@llblab/pi-telegram 0.51.6 → 0.52.1

package/lib/routing.ts

@@ -4,12 +4,15 @@
  * Wires authorized updates into menus, commands, media grouping, and prompt queueing, and owns exact assistant-output target/route authority capture
  */
 
+import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename, dirname } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import * as Bus from "./bus.ts";
 import * as Commands from "./commands.ts";
 import type { TelegramConfigStore } from "./config.ts";
 import type { TelegramInboundHandlerRuntime } from "./inbound.ts";
+import type { TelegramUpdateJournalQueuedCompletion, TelegramUpdateJournalQueuedReceiptEvidence } from "./journal.ts";
 import * as Media from "./media.ts";
 import * as Menu from "./menu.ts";
 import * as Model from "./model.ts";
@@ -19,7 +22,7 @@ import * as Queue from "./queue.ts";
 import * as Replies from "./replies.ts";
 import type { TelegramBridgeRuntime } from "./runtime.ts";
 import type { TelegramSectionRegistry } from "./sections.ts";
-import type { TelegramInputRichMessage } from "./telegram-api.ts";
+import type { TelegramApiCallOptions, TelegramInputRichMessage } from "./telegram-api.ts";
 import * as TextGroups from "./text-groups.ts";
 import * as ThreadNaming from "./thread-naming.ts";
 import * as ThreadReconciler from "./thread-reconciler.ts";
@@ -28,6 +31,8 @@ import type {
   TelegramTopicTargetRecord,
 } from "./threads.ts";
 import * as Turns from "./turns.ts";
+import * as WorkspaceIdentity from "./workspace-identity.ts";
+import type { createTelegramWorkspaceExternalProtectionCapture } from "./workspace-retirement.ts";
 
 interface TelegramPromptPeerView {
   id?: unknown;
@@ -106,6 +111,19 @@ export function resolveTelegramGuestPromptPeer(input: {
   return undefined;
 }
 
+/** Stable file scope of the remote Guest Mode peer: username, else numeric id; never the bot's own scope. */
+export function resolveTelegramGuestFileScope(input: Parameters<typeof resolveTelegramGuestPromptPeer>[0]): string {
+  const candidates = input.chatType !== "private" ? [input.chat]
+    : [input.from, input.chat, input.guestBotCallerUser, input.guestBotCallerChat, input.replyFrom];
+  for (const candidate of candidates) {
+    if (!candidate || (input.chatType === "private" &&
+        (isTelegramPromptOwnerPeer(candidate, input.ownerUserId) || isTelegramPromptBotPeer(candidate)))) continue;
+    if (typeof candidate.username === "string" && candidate.username.length > 0) return candidate.username;
+    if (typeof candidate.id === "number" && Number.isSafeInteger(candidate.id)) return String(Math.abs(candidate.id));
+  }
+  return "guest";
+}
+
 function appendTelegramSourceAttachmentSection(
   text: string,
   from: string | undefined,
@@ -177,7 +195,12 @@ function escapeHtml(text: string): string {
 
 const TELEGRAM_UNBOUND_REROUTE_CALLBACK_PREFIX = "reroute:";
 const TELEGRAM_UNBOUND_REROUTE_RESTORE_MENU_CALLBACK_PREFIX = "rerouterestore:";
+const TELEGRAM_UNBOUND_REROUTE_MENU_CALLBACK_PREFIX = "reroutemenu:";
+const TELEGRAM_UNBOUND_REROUTE_ROOT_CALLBACK_PREFIX = "rerouteroot:";
 const TELEGRAM_UNBOUND_REROUTE_NEW_SLOT_CALLBACK_PREFIX = "reroutenew:";
+const TELEGRAM_UNBOUND_REROUTE_CANCEL_CALLBACK_PREFIX = "reroutecancel:";
+const TELEGRAM_PENDING_CANCELLATION_REVIEW_PREFIX = "reroutecancel:review:";
+const TELEGRAM_RETIRED_HISTORICAL_REVIEW_PREFIX = "reroutecancel:history:";
 const TELEGRAM_SLOT_CAPACITY_MESSAGE =
   "No Telegram instance slot is available. Automatic reclamation is disabled for safety.";
 
@@ -203,10 +226,10 @@ function formatTelegramUnboundRerouteNewSlotCallbackData(
 
 function parseTelegramUnboundRerouteRestoreMenuCallbackData(
   data: string | undefined,
-): { rerouteId: string } | undefined {
-  const match = data?.match(/^rerouterestore:([a-z0-9]+)$/);
-  const rerouteId = match?.[1];
-  return rerouteId ? { rerouteId } : undefined;
+): { rerouteId: string; restore: boolean; root: boolean } | undefined {
+  const match = data?.match(/^(rerouterestore|reroutemenu|rerouteroot):([a-z0-9]+)$/);
+  const rerouteId = match?.[2];
+  return rerouteId ? { rerouteId, restore: match?.[1] === "rerouterestore", root: match?.[1] === "rerouteroot" } : undefined;
 }
 
 function parseTelegramUnboundRerouteCallbackData(
@@ -228,22 +251,14 @@ function getTelegramThreadRecordLabel(
   return getDisplayTitle?.(record.target) ?? getRestoredThreadName(record, record.slot ?? "");
 }
 
-function getNextTelegramSlotPreference(
-  slot: string | undefined,
-): string | undefined {
-  if (!slot || !/^[A-Z]$/.test(slot)) return undefined;
-  const index = slot.charCodeAt(0) - "A".charCodeAt(0);
-  return String.fromCharCode("A".charCodeAt(0) + ((index + 1) % 26));
-}
-
 function getRestoredThreadName(
   record: Threads.TelegramTopicTargetRecord,
   slot: string,
 ): string {
   return record.threadName &&
-    Threads.isTelegramTopicThreadNameValidForSlot(record.threadName, slot)
+    ThreadNaming.isTelegramTopicThreadNameValidForSlot(record.threadName, slot)
     ? record.threadName
-    : (Threads.chooseTelegramThreadName({ slot }) ?? "Pi");
+    : (ThreadNaming.chooseTelegramThreadName({ slot }) ?? "Pi");
 }
 
 function isTelegramLiveThreadTarget(
@@ -269,6 +284,16 @@ function getTelegramRoutableThreadRecords(
   );
 }
 
+function formatTelegramTemporaryThreadChooserText(command?: string): string {
+  return [
+    "<b>🧵 Choose target thread:</b>",
+    "",
+    command ? `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.` : "Choose where to send your message.",
+    "Unaccepted routing expires after 60 minutes; disposable tabs are removed when clear. Accepted work and restored Threads are kept.",
+    "Select the Pi thread that should handle it, or restore a Pi into this tab:",
+  ].join("\n");
+}
+
 function formatTelegramAllTabMenuChooserText(command: string): string {
   return [
     "<b>🧵 Choose target thread:</b>",
@@ -284,34 +309,23 @@ function buildTelegramUnboundRerouteChooserMarkup(
   records: readonly Threads.TelegramTopicTargetRecord[],
   options: {
     canRestore: boolean;
+    canCancel?: boolean;
     getDisplayTitle?: Threads.TelegramCurrentThreadAssembly["getDisplayTitle"];
   },
 ): Menu.TelegramReplyMarkup {
   const activeRecords = records.filter((record) => record.status === "active");
   const canRestoreAnyLiveThread = options.canRestore && activeRecords.length > 0;
-  const rows = activeRecords.map((record) => [
-    {
-      text: `↪️ ${getTelegramThreadRecordLabel(record, options.getDisplayTitle)}`,
-      callback_data: formatTelegramUnboundRerouteCallbackData(
-        rerouteId,
-        record.target.threadId,
-      ),
-    },
-  ]);
-  return {
-    inline_keyboard: canRestoreAnyLiveThread
-      ? [
-          ...rows,
-          [
-            {
-              text: "🔁 Replace/restore thread…",
-              callback_data:
-                formatTelegramUnboundRerouteRestoreMenuCallbackData(rerouteId),
-            },
-          ],
-        ]
-      : rows,
-  };
+  const rows = activeRecords.length
+    ? [[{ text: "↪️ Reroute…", callback_data: `${TELEGRAM_UNBOUND_REROUTE_MENU_CALLBACK_PREFIX}${rerouteId}` }]] : [];
+  if (canRestoreAnyLiveThread) rows.push([{
+    text: "🔁 Restore…",
+    callback_data: formatTelegramUnboundRerouteRestoreMenuCallbackData(rerouteId),
+  }]);
+  if (options.canCancel) rows.push([{
+    text: "⛔️ Cancel routing",
+    callback_data: `${TELEGRAM_UNBOUND_REROUTE_CANCEL_CALLBACK_PREFIX}${rerouteId}`,
+  }]);
+  return { inline_keyboard: rows };
 }
 
 function buildTelegramUnboundRerouteRestoreChooserMarkup(
@@ -357,26 +371,102 @@ function formatTelegramTargetKey(target: Queue.TelegramQueueTarget): string {
   return `${target.chatId}:${target.threadId ?? "all"}`;
 }
 
-function formatTelegramUnboundRerouteChooserText(
-  _records: readonly Threads.TelegramTopicTargetRecord[],
-  options: { includeGuidance?: boolean } = {},
-): string {
-  const rerouteText = [
-    "<b>🧵 Choose target thread:</b>",
-    "",
-    "Your message is still in this Telegram thread.",
-    "Select the Pi thread that should handle it:",
-  ].join("\n");
-  return options.includeGuidance === false
-    ? rerouteText
-    : [formatTelegramUnboundTopicGuidance(), "", rerouteText].join("\n");
-}
-
 import * as Threads from "./threads.ts";
 import type { TelegramUser } from "./updates.ts";
 import * as Updates from "./updates.ts";
 import { getTelegramVoiceReplyMode } from "./voice.ts";
 
+/** One admitted Restore attempt through recipient readiness, never source dispatch or cleanup. */
+export async function advanceTelegramWorkspaceRestore(input: {
+  request: Threads.TelegramWorkspaceRestoreRequest;
+  authority: Threads.TelegramWorkspaceRestoreAuthority;
+  restoreStore: Threads.TelegramWorkspaceRestore;
+  getRecipient: () => Threads.TelegramWorkspaceRestoreRecipient | undefined;
+  /** Adapter proves current canonical ownership and authenticates observations; apply needs a fresh issuance. */
+  runRecipient: (input: { intent: Threads.TelegramWorkspaceRestoreIntent; mode: "apply" | "inspect"; isCurrent: () => boolean }) =>
+    Promise<{ operationId: string; recipient: Threads.TelegramWorkspaceRestoreRecipient;
+      target: Threads.TelegramWorkspaceRestoreRequest["target"]; slot: string; ready: boolean } | undefined>;
+  /**
+   * Recovery for a same-session successor already on the relocated target: it may receive the first grant, but only
+   * read-only inspection runs. It never commits a new relocation or applies a target.
+   */
+  inspectOnly?: true;
+}): Promise<Threads.TelegramWorkspaceRestoreIntent | undefined> {
+  const isCurrent = input.authority.isCurrent.bind(input.authority);
+  if (!isCurrent()) return undefined;
+  const request = structuredClone(input.request);
+  if (!Threads.isTelegramWorkspaceRestoreRequest(request)) return undefined;
+  const getRecipient = input.getRecipient;
+  const runRecipient = input.runRecipient;
+  const observedRecipient = getRecipient();
+  if (!Threads.isTelegramWorkspaceRestoreRecipient(observedRecipient) || observedRecipient.sessionId !== request.binding.sessionId) return undefined;
+  const recipient = structuredClone(observedRecipient);
+  const executor = structuredClone(input.authority.executor);
+  const operatorUserId = input.authority.operatorUserId;
+  const current = (): boolean => isCurrent() && input.authority.operatorUserId === operatorUserId &&
+    isDeepStrictEqual(input.authority.executor, executor) && isDeepStrictEqual(getRecipient(), recipient);
+  const authority = { executor, operatorUserId, isCurrent: current };
+  const { restoreStore } = input;
+  const retained = (): Threads.TelegramWorkspaceRestoreIntent | undefined => {
+    if (!current()) return undefined;
+    const found = restoreStore.list().find(value => value.request.operationId === request.operationId);
+    return current() && found && isDeepStrictEqual(found.request, request) && found.operatorUserId === operatorUserId &&
+      isDeepStrictEqual(found.executor, executor) ? found : undefined;
+  };
+  let intent = retained();
+  const predecessor = intent ? undefined : restoreStore.list().find(value => value.request.operationId === request.operationId);
+  if (predecessor && current() && isDeepStrictEqual(predecessor.request, request) &&
+      predecessor.operatorUserId === operatorUserId && !isDeepStrictEqual(predecessor.executor, executor)) {
+    // Adoption transfers executor authority only. Issued grants stay issued, so a successor can merely inspect them.
+    try { intent = restoreStore.adopt(predecessor, authority); }
+    catch (error) {
+      intent = retained();
+      if (!intent) throw error;
+    }
+    if (!current() || !intent) return undefined;
+    intent = retained();
+    if (!intent) return undefined;
+  }
+  if (input.inspectOnly && !intent) return undefined;
+  if (!intent || intent.phase === "relocated") {
+    if ((!input.inspectOnly && recipient.instanceId !== request.owner.instanceId) ||
+        recipient.kind !== (request.owner.owner?.kind === "leader" ? "leader" : "follower")) return undefined;
+    intent = await restoreStore.commit(request, authority);
+    if (!current() || !intent) return undefined;
+  }
+  let mode: "apply" | "inspect" = "inspect";
+  if (intent.phase === "relocated") {
+    try {
+      const issuance = restoreStore.issueRecipient(intent, recipient, authority);
+      if (issuance) { intent = issuance.intent; mode = input.inspectOnly ? "inspect" : "apply"; }
+      else intent = retained();
+    } catch (error) {
+      intent = retained();
+      if (intent?.phase !== "recipient-issued") throw error;
+      // A retained issued phase is not a fresh grant, even when publication's reply was lost.
+    }
+  }
+  if (!current() || !intent || !["recipient-issued", "ready"].includes(intent.phase) ||
+      (mode === "apply" && !isDeepStrictEqual(intent.recipient, recipient))) return undefined;
+  const expected = structuredClone(intent);
+  if (!isDeepStrictEqual(retained(), expected)) return undefined;
+  const observation = await runRecipient({ intent: structuredClone(expected), mode, isCurrent: current });
+  if (!current() || !isDeepStrictEqual(retained(), expected) || !observation || observation.ready !== true ||
+      observation.operationId !== request.operationId || !isDeepStrictEqual(observation.recipient, recipient) ||
+      !isDeepStrictEqual(observation.target, request.target) || observation.slot !== request.binding.slot) return undefined;
+  if (expected.phase === "ready" && isDeepStrictEqual(expected.readyRecipient ?? expected.recipient, recipient)) return retained();
+  try {
+    intent = mode === "inspect" ? restoreStore.confirmInspectedReady(expected, recipient, authority) :
+      restoreStore.confirmReady(expected, recipient, authority);
+  } catch (error) {
+    intent = retained();
+    if (intent?.phase !== "ready" || !isDeepStrictEqual(intent.readyRecipient ?? intent.recipient, recipient)) throw error;
+  }
+  const confirmed = retained();
+  return current() && confirmed?.phase === "ready" &&
+    isDeepStrictEqual(confirmed.readyRecipient ?? confirmed.recipient, recipient) ? confirmed : undefined;
+}
+
 async function deleteReservedTelegramTopicThroughReconciler(
   deps: {
     callApi?: <TResponse>(
@@ -447,6 +537,8 @@ async function deleteReservedTelegramTopicThroughReconciler(
 }
 
 export const TELEGRAM_ALL_TAB_COMMAND_MAX_AGE_MS = 60 * 60_000;
+/** One user-facing answer for expired or previous-process routing controls. */
+export const TELEGRAM_ROUTING_CHOICE_EXPIRED = "⌛ Routing choice expired.";
 
 export function isTelegramAllTabCommandExpired(
   message: { date?: number; message_thread_id?: number },
@@ -517,6 +609,17 @@ export function createTelegramInboundBusProjectionRuntime(deps: {
   };
 }
 
