612,15 +621,16 @@ export function createTelegramBusFollowerTargetReplacementHandler<TContext>(
     deps.registrationState.setRegistered(true, input.target, {
       slot: currentRecord?.slot,
       threadName: currentRecord?.threadName,
-      generation: deps.registrationState.getGeneration?.(),
+      generation: input.registrationGeneration,
     });
+    await deps.topicTargetStore.persist();
+    assertCurrent(input.target);
     deps.setSyncState(
       Sync.markTelegramSyncSliceFresh(deps.getSyncState(), "target-bindings", {
         nowMs,
         action: "follower-thread-restore",
       }),
     );
-    await deps.topicTargetStore.persist();
     deps.updateStatus(ctx);
     deps.recordRuntimeEvent?.(
       "bus",
@@ -1992,6 +2002,7 @@ export function createTelegramBusForwardedUpdateReceiverRuntime<TContext>(
               target: envelope.target,
               ...(envelope.oldTarget ? { oldTarget: envelope.oldTarget } : {}),
               reason: envelope.reason,
+              registrationGeneration,
             },
             ctx,
           );

package/lib/bus-leader.ts

@@ -135,6 +135,7 @@ export interface TelegramBusFollowerTargetProvisionerDeps {
 export interface TelegramBusFollowerDisconnectHandlerDeps {
   topicTargetStore: Pick<
     Threads.TelegramTopicTargetStore,
+    | "list"
     | "markStaleByTarget"
     | "persist"
     | "upsertPendingCleanup"
@@ -726,6 +727,7 @@ export function createTelegramBusFollowerTargetProvisioner(
               ],
             }),
             {
+              isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.topicTargetStore),
               callApi: deps.callApi,
               markStaleByTarget(target, syncStatus, lastSyncError) {
                 return deps.topicTargetStore.markStaleByTarget(
@@ -805,16 +807,21 @@ function createTelegramBusFollowerCleanupHandler(
       target: { chatId: target.chatId, threadId: target.threadId },
       requestedAtMs: (deps.getNowMs ?? Date.now)(),
     };
+    const departingRecord = deps.topicTargetStore.list().find((record) => record.instanceId === follower.instanceId &&
+      record.target.chatId === target.chatId && record.target.threadId === target.threadId);
+    const isCleanupTargetProtected = Threads.createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
     deps.topicTargetStore.upsertPendingCleanup(intent);
     await deps.topicTargetStore.persist();
+    const cleanupPlan = ThreadReconciler.planThreadReconciliation({
+      nowMs: (deps.getNowMs ?? Date.now)(),
+      currentLeaderEpoch: leaderEpoch,
+      records: [],
+      pendingCleanups: [intent],
+    });
     const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(
-      ThreadReconciler.planThreadReconciliation({
-        nowMs: (deps.getNowMs ?? Date.now)(),
-        currentLeaderEpoch: leaderEpoch,
-        records: [],
-        pendingCleanups: [intent],
-      }),
+      cleanupPlan,
       {
+        isCleanupTargetProtected,
         callApi: deps.callApi,
         markStaleByTarget: deps.topicTargetStore.markStaleByTarget,
         removeCleanupIntentById: deps.topicTargetStore.removePendingCleanup,
@@ -823,6 +830,7 @@ function createTelegramBusFollowerCleanupHandler(
         recordRuntimeEvent: deps.recordRuntimeEvent,
       },
     );
+    if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) return;
     if (cleanup.incompleteActions?.length) {
       throw new Error(
         "Telegram follower thread deletion was not confirmed; reconnect the leader to retry cleanup.",
@@ -916,6 +924,7 @@ export function createTelegramBusLeaderTargetProvisioner<TContext>(
     });
     deps.recordThreadReconciliationPlan?.(pendingCleanupPlan);
     const cleanupPorts = {
+      isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.topicTargetStore),
       callApi: deps.callApi,
       markStaleByTarget: deps.topicTargetStore.markStaleByTarget,
       removeCleanupIntentById: deps.topicTargetStore.removePendingCleanup,

package/lib/bus.ts

@@ -1450,18 +1450,25 @@ export function createTelegramBusFollowerThreadRestoreHandler(
   return async ({ record, target, oldTarget }) => {
     if (!record.instanceId) return false;
     const follower = deps.followerRegistry.get(record.instanceId);
-    if (!follower) return false;
+    if (!follower?.registrationGeneration || !oldTarget ||
+      follower.target?.chatId !== oldTarget.chatId ||
+      follower.target.threadId !== oldTarget.threadId ||
+      target.chatId !== oldTarget.chatId || target.threadId === oldTarget.threadId) return false;
     const replaced = await deps.followerTargetController.replaceTarget({
       follower,
       target,
       oldTarget,
       reason: "thread-restore",
     });
-    if (!replaced) return false;
+    const current = deps.followerRegistry.get(record.instanceId);
+    if (!replaced || !current ||
+      current.registrationGeneration !== follower.registrationGeneration ||
+      current.target?.chatId !== oldTarget.chatId ||
+      current.target.threadId !== oldTarget.threadId) return false;
     deps.followerRegistry.register({
-      ...follower,
+      ...current,
       target,
-      connectedAtMs: follower.connectedAtMs,
+      connectedAtMs: current.connectedAtMs,
     });
     deps.onRestored?.();
     return true;