+/** Fenced temporary-Thread authority; see `captureTemporaryThreadAuthority`. */
+interface TemporaryThreadAuthority {
+  store: Threads.TelegramWorkspaceRestore;
+  operatorUserId: number;
+  journalBindingKey: string;
+  epoch: number | string;
+  authority: Threads.TelegramWorkspaceRestoreAuthority;
+  isCurrent: () => boolean;
+  adopt: (entry: Threads.TelegramTemporaryThreadEntry) => Threads.TelegramTemporaryThreadEntry | undefined;
+}
+
 export interface TelegramInboundRouteRuntimeDeps<
   TMessage extends TelegramRoutedMessage,
   TCallbackQuery extends TelegramRoutedCallbackQuery,
@@ -530,6 +633,7 @@ export interface TelegramInboundRouteRuntimeDeps<
   callApi?: <TResponse>(
     method: string,
     body: Record<string, unknown>,
+    options?: TelegramApiCallOptions,
   ) => Promise<TResponse>;
   getCurrentInstanceId?: () => string | undefined;
   getAdmissionScope?: () => string | undefined;
@@ -567,11 +671,29 @@ export interface TelegramInboundRouteRuntimeDeps<
     TCallbackQuery,
     TMessage
   >;
-  replaceFollowerThreadTarget?: (input: {
-    record: Threads.TelegramTopicTargetRecord;
-    target: Threads.TelegramTopicTargetRecord["target"];
-    oldTarget: Threads.TelegramTopicTargetRecord["target"];
-  }) => Promise<boolean>;
+  getWorkspaceRestoreStore?: () => Threads.TelegramWorkspaceRestore | undefined;
+  captureWorkspaceExternalProtection?: ReturnType<typeof createTelegramWorkspaceExternalProtectionCapture>;
+  /** Strict committed abandonment plus retained original; shared by Restore and temporary-input cancellation. */
+  inspectRestoreSourceAbandonment?: (updateId: number, journalBindingKey: string) => Threads.TelegramTemporaryThreadCancellationEvidence | undefined;
+  inspectRoutingInputGroupExpiry?: (input: Threads.TelegramTemporaryThreadInput) => readonly Threads.TelegramTemporaryThreadCancellationEvidence[] | undefined;
+  /** Strict active-journal observation only; a hint or missing source never substitutes for this ACK. */
+  inspectRestoreSourceCompletion?: (expected: Updates.TelegramDeferredSourceEvidence & { completionSha256: string }) =>
+    (Updates.TelegramDeferredSourceEvidence & { completionSha256: string }) | undefined;
+  inspectRestoreQueuedReceipt?: (expected: TelegramUpdateJournalQueuedCompletion & { journalBindingKey: string }) =>
+    TelegramUpdateJournalQueuedReceiptEvidence | undefined;
+  hasWorkspaceRestoreAuthority?: () => boolean;
+  /** Strict complete namespace plus exact current/historical references; only an empty result clears journal protection. */
+  inspectTemporaryThreadSources?: (target: Queue.TelegramQueueTarget, requiredJournalBindingKeys: readonly string[]) => readonly number[] | undefined;
+  /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 1000 ms. */
+  temporaryThreadCleanupDelayMs?: number;
+  getSessionGeneration?: () => number;
+  workspaceRestoreRecipient?: {
+    getSessionId: (ctx: TContext) => string | undefined;
+    getCwd: (ctx: TContext) => string | undefined;
+    getLeaderIdentity: Threads.TelegramLeaderThreadStateRuntime["getIdentity"];
+    followerRegistry: Pick<Bus.TelegramBusFollowerRegistry, "get" | "register">;
+    runFollower: ReturnType<typeof Bus.createTelegramBusWorkspaceRestoreController>;
+  };
   bridgeRuntime: TelegramBridgeRuntime;
   activeTurnRuntime: Queue.TelegramActiveTurnStore;
   mediaGroupRuntime: Media.TelegramMediaGroupController<TMessage, TContext>;
@@ -720,6 +842,7 @@ export interface TelegramInboundRouteRuntimeDeps<
 const TELEGRAM_OWNED_CALLBACK_PREFIXES = [
   "allmenu:",
   TELEGRAM_UNBOUND_REROUTE_CALLBACK_PREFIX,
+  TELEGRAM_UNBOUND_REROUTE_CANCEL_CALLBACK_PREFIX,
   "compact:",
   "menu:",
   "model:",
@@ -755,12 +878,26 @@ export function createTelegramInboundRouteRuntime<
     TContext,
     TModel
   >,
-): Updates.TelegramUpdateRuntimeController<TContext, TUpdate> {
+): Updates.TelegramUpdateRuntimeController<TContext, TUpdate> & {
+  expireRoutingInput: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["expireRoutingInput"]>;
+  shouldReviewHistoricalInput: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["shouldReviewHistoricalInput"]>;
+  shouldHoldPendingInput: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["shouldHoldPendingInput"]>;
+  forgetPreviousWorld(input: Updates.TelegramHeldSourcePreparation<TContext>,
+    captureTransport?: (ctx: TContext) => (() => boolean) | undefined): Promise<{ forgotten: number; deleted: number }>;
+  beforeQueueReceiptPublished: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["beforeQueueReceiptPublished"]>;
+  onQueueReceiptCommitted: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["onQueueReceiptCommitted"]>;
+  onQueueReceiptCompleted: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["onQueueReceiptCompleted"]>;
+  onUpdateCompleted: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["onUpdateCompleted"]>;
+  onWorkspaceRestoreRecipientObserved(follower: Bus.TelegramBusFollowerView, isCurrent: () => boolean,
+    ctx: TContext | undefined): Promise<void> | undefined;
+  waitForRestoreSettlement(): Promise<void>;
+} {
   type PendingRerouteCleanup =
     | {
         kind: "unbound";
         target: { chatId: number; threadId: number };
         messageId?: number;
+        temporaryThread?: Threads.TelegramTemporaryThreadEntry;
       }
     | {
         kind: "previous-leader";
@@ -774,16 +911,32 @@ export function createTelegramInboundRouteRuntime<
   type PendingUnboundReroute = {
     sourceTarget: Queue.TelegramQueueTarget;
     chooserMessageId?: number;
+    rootChooserText?: string;
     messages: TMessage[];
-    createdAtMs: number;
     dispatchKind: "prompt" | "command";
+    routingOperatorUserId?: number;
     expiresAtMs?: number;
     destinationSelected?: boolean;
     selectionAttempted?: boolean;
+    workspaceRestore?: { operationId: string; record: Threads.TelegramTopicTargetRecord; messages: TMessage[] };
+    /** The acknowledged tab presenting an All source; `sourceTarget` is this tab, not the original's location. */
+    temporaryThread?: Threads.TelegramTemporaryThreadEntry;
+    /** Acknowledged same-tab membership stays protective when its reader disappears; never a dispatch/cleanup grant. */
+    temporaryMembership?: true;
     dispatching?: boolean;
+    abandonment?: {
+      ownerUserId: number;
+      journalBindingKey: string;
+      leaderEpoch: number | string;
+      running?: boolean;
+      attempted?: boolean;
+      result?: NonNullable<ReturnType<typeof Updates.abandonTelegramDeferredUpdate>>;
+    };
     pauseExpiry?: () => void;
     stopExpiry?: () => void;
     cleanup?: PendingRerouteCleanup;
+    /** Process-local protection only; restart-safe Forward issuance remains a release gate. */
+    foreignForwardIssued?: boolean;
     foreignRetry?: {
       instanceId: string;
       threadId: number;
@@ -792,8 +945,17 @@ export function createTelegramInboundRouteRuntime<
     finalizeMessage?: string;
   };
   const pendingUnboundReroutes = new Map<string, PendingUnboundReroute>();
+  const implicitThreadCreations = new Map<string, { ctx: TContext; updateId: number; operatorUserId: number;
+    journalBindingKey: string; executor: Threads.TelegramWorkspaceRestoreExecutor; generation: number | undefined; scope: string | undefined }>();
   const guidedUnboundTopicKeys = new Set<string>();
   let nextUnboundRerouteId = 0;
+  type RecoverySource = Updates.TelegramDeferredAbandonmentRecoveryPage["sources"][number];
+  type CancellationReview = {
+    id: string; target: Queue.TelegramQueueTarget; messageId: number; ownerUserId: number; journalBindingKey: string;
+    isCurrent: () => boolean; running?: boolean; nextAfterUpdateId?: number; unsupported: boolean;
+    sources: Array<RecoverySource & { preview: string; result?: NonNullable<ReturnType<RecoverySource["retry"]>> }>;
+  };
+  let cancellationReview: CancellationReview | undefined;
   const requestDispatchNextQueuedTelegramTurn = (ctx: TContext): void => {
     deps.dispatchNextQueuedTelegramTurn(ctx);
     if (
@@ -833,7 +995,7 @@ export function createTelegramInboundRouteRuntime<
         continue;
       }
       return record.threadName &&
-        Threads.isTelegramTopicThreadNameValidForSlot(
+        ThreadNaming.isTelegramTopicThreadNameValidForSlot(
           record.threadName,
           record.slot,
         )
@@ -915,35 +1077,34 @@ export function createTelegramInboundRouteRuntime<
     };
     schedule();
   };
-  const prunePendingUnboundReroutes = () => {
-    const nowMs = Date.now();
+  const prunePendingCommandReroutes = () => {
+    // Deferred prompts and selected routes with cleanup work must retain their control.
+    // Age is not settlement; the chooser capacity limit still bounds retained entries.
     for (const [id, entry] of pendingUnboundReroutes) {
       if (entry.dispatchKind === "command" && entry.sourceTarget.threadId === undefined) {
         expirePendingCommand(id, entry);
-      } else if (nowMs - entry.createdAtMs > 30 * 60_000) {
-        removePendingReroute(id);
       }
     }
   };
   const storePendingUnboundReroute = (
     messages: TMessage[],
     dispatchKind: "prompt" | "command" = "prompt",
+    presentationTarget?: { chatId: number; threadId: number },
   ): string => {
-    prunePendingUnboundReroutes();
+    prunePendingCommandReroutes();
     if (pendingUnboundReroutes.size >= 100) {
       throw new Error("Telegram route chooser capacity reached; source remains retryable.");
     }
     nextUnboundRerouteId += 1;
     const id = nextUnboundRerouteId.toString(36);
     pendingUnboundReroutes.set(id, {
-      sourceTarget: {
+      sourceTarget: presentationTarget ? { ...presentationTarget } : {
         chatId: messages[0]!.chat.id,
         ...(typeof messages[0]!.message_thread_id === "number"
           ? { threadId: messages[0]!.message_thread_id }
           : {}),
       },
       messages,
-      createdAtMs: Date.now(),
       dispatchKind,
     });
     const pending = pendingUnboundReroutes.get(id)!;
@@ -954,6 +1115,15 @@ export function createTelegramInboundRouteRuntime<
     const pending = pendingUnboundReroutes.get(id);
     if (!pending) return;
     pending.chooserMessageId = messageId;
+    if (Number.isSafeInteger(messageId) && messageId! > 0) {
+      const owner = deps.configStore.getAllowedUserId();
+      if (owner !== undefined && pending.messages.every(source => source.from?.id === owner && !source.from.is_bot && source.chat.type === "private")) {
+        try {
+          const lifetime = Updates.armTelegramRoutingInputs(pending.messages, owner);
+          if (lifetime) pending.routingOperatorUserId = lifetime.operatorUserId;
+        } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-clock" }); }
+      }
+    }
     if (messageId === undefined || pending.dispatchKind !== "command" ||
         pending.sourceTarget.threadId !== undefined || pending.selectionAttempted) return;
     const source = pending.messages[0];
@@ -1083,18 +1253,49 @@ export function createTelegramInboundRouteRuntime<
         ),
     );
   };
+  /** Whether a chooser is still pending in this Thread, ignoring the ones the caller itself owns. */
+  const hasPendingRerouteForTarget = (target: Queue.TelegramQueueTarget, own?: (pending: PendingUnboundReroute) => boolean): boolean =>
+    [...pendingUnboundReroutes.values()].some(pending => pending.sourceTarget.chatId === target.chatId &&
+      pending.sourceTarget.threadId === target.threadId && !own?.(pending));
+  const isOwnTemporaryChooser = (entry: Threads.TelegramTemporaryThreadEntry) => (pending: PendingUnboundReroute): boolean =>
+    pending.temporaryThread?.token === entry.token && isDeepStrictEqual(pending.temporaryThread.source, entry.source);
+  const hasOtherTemporaryThreadReroute = (target: Queue.TelegramQueueTarget, own: Threads.TelegramTemporaryThreadEntry): boolean =>
+    hasPendingRerouteForTarget(target, isOwnTemporaryChooser(own));
   const applyThreadCleanupPlan = async (
     plan: ThreadReconciler.ThreadReconciliationPlan,
     assertExecutionCurrent?: () => void,
+    restoreCleanup?: Threads.TelegramWorkspaceRestoreIntent,
+    temporaryCleanup?: Threads.TelegramTemporaryThreadEntry,
   ): Promise<boolean> => {
     assertExecutionCurrent?.();
+    if ((restoreCleanup && restoreCleanup.routing?.cleanup !== "issued") ||
+        (temporaryCleanup && !temporaryCleanup.cleanupIssued)) return false;
+    let protectedTarget = false, temporaryDeleteConfirmed = false, temporaryTransportUncertain = false;
     deps.recordThreadReconciliationPlan?.(plan);
     const result = await ThreadReconciler.applyThreadReconciliationPlan(plan, {
+      skipCloseBeforeDelete: (temporaryCleanup?.target?.chatId ?? 0) > 0,
       isCleanupTargetProtected(target) {
         assertExecutionCurrent?.();
-        return isRerouteTargetProtected(target);
+        // A tab's first source is not authority over sibling choosers, including unsettled cleanup-only work.
+        const siblingProtected = !!temporaryCleanup && hasOtherTemporaryThreadReroute(target, temporaryCleanup);
+        const lostTemporaryGrant = !!temporaryCleanup && !deps.getWorkspaceRestoreStore?.()?.listTemporaryThreads()
+          .some(entry => isDeepStrictEqual(entry, temporaryCleanup));
+        const protectedNow = temporaryTransportUncertain || lostTemporaryGrant || siblingProtected || isRerouteTargetProtected(target, restoreCleanup, temporaryCleanup);
+        protectedTarget ||= protectedNow;
+        return protectedNow;
       },
-      callApi: deps.callApi,
+      callApi: temporaryCleanup && deps.callApi
+        ? async <TResponse>(method: string, body: Record<string, unknown>): Promise<TResponse> => {
+          try {
+            assertExecutionCurrent?.();
+            const result = await deps.callApi!<TResponse>(method, body, { maxAttempts: 1, retrySafety: "non-idempotent" });
+            assertExecutionCurrent?.();
+            if (result !== true) throw new Error("Temporary Thread cleanup lacks a positive API acknowledgement.");
+            if (method === "deleteForumTopic") temporaryDeleteConfirmed = true;
+            return result;
+          } catch (error) { temporaryTransportUncertain = true; throw error; }
+        }
+        : deps.callApi,
       markStaleByTarget: (staleTarget, syncStatus, lastSyncError) =>
         deps.threadStore?.markStaleByTarget(
           staleTarget,
@@ -1108,15 +1309,111 @@ export function createTelegramInboundRouteRuntime<
       recordRuntimeEvent: deps.recordRuntimeEvent,
     });
     assertExecutionCurrent?.();
-    return (result.incompleteActions?.length ?? 0) === 0;
+    return !protectedTarget && (!temporaryCleanup || temporaryDeleteConfirmed) && (result.incompleteActions?.length ?? 0) === 0;
+  };
+  const findCreatedTemporaryThread = (target: Queue.TelegramQueueTarget): Threads.TelegramTemporaryThreadEntry | undefined => {
+    try { return deps.getWorkspaceRestoreStore?.()?.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target)); }
+    catch { return undefined; }
+  };
+  /**
+   * One fenced capture of leader epoch, operator, journal binding and context for a temporary-Thread effect. `isCurrent`
+   * re-reads every captured fact (plus an optional extra fence) at each boundary, so a delayed effect keeps the identity it
+   * was scheduled under; `adopt` re-keys an entry to this executor before a write.
+   */
+  const captureTemporaryThreadAuthority = (ctx: TContext, extra?: () => boolean): TemporaryThreadAuthority | undefined => {
+    const store = deps.getWorkspaceRestoreStore?.();
+    const instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.();
+    const operatorUserId = deps.configStore.getAllowedUserId(), journalBindingKey = deps.getAdmissionJournalBinding?.();
+    const generation = deps.getSessionGeneration?.(), scope = deps.getAdmissionScope?.();
+    if (!store || !instanceId || epoch === undefined || operatorUserId === undefined || !journalBindingKey) return undefined;
+    const isCurrent = (): boolean => deps.isContextActive?.(ctx) === true && deps.getCurrentInstanceId?.() === instanceId &&
+      deps.getSessionGeneration?.() === generation && deps.getAdmissionScope?.() === scope &&
+      deps.getCurrentLeaderEpoch?.() === epoch && deps.configStore.getAllowedUserId() === operatorUserId &&
+      deps.getAdmissionJournalBinding?.() === journalBindingKey && (extra?.() ?? true);
+    const authority = { executor: { instanceId, leaderEpoch: String(epoch) }, operatorUserId, isCurrent };
+    return { store, operatorUserId, journalBindingKey, epoch, authority, isCurrent,
+      adopt: entry => isDeepStrictEqual(entry.executor, authority.executor) ? entry : store.adoptTemporaryThread(entry, authority) };
   };
-  const isRerouteTargetProtected = (target: Queue.TelegramQueueTarget): boolean => {
+  const isTemporaryTabTarget = (target: Queue.TelegramQueueTarget | undefined): boolean =>
+    !!target && findCreatedTemporaryThread(target) !== undefined;
+  /** Restore may choose one input only when every other known group is cancelled or a live unassigned chooser that can be retained. */
+  const areTemporaryThreadSiblingsAccountedForRestore = (entry: Threads.TelegramTemporaryThreadEntry, from: PendingUnboundReroute): boolean => {
+    const target = entry.target;
+    if (!target) return false;
+    const group = { journalBindingKey: entry.source.journalBindingKey, updateIds: Updates.collectTelegramAdmissionSourceUpdateIds(from.messages) };
+    const inputs = Threads.getTelegramTemporaryThreadInputs(entry), resolved = [...(entry.cancelledInputs ?? []), ...(entry.completedInputs ?? [])];
+    if (!inputs.some(input => isDeepStrictEqual(input, group)) || resolved.some(input => isDeepStrictEqual(input, group))) return false;
+    const others = [...pendingUnboundReroutes.values()].filter(pending => pending !== from &&
+      pending.sourceTarget.chatId === target.chatId && pending.sourceTarget.threadId === target.threadId);
+    const groupOf = (pending: PendingUnboundReroute) => ({ journalBindingKey: entry.source.journalBindingKey,
+      updateIds: Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages) });
+    if (!others.every(pending => !!pending.abandonment && !pending.abandonment.result && !pending.destinationSelected &&
+        !pending.selectionAttempted && !pending.dispatching && !pending.foreignForwardIssued && !pending.foreignRetry && !pending.cleanup && !pending.finalizeMessage &&
+        !pending.workspaceRestore && !entry.forwardedInputs?.some(input => isDeepStrictEqual(input, groupOf(pending))) &&
+        inputs.some(input => isDeepStrictEqual(input, groupOf(pending))))) return false;
+    return inputs.every(input => isDeepStrictEqual(input, group) || resolved.some(other => isDeepStrictEqual(other, input)) ||
+      others.some(pending => isDeepStrictEqual(groupOf(pending), input)));
+  };
+  const isRerouteTargetProtected = (target: Queue.TelegramQueueTarget, ownRestore?: Threads.TelegramWorkspaceRestoreIntent,
+    ownTemporary?: Threads.TelegramTemporaryThreadEntry, restoreFrom?: PendingUnboundReroute): boolean => {
     const matches = (candidate: Queue.TelegramQueueTarget): boolean =>
       candidate.chatId === target.chatId && candidate.threadId === target.threadId;
-    return (deps.getLiveThreadTargets?.() ?? []).some(matches) ||
-      (deps.threadStore?.list() ?? []).some((record) => matches(record.target)) ||
-      (deps.threadStore?.listReservations() ?? []).some((record) => matches(record.target)) ||
-      (deps.threadStore?.listPendingProvisions() ?? []).some((record) => !!record.target && matches(record.target));
+    const activeTarget = deps.activeTurnRuntime.getTarget();
+    if ((activeTarget && matches(activeTarget)) ||
+        deps.telegramQueueStore.getQueuedItems().some(item => item.target && matches(item.target)) ||
+        (deps.getLiveThreadTargets?.() ?? []).some(matches) ||
+        (deps.threadStore?.list() ?? []).some(record => matches(record.target)) ||
+        (deps.threadStore?.listReservations() ?? []).some(record => matches(record.target)) ||
+        (deps.threadStore?.listPendingProvisions() ?? []).some(record => record.target && matches(record.target))) return true;
+    const store = deps.getWorkspaceRestoreStore?.();
+    if (deps.getWorkspaceRestoreStore && !store) return true;
+    let temporary: Threads.TelegramTemporaryThreadEntry[];
+    try { temporary = store?.listTemporaryThreads() ?? []; } catch { return true; }
+    // Only the source's own Forward/Cancel may remove its retained tab; adoption may have changed its executor.
+    const ownTab = (entry: Threads.TelegramTemporaryThreadEntry): boolean => !!ownTemporary && entry.token === ownTemporary.token &&
+      isDeepStrictEqual(entry.source, ownTemporary.source) && isDeepStrictEqual(entry.target, ownTemporary.target);
+    if (temporary.some(entry => !!entry.target && matches(entry.target) &&
+        (!ownTab(entry) || (Threads.getTelegramTemporaryThreadInputs(entry).length > 1 &&
+          !Threads.isTelegramTemporaryThreadFullyResolved(entry) &&
+          !(restoreFrom && areTemporaryThreadSiblingsAccountedForRestore(entry, restoreFrom)))))) return true;
+    // Whole-tab cleanup after cancellation also needs a fresh census of retained arrivals no membership has seen.
+    if (!restoreFrom && temporary.some(entry => ownTab(entry) && !!(entry.cancelledInputs?.length || entry.completedInputs?.length))) {
+      try {
+        const required = [...new Set([deps.getAdmissionJournalBinding?.(), ownTemporary!.source.journalBindingKey,
+          ...Threads.getTelegramTemporaryThreadInputs(ownTemporary!).map(input => input.journalBindingKey)].filter((key): key is string => !!key))];
+        if (deps.inspectTemporaryThreadSources?.({ chatId: target.chatId, threadId: target.threadId! }, required)?.length !== 0) return true;
+      } catch { return true; }
+    }
+    const retained = store?.list() ?? [];
+    // Exempt only the exact operation's old target. Cleanup itself also requires its issued grant.
+    if (ownRestore && (!matches(ownRestore.request.binding.target) ||
+        !retained.some(intent => isDeepStrictEqual(intent, ownRestore)))) return true;
+    if (retained.some(intent => (matches(intent.request.binding.target) || matches(intent.request.target)) &&
+        !(ownRestore && isDeepStrictEqual(intent, ownRestore) && matches(intent.request.binding.target)))) return true;
+    if (!ownRestore) return false;
+    let acceptedWorkClear = false;
+    try {
+      deps.threadStore?.withWorkspaceRestoreSnapshot(ownRestore, snapshot => {
+        const bindings = snapshot.workspaceBindings?.filter(binding => binding.bindingKey === ownRestore.request.binding.bindingKey) ?? [];
+        if (bindings.length !== 1 || !deps.captureWorkspaceExternalProtection) return undefined;
+        const binding = bindings[0]!;
+        // Relocation does not erase predecessor references or prove where their work executes.
+        const journalBindingKeys = [...new Set([
+          ...(ownRestore.request.binding.journalBindingKeys ?? []), ...(binding.journalBindingKeys ?? []),
+        ])];
+        const journalSources = [...new Map([
+          ...(ownRestore.request.binding.journalSources ?? []), ...(binding.journalSources ?? []),
+        ].map(source => [JSON.stringify([source.sessionId, source.recipientBindingKey]), source])).values()];
+        acceptedWorkClear = deps.captureWorkspaceExternalProtection({ ...binding, target: ownRestore.request.binding.target,
+          journalBindingKeys, journalSources },
+          { requireBindingProvenance: true }).acceptedWork === "clear";
+        return undefined;
+      });
+    } catch (error) {
+      acceptedWorkClear = false;
+      deps.recordRuntimeEvent?.("telegram", error, { phase: "workspace-restore-protection" });
+    }
+    return !acceptedWorkClear;
   };
   const dismissRerouteChooserMessage = async (
     query: TCallbackQuery,
@@ -1151,6 +1448,7 @@ export function createTelegramInboundRouteRuntime<
     target: { chatId: number; threadId: number } | undefined,
     messageId: number | undefined,
     assertExecutionCurrent?: () => void,
+    ownTemporary?: Threads.TelegramTemporaryThreadEntry,
   ): Promise<boolean> => {
     if (!target || !deps.threadStore) return true;
     const nowMs = Date.now();
@@ -1173,11 +1471,15 @@ export function createTelegramInboundRouteRuntime<
         },
       ],
     });
-    return applyThreadCleanupPlan(plan, assertExecutionCurrent);
+    // A temporary grant licenses this tab only, not unrelated cleanup emitted by the general planner.
+    const scoped = ownTemporary ? { ...plan, actions: plan.actions.filter(action =>
+      action.kind === "close-delete-unbound-topic" && isDeepStrictEqual(action.target, target)) } : plan;
+    return applyThreadCleanupPlan(scoped, assertExecutionCurrent, undefined, ownTemporary);
   };
   const closePreviousLeaderThread = async (
     target: { chatId: number; threadId: number } | undefined,
     assertExecutionCurrent?: () => void,
+    restoreCleanup?: Threads.TelegramWorkspaceRestoreIntent,
   ): Promise<boolean> => {
     if (!target || !deps.threadStore) return true;
     const currentLeaderEpoch = deps.getCurrentLeaderEpoch?.();
@@ -1193,12 +1495,13 @@ export function createTelegramInboundRouteRuntime<
             : {}),
         },
       ],
-    }, assertExecutionCurrent);
+    }, assertExecutionCurrent, restoreCleanup);
   };
   const closeReplacedFollowerThread = async (
     target: { chatId: number; threadId: number } | undefined,
     instanceId: string | undefined,
     assertExecutionCurrent?: () => void,
+    restoreCleanup?: Threads.TelegramWorkspaceRestoreIntent,
   ): Promise<boolean> => {
     if (!target || !deps.threadStore) return true;
     const currentLeaderEpoch = deps.getCurrentLeaderEpoch?.();
@@ -1214,8 +1517,692 @@ export function createTelegramInboundRouteRuntime<
             : {}),
         },
       ],
-    }, assertExecutionCurrent);
+    }, assertExecutionCurrent, restoreCleanup);
+  };
+  // Worker ACK observers outlive callback admission. Re-enter the existing Workspace gate;
+  // never await this continuation while holding the dispatch invocation's gate.
+  const restoreSettlementTasks = new Set<Promise<void>>();
+  /**
+   * After a Restore into a temporary tab reached positive terminal settlement, every still-unassigned sibling there is retained
+   * privately and cancelled without Pi delivery. Missing proof, authority or abandonment leaves that sibling pending and the
+   * tab's temporary entry protected; selected, queued, running or unknown work is never touched.
+   */
+  const disposeTemporaryThreadSiblingsAfterRestore = async (intent: Threads.TelegramWorkspaceRestoreIntent, ctx: TContext,
+    restoreCurrent: () => boolean): Promise<void> => {
+    const target = intent.request.target, cap = captureTemporaryThreadAuthority(ctx, restoreCurrent);
+    const entry = findCreatedTemporaryThread(target);
+    if (!cap || !entry || !entry.target || !cap.isCurrent()) return;
+    const operatorUserId = intent.operatorUserId, journalBindingKey = intent.request.source.journalBindingKey;
+    if (cap.operatorUserId !== operatorUserId || cap.journalBindingKey !== journalBindingKey ||
+        entry.operatorUserId !== operatorUserId || entry.source.journalBindingKey !== journalBindingKey) return;
+    const group = { journalBindingKey, updateIds: [...intent.request.source.updateIds] };
+    if (!Threads.getTelegramTemporaryThreadInputs(entry).some(input => isDeepStrictEqual(input, group))) return;
+    for (const [id, pending] of [...pendingUnboundReroutes]) {
+      const cancellation = pending.abandonment, source = pending.messages[0];
+      if (pending.sourceTarget.chatId !== target.chatId || pending.sourceTarget.threadId !== target.threadId ||
+          pending.workspaceRestore?.operationId === intent.request.operationId || !cancellation || !source || cancellation.result ||
+          cancellation.running) continue;
+      const current = (): boolean => cap.isCurrent() &&
+        pendingUnboundReroutes.get(id) === pending && pending.abandonment === cancellation &&
+        !pending.destinationSelected && !pending.selectionAttempted && !pending.dispatching && !pending.foreignForwardIssued && !pending.foreignRetry &&
+        !pending.cleanup && !pending.finalizeMessage && !pending.workspaceRestore &&
+        Updates.getTelegramUpdateExecutionFence(source)?.signal.aborted === false &&
+        cancellation.ownerUserId === operatorUserId && cancellation.journalBindingKey === journalBindingKey;
+      if (!current()) continue;
+      cancellation.running = true;
+      try {
+        const result = Updates.abandonTelegramDeferredUpdate(source, { operatorAuthorityId: `telegram-owner:${operatorUserId}`, isCurrent: current });
+        if (!result) continue;
+        cancellation.attempted = true;
+        cancellation.result = result;
+        if (!recordCancelledTemporaryThreadInput(pending, ctx, current)) continue;
+        await retireCancellationChooser(id, pending, current);
+      } catch (error) {
+        deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-restore-sibling", rerouteId: id });
+      } finally { cancellation.running = false; }
+    }
+    // The entry is released only after every sibling is gone and the Restore group's completion is the single uncancelled input.
+    if (hasPendingRerouteForTarget(target, pending => pending.workspaceRestore?.operationId === intent.request.operationId) ||
+        !cap.isCurrent()) return;
+    const fresh = findCreatedTemporaryThread(target), owned = fresh && cap.adopt(fresh);
+    if (owned && cap.isCurrent()) cap.store.retireTemporaryThread(owned, cap.authority, group);
+  };
+  const observeRestoreSettlement = (signal:
+    | { kind: "source"; evidence: Threads.TelegramWorkspaceRestoreSourceSettlement }
+    | { kind: "recipient"; follower: Bus.TelegramBusFollowerView; isCurrent: () => boolean },
+  ctx: TContext): Promise<void> | undefined => {
+    if (!deps.hasWorkspaceRestoreAuthority?.() || !deps.runWorkspaceOperation || !deps.getWorkspaceRestoreStore ||
+        !deps.getSessionGeneration || deps.isContextActive?.(ctx) === false) return;
+    const evidence = signal.kind === "source" ? structuredClone(signal.evidence) : undefined;
+    const follower = signal.kind === "recipient" ? structuredClone(signal.follower) : undefined;
+    const recipientCurrent = (): boolean => {
+      if (signal.kind !== "recipient" || !follower) return true;
+      const live = deps.workspaceRestoreRecipient?.followerRegistry.get(follower.instanceId);
+      return signal.isCurrent() && !!live && Bus.hasTelegramBusCapability(live.protocol, Bus.TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) &&
+        isDeepStrictEqual({ ...live, lastHeartbeatMs: undefined, connectedAtMs: undefined, threadName: undefined },
+          { ...follower, lastHeartbeatMs: undefined, connectedAtMs: undefined, threadName: undefined });
+    };
+    const recipientMatches = (intent: Threads.TelegramWorkspaceRestoreIntent): boolean => {
+      if (!follower) return true;
+      const ready = intent.readyRecipient ?? intent.recipient;
+      return ready?.kind === "follower" && ready.instanceId === follower.instanceId && ready.sessionId === follower.sessionId &&
+        ready.generation === follower.registrationGeneration && !!follower.cwd &&
+        intent.request.binding.cwd === WorkspaceIdentity.normalizeTelegramWorkspacePath(follower.cwd) &&
+        intent.request.binding.slot === follower.slot && isDeepStrictEqual(intent.request.target, follower.target);
+    };
+    // A same-session successor already registered on the relocated target may prove an issued grant by inspection only.
+    const inspectableSuccessor = (intent: Threads.TelegramWorkspaceRestoreIntent): boolean =>
+      !!follower?.registrationGeneration && !!follower.cwd && (intent.phase === "relocated" || intent.phase === "recipient-issued") &&
+      intent.request.owner.owner?.kind === "manual-follower" && follower.sessionId === intent.request.binding.sessionId &&
+      intent.request.binding.cwd === WorkspaceIdentity.normalizeTelegramWorkspacePath(follower.cwd) &&
+      intent.request.binding.slot === follower.slot && isDeepStrictEqual(intent.request.target, follower.target);
+    const instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.();
+    const operatorUserId = deps.configStore.getAllowedUserId();
+    const generation = deps.getSessionGeneration(), scope = deps.getAdmissionScope?.();
+    const sourceBinding = deps.getAdmissionJournalBinding?.();
+    if (!instanceId || epoch === undefined || operatorUserId === undefined || !scope ||
+        !sourceBinding || (evidence && evidence.journalBindingKey !== sourceBinding) || !recipientCurrent()) return;
+    // This same-session leader already runs on the relocated target; it may only inspect an issued leader grant.
+    const leaderSessionId = deps.workspaceRestoreRecipient?.getSessionId(ctx);
+    const leaderCwd = deps.workspaceRestoreRecipient?.getCwd(ctx);
+    const leaderAt = (request: Threads.TelegramWorkspaceRestoreRequest): boolean => {
+      const ports = deps.workspaceRestoreRecipient;
+      const cwd = ports?.getCwd(ctx), local = ports?.getLeaderIdentity();
+      return !!cwd && cwd === leaderCwd && ports?.getSessionId(ctx) === leaderSessionId &&
+        leaderSessionId === request.binding.sessionId && WorkspaceIdentity.normalizeTelegramWorkspacePath(cwd) === request.binding.cwd &&
+        !!local && local.slot === request.binding.slot && isDeepStrictEqual(local.target, request.target);
+    };
+    const observeLeaderRestore = (intent: Threads.TelegramWorkspaceRestoreIntent, recipient: Threads.TelegramWorkspaceRestoreRecipient,
+      isCurrent: () => boolean): Awaited<ReturnType<Parameters<typeof advanceTelegramWorkspaceRestore>[0]["runRecipient"]>> => {
+      const threads = deps.threadStore;
+      if (!threads || !isCurrent() || !leaderAt(intent.request)) return undefined;
+      const { request } = intent;
+      let observation: Awaited<ReturnType<Parameters<typeof advanceTelegramWorkspaceRestore>[0]["runRecipient"]>>;
+      threads.withWorkspaceRestoreSnapshot(intent, snapshot => {
+        if (!isCurrent() || !leaderAt(request)) return;
+        const bindings = (snapshot.workspaceBindings ?? []).filter(value => value.bindingKey === request.binding.bindingKey);
+        const live = bindings[0];
+        const owners = snapshot.threads.filter(value => value.status === "active" &&
+          (value.slot === request.binding.slot || isDeepStrictEqual(value.target, request.target)));
+        if (bindings.length !== 1 || live?.sessionId !== request.binding.sessionId || live.cwd !== request.binding.cwd ||
+            live.slot !== request.binding.slot || live.inactiveSinceMs !== undefined || !isDeepStrictEqual(live.target, request.target) ||
+            owners.length !== 1 || owners[0]?.owner?.kind !== "leader" || owners[0].instanceId !== recipient.instanceId ||
+            owners[0].owner.instanceId !== recipient.instanceId || !owners[0].owner.cwd ||
+            WorkspaceIdentity.normalizeTelegramWorkspacePath(owners[0].owner.cwd) !== request.binding.cwd ||
+            owners[0].profileKey !== request.owner.profileKey || owners[0].slot !== request.binding.slot || !isDeepStrictEqual(owners[0].target, request.target)) return;
+        observation = { operationId: request.operationId, recipient, target: request.target, slot: request.binding.slot!, ready: true };
+      });
+      return isCurrent() && leaderAt(request) ? observation : undefined;
+    };
+    // Same-process lost replies stay with their chooser; this path only serves a restarted leader process.
+    const inspectableLeader = (intent: Threads.TelegramWorkspaceRestoreIntent): boolean => !!evidence &&
+      intent.request.owner.owner?.kind === "leader" && leaderAt(intent.request) &&
+      (intent.phase === "relocated" ? intent.request.owner.instanceId !== instanceId
+        : intent.phase === "recipient-issued" && intent.recipient?.kind === "leader" && intent.recipient.instanceId !== instanceId);
+    const current = (): boolean => deps.hasWorkspaceRestoreAuthority?.() === true && deps.isContextActive?.(ctx) !== false &&
+      deps.getSessionGeneration?.() === generation && deps.getAdmissionScope?.() === scope &&
+      deps.getAdmissionJournalBinding?.() === sourceBinding && deps.getCurrentInstanceId?.() === instanceId &&
+      deps.getCurrentLeaderEpoch?.() === epoch && deps.configStore.getAllowedUserId() === operatorUserId && recipientCurrent();
+    const recoveryRecipient = (intent: Threads.TelegramWorkspaceRestoreIntent): Bus.TelegramBusFollowerView | undefined => {
+      const ready = intent.readyRecipient ?? intent.recipient;
+      if (!deps.inspectRestoreSourceCompletion || !deps.workspaceRestoreRecipient || intent.phase !== "ready" ||
+          !intent.routing || intent.routing.cleanup !== undefined || intent.operatorUserId !== operatorUserId ||
+          !intent.routing.acceptances?.some(value => value.kind === "forwarded")) return undefined;
+      const live = deps.workspaceRestoreRecipient.followerRegistry.get(follower?.instanceId ?? ready?.instanceId ?? "");
+      return ready?.kind === "follower" && live?.registrationGeneration && live.cwd &&
+        Bus.hasTelegramBusCapability(live.protocol, Bus.TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) &&
+        Bus.hasTelegramBusCapability(live.protocol, Bus.TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION) &&
+        live.sessionId === intent.request.binding.sessionId && WorkspaceIdentity.normalizeTelegramWorkspacePath(live.cwd) === intent.request.binding.cwd &&
+        live.slot === intent.request.binding.slot && isDeepStrictEqual(live.target, intent.request.target) ? live : undefined;
+    };
+    const recoveryLeader = (intent: Threads.TelegramWorkspaceRestoreIntent): Threads.TelegramWorkspaceRestoreRecipient | undefined => {
+      const ready = intent.readyRecipient ?? intent.recipient;
+      if (evidence?.kind !== "completed" || !deps.inspectRestoreSourceCompletion || !deps.threadStore ||
+          intent.phase !== "ready" || !intent.routing || intent.routing.cleanup !== undefined || intent.operatorUserId !== operatorUserId ||
+          intent.request.owner.owner?.kind !== "leader" || ready?.kind !== "leader" || ready.sessionId !== intent.request.binding.sessionId ||
+          !leaderAt(intent.request) ||
+          !intent.routing.acceptances?.some(value => value.kind === "completed" || value.kind === "queued")) return undefined;
+      return { kind: "leader", instanceId, sessionId: intent.request.binding.sessionId!, generation: String(generation) };
+    };
+    let selected: string[];
+    try {
+      selected = deps.getWorkspaceRestoreStore()?.list().filter(intent => {
+        if (intent.request.source.journalBindingKey !== sourceBinding) return false;
+        if (evidence && intent.request.source.updateIds.some(id => evidence.updateIds.includes(id))) return true;
+        if (((evidence?.kind === "completed" || follower) && recoveryRecipient(intent)) || recoveryLeader(intent)) return true;
+        if (follower && deps.workspaceRestoreRecipient && inspectableSuccessor(intent)) return true;
+        if (deps.threadStore && inspectableLeader(intent)) return true;
+        // Completion rechecks an unsent Restore whose originals may all have been abandoned before its retirement published.
+        if (evidence?.kind === "completed" && deps.inspectRestoreSourceAbandonment && intent.phase === "ready" &&
+            intent.routing === undefined) return true;
+        // Hints only wake fully settled, unissued cleanup. They never settle another source.
+        return (evidence?.kind === "completed" || !!follower) && intent.phase === "ready" && intent.routing?.cleanup === undefined &&
+          recipientMatches(intent) && intent.request.source.updateIds.every(id =>
+            intent.routing?.settlements.some(value => value.kind !== "queued" && value.updateIds.includes(id)));
+      }).map(intent => intent.request.operationId) ?? [];
+    } catch (error) {
+      deps.recordRuntimeEvent?.("telegram", error, { phase: "workspace-restore-settlement" });
+      return;
+    }
+    if (!selected.length || !current()) return;
+    const task = Promise.resolve().then(() => deps.runWorkspaceOperation!({ operationId: `restore-settlement-${randomBytes(16).toString("hex")}`,
+      operationKind: "workspace.restore-settlement", scopes: [{ kind: "profile" }] }, async () => {
+      if (!current()) return;
+      const store = deps.getWorkspaceRestoreStore!();
+      if (!store) return;
+      const authority: Threads.TelegramWorkspaceRestoreAuthority = {
+        executor: { instanceId, leaderEpoch: String(epoch) }, operatorUserId, isCurrent: current };
+      const assertCurrent = (): void => { if (!current()) throw new Error("Workspace Restore settlement authority ended."); };
+      // Exact owner abandonment of every original is terminal for an unsent Restore; no cleanup or delivery follows.
+      const abandoned = (value: Threads.TelegramWorkspaceRestoreIntent): boolean => {
+        if (evidence?.kind !== "completed" || !value.request.source.updateIds.length) return false;
+        return value.request.source.updateIds.every(updateId => {
+          const proof = deps.inspectRestoreSourceAbandonment?.(updateId, sourceBinding);
+          assertCurrent();
+          return proof?.journalBindingKey === sourceBinding && proof.updateId === updateId &&
+            proof.operatorAuthorityId === `telegram-owner:${operatorUserId}`;
+        });
+      };
+      for (const operationId of selected) {
+        assertCurrent();
+        let intent = store.list().find(value => value.request.operationId === operationId);
+        let settlementCurrent = current;
+        let settlementCanonicalCurrent: (() => boolean) | undefined;
+        let retired = false;
+        if (follower && intent && inspectableSuccessor(intent) && intent.operatorUserId === operatorUserId) {
+          const ports = deps.workspaceRestoreRecipient!;
+          const successor: Threads.TelegramWorkspaceRestoreRecipient = { kind: "follower", instanceId: follower.instanceId,
+            sessionId: follower.sessionId!, generation: follower.registrationGeneration! };
+          const { request } = intent;
+          // Adoption plus inspect never consumes the original apply grant, delivers input or issues cleanup.
+          await advanceTelegramWorkspaceRestore({ request, authority, restoreStore: store, inspectOnly: true,
+            getRecipient: () => current() ? successor : undefined,
+            async runRecipient(action) {
+              if (action.mode !== "inspect" || !action.isCurrent()) return undefined;
+              return ports.runFollower({ operationId: request.operationId, instanceId: successor.instanceId,
+                sessionId: successor.sessionId, slot: request.binding.slot!, target: request.target,
+                oldTarget: request.binding.target, mode: "inspect", isCurrent: action.isCurrent });
+            } });
+          continue;
+        }
+        if (intent && inspectableLeader(intent) && intent.operatorUserId === operatorUserId) {
+          const threads = deps.threadStore!;
+          const leader: Threads.TelegramWorkspaceRestoreRecipient = { kind: "leader", instanceId,
+            sessionId: intent.request.binding.sessionId!, generation: String(generation) };
+          const { request } = intent;
+          await threads.load();
+          assertCurrent();
+          await advanceTelegramWorkspaceRestore({ request, authority, restoreStore: store, inspectOnly: true,
+            getRecipient: () => current() && leaderAt(request) ? leader : undefined,
+            async runRecipient(action) {
+              if (action.mode !== "inspect") return undefined;
+              return observeLeaderRestore(action.intent, leader, action.isCurrent);
+            } });
+          continue;
+        }
+        if (intent?.phase === "ready" && intent.routing === undefined && intent.operatorUserId === operatorUserId &&
+            intent.request.source.journalBindingKey === sourceBinding && abandoned(intent)) {
+          const owned = isDeepStrictEqual(intent.executor, authority.executor) ? intent : store.adopt(intent, authority);
+          assertCurrent();
+          if (owned) store.retireAbandoned(owned, owned.request.source.updateIds, authority);
+          continue;
+        }
+        const liveRecipient = intent && recoveryRecipient(intent), localRecipient = intent && recoveryLeader(intent);