package/lib/routing.ts

@@ -281,19 +281,17 @@ function formatTelegramAllTabMenuChooserText(command: string): string {
     "",
     `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.`,
     "Select the Pi thread that should handle it:",
+    "To restore into a new thread, send a plain message in that destination thread first.",
   ].join("\n");
 }
 
 function buildTelegramUnboundRerouteChooserMarkup(
   rerouteId: string,
   records: readonly Threads.TelegramTopicTargetRecord[],
-  _options: {
-    currentLeaderProfileKey?: string;
-    currentInstanceId?: string;
-  } = {},
+  options: { canRestore: boolean },
 ): Menu.TelegramReplyMarkup {
   const activeRecords = records.filter((record) => record.status === "active");
-  const canRestoreAnyLiveThread = activeRecords.length > 0;
+  const canRestoreAnyLiveThread = options.canRestore && activeRecords.length > 0;
   const rows = activeRecords.map((record) => [
     {
       text: getTelegramRouteThreadButtonLabel(record),
@@ -433,6 +431,7 @@ async function deleteReservedTelegramTopicThroughReconciler(
   });
   deps.recordThreadReconciliationPlan?.(plan);
   await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+    isCleanupTargetProtected: Threads.createTelegramCleanupTargetProtection(deps.threadStore),
     callApi: deps.callApi,
     markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
       deps.threadStore?.markStaleByTarget(
@@ -734,6 +733,8 @@ export function createTelegramInboundRouteRuntime<
         instanceId?: string;
       };
   type PendingUnboundReroute = {
+    sourceTarget: Queue.TelegramQueueTarget;
+    chooserMessageId?: number;
     messages: TMessage[];
     createdAtMs: number;
     dispatchKind: "prompt" | "command";
@@ -842,12 +843,33 @@ export function createTelegramInboundRouteRuntime<
     nextUnboundRerouteId += 1;
     const id = nextUnboundRerouteId.toString(36);
     pendingUnboundReroutes.set(id, {
+      sourceTarget: {
+        chatId: messages[0]!.chat.id,
+        ...(typeof messages[0]!.message_thread_id === "number"
+          ? { threadId: messages[0]!.message_thread_id }
+          : {}),
+      },
       messages,
       createdAtMs: Date.now(),
       dispatchKind,
     });
     return id;
   };
+  const rememberRerouteChooser = (id: string, messageId: number | undefined): void => {
+    const pending = pendingUnboundReroutes.get(id);
+    if (pending) pending.chooserMessageId = messageId;
+  };
+  const matchesRerouteChooser = (
+    pending: PendingUnboundReroute,
+    query: TCallbackQuery,
+  ): boolean => {
+    const message = query.message;
+    return !!message && pending.chooserMessageId !== undefined &&
+      message.message_id === pending.chooserMessageId &&
+      message.chat.id === pending.sourceTarget.chatId &&
+      (message.message_thread_id === undefined ||
+        message.message_thread_id === pending.sourceTarget.threadId);
+  };
   const pendingUnboundRerouteMediaGroups = new Map<
     string,
     {
@@ -951,6 +973,10 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent?.();
     deps.recordThreadReconciliationPlan?.(plan);
     const result = await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+      isCleanupTargetProtected(target) {
+        assertExecutionCurrent?.();
+        return isRerouteTargetProtected(target);
+      },
       callApi: deps.callApi,
       markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
         deps.threadStore?.markStaleByTarget(
@@ -967,6 +993,14 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent?.();
     return (result.incompleteActions?.length ?? 0) === 0;
   };
+  const isRerouteTargetProtected = (target: Queue.TelegramQueueTarget): boolean => {
+    const matches = (candidate: Queue.TelegramQueueTarget): boolean =>
+      candidate.chatId === target.chatId && candidate.threadId === target.threadId;
+    return (deps.getLiveThreadTargets?.() ?? []).some(matches) ||
+      (deps.threadStore?.list() ?? []).some((record) => matches(record.target)) ||
+      (deps.threadStore?.listReservations() ?? []).some((record) => matches(record.target)) ||
+      (deps.threadStore?.listPendingProvisions() ?? []).some((record) => !!record.target && matches(record.target));
+  };
   const dismissRerouteChooserMessage = async (
     query: TCallbackQuery,
     assertExecutionCurrent?: () => void,
@@ -986,6 +1020,7 @@ export function createTelegramInboundRouteRuntime<
       assertExecutionCurrent?.();
       return true;
     } catch (error) {
+      assertExecutionCurrent?.();
       deps.recordRuntimeEvent?.("telegram", error, {
         phase: "reroute-chooser-delete",
         chatId,
@@ -1103,12 +1138,14 @@ export function createTelegramInboundRouteRuntime<
     pending: PendingUnboundReroute,
     query: TCallbackQuery,
     successMessage: string,
-    assertExecutionCurrent?: () => void,
+    assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query),
   ): Promise<void> => {
+    assertExecutionCurrent();
     const dismissed = await dismissRerouteChooserMessage(
       query,
       assertExecutionCurrent,
     );
+    assertExecutionCurrent();
     if (dismissed) {
       pendingUnboundReroutes.delete(rerouteId);
       await deps.answerCallbackQuery(query.id, successMessage);
@@ -1169,6 +1206,8 @@ export function createTelegramInboundRouteRuntime<
       query.data,
     );
     if (!parsed) return false;
+    const assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query);
+    assertExecutionCurrent();
     const chatId = query.message?.chat?.id;
     const messageId = query.message?.message_id;
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
@@ -1176,12 +1215,18 @@ export function createTelegramInboundRouteRuntime<
       typeof chatId !== "number" ||
       typeof messageId !== "number" ||
       !deps.threadStore ||
-      !pending
+      !pending ||
+      !matchesRerouteChooser(pending, query)
     ) {
       await deps.answerCallbackQuery(query.id, "Message route expired.");
       return true;
     }
+    if (pending.sourceTarget.threadId === undefined) {
+      await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