+        if (intent && (liveRecipient || localRecipient) && intent.request.source.journalBindingKey === sourceBinding) {
+          const expected = intent, ports = deps.workspaceRestoreRecipient!;
+          const recoveryCurrent = (): boolean => current() && (localRecipient ? leaderAt(expected.request) && isDeepStrictEqual(
+            recoveryLeader(expected), localRecipient) : isDeepStrictEqual(
+            { ...recoveryRecipient(expected), lastHeartbeatMs: undefined, connectedAtMs: undefined, threadName: undefined },
+            { ...liveRecipient, lastHeartbeatMs: undefined, connectedAtMs: undefined, threadName: undefined }));
+          // Storage authority callbacks check live fences only; canonical reads cannot re-enter their transaction lock.
+          const recoveryAuthority = { ...authority, isCurrent: recoveryCurrent };
+          settlementCurrent = recoveryCurrent;
+          if (localRecipient) {
+            settlementCanonicalCurrent = () => !!intent && !!observeLeaderRestore(intent, localRecipient, recoveryCurrent);
+            if (!settlementCanonicalCurrent()) continue; // A local target alone cannot authorize executor adoption.
+          }
+          const inspect = (acceptance: Threads.TelegramWorkspaceRestoreSourceAcceptance,
+            operation: Threads.TelegramWorkspaceRestoreIntent): boolean => {
+            const completion = { journalBindingKey: sourceBinding, updateId: acceptance.updateId,
+              sourceSha256: acceptance.sourceSha256,
+              completionSha256: Threads.getTelegramWorkspaceRestoreSourceCompletionSha256(operation, acceptance) };
+            const observed = deps.inspectRestoreSourceCompletion!({ ...completion });
+            if (!recoveryCurrent()) throw new Error("Workspace Restore completion observation authority ended.");
+            return isDeepStrictEqual(observed, completion);
+          };
+          // Inspect proof before adopting: missing/foreign ACKs cannot even re-key the retained operation.
+          const accepted = expected.routing!.acceptances!.filter(value =>
+            (localRecipient ? value.kind === "completed" || value.kind === "queued" : value.kind === "forwarded") && inspect(value, expected));
+          if (accepted.length) {
+            const successor: Threads.TelegramWorkspaceRestoreRecipient = localRecipient ?? { kind: "follower", instanceId: liveRecipient!.instanceId,
+              sessionId: liveRecipient!.sessionId!, generation: liveRecipient!.registrationGeneration! };
+            const { request } = expected;
+            const inspected = await advanceTelegramWorkspaceRestore({ request, authority: recoveryAuthority, restoreStore: store, inspectOnly: true,
+              getRecipient: () => recoveryCurrent() ? successor : undefined,
+              async runRecipient(action) {
+                if (action.mode !== "inspect" || !action.isCurrent()) return undefined;
+                if (localRecipient) return observeLeaderRestore(action.intent, successor, action.isCurrent);
+                return ports.runFollower({ operationId: request.operationId, instanceId: successor.instanceId,
+                  sessionId: successor.sessionId, slot: request.binding.slot!, target: request.target,
+                  oldTarget: request.binding.target, mode: "inspect", isCurrent: action.isCurrent });
+              } });
+            if (!inspected || !recoveryCurrent()) continue;
+            intent = inspected;
+            if (settlementCanonicalCurrent && !settlementCanonicalCurrent()) continue;
+            // The await cannot lend earlier readback; confirm each immutable proof again before publication.
+            const settledIds = new Set(intent.routing!.settlements.filter(value => value.kind !== "queued").flatMap(value => value.updateIds));
+            const recovered = new Map<string, Threads.TelegramWorkspaceRestoreSourceSettlement>();
+            for (const acceptance of accepted.filter(value => !settledIds.has(value.updateId) && inspect(value, intent!))) {
+              const key = acceptance.kind === "queued" ? JSON.stringify([acceptance.receiptId, acceptance.queueKind]) : "completed";
+              const settlement = recovered.get(key) ?? { journalBindingKey: sourceBinding, updateIds: [],
+                ...(acceptance.kind === "queued" ? { kind: "queue-completed" as const, receiptId: acceptance.receiptId, queueKind: acceptance.queueKind }
+                  : { kind: "completed" as const }) };
+              settlement.updateIds.push(acceptance.updateId);
+              recovered.set(key, settlement);
+            }
+            for (const settlement of recovered.values()) {
+              intent = store.recordSourceSettlement(intent!, settlement, recoveryAuthority);
+              if (!intent) break;
+            }
+            if (!intent) continue;
+          }
+        }
+        // Source hints carry no registry fence; cleanup must keep the acknowledged recipient exact across awaits.
+        const readyRecipientCurrent = (): boolean => {
+          const ready = intent?.readyRecipient ?? intent?.recipient;
+          if (intent?.phase !== "ready" || ready?.kind !== "follower") return true;
+          const live = deps.workspaceRestoreRecipient?.followerRegistry.get(ready.instanceId);
+          return !!live?.cwd && live.registrationGeneration === ready.generation && live.sessionId === ready.sessionId &&
+            WorkspaceIdentity.normalizeTelegramWorkspacePath(live.cwd) === intent.request.binding.cwd &&
+            live.slot === intent.request.binding.slot && isDeepStrictEqual(live.target, intent.request.target) &&
+            Bus.hasTelegramBusCapability(live.protocol, Bus.TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) &&
+            Bus.hasTelegramBusCapability(live.protocol, Bus.TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION);
+        };
+        const settlementAuthority = { ...authority, isCurrent: function () { return settlementCurrent() && readyRecipientCurrent(); } };
+        const assertSettlementCurrent = (): void => {
+          if (!settlementAuthority.isCurrent() || (!retired && settlementCanonicalCurrent && !settlementCanonicalCurrent())) {
+            throw new Error("Workspace Restore settlement authority ended.");
+          }
+        };
+        assertSettlementCurrent();
+        if (!intent || intent.phase !== "ready" || !intent.routing || !isDeepStrictEqual(intent.executor, authority.executor) ||
+            intent.operatorUserId !== operatorUserId || intent.request.source.journalBindingKey !== sourceBinding) continue;
+        const settled = new Set(intent.routing.settlements.flatMap(value => value.updateIds));
+        if (follower && (intent.routing.cleanup !== undefined || !recipientMatches(intent) ||
+            !intent.request.source.updateIds.every(id => settled.has(id)))) continue;
+        const updateIds = evidence?.updateIds.filter(id => intent!.request.source.updateIds.includes(id) && !settled.has(id)) ?? [];
+        if (evidence && updateIds.length) {
+          intent = store.recordSourceSettlement(intent, { ...evidence, updateIds }, settlementAuthority);
+          if (!intent) continue;
+        }
+        if (intent.routing?.cleanup === undefined) {
+          if (!intent.request.source.updateIds.every(id => intent!.routing!.settlements.some(value => value.kind !== "queued" && value.updateIds.includes(id)))) continue;
+          // Positive settlement of every selected source is the success proof; old-thread cleanup may stay protected indefinitely.
+          await disposeTemporaryThreadSiblingsAfterRestore(intent, ctx, settlementAuthority.isCurrent);
+          assertSettlementCurrent();
+          if (isRerouteTargetProtected(intent.request.binding.target, intent)) continue;
+          const grant = store.issueCleanup(intent, settlementAuthority);
+          if (!grant) continue;
+          intent = grant.intent;
+          const oldTarget = intent.request.binding.target;
+          const completed = intent.request.owner.owner?.kind === "leader"
+            ? await closePreviousLeaderThread(oldTarget, assertSettlementCurrent, intent)
+            : await closeReplacedFollowerThread(oldTarget, intent.request.owner.instanceId, assertSettlementCurrent, intent);
+          assertSettlementCurrent();
+          if (!completed) continue; // Issued uncertainty stays protected, never downgraded or retried.
+          intent = store.recordCleanup(intent, { kind: "completed", target: oldTarget }, settlementAuthority);
+          if (!intent) continue;
+        }
+        if (!store.retire(intent, settlementAuthority)) continue;
+        retired = true;
+        for (const [id, pending] of pendingUnboundReroutes) {
+          if (pending.workspaceRestore?.operationId !== operationId) continue;
+          pending.finalizeMessage = "Message routed.";
+          if (!deps.editInteractiveMessage || pending.chooserMessageId === undefined) continue;
+          assertSettlementCurrent();
+          await deps.editInteractiveMessage(pending.sourceTarget.chatId, pending.chooserMessageId,
+            "<b>✅ Message routed.</b>", "html", { inline_keyboard: [] });
+          assertSettlementCurrent();
+          if (pendingUnboundReroutes.get(id) === pending) removePendingReroute(id);
+        }
+      }
+    })).catch(error => { deps.recordRuntimeEvent?.("telegram", error, { phase: "workspace-restore-settlement" }); });
+    restoreSettlementTasks.add(task);
+    void task.finally(() => restoreSettlementTasks.delete(task));
+    return task;
+  };
+  const beforeQueueReceiptPublished: NonNullable<Updates.TelegramUpdateWorkerRuntimeDeps<TContext>["beforeQueueReceiptPublished"]> =
+    async (receipt, queueOwner, ctx, isWorkerCurrent) => {
+      const store = deps.getWorkspaceRestoreStore?.();
+      if (!store) return;
+      const selected = store.list().filter(intent => intent.request.source.journalBindingKey === receipt.journalBindingKey &&
+        intent.request.source.updateIds.some(id => receipt.sourceUpdateIds.includes(id))).map(intent => intent.request.operationId);
+      if (!selected.length) return;
+      const instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.();
+      const generation = deps.getSessionGeneration?.(), scope = deps.getAdmissionScope?.(), operatorUserId = deps.configStore.getAllowedUserId();
+      const binding = receipt.journalBindingKey, ports = deps.workspaceRestoreRecipient, threads = deps.threadStore;
+      if (!instanceId || epoch === undefined || generation === undefined || !scope || !binding || operatorUserId === undefined ||
+          !ports || !threads || !deps.runWorkspaceOperation || !deps.inspectRestoreQueuedReceipt) {
+        throw new Error("Workspace Restore queued acceptance authority is unavailable.");
+      }
+      const expectedReceipt: TelegramUpdateJournalQueuedCompletion = { queueKind: receipt.queueKind, receiptId: receipt.receiptId,
+        sourceUpdateIds: [...receipt.sourceUpdateIds], queueOwner: { ...queueOwner } };
+      const current = (): boolean => isWorkerCurrent() && deps.hasWorkspaceRestoreAuthority?.() === true &&
+        deps.isContextActive?.(ctx) !== false && deps.getSessionGeneration?.() === generation && deps.getAdmissionScope?.() === scope &&
+        deps.getAdmissionJournalBinding?.() === binding && deps.getCurrentInstanceId?.() === instanceId &&
+        deps.getCurrentLeaderEpoch?.() === epoch && deps.configStore.getAllowedUserId() === operatorUserId &&
+        queueOwner.instanceId === instanceId && queueOwner.sessionGeneration === generation;
+      const assertCurrent = (): void => { if (!current()) throw new Error("Workspace Restore queued acceptance authority changed."); };
+      assertCurrent();
+      const recipientGuards: Array<() => boolean> = [];
+      const sourceCompletions: Updates.TelegramQueueSourceCompletion[] = [];
+      await deps.runWorkspaceOperation({ operationId: `restore-queue-acceptance-${randomBytes(16).toString("hex")}`,
+        operationKind: "workspace.restore-queue-acceptance", scopes: [{ kind: "profile" }] }, async () => {
+        assertCurrent();
+        const active = deps.getWorkspaceRestoreStore?.();
+        if (!active) throw new Error("Workspace Restore queued acceptance storage disappeared.");
+        const proof = deps.inspectRestoreQueuedReceipt!({ ...structuredClone(expectedReceipt), journalBindingKey: binding });
+        assertCurrent();
+        if (!proof || !isDeepStrictEqual(proof.receipt, expectedReceipt) || !/^[a-f0-9]{64}$/u.test(proof.queueOwnerSha256) ||
+            proof.sources.length !== receipt.sourceUpdateIds.length || proof.sources.some((source, index) =>
+              source.updateId !== receipt.sourceUpdateIds[index] || !/^[a-f0-9]{64}$/u.test(source.sourceSha256))) {
+          throw new Error("Workspace Restore queued receipt proof is unavailable.");
+        }
+        for (const operationId of selected) {
+          let intent = active.list().find(value => value.request.operationId === operationId);
+          const recipient = intent?.readyRecipient ?? intent?.recipient;
+          if (!intent || intent.phase !== "ready" || !intent.routing || intent.operatorUserId !== operatorUserId ||
+              !isDeepStrictEqual(intent.executor, { instanceId, leaderEpoch: String(epoch) }) ||
+              intent.request.source.journalBindingKey !== binding || recipient?.kind !== "leader" || recipient.instanceId !== instanceId ||
+              recipient.generation !== String(generation) || recipient.sessionId !== intent.request.binding.sessionId) {
+            throw new Error("Workspace Restore queued recipient proof changed.");
+          }
+          const request = intent.request;
+          const liveRecipientCurrent = (): boolean => {
+            const local = ports.getLeaderIdentity(), cwd = ports.getCwd(ctx);
+            return current() && !!local && local.slot === request.binding.slot && isDeepStrictEqual(local.target, request.target) &&
+              ports.getSessionId(ctx) === recipient.sessionId && !!cwd && WorkspaceIdentity.normalizeTelegramWorkspacePath(cwd) === request.binding.cwd;
+          };
+          const recipientCurrent = (): boolean => {
+            if (!liveRecipientCurrent()) return false;
+            let committed = false;
+            threads.withWorkspaceRestoreSnapshot(intent!, snapshot => {
+              const live = snapshot.workspaceBindings?.filter(value => value.bindingKey === request.binding.bindingKey) ?? [];
+              const owners = snapshot.threads.filter(value => value.status === "active" &&
+                (value.slot === request.binding.slot || isDeepStrictEqual(value.target, request.target)));
+              const local = ports.getLeaderIdentity(), cwd = ports.getCwd(ctx);
+              committed = live.length === 1 && live[0]?.sessionId === recipient.sessionId && live[0].cwd === request.binding.cwd &&