+      return true;
+    }
     await deps.threadStore.load();
+    assertExecutionCurrent();
     const activeRecords = getTelegramRoutableThreadRecords(
       deps.threadStore.list(),
       deps.getLiveThreadTargets?.(),
@@ -1199,19 +1244,17 @@ export function createTelegramInboundRouteRuntime<
         replyMarkup,
       );
     } else if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         chatId,
         formatTelegramUnboundRerouteRestoreChooserText(),
         "html",
         replyMarkup,
-        typeof query.message?.message_thread_id === "number"
-          ? {
-              target: { chatId, threadId: query.message.message_thread_id },
-              replyToMessageId: messageId,
-            }
-          : undefined,
+        { target: pending.sourceTarget, replyToMessageId: messageId },
       );
+      assertExecutionCurrent();
+      rememberRerouteChooser(parsed.rerouteId, chooserId);
     }
+    assertExecutionCurrent();
     await deps.answerCallbackQuery(query.id, "Choose instance to restore.");
     return true;
   };
@@ -1226,7 +1269,8 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent();
     const chatId = query.message?.chat?.id;
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
-    if (typeof chatId !== "number" || !deps.threadStore || !pending) {
+    if (typeof chatId !== "number" || !deps.threadStore || !pending ||
+      !matchesRerouteChooser(pending, query)) {
       await deps.answerCallbackQuery(query.id, "Message route expired.");
       return true;
     }
@@ -1300,10 +1344,23 @@ export function createTelegramInboundRouteRuntime<
       parsed.threadId,
     );
     const sourceTarget =
-      typeof query.message?.message_thread_id === "number"
-        ? { chatId, threadId: query.message.message_thread_id }
+      typeof pending.sourceTarget.threadId === "number"
+        ? { chatId, threadId: pending.sourceTarget.threadId }
         : undefined;
-    const sourceMessageId = query.message?.message_id;
+    const sourceMessageId = pending.chooserMessageId;
+    if (parsed.useNewSlot && !sourceTarget) {
+      await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
+      return true;
+    }
+    if (parsed.useNewSlot && sourceTarget && record.target.chatId === sourceTarget.chatId &&
+      record.target.threadId === sourceTarget.threadId) {
+      await deps.answerCallbackQuery(query.id, "🚫 Selected thread is already the destination.");
+      return true;
+    }
+    if (parsed.useNewSlot && sourceTarget && isRerouteTargetProtected(sourceTarget)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Thread restore source is already owned.");
+      return true;
+    }
     const currentInstanceId = deps.getCurrentInstanceId?.();
     const leaderProfileKey = getLeaderTopicProfileKey(ctx, currentInstanceId);
     const isCurrentLeaderRecord = isCurrentLeaderTopicRecord(
@@ -1507,6 +1564,7 @@ export function createTelegramInboundRouteRuntime<
         rerouteConfirmedAtMs: nowMs,
       });
       await deps.threadStore.persist();
+      assertExecutionCurrent();
       deps.setCurrentLeaderIdentity?.({
         target: sourceTarget,
         slot,
@@ -1944,7 +2002,7 @@ export function createTelegramInboundRouteRuntime<
   };
   const sendUnboundRerouteChooserNow = async (
     messages: TMessage[],
-    ctx: TContext,
+    _ctx: TContext,
     reportDeferred = true,
   ): Promise<void> => {
     const message = messages[0];
@@ -1988,20 +2046,13 @@ export function createTelegramInboundRouteRuntime<
     const text = formatTelegramUnboundRerouteChooserText(activeRecords, {
       includeGuidance,
     });
-    const currentInstanceId = deps.getCurrentInstanceId?.();
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
-      {
-        currentLeaderProfileKey: getLeaderTopicProfileKey(
-          ctx,
-          currentInstanceId,
-        ),
-        currentInstanceId,
-      },
+      { canRestore: sourceTarget !== undefined },
     );
     if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         message.chat.id,
         text,
         "html",
@@ -2010,12 +2061,14 @@ export function createTelegramInboundRouteRuntime<
           ? { target: sourceTarget, replyToMessageId: message.message_id }
           : { replyToMessageId: message.message_id },
       );
+      rememberRerouteChooser(rerouteId, chooserId);
       return;
     }
-    await deps.sendTextReply(message.chat.id, message.message_id, text, {
+    const chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
       parseMode: "HTML",
       target: sourceTarget,
     });
+    rememberRerouteChooser(rerouteId, chooserId);
   };
   const sendUnboundRerouteChooser = async (
     message: TMessage,
@@ -2080,9 +2133,10 @@ export function createTelegramInboundRouteRuntime<
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
+      { canRestore: typeof message.message_thread_id === "number" },
     );
     if (deps.sendInteractiveMessage) {
-      await deps.sendInteractiveMessage(
+      const chooserId = await deps.sendInteractiveMessage(
         message.chat.id,
         text,
         "html",
@@ -2096,10 +2150,11 @@ export function createTelegramInboundRouteRuntime<
             }
           : undefined,
       );
+      rememberRerouteChooser(rerouteId, chooserId);
       return true;
     }
     if (deps.callApi) {
-      await deps.callApi("sendMessage", {
+      const chooser = await deps.callApi<{ message_id?: number }>("sendMessage", {
         chat_id: message.chat.id,
         text,
         parse_mode: "HTML",
@@ -2116,12 +2171,14 @@ export function createTelegramInboundRouteRuntime<
             }
           : {}),
       });
+      rememberRerouteChooser(rerouteId, chooser?.message_id);
       return true;
     }
-    await deps.sendTextReply(message.chat.id, message.message_id, text, {
+    const chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
       parseMode: "HTML",
       target: options.target,
     });
+    rememberRerouteChooser(rerouteId, chooserId);
     return true;
   };
   const commandOrPrompt = Commands.createTelegramCommandOrPromptRuntime<

package/lib/sync.ts

@@ -4,10 +4,11 @@
  * Owns pure contracts for deciding when local Telegram mirror state should be refreshed without querying Telegram on every action
  */
 
-import { getTelegramApiErrorRequestTarget } from "./telegram-api.ts";
+import { getTelegramApiErrorRequestTarget, isTelegramStaleTargetHttpError } from "./telegram-api.ts";
 import { getTelegramTargetKey, type TelegramTarget } from "./target.ts";
 import * as ThreadReconciler from "./thread-reconciler.ts";
 import {
+  createTelegramCleanupTargetProtection,
   getTelegramTargetFromApiBody,
   isTelegramTopicTargetStaleError,
   provisionOwnBusTopic,
@@ -121,6 +122,7 @@ export interface TelegramManualThreadDisconnectDeps<TSyncState> {
     | undefined;
   topicTargetStore: Pick<
     TelegramTopicTargetStore,
+    | "list"
     | "markStaleByTarget"
     | "persist"
     | "upsertPendingCleanup"
@@ -247,16 +249,21 @@ export function createTelegramManualThreadDisconnectHandler<
           target,
           requestedAtMs: (deps.getNowMs ?? Date.now)(),
         };
+        const departingRecord = deps.topicTargetStore.list().find((record) => record.instanceId === currentRecord.instanceId &&
+          record.target.chatId === target.chatId && record.target.threadId === target.threadId);
+        const isCleanupTargetProtected = createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
         deps.topicTargetStore.upsertPendingCleanup(intent);
         await deps.topicTargetStore.persist();
+        const cleanupPlan = ThreadReconciler.planThreadReconciliation({
+          nowMs: (deps.getNowMs ?? Date.now)(),
+          currentLeaderEpoch: leaderEpoch,
+          records: [],
+          pendingCleanups: [intent],
+        });
         const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(
-          ThreadReconciler.planThreadReconciliation({
-            nowMs: (deps.getNowMs ?? Date.now)(),
-            currentLeaderEpoch: leaderEpoch,
-            records: [],
-            pendingCleanups: [intent],
-          }),
+          cleanupPlan,
           {
+            isCleanupTargetProtected,
             callApi(method, body) {
               return deps.callApi(method, body);
             },
@@ -277,6 +284,9 @@ export function createTelegramManualThreadDisconnectHandler<
             recordRuntimeEvent: deps.recordRuntimeEvent,
           },
         );
+        if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) {
+          return "Thread disconnect superseded by a new binding.";
+        }
         cleanupPending = Boolean(cleanup.incompleteActions?.length);
       }
       const leaderTarget = deps.getLeaderTarget();
@@ -404,7 +414,7 @@ export interface TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> {
   topicTargetStore: Pick<
     TelegramTopicTargetStore,
     "load" | "markStaleByTarget" | "persist"
-  >;
+  > & Partial<Pick<TelegramTopicTargetStore, "invalidateTarget">>;
   getSyncState: () => TSyncState;
   setSyncState: (state: TSyncState) => void;
   recordEvent: (
@@ -413,6 +423,46 @@ export interface TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> {
     details?: Record<string, unknown>,
   ) => void;
   getNowMs?: () => number;
+  isCurrent?: () => boolean;
+  isAuthorityCurrent?: () => boolean;
+}
+
+export function captureTelegramStaleTargetRequestRecovery<TSyncState extends TelegramSyncState>(
+  body: Record<string, unknown>,
+  deps: TelegramStaleTopicApiErrorRecoveryDeps<TSyncState> & {
+    topicTargetStore: Pick<TelegramTopicTargetStore, "load" | "list" | "markStaleByTarget" | "persist" | "invalidateTarget">;
+    getCurrentLeaderEpoch: () => number | string | undefined;
+    getSessionGeneration: () => number;
+    getProfileName: () => string | undefined;
+    onRecovered: () => void;
+  },
+): ((error: unknown) => Promise<void>) | undefined {
+  const target = getTelegramTargetFromApiBody(body);
+  const epoch = deps.getCurrentLeaderEpoch();
+  if (!target || epoch === undefined) return undefined;
+  const key = getTelegramTargetKey(target);
+  const record = deps.topicTargetStore.list().find((candidate) => getTelegramTargetKey(candidate.target) === key);
+  if (!record) return undefined;
+  const generation = deps.getSessionGeneration();
+  const profile = deps.getProfileName();
+  const isAuthorityCurrent = (): boolean => deps.getCurrentLeaderEpoch() === epoch &&
+    deps.getSessionGeneration() === generation && deps.getProfileName() === profile;
+  const isCurrent = (): boolean => {
+    const current = deps.topicTargetStore.list().find((candidate) => getTelegramTargetKey(candidate.target) === key);
+    return isAuthorityCurrent() &&
+      current?.instanceId === record.instanceId && current?.profileKey === record.profileKey &&
+      current?.updatedAtMs === record.updatedAtMs && current?.createdAtMs === record.createdAtMs;
+  };
+  return async (error) => {
+    const requestTarget = getTelegramApiErrorRequestTarget(error);
+    if (!isTelegramStaleTargetHttpError(error) || !requestTarget ||
+      getTelegramTargetKey(requestTarget) !== key || !isCurrent()) return;
+    if (await recoverStaleTelegramTopicApiError(
+      { chat_id: target.chatId, message_thread_id: target.threadId }, error, { ...deps, isCurrent, isAuthorityCurrent },
+    )) {
+      deps.onRecovered();
+    }
+  };
 }
 