+                live[0].slot === request.binding.slot && live[0].inactiveSinceMs === undefined && isDeepStrictEqual(live[0].target, request.target) &&
+                owners.length === 1 && owners[0]?.owner?.kind === "leader" && owners[0].instanceId === instanceId &&
+                owners[0].owner.instanceId === instanceId && !!owners[0].owner.cwd &&
+                WorkspaceIdentity.normalizeTelegramWorkspacePath(owners[0].owner.cwd) === request.binding.cwd && owners[0].profileKey === request.owner.profileKey &&
+                owners[0].slot === request.binding.slot && isDeepStrictEqual(owners[0].target, request.target) &&
+                !!local && local.slot === request.binding.slot && isDeepStrictEqual(local.target, request.target) &&
+                ports.getSessionId(ctx) === recipient.sessionId && !!cwd && WorkspaceIdentity.normalizeTelegramWorkspacePath(cwd) === request.binding.cwd;
+            });
+            return committed && liveRecipientCurrent();
+          };
+          recipientGuards.push(recipientCurrent);
+          // Storage owns the canonical CAS; its in-transaction authority callback cannot reacquire the snapshot lock.
+          const authority: Threads.TelegramWorkspaceRestoreAuthority = { executor: { instanceId, leaderEpoch: String(epoch) }, operatorUserId, isCurrent: liveRecipientCurrent };
+          for (const source of proof.sources.filter(value => request.source.updateIds.includes(value.updateId))) {
+            if (!recipientCurrent()) throw new Error("Workspace Restore queued recipient authority changed.");
+            const evidence: Threads.TelegramWorkspaceRestoreSourceAcceptance = { ...source, journalBindingKey: binding, recipient,
+              kind: "queued", receiptId: receipt.receiptId, queueKind: receipt.queueKind, queueOwnerSha256: proof.queueOwnerSha256 };
+            let accepted: Threads.TelegramWorkspaceRestoreIntent | undefined, failure: unknown;
+            try { accepted = active.recordSourceAcceptance(intent, evidence, authority); } catch (error) { failure = error; }
+            if (!accepted) accepted = active.list().find(value => value.request.operationId === operationId &&
+              isDeepStrictEqual(value.request, request) && isDeepStrictEqual(value.executor, authority.executor) && value.operatorUserId === operatorUserId &&
+              value.routing?.acceptances?.some(retained => isDeepStrictEqual(retained, evidence)));
+            if (!accepted || !isDeepStrictEqual(accepted.request, request) || !isDeepStrictEqual(accepted.executor, authority.executor) ||
+                accepted.operatorUserId !== operatorUserId || !accepted.routing?.acceptances?.some(value => isDeepStrictEqual(value, evidence))) {
+              throw failure ?? new Error("Workspace Restore queued acceptance was not published.");
+            }
+            intent = accepted;
+            sourceCompletions.push({ ...source, journalBindingKey: binding,
+              completionSha256: Threads.getTelegramWorkspaceRestoreSourceCompletionSha256(accepted, evidence) });
+            if (!recipientCurrent()) throw new Error("Workspace Restore queued recipient authority changed.");
+          }
+        }
+        const observed = deps.inspectRestoreQueuedReceipt!({ ...structuredClone(expectedReceipt), journalBindingKey: binding });
+        assertCurrent();
+        if (!isDeepStrictEqual(observed, proof)) throw new Error("Workspace Restore queued receipt changed after publication.");
+      });
+      assertCurrent();
+      if (recipientGuards.some(guard => !guard())) throw new Error("Workspace Restore queued recipient changed after admission.");
+      return sourceCompletions.sort((a, b) => a.updateId - b.updateId);
+    };
+  const onQueueReceiptCompleted = (receipt: Updates.TelegramQueueAdmissionReceiptLike, ctx: TContext): void => {
+    // A hint re-enters admission and rereads scoped proof; it never supplies completed command evidence for a queued source.
+    if (!receipt.journalBindingKey) return;
+    observeRestoreSettlement({ kind: "source", evidence: { journalBindingKey: receipt.journalBindingKey,
+      updateIds: [...receipt.sourceUpdateIds], kind: "completed" } }, ctx);
+    for (const updateId of receipt.sourceUpdateIds) retireCompletedTemporaryThread(updateId, ctx, receipt.journalBindingKey);
+  };
+  const onQueueReceiptCommitted = (receipt: Updates.TelegramQueueAdmissionReceiptLike, ctx: TContext): void => {
+    if (receipt.journalBindingKey) observeRestoreSettlement({ kind: "source", evidence: { journalBindingKey: receipt.journalBindingKey,
+      updateIds: [...receipt.sourceUpdateIds], kind: "queued", receiptId: receipt.receiptId, queueKind: receipt.queueKind } }, ctx);
+  };
+  // Worker-confirmed source completion is the only evidence for a Forwarded input. It records a durable group fact and
+  // starts the same delayed, fully rechecked cleanup as the last Cancel; deletion itself never happens here.
+  const completedTemporaryInputIds = new Map<string, Set<number>>();
+  const retireCompletedTemporaryThread = (updateId: number, ctx: TContext, journalBindingKey: string): void => {
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!cap || !deps.runWorkspaceOperation || cap.journalBindingKey !== journalBindingKey) return;
+    const store = cap.store;
+    const matches = (entry: Threads.TelegramTemporaryThreadEntry) =>
+      entry.source.journalBindingKey === journalBindingKey && entry.source.updateId === updateId;
+    const inGroup = (entry: Threads.TelegramTemporaryThreadEntry) => Threads.getTelegramTemporaryThreadInputs(entry).some(input =>
+      input.journalBindingKey === journalBindingKey && input.updateIds.includes(updateId));
+    let restoreOwned = false;
+    try {
+      if (!store.listTemporaryThreads().some(entry => matches(entry) || inGroup(entry))) return;
+      restoreOwned = store.list().some(intent => intent.request.source.journalBindingKey === journalBindingKey &&
+        intent.request.source.updateIds.includes(updateId));
+    } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-retire" }); return; }
+    const task = Promise.resolve().then(() => deps.runWorkspaceOperation!({ operationId: `temporary-thread-retire-${randomBytes(16).toString("hex")}`,
+      operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
+      if (!cap.isCurrent()) return;
+      let entry = store.listTemporaryThreads().find(restoreOwned ? matches : inGroup);
+      if (!entry) return;
+      if (restoreOwned) {
+        // A Restore keeps its own lifecycle: only its source entry may be released, never by Forward bookkeeping.
+        if (entry.target && hasOtherTemporaryThreadReroute(entry.target, entry)) return;
+        entry = cap.adopt(entry);
+        if (entry && cap.isCurrent()) store.retireTemporaryThread(entry, cap.authority);
+        return;
+      }
+      const group = Threads.getTelegramTemporaryThreadInputs(entry).find(input =>
+        input.journalBindingKey === journalBindingKey && input.updateIds.includes(updateId));
+      const target = entry.target;
+      if (!group || entry.phase !== "created" || !target) return;
+      if (entry.cancelledInputs?.some(input => isDeepStrictEqual(input, group)) ||
+          entry.completedInputs?.some(input => isDeepStrictEqual(input, group))) return;
+      // Process-local accumulation only: a restart forgets partial groups and the tab stays protected.
+      const seen = completedTemporaryInputIds.get(entry.token) ?? new Set<number>();
+      seen.add(updateId);
+      completedTemporaryInputIds.set(entry.token, seen);
+      if (!group.updateIds.every(id => seen.has(id))) return;
+      entry = cap.adopt(entry);
+      if (!entry || !cap.isCurrent() || !store.recordTemporaryThreadInputCompletion(entry, group, cap.authority) || !cap.isCurrent()) return;
+      scheduleTemporaryThreadCleanup(target, ctx);
+      return true;
+    })).then(published => {
+      // A sibling may complete after Restore already settled. Reinspect only after its terminal fact publishes and admission releases.
+      if (published && cap.isCurrent()) observeRestoreSettlement({ kind: "source",
+        evidence: { journalBindingKey, updateIds: [updateId], kind: "completed" } }, ctx);
+    }).catch(error => { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-retire" }); });
+    restoreSettlementTasks.add(task);
+    void task.finally(() => restoreSettlementTasks.delete(task));
   };
+  const onUpdateCompleted = (updateId: number, ctx: TContext, journalBindingKey?: string): void => {
+    if (!journalBindingKey) return;
+    observeRestoreSettlement({ kind: "source", evidence: { journalBindingKey, updateIds: [updateId], kind: "completed" } }, ctx);
+    retireCompletedTemporaryThread(updateId, ctx, journalBindingKey);
+  };
+  const restoreWorkspace = deps.workspaceRestoreRecipient ? async (input: {
+    operationId: string; record: Threads.TelegramTopicTargetRecord;
+    target: Threads.TelegramTopicTargetRecord["target"]; messages: readonly TMessage[];
+    ctx: TContext; isCurrent: () => boolean;
+    dispatch: (recipient: { kind: "leader" | "follower"; instanceId: string }, isRecipientCurrent: () => boolean,
+      recordForwardAcceptance: (message: TMessage, delivery: Bus.TelegramBusFollowerDeliveryIdentity) => Updates.TelegramDeferredSourceEvidence,
+      recordLocalAcceptance: (message: TMessage) => Updates.TelegramDeferredSourceEvidence) => Promise<boolean>;
+  }) => {
+    const ports = deps.workspaceRestoreRecipient!;
+    const threads = deps.threadStore;
+    if (!threads || !deps.getWorkspaceRestoreStore || !deps.getSessionGeneration ||
+        !deps.hasWorkspaceRestoreAuthority?.() || !input.isCurrent() || input.target.threadId === undefined) return "protected";
+    const instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.();
+    const operatorUserId = deps.configStore.getAllowedUserId(), scope = deps.getAdmissionScope?.();
+    const journalBindingKey = deps.getAdmissionJournalBinding?.(), generation = deps.getSessionGeneration();
+    const sourceIds = Updates.collectTelegramAdmissionSourceUpdateIds(input.messages);
+    if (!instanceId || epoch === undefined || operatorUserId === undefined || !scope || !journalBindingKey || !sourceIds.length) return "protected";
+    const current = (): boolean => input.isCurrent() && deps.hasWorkspaceRestoreAuthority?.() === true &&
+      deps.isContextActive?.(input.ctx) !== false && deps.getSessionGeneration?.() === generation &&
+      deps.getCurrentInstanceId?.() === instanceId && deps.getCurrentLeaderEpoch?.() === epoch &&
+      deps.getAdmissionScope?.() === scope && deps.getAdmissionJournalBinding?.() === journalBindingKey &&
+      deps.configStore.getAllowedUserId() === operatorUserId;
+    await threads.load();
+    if (!current()) return "protected";
+    const store = deps.getWorkspaceRestoreStore();
+    if (!store) return "protected";
+    const retained = store.list().find(value => value.request.operationId === input.operationId);
+    const bindings = threads.listWorkspaceBindings().filter(value => isDeepStrictEqual(value.target, input.record.target));
+    const binding = retained?.request.binding ?? (bindings.length === 1 ? bindings[0] : undefined);
+    if (!binding || !binding.sessionId || !binding.slot) return "protected";
+    const { sessionId, slot } = binding;
+    const request: Threads.TelegramWorkspaceRestoreRequest = { operationId: input.operationId,
+      binding, owner: structuredClone(input.record), target: { chatId: input.target.chatId, threadId: input.target.threadId },
+      source: { journalBindingKey, updateIds: sourceIds } };
+    if (retained && !isDeepStrictEqual(retained.request, request)) return "protected";
+    const getRecipient = (snapshot?: Readonly<Pick<Threads.TelegramTopicTargetFile, "threads" | "workspaceBindings">>): Threads.TelegramWorkspaceRestoreRecipient | undefined => {
+      if (!current()) return undefined;
+      const liveBindings = (snapshot ? snapshot.workspaceBindings ?? [] : threads.listWorkspaceBindings())
+        .filter(value => value.bindingKey === binding.bindingKey);
+      const live = liveBindings[0];
+      if (liveBindings.length !== 1 || live?.sessionId !== binding.sessionId || live.cwd !== binding.cwd || live.slot !== binding.slot ||
+          live.inactiveSinceMs !== undefined || (!isDeepStrictEqual(live.target, binding.target) && !isDeepStrictEqual(live.target, request.target))) return undefined;
+      const records = (snapshot ? snapshot.threads : threads.list()).filter(value => value.status === "active" &&
+        (value.slot === binding.slot || isDeepStrictEqual(value.target, live.target)));
+      const record = records[0];
+      if (records.length !== 1 || record?.slot !== binding.slot || !isDeepStrictEqual(record.target, live.target)) return undefined;
+      if (record.owner?.kind === "leader" && record.instanceId === instanceId) {
+        const cwd = ports.getCwd(input.ctx);
+        if (ports.getSessionId(input.ctx) !== sessionId || !cwd || WorkspaceIdentity.normalizeTelegramWorkspacePath(cwd) !== binding.cwd ||
+            !deps.setCurrentLeaderIdentity) return undefined;
+        return { kind: "leader", instanceId, sessionId, generation: String(generation) };
+      }
+      if (record.owner?.kind !== "manual-follower" || !record.instanceId) return undefined;
+      const follower = ports.followerRegistry.get(record.instanceId);
+      if (!follower?.registrationGeneration || !follower.cwd || follower.sessionId !== sessionId ||
+          WorkspaceIdentity.normalizeTelegramWorkspacePath(follower.cwd) !== binding.cwd || follower.slot !== slot ||
+          !Bus.hasTelegramBusCapability(follower.protocol, Bus.TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE)) return undefined;
+      return { kind: "follower", instanceId: follower.instanceId, sessionId, generation: follower.registrationGeneration };
+    };
+    const hasCommittedTarget = (): boolean => threads.listWorkspaceBindings().some(value =>
+      value.bindingKey === binding.bindingKey && isDeepStrictEqual(value.target, request.target));
+    const authority = { executor: { instanceId, leaderEpoch: String(epoch) }, operatorUserId, isCurrent: current };
+    const ready = await advanceTelegramWorkspaceRestore({ request, authority, restoreStore: store, getRecipient,
+      async runRecipient(action) {
+        const recipient = getRecipient();
+        if (!recipient || !action.isCurrent() || !hasCommittedTarget()) return undefined;
+        if (recipient.kind === "follower") {
+          const follower = ports.followerRegistry.get(recipient.instanceId);
+          const observation = await ports.runFollower({ operationId: request.operationId, instanceId: recipient.instanceId,
+            sessionId: recipient.sessionId, slot: binding.slot!, target: request.target, oldTarget: binding.target,
+            mode: action.mode, isCurrent: action.isCurrent });