 export function createTelegramStaleTopicApiErrorRecoveryRuntime<
@@ -448,12 +498,16 @@ export async function recoverStaleTelegramTopicApiError<
   deps: TelegramStaleTopicApiErrorRecoveryDeps<TSyncState>,
 ): Promise<boolean> {
   const target = getTelegramTargetFromApiBody(apiBody);
-  if (!target || !isTelegramTopicTargetStaleError(error)) return false;
-  await deps.topicTargetStore.load();
-  if (
-    !deps.topicTargetStore.markStaleByTarget(target, "deleted", String(error))
-  ) {
-    return false;
+  if (!target || !isTelegramTopicTargetStaleError(error) || deps.isCurrent?.() === false) return false;
+  if (deps.isCurrent) {
+    if (!deps.topicTargetStore.invalidateTarget || !await deps.topicTargetStore.invalidateTarget(
+      target, deps.isCurrent, String(error),
+    )) return false;
+    if (deps.isAuthorityCurrent?.() === false) return false;
+  } else {
+    await deps.topicTargetStore.load();
+    if (!deps.topicTargetStore.markStaleByTarget(target, "deleted", String(error))) return false;
+    await deps.topicTargetStore.persist();
   }
   const nowMs = (deps.getNowMs ?? Date.now)();
   let state = markTelegramSyncSliceSuspect(deps.getSyncState(), "topic-state", {
@@ -466,8 +520,12 @@ export async function recoverStaleTelegramTopicApiError<
     reason: "stale-api-error",
     action: "topic-target-stale",
   }) as TSyncState;
+  state = markTelegramSyncSliceSuspect(state, "target-bindings", {
+    nowMs,
+    reason: "stale-api-error",
+    action: "topic-target-stale",
+  }) as TSyncState;
   deps.setSyncState(state);
-  await deps.topicTargetStore.persist();
   deps.recordEvent("bus", error, {
     phase: "topic-target-stale",
     chatId: target.chatId,
@@ -606,6 +664,7 @@ export async function ensureTelegramLeaderThreadBinding(
   });
   deps.recordThreadReconciliationPlan?.(replacementPlan);
   await ThreadReconciler.applyThreadReconciliationPlan(replacementPlan, {
+    isCleanupTargetProtected: createTelegramCleanupTargetProtection(deps.topicTargetStore),
     callApi: deps.callApi,
     markStaleByTarget: (target, syncStatus, lastSyncError) =>
       deps.topicTargetStore.markStaleByTarget(

package/lib/telegram-api.ts

@@ -466,6 +466,8 @@ export interface TelegramApiClient {
 }
 
 export interface TelegramBridgeApiRuntimeDeps {
+  captureRequestErrorHandler?: (body: Record<string, unknown>) =>
+    ((error: unknown) => Promise<void>) | undefined;
   client: TelegramApiClient;
   tempDir: string;
   maxFileSizeBytes: number;
@@ -634,6 +636,11 @@ export function getTelegramApiErrorRequestTarget(
   return target ? { ...target } : undefined;
 }
 
+export function isTelegramStaleTargetHttpError(error: unknown): boolean {
+  if (!(error instanceof TelegramApiHttpError) || error.status !== 400) return false;
+  return /^Telegram API \w+ failed: HTTP 400: Bad Request: (message thread not found|thread not found|topic not found|topic deleted|topic closed|thread closed|forum topic closed|message thread closed|topic_id_invalid|topic_closed)$/i.test(error.message);
+}
+
 export function isTelegramMessageNotModifiedError(error: unknown): boolean {
   return (
     error instanceof Error && error.message.includes("message is not modified")
@@ -1438,6 +1445,7 @@ export function createTelegramAssistantDraftSender(deps: {
 export function createDefaultTelegramBridgeApiRuntime(deps: {
   getBotToken: () => string | undefined;
   recordRuntimeEvent: TelegramBridgeApiRuntimeDeps["recordRuntimeEvent"];
+  captureRequestErrorHandler?: TelegramBridgeApiRuntimeDeps["captureRequestErrorHandler"];
 }): TelegramBridgeApiRuntime {
   return createTelegramBridgeApiRuntime({
     client: createTelegramApiClient(deps.getBotToken, {
@@ -1447,12 +1455,23 @@ export function createDefaultTelegramBridgeApiRuntime(deps: {
     maxFileSizeBytes: TELEGRAM_INBOUND_FILE_MAX_BYTES,
     tempFileMaxAgeMs: TELEGRAM_TEMP_FILE_MAX_AGE_MS,
     recordRuntimeEvent: deps.recordRuntimeEvent,
+    captureRequestErrorHandler: deps.captureRequestErrorHandler,
   });
 }
 
 export function createTelegramBridgeApiRuntime(
   deps: TelegramBridgeApiRuntimeDeps,
 ): TelegramBridgeApiRuntime {
+  const recoverRequestError = async (
+    handler: ((error: unknown) => Promise<void>) | undefined,
+    error: unknown,
+  ): Promise<void> => {
+    try {
+      await handler?.(error);
+    } catch (recoveryError) {
+      deps.recordRuntimeEvent("api", recoveryError, { phase: "stale-target-recovery" });
+    }
+  };
   const now = deps.now ?? Date.now;
   const chatActionMinIntervalMs = Math.max(
     0,
@@ -1488,6 +1507,7 @@ export function createTelegramBridgeApiRuntime(
     body: Record<string, unknown>,
     options?: TelegramApiCallOptions,
   ): Promise<TResponse> => {
+    const recoverError = deps.captureRequestErrorHandler?.(body);
     const chatActionKey = getChatActionKey(method, body);
     if (chatActionKey) {
       const nowMs = now();
@@ -1516,7 +1536,8 @@ export function createTelegramBridgeApiRuntime(
           gate.notBeforeMs = now() + chatActionMinIntervalMs;
           return result;
         })
-        .catch((error: unknown) => {
+        .catch(async (error: unknown) => {
+          await recoverRequestError(recoverError, error);
           if (error instanceof TelegramApiHttpError && error.status === 429) {
             const retryAfterMs = Math.max(
               chatActionMinIntervalMs,
@@ -1550,6 +1571,12 @@ export function createTelegramBridgeApiRuntime(
     try {
       return await deps.client.call<TResponse>(method, body, options);
     } catch (error) {
+      await recoverRequestError(recoverError, error);
+      if (method === "deleteMessage" && error instanceof TelegramApiHttpError &&
+        error.status === 400 && error.message ===
+          "Telegram API deleteMessage failed: HTTP 400: Bad Request: message to delete not found") {
+        return true as TResponse;
+      }
       deps.recordRuntimeEvent(
         "api",
         error,
@@ -1574,6 +1601,7 @@ export function createTelegramBridgeApiRuntime(
       fileName,
       options,
     ) => {
+      const recoverError = deps.captureRequestErrorHandler?.(fields);
       try {
         return await deps.client.callMultipart(
           method,
@@ -1584,6 +1612,7 @@ export function createTelegramBridgeApiRuntime(
           options,
         );
       } catch (error) {
+        await recoverRequestError(recoverError, error);
         deps.recordRuntimeEvent(
           "multipart",
           error,
@@ -1676,11 +1705,13 @@ export function createTelegramBridgeApiRuntime(
     sendRichMessageDraft: (body) =>
       callRecorded<boolean>("sendRichMessageDraft", body),
     editMessageText: async (body) => {
+      const recoverError = deps.captureRequestErrorHandler?.(body);
       try {
         await deps.client.call("editMessageText", body);
         return "edited";
       } catch (error) {
         if (isTelegramMessageNotModifiedError(error)) return "unchanged";
+        await recoverRequestError(recoverError, error);
         deps.recordRuntimeEvent(
           "api",
           error,

package/lib/thread-reconciler.ts

@@ -202,6 +202,7 @@ export interface ThreadReconciliationApplyResult {
 }
 
 export interface ThreadReconciliationApplyPorts {
+  isCleanupTargetProtected?: (target: ThreadTarget, action: ThreadReconciliationAction) => boolean;
   callApi?: <TResponse>(
     method: string,
     body: Record<string, unknown>,
@@ -576,6 +577,7 @@ export async function applyThreadReconciliationPlan(
         incompleteActions.push(action);
         continue;
       }
+      if (ports.isCleanupTargetProtected?.(action.target, action)) continue;
       let closeConfirmed = false;
       try {
         await ports.callApi("closeForumTopic", {
@@ -598,6 +600,7 @@ export async function applyThreadReconciliationPlan(
         incompleteActions.push(action);
         continue;
       }
+      if (ports.isCleanupTargetProtected?.(action.target, action)) continue;
       const changed =
         ports.markStaleByTarget?.(action.target, "closed") ?? false;
       if (changed) persistFences.push(action);
@@ -632,7 +635,12 @@ export async function applyThreadReconciliationPlan(
         continue;
       }
       let deleteConfirmed = false;
+      let superseded = false;
       for (const method of ["closeForumTopic", "deleteForumTopic"]) {
+        if (ports.isCleanupTargetProtected?.(action.target, action)) {
+          superseded = true;
+          break;
+        }
         if (shouldSkipForStaleLeaderEpoch(action, ports)) break;
         try {
           await ports.callApi(method, {
@@ -660,6 +668,15 @@ export async function applyThreadReconciliationPlan(
         incompleteActions.push(action);
         continue;
       }
+      if (superseded || ports.isCleanupTargetProtected?.(action.target, action)) {
+        ports.recordRuntimeEvent?.("telegram", "Cancelled cleanup of a protected Telegram target", {
+          phase: "thread-reconciler-cleanup-target-reused",
+          action: action.kind,
+          chatId: action.target.chatId,
+          threadId: action.target.threadId,
+        });
+        continue;
+      }
       if (!deleteConfirmed) {
         ports.recordRuntimeEvent?.(
           "telegram",