+          if (!action.isCurrent() || !hasCommittedTarget()) return undefined;
+          if (!follower || !observation?.ready) return observation;
+          if (observation.operationId !== request.operationId || !isDeepStrictEqual(observation.recipient, recipient) ||
+              !isDeepStrictEqual(observation.target, request.target) || observation.slot !== binding.slot) return undefined;
+          const actual = ports.followerRegistry.get(recipient.instanceId);
+          if (!actual || actual.registrationGeneration !== follower.registrationGeneration || actual.sessionId !== follower.sessionId ||
+              actual.cwd !== follower.cwd || actual.slot !== follower.slot || actual.profileKey !== follower.profileKey ||
+              actual.busSocketPath !== follower.busSocketPath || !isDeepStrictEqual(actual.target, follower.target) ||
+              !isDeepStrictEqual(actual.protocol, follower.protocol)) return undefined;
+          threads.commitWorkspaceRestoreRegistration({ target: request.target, bindingKey: binding.bindingKey, slot: binding.slot }, () => {
+            if (!action.isCurrent()) throw new Error("Workspace Restore recipient authority changed.");
+            ports.followerRegistry.register({ ...actual, target: request.target, connectedAtMs: actual.connectedAtMs });
+          });
+          return observation;
+        }
+        let observation: Awaited<ReturnType<Parameters<typeof advanceTelegramWorkspaceRestore>[0]["runRecipient"]>>;
+        threads.withWorkspaceRestoreSnapshot(action.intent, snapshot => {
+          if (!action.isCurrent() || !isDeepStrictEqual(getRecipient(snapshot), recipient)) return;
+          const live = snapshot.workspaceBindings?.find(value => value.bindingKey === binding.bindingKey);
+          if (!live || !isDeepStrictEqual(live.target, request.target)) return;
+          const local = ports.getLeaderIdentity();
+          if (!local || local.slot !== binding.slot || (!isDeepStrictEqual(local.target, binding.target) &&
+              !isDeepStrictEqual(local.target, request.target))) return;
+          if (action.mode === "apply" && !isDeepStrictEqual(local.target, request.target)) {
+            if (action.intent.phase !== "recipient-issued" || !action.isCurrent()) return;
+            deps.setCurrentLeaderIdentity!({ target: request.target, slot: binding.slot, threadName: request.owner.threadName });
+          }
+          if (!action.isCurrent() || !isDeepStrictEqual(getRecipient(snapshot), recipient)) return;
+          const observed = ports.getLeaderIdentity();
+          if (!observed || observed.slot !== binding.slot) return;
+          observation = { operationId: request.operationId, recipient, target: observed.target as typeof request.target,
+            slot: binding.slot!, ready: isDeepStrictEqual(observed.target, request.target) };
+        });
+        return observation;
+      } }).catch(error => {
+        deps.recordRuntimeEvent?.("telegram", error, { phase: "workspace-restore-recipient" });
+        return undefined;
+      });
+    if (!ready || !current() || ready.routing) return "protected";
+    const recipient = ready.readyRecipient ?? ready.recipient;
+    const recipientCurrent = (): boolean => {
+      if (!current() || !recipient || !hasCommittedTarget() || !isDeepStrictEqual(getRecipient(), recipient)) return false;
+      const observed = recipient.kind === "leader" ? ports.getLeaderIdentity() : ports.followerRegistry.get(recipient.instanceId);
+      return observed?.slot === slot && isDeepStrictEqual(observed.target, request.target);
+    };
+    if (!recipient || !recipientCurrent()) return "protected";
+    if (deps.callApi) {
+      try {
+        await deps.callApi("editForumTopic", { chat_id: request.target.chatId, message_thread_id: request.target.threadId,
+          name: deps.getDisplayTitle?.(request.target) ?? ThreadNaming.getTelegramTopicTitleForThreadName(getRestoredThreadName(request.owner, slot), slot) });
+      } catch (error) { deps.recordRuntimeEvent?.("telegram", error, { phase: "workspace-restore-title" }); }
+    }
+    if (!recipientCurrent() || !store.issueRouting(ready, { ...authority, isCurrent: recipientCurrent })) return "protected";
+    const recordAcceptance = (message: TMessage, delivery?: Bus.TelegramBusFollowerDeliveryIdentity): Updates.TelegramDeferredSourceEvidence => {
+      if (!recipientCurrent() || recipient.kind !== (delivery ? "follower" : "leader")) throw new Error("Workspace Restore acceptance authority changed.");
+      const source = Updates.inspectTelegramDeferredSource(message);
+      const follower = ports.followerRegistry.get(recipient.instanceId);
+      const ownership = deps.getTargetOwnership?.(request.target);
+      if (!source || source.journalBindingKey !== journalBindingKey || !request.source.updateIds.includes(source.updateId) ||
+          delivery && (!follower || ownership?.instanceId !== recipient.instanceId || ownership.ownerGeneration !== recipient.generation ||
+          !ownership.recipientBindingKey || delivery.sourceUpdateId !== source.updateId ||
+          delivery.recipientBindingKey !== ownership.recipientBindingKey || delivery.deliveryId !== Bus.createTelegramBusFollowerDeliveryIdentity({
+            kind: "leader.forwardMessage", recipientBindingKey: ownership.recipientBindingKey, sourceUpdateId: source.updateId }).deliveryId) ||
+          !recipientCurrent()) throw new Error("Workspace Restore acceptance source or delivery changed.");
+      const evidence: Threads.TelegramWorkspaceRestoreSourceAcceptance = { ...source, recipient,
+        ...(delivery ? { kind: "forwarded", deliveryId: delivery.deliveryId, recipientBindingKey: delivery.recipientBindingKey }
+          : { kind: "completed" }) };
+      const expected = store.list().find(value => value.request.operationId === request.operationId);
+      if (!expected || !isDeepStrictEqual(expected.request, request) || !expected.routing ||
+          !recipientCurrent()) throw new Error("Workspace Restore dispatch proof is unavailable.");
+      let accepted: Threads.TelegramWorkspaceRestoreIntent | undefined;
+      let failure: { error: unknown } | undefined;
+      const acceptanceAuthority = { ...authority, isCurrent: recipientCurrent };
+      try { accepted = store.recordSourceAcceptance(expected, evidence, acceptanceAuthority); }
+      catch (error) { failure = { error }; }
+      if (!recipientCurrent()) throw new Error("Workspace Restore acceptance authority changed.");
+      // A lost rename reply observes only the exact full retained proof; it never resends the accepted message.
+      if (!accepted) {
+        const observed = store.list().find(value => value.request.operationId === request.operationId);
+        if (observed && isDeepStrictEqual(observed.request, request) && isDeepStrictEqual(observed.executor, authority.executor) &&
+            observed.operatorUserId === operatorUserId && observed.routing?.acceptances?.some(value => isDeepStrictEqual(value, evidence))) accepted = observed;
+      }
+      if (!accepted || !isDeepStrictEqual(accepted.request, request) || !isDeepStrictEqual(accepted.executor, authority.executor) ||
+          accepted.operatorUserId !== operatorUserId || !accepted.routing?.acceptances?.some(value => isDeepStrictEqual(value, evidence)) ||
+          !recipientCurrent()) throw failure?.error ?? new Error("Workspace Restore acceptance was not published.");
+      return { ...source, completionSha256: Threads.getTelegramWorkspaceRestoreSourceCompletionSha256(accepted, evidence) };
+    };
+    try { await input.dispatch(recipient, recipientCurrent, recordAcceptance, message => recordAcceptance(message)); }
+    catch (error) { deps.recordRuntimeEvent?.("telegram", error, { phase: "workspace-restore-dispatch" }); }
+    // Positive worker ACKs own settlement and cleanup under a subsequent admission.
+    return "protected";
+  } : undefined;
   const retryPendingRerouteCleanup = async (
     cleanup: PendingRerouteCleanup,
     assertExecutionCurrent?: () => void,
@@ -1225,6 +2212,7 @@ export function createTelegramInboundRouteRuntime<
         cleanup.target,
         cleanup.messageId,
         assertExecutionCurrent,
+        cleanup.temporaryThread,
       );
     }
     if (cleanup.kind === "previous-leader") {
@@ -1240,15 +2228,15 @@ export function createTelegramInboundRouteRuntime<
     | ((messages: TMessage[], ctx: TContext) => Promise<void>)
     | undefined;
   const dispatchPendingRerouteMessages = async (
-    pending: Pick<PendingUnboundReroute, "dispatchKind" | "sourceTarget">,
+    pending: Pick<PendingUnboundReroute, "dispatchKind" | "sourceTarget" | "temporaryThread">,
     messages: TMessage[],
     ctx: TContext,
   ): Promise<void> => {
     if (pending.dispatchKind === "command" && dispatchReroutedCommandMessages) {
       await dispatchReroutedCommandMessages(messages, ctx);
-      if (pending.sourceTarget.threadId === undefined) {
-        for (const message of messages) Updates.reportTelegramUpdateCompleted(message);
-      }
+      // Every command chooser deferred its exact original, whether the tab came from Telegram or the bridge.
+      // A queued command retains its separately reported receipt; this cannot settle accepted queue custody.
+      for (const message of messages) Updates.reportTelegramUpdateCompleted(message);
       return;
     }
     await promptEnqueue(messages, ctx);
@@ -1277,36 +2265,78 @@ export function createTelegramInboundRouteRuntime<
       `${successMessage} Chooser cleanup is still pending. Try again.`,
     );
   };
+  const isTemporaryReroute = (pending: PendingUnboundReroute): boolean =>
+    !!pending.temporaryThread || pending.temporaryMembership === true || isTemporaryTabTarget(pending.sourceTarget);
+  const isTemporaryThreadForwardIssued = (pending: PendingUnboundReroute): boolean => {
+    try {
+      const entry = pending.temporaryThread ?? findCreatedTemporaryThread(pending.sourceTarget);
+      const store = deps.getWorkspaceRestoreStore?.();
+      if ((entry || pending.temporaryMembership) && !store) return true;
+      const stored = entry && store?.listTemporaryThreads().find(value => value.token === entry.token);
+      const updateIds = Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages);
+      return !!stored?.forwardedInputs?.some(input => input.updateIds.some(id => updateIds.includes(id)));
+    } catch { return true; }
+  };
+  /** Publishes the durable one-time Forward fact for this chooser's exact group; false means nothing may be sent. */
+  const issueTemporaryThreadForward = (pending: PendingUnboundReroute, ctx: TContext): boolean => {
+    const entry = pending.temporaryThread ?? findCreatedTemporaryThread(pending.sourceTarget);
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!entry || !cap) return false;
+    const group = { journalBindingKey: entry.source.journalBindingKey, updateIds: Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages) };
+    try {
+      const current = cap.store.listTemporaryThreads().find(value => value.token === entry.token);
+      const adopted = current && cap.isCurrent() ? cap.adopt(current) : undefined;
+      return !!adopted && cap.isCurrent() && !!cap.store.recordTemporaryThreadForwardIssued(adopted, group, cap.authority) && cap.isCurrent();
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-forward-issue" });
+      return false;
+    }
+  };
   const forwardPendingRerouteMessages = async (
     pending: PendingUnboundReroute,
     instanceId: string,
     threadId: number,
     ctx: TContext,
     assertExecutionCurrent?: () => void,
+    recordForwardAcceptance?: (message: TMessage, delivery: Bus.TelegramBusFollowerDeliveryIdentity) => Updates.TelegramDeferredSourceEvidence,
   ): Promise<boolean> => {
     assertExecutionCurrent?.();
     const forwardMessage = deps.foreignOwnedUpdateForwarder?.forwardMessage;
-    if (!forwardMessage) return false;
+    if (!forwardMessage || pending.foreignForwardIssued) return false;
+    const target = { ...pending.sourceTarget, threadId };
+    const liveOwnership = deps.getTargetOwnership?.(target);
+    if (!liveOwnership || liveOwnership.instanceId !== instanceId ||
+        !liveOwnership.ownerGeneration || !liveOwnership.recipientBindingKey) return false;
+    const ownership = structuredClone(liveOwnership);
     const messages = cloneTelegramMessagesForThread(pending.messages, threadId);
+    // Issuance is durable before the RPC: an unacknowledged temporary-tab Forward never becomes another dispatch grant,
+    // even after restart. Any refusal or publication failure sends nothing and keeps the input held.
+    if (!recordForwardAcceptance && isTemporaryReroute(pending) && !issueTemporaryThreadForward(pending, ctx)) {
+      if (isTemporaryThreadForwardIssued(pending)) pending.foreignForwardIssued = true;
+      return false;
+    }
+    if (!recordForwardAcceptance && isTemporaryReroute(pending)) pending.foreignForwardIssued = true;
     const outcomes = await Promise.allSettled(
       messages.map((message) =>
         forwardMessage({
           message,
-          ownership: { instanceId },
+          ownership,
           ctx,
         }),
       ),
     );
     assertExecutionCurrent?.();
+    if (!isDeepStrictEqual(deps.getTargetOwnership?.(target), ownership)) return false;
     pending.messages = pending.messages.filter((_, index) => {
       const outcome = outcomes[index];
       if (
         outcome?.status === "fulfilled" &&
         outcome.value.status === "accepted"
       ) {
-        if (pending.dispatchKind === "command" && pending.sourceTarget.threadId === undefined) {
-          Updates.reportTelegramUpdateCompleted(pending.messages[index]);
-        }
+        // Restore publishes acceptance before reporting completion; cleanup still waits for journal disposition.
+        const expectedSource = recordForwardAcceptance?.(pending.messages[index], outcome.value.delivery);
+        assertExecutionCurrent?.();
+        Updates.reportTelegramUpdateCompleted(pending.messages[index], expectedSource);
         return false;
       }
       if (outcome?.status === "rejected") {
@@ -1319,9 +2349,540 @@ export function createTelegramInboundRouteRuntime<
       }
       return true;
     });
+    if (pending.messages.length === 0) pending.foreignForwardIssued = false;
     return pending.messages.length === 0;
   };
-  const handleUnboundRerouteRestoreMenuCallback = async (
+  const temporaryCleanupTimers = new Map<string, { timer: ReturnType<typeof setTimeout>; settle: () => void }>();
+  const cancelTemporaryThreadCleanup = (token: string): void => {
+    const scheduled = temporaryCleanupTimers.get(token);
+    if (!scheduled) return;
+    clearTimeout(scheduled.timer);
+    temporaryCleanupTimers.delete(token);
+    scheduled.settle();
+  };
+  /**
+   * One cleanup attempt after the quiet period. Cancellation facts are only a precondition: fresh authority, proof,