package/lib/threads.ts

@@ -21,6 +21,7 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { dirname } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 import {
   isTelegramApiCommitUnknownError,
@@ -229,6 +230,11 @@ export interface TelegramTopicTargetStore {
   /** Discard process-local projections and reload owner-published state. */
   refresh?: () => Promise<void>;
   persist: () => Promise<void>;
+  invalidateTarget: (
+    target: TelegramTarget,
+    isCurrent: () => boolean,
+    lastSyncError: string,
+  ) => Promise<boolean>;
   list: () => TelegramTopicTargetRecord[];
   getFollowerRecoveryHintByTarget?: (
     target: TelegramTarget,
@@ -316,6 +322,53 @@ export function reconcileTelegramFreshAllocationCursor(
   return true;
 }
 
+export function createTelegramCleanupTargetProtection(
+  store: Pick<TelegramTopicTargetStore, "list"> & Partial<Pick<TelegramTopicTargetStore, "listReservations" | "listPendingProvisions" | "listPendingCleanups">>,
+  departingRecord?: TelegramTopicTargetRecord,
+): NonNullable<ThreadReconciler.ThreadReconciliationApplyPorts["isCleanupTargetProtected"]> {
+  const records = store.list();
+  const reservations = store.listReservations?.() ?? [];
+  const provisions = store.listPendingProvisions?.() ?? [];
+  const intents = store.listPendingCleanups?.() ?? [];
+  // Persistence may reconstruct keys in another order and omit undefined
+  // optional fields; neither changes the authority represented by a snapshot.
+  const sameSnapshot = (left: unknown, right: unknown): boolean =>
+    isDeepStrictEqual(JSON.parse(JSON.stringify(left)), JSON.parse(JSON.stringify(right)));
+  return (target, action) => {
+    for (const record of store.list()) {
+      if (!targetMatches(record.target, target)) continue;
+      // A persisted shutdown intent may retire only its original pre-intent
+      // binding. Registration/rebinding after that intent supersedes it.
+      const intent = action.kind === "close-delete-graceful-shutdown-topic"
+        ? intents.find((candidate) => candidate.id === action.cleanupIntentId && candidate.runtimeGeneration === action.runtimeGeneration)
+        : undefined;
+      const expectedDeparting = departingRecord ?? (intent && records.find((candidate) =>
+        candidate.instanceId === intent.instanceId && targetMatches(candidate.target, intent.target) &&
+        candidate.updatedAtMs <= intent.requestedAtMs));
+      if (expectedDeparting && "instanceId" in action &&
+        (action.kind === "close-delete-previous-leader-topic" || action.instanceId === expectedDeparting.instanceId) &&
+        sameSnapshot(record, expectedDeparting)) {
+        if (action.kind === "close-delete-previous-leader-topic" || action.kind === "close-stale-replaced-topic") continue;
+        if (action.kind === "close-delete-graceful-shutdown-topic" &&
+          store.listPendingCleanups?.().some((intent) => intent.id === action.cleanupIntentId &&
+            intent.instanceId === action.instanceId && intent.runtimeGeneration === action.runtimeGeneration &&
+            targetMatches(intent.target, target))) continue;
+      }
+      if (record.status === "active" || record.status === "starting" || record.status === "pending" || record.status === "probe-required") return true;
+    }
+    for (const reservation of store.listReservations?.() ?? []) {
+      if (!targetMatches(reservation.target, target)) continue;
+      if (action.kind !== "close-delete-reserved-topic" || !reservations.some((initial) => sameSnapshot(initial, reservation))) return true;
+    }
+    for (const provision of store.listPendingProvisions?.() ?? []) {
+      if (!provision.target || !targetMatches(provision.target, target)) continue;
+      if (action.kind !== "close-delete-expired-pending-provision-topic" || provision.id !== action.pendingProvisionId ||
+        !provisions.some((initial) => sameSnapshot(initial, provision))) return true;
+    }
+    return false;
+  };
+}
+
 export interface TelegramTopicTargetStoreOptions {
   path: string | (() => string);
   getNowMs?: () => number;
@@ -1230,7 +1283,11 @@ export function createTelegramTopicTargetStore(
       loaded = true;
       return;
     }
+    const revision = mutationRevision;
     const content = await readFile(path, "utf8");
+    // A read begun before a local mutation must not replace the newly admitted
+    // binding/cleanup state with its older disk snapshot.
+    if (mutationRevision !== revision || getPath() !== path) return;
     const rawFile: unknown = JSON.parse(content);
     const file = parseTopicTargetFile(rawFile);
     followerRecoveryHints = parseFollowerRecoveryHints(rawFile);
@@ -1293,25 +1350,20 @@ export function createTelegramTopicTargetStore(
     mutationRevision += 1;
   };
 
-  return {
-    async load() {
-      if (dirty) return;
-      await loadFromDisk();
-    },
-    refresh() {
-      const refresh = persistQueue.then(loadFromDisk);
-      persistQueue = refresh.catch(() => undefined);
-      return refresh;
-    },
-    persist() {
+  const persistSnapshot = (invalidation?: {
+    target: TelegramTarget;
+    isCurrent: () => boolean;
+    lastSyncError: string;
+  }): Promise<boolean> => {
       const persist = persistQueue.then(async () => {
         const path = getPath();
         if (loadedPath !== path && !dirty) resetForPath(path);
         if (options.canPersist && !options.canPersist()) {
-          await loadFromDisk();
-          return;
+          if (!invalidation) await loadFromDisk();
+          return false;
         }
         if (!dirty || !loaded) await loadFromDisk();
+        if (invalidation && !invalidation.isCurrent()) return false;
         await mkdir(dirname(path), { recursive: true });
         const tempPath = `${path}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
         const nowMs = getNowMs();
@@ -1359,6 +1411,21 @@ export function createTelegramTopicTargetStore(
             return serialized;
           }),
         };
+        if (invalidation) {
+          const record = file.threads.find((record) => targetMatches(record.target, invalidation.target));
+          if (!record) return false;
+          file.threads = file.threads.filter((candidate) => candidate !== record);
+          file.syncObservations = file.syncObservations.filter((observation) => !targetMatches(observation.target, record.target));
+          file.syncObservations.push({
+            target: { ...record.target },
+            syncStatus: "deleted",
+            observedAtMs: nowMs,
+            ...(record.instanceId ? { instanceId: record.instanceId } : {}),
+            ...(record.slot ? { slot: record.slot } : {}),
+            lastSyncError: invalidation.lastSyncError,
+            lastReconcileAction: "mark-stale",
+          });
+        }
         let persistedSemanticSnapshot: string | undefined;
         try {
           persistedSemanticSnapshot = serializeTelegramStateSemanticSnapshot(
@@ -1375,7 +1442,7 @@ export function createTelegramTopicTargetStore(
         ) {
           loaded = true;
           dirty = false;
-          return;
+          return true;
         }
         await writeFile(tempPath, `${JSON.stringify(file, null, 2)}\n`, {
           encoding: "utf8",
@@ -1383,6 +1450,25 @@ export function createTelegramTopicTargetStore(
         });
         await chmod(tempPath, 0o600);
         try {
+          if (invalidation) {
+            let applied = false;
+            const commit = () => {
+              if (getPath() !== path || mutationRevision !== persistedRevision ||
+                statusRevision !== persistedStatusRevision || !invalidation.isCurrent()) return;
+              // Fence and rename share one synchronous commit boundary. No stale
+              // invalidation enters the live projection before durable commit.
+              renameSync(tempPath, path);
+              records = new Map(Array.from(records).filter(([, record]) => !targetMatches(record.target, invalidation.target)));
+              syncObservations = file.syncObservations;
+              mutationRevision += 1;
+              dirty = false;
+              applied = true;
+            };
+            if (options.commitPersist) options.commitPersist(commit);
+            else if (!options.canPersist || options.canPersist()) commit();
+            if (!applied) await unlink(tempPath).catch(() => undefined);
+            return applied;
+          }
           if (options.commitPersist) {
             const committed = options.commitPersist(() => {
               renameSync(tempPath, path);
@@ -1404,9 +1490,27 @@ export function createTelegramTopicTargetStore(
         }
         loaded = true;
         if (mutationRevision === persistedRevision) dirty = false;
+        return true;
       });
-      persistQueue = persist.catch(() => undefined);
+      persistQueue = persist.then(() => undefined, () => undefined);
       return persist;
+  };
+
+  return {
+    async load() {
+      if (dirty) return;
+      await loadFromDisk();
+    },
+    refresh() {
+      const refresh = persistQueue.then(loadFromDisk);
+      persistQueue = refresh.catch(() => undefined);
+      return refresh;
+    },
+    async persist() {
+      await persistSnapshot();
+    },
+    invalidateTarget(target, isCurrent, lastSyncError) {
+      return persistSnapshot({ target, isCurrent, lastSyncError });
     },
     list() {
       return Array.from(records.values()).map(cloneRecord);
@@ -2100,6 +2204,7 @@ export async function provisionOwnBusTopic(
   if (typeof chatId !== "number") return undefined;
   await deps.store.load();
   const reservationCleanupPorts = {
+    isCleanupTargetProtected: createTelegramCleanupTargetProtection(deps.store),
     callApi: deps.callApi,
     markStaleByTarget: (
       target: TelegramTarget & { threadId: number },
@@ -2253,9 +2358,11 @@ export async function provisionOwnBusTopic(
       continue;
     }
     const previousLeaderCleanupStartedAtMs = Date.now();
+    const isCleanupTargetProtected = createTelegramCleanupTargetProtection(deps.store, record);
     const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(
       { actions: [action] },
       {
+        isCleanupTargetProtected,
         callApi: deps.callApi,
         markStaleByTarget: (target, syncStatus, lastSyncError) =>
           deps.store.markStaleByTarget(target, syncStatus, lastSyncError),
@@ -2304,6 +2411,7 @@ export async function provisionOwnBusTopic(
         "Previous Telegram leader topic deletion was not confirmed.",
       );
     }
+    if (isCleanupTargetProtected(action.target, action)) continue;
     deps.store.markStaleByTarget(record.target);
     deps.store.reserveThread({
       target: record.target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.42.3",
+  "version": "0.42.4",
   "private": false,
   "publishConfig": {
     "access": "public"