+   * absence of chooser and journal custody, and the ordinary protection checks must all hold again. The attempt is
+   * durably issued once; a skipped or unknown removal keeps the entry protecting the tab across restart.
+   */
+  const runTemporaryThreadCleanup = async (token: string, cap: TemporaryThreadAuthority, reconcileExpiry: boolean): Promise<void> => {
+    const store = cap.store;
+    if ((!deps.inspectRestoreSourceAbandonment && !deps.inspectRoutingInputGroupExpiry) || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent()) return;
+    await deps.runWorkspaceOperation({ operationId: `temporary-thread-cleanup-${randomBytes(16).toString("hex")}`,
+      operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
+      if (!cap.isCurrent()) return;
+      let entry = store.listTemporaryThreads().find(value => value.token === token && value.phase === "created" && !!value.target);
+      const target = entry?.target;
+      if (!entry || !target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+          entry.source.journalBindingKey !== cap.journalBindingKey) return;
+      const owner = `telegram-owner:${cap.operatorUserId}`;
+      if (reconcileExpiry && deps.inspectRoutingInputGroupExpiry) {
+        for (const group of Threads.getTelegramTemporaryThreadInputs(entry)) {
+          if ([...(entry.cancelledInputs ?? []), ...(entry.completedInputs ?? [])].some(value => isDeepStrictEqual(value, group))) continue;
+          const inspect = (id: number) => deps.inspectRoutingInputGroupExpiry!(group)?.find(value => value.updateId === id);
+          if (!group.updateIds.every(id => inspect(id)?.operatorAuthorityId === owner)) continue;
+          entry = cap.adopt(entry);
+          if (!entry || !cap.isCurrent()) return;
+          let recorded: Threads.TelegramTemporaryThreadEntry | undefined, failure: unknown;
+          try { recorded = store.recordTemporaryThreadInputExpiry(entry, group, cap.authority, inspect); }
+          catch (error) { failure = error; }
+          if (!cap.isCurrent()) return;
+          const retained = store.listTemporaryThreads().find(value => value.token === token);
+          // A lost publication ACK may already have recorded the group or retired a bound tab's temporary frame.
+          if (!retained) return;
+          if (!recorded && !retained.cancelledInputs?.some(value => isDeepStrictEqual(value, group)))
+            throw failure ?? new Error("Chooser expiry metadata was not confirmed.");
+          entry = retained;
+        }
+      }
+      if (!Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target)) return;
+      const cancelled = entry.cancelledInputs ?? [];
+      const cancelledCurrent = () => cancelled.every(input => {
+        const expiry = deps.inspectRoutingInputGroupExpiry?.(input);
+        return input.updateIds.every(updateId => {
+          const evidence = deps.inspectRestoreSourceAbandonment?.(updateId, input.journalBindingKey) ?? expiry?.find(value => value.updateId === updateId);
+          return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId && evidence.operatorAuthorityId === owner;
+        });
+      });
+      if (!cancelledCurrent()) return;
+      entry = cap.adopt(entry);
+      if (!entry || !cap.isCurrent() || isRerouteTargetProtected(target, undefined, entry)) return;
+      const issued = store.issueTemporaryThreadCleanup(entry, cap.authority);
+      if (!issued || !cap.isCurrent()) return;
+      entry = issued.entry;
+      const issuedEntry = entry;
+      const assertCurrent = (): void => {
+        if (!cap.isCurrent() || !cancelledCurrent() || !store.isTemporaryThreadCleanupCurrent(issuedEntry, cap.authority))
+          throw new Error("Temporary Thread cleanup authority or exact grant evidence changed.");
+      };
+      if (!await closeReroutedUnboundTopic(target, undefined, assertCurrent, entry) || !cap.isCurrent()) return;
+      store.retireTemporaryThread(entry, cap.authority);
+    });
+  };
+  // Reuse the one timer per tab for body-free metadata retries. Future retry timers do not join settlement waits;
+  // only their running attempt does. No retry is licensed once a destructive grant may have been issued.
+  const queueTemporaryThreadCleanup = (token: string, cap: TemporaryThreadAuthority, delay: number, reconcileExpiry: boolean, retry = false): void => {
+    cancelTemporaryThreadCleanup(token);
+    let settle = (): void => undefined;
+    const task = new Promise<void>(resolve => { settle = resolve; });
+    const timer = setTimeout(() => {
+      if (temporaryCleanupTimers.get(token)?.timer !== timer) return;
+      temporaryCleanupTimers.delete(token);
+      if (retry) restoreSettlementTasks.add(task);
+      runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+        .catch(error => {
+          deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" });
+          if (!reconcileExpiry || !cap.isCurrent()) return;
+          try {
+            const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+            if (retained && !retained.cleanupIssued && cap.isCurrent()) queueTemporaryThreadCleanup(token, cap, 60_000, true, true);
+          } catch { /* Unknown grant state never licenses a retry. */ }
+        })
+        .finally(settle);
+    }, delay);
+    timer.unref?.();
+    temporaryCleanupTimers.set(token, { timer, settle });
+    if (!retry) restoreSettlementTasks.add(task);
+    void task.finally(() => restoreSettlementTasks.delete(task));
+  };
+  /** Starts the quiet period for resolved groups or body-free expiry reconciliation; fresh input/authority revokes it. */
+  const scheduleTemporaryThreadCleanup = (target: Queue.TelegramQueueTarget, ctx: TContext, reconcileExpiry = false): void => {
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target)) return;
+    let entry: Threads.TelegramTemporaryThreadEntry | undefined;
+    try { entry = cap.store.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target)); }
+    catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
+    if (!entry || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
+    if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) {
+      try { reconcileExpiry = Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)); }
+      catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
+    }
+    if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) return;
+    const requested = deps.temporaryThreadCleanupDelayMs;
+    const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
+    queueTemporaryThreadCleanup(entry.token, cap, delay, reconcileExpiry);
+  };
+  const recordCancelledTemporaryThreadInput = (pending: PendingUnboundReroute, ctx: TContext, isCurrent: () => boolean): boolean => {
+    const store = deps.getWorkspaceRestoreStore?.(), target = pending.sourceTarget;
+    if (!store || target.threadId === undefined) return !pending.temporaryThread;
+    let entry = store.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target));
+    if (!entry) return !pending.temporaryThread;
+    const cap = captureTemporaryThreadAuthority(ctx, isCurrent), inspect = deps.inspectRestoreSourceAbandonment;
+    if (!cap || !inspect || cap.operatorUserId !== entry.operatorUserId || cap.journalBindingKey !== entry.source.journalBindingKey) return false;
+    const { operatorUserId, journalBindingKey } = cap, current = cap.isCurrent;
+    const input = { journalBindingKey, updateIds: Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages) };
+    if (!current()) return false;
+    entry = cap.adopt(entry);
+    if (!entry || !current()) return false;
+    const recorded = store.recordTemporaryThreadInputCancellation(entry, input, cap.authority, updateId => inspect(updateId, journalBindingKey));
+    if (!recorded || !current() || !recorded.cancelledInputs?.some(value => isDeepStrictEqual(value, input))) return false;
+    const observed = store.listTemporaryThreads().find(value => isDeepStrictEqual(value, recorded));
+    return !!observed && input.updateIds.every(updateId => {
+      const evidence = inspect(updateId, journalBindingKey);
+      return evidence?.journalBindingKey === journalBindingKey && evidence.updateId === updateId &&
+        evidence.operatorAuthorityId === `telegram-owner:${operatorUserId}`;
+    }) && current();
+  };
+  const retireCancellationChooser = async (id: string, pending: PendingUnboundReroute, isCurrent: () => boolean): Promise<boolean> => {
+    if (!pending.abandonment?.result || !isCurrent() || !deps.editInteractiveMessage || pending.chooserMessageId === undefined) return false;
+    await deps.editInteractiveMessage(pending.sourceTarget.chatId, pending.chooserMessageId,
+      "<b>⛔️ Routing cancelled.</b>", "html", { inline_keyboard: [] });
+    if (!isCurrent() || pendingUnboundReroutes.get(id) !== pending) return false;
+    removePendingReroute(id);
+    return true;
+  };
+  const isReviewText = (message: Partial<TMessage> | undefined): boolean => {
+    if (!message || message.chat?.type !== "private" || !Number.isSafeInteger(message.chat.id) ||
+        !Number.isSafeInteger(message.from?.id) || message.from?.is_bot !== false ||
+        !Number.isSafeInteger(message.message_id) || message.message_id! <= 0 ||
+        !Number.isSafeInteger(message.message_thread_id) || message.message_thread_id! <= 0 ||
+        typeof message.text !== "string" || !message.text.trim() || message.text.trim().startsWith("/")) return false;
+    const fields = message as Record<string, unknown>;
+    return ["media_group_id", "business_connection_id", "photo", "video", "audio", "voice", "document", "animation", "sticker", "contact", "location", "venue", "poll", "dice", "story"].every(key => fields[key] === undefined);
+  };
+  const reviewMessage = (entry: RecoverySource["original"]): Partial<TMessage> | undefined => {
+    const message = entry.update.message as Partial<TMessage> | undefined;
+    if (entry.state !== "pending" || entry.preApprovalExcluded || entry.inputClaim || entry.inputProvenance ||
+        entry.queueOwner || entry.queueReceiptId || entry.queueHandoff || entry.failure ||
+        Object.keys(entry.update).some(key => key !== "update_id" && key !== "message") ||
+        !isReviewText(message) || Reflect.has(message!, "pi_telegram_source_update_id")) return undefined;
+    return message;
+  };
+  const needsHistoricalReview = (message: Partial<TMessage>): boolean => {
+    if (!deps.threadStore) throw new Error("Historical routing requires a current Thread snapshot.");
+    if (deps.threadStore.getBotState().threadMode === "disabled") return true;
+    return !getTelegramRoutableThreadRecords(deps.threadStore.list(), deps.getLiveThreadTargets?.()).some(record =>
+      record.target.chatId === message.chat!.id && record.target.threadId === message.message_thread_id);
+  };
+  /** New-world restart: forget previous-instance Restore/temporary state, then one silent delete per positively disposable tab. */
+  const forgetPreviousWorld = async (input: Updates.TelegramHeldSourcePreparation<TContext>,
+    captureTransport?: (ctx: TContext) => (() => boolean) | undefined): Promise<{ forgotten: number; deleted: number }> => {
+    const result = { forgotten: 0, deleted: 0 };
+    const { ctx, signal, journalBindingKey, isCurrent: preparedCurrent } = input;
+    const transport = captureTransport ? captureTransport(ctx) : () => true;
+    const cap = transport && captureTemporaryThreadAuthority(ctx, () => !signal.aborted && preparedCurrent() && transport() &&
+      deps.hasWorkspaceRestoreAuthority?.() === true);
+    const threads = deps.threadStore;
+    if (!cap?.isCurrent() || cap.journalBindingKey !== journalBindingKey || !threads || !deps.runWorkspaceOperation) return result;
+    try {
+      await deps.runWorkspaceOperation({ operationId: `new-world-${randomBytes(16).toString("hex")}`,
+        operationKind: "workspace.forget-previous-world", scopes: [{ kind: "profile" }] }, async () => {
+        if (!cap.isCurrent()) return;
+        await threads.load();
+        if (!cap.isCurrent()) return;
+        const self = cap.authority.executor.instanceId;
+        const entries = cap.store.listTemporaryThreads();
+        const preserved = entries.filter(entry => entry.operatorUserId === cap.operatorUserId && entry.phase === "created" &&
+          cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" &&
+          Threads.getTelegramTemporaryThreadInputs(entry).some(source => source.journalBindingKey === journalBindingKey &&
+            source.updateIds.some(id => input.routingSourceIds?.includes(id)))).map(entry => entry.token);
+        const disposable = entries.flatMap(entry => entry.operatorUserId === cap.operatorUserId && !preserved.includes(entry.token) &&
+          entry.executor.instanceId !== self && entry.phase === "created" && entry.target &&
+          cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" ? [entry] : []);
+        const forgotten = cap.store.forgetPreviousWorld(cap.authority, preserved);
+        if (!forgotten) return;
+        result.forgotten = forgotten.operations.length + forgotten.temporaryThreads.length;
+        for (const entry of disposable) {
+          const target = entry.target!;
+          if (!cap.isCurrent() || !deps.callApi) break;
+          await threads.load();
+          const same = (value: { chatId: number; threadId?: number } | undefined) => value?.chatId === target.chatId && value.threadId === target.threadId;
+          if (!cap.isCurrent() || threads.listWorkspaceBindings().some(value => same(value.target)) ||
+              threads.list().some(record => record.status === "active" && same(record.target)) ||
+              cap.store.listTemporaryThreads().some(entry => same(entry.target)) ||
+              cap.store.list().some(({ request }) => same(request.target) || same(request.binding.target))) continue;
+          try {
+            const required = [...new Set([cap.journalBindingKey, entry.source.journalBindingKey,
+              ...Threads.getTelegramTemporaryThreadInputs(entry).map(input => input.journalBindingKey)])];
+            if (deps.inspectTemporaryThreadSources?.(target, required)?.length !== 0 || !cap.isCurrent()) continue;
+            // Exactly one attempt; the entry is already forgotten, so failure or silence leaves the tab without retry.
+            if (await deps.callApi<boolean>("deleteForumTopic", { chat_id: target.chatId, message_thread_id: target.threadId },
+              { maxAttempts: 1, retrySafety: "non-idempotent" }) === true) result.deleted++;
+          } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-tab-delete" }); }
+        }
+        // Same-instance session replacement may have lost a metadata-only timer after the source was already spent.
+        // Reconstruct from retained tab/source proof under fresh authority, never from a prompt body or an issued delete.
+        for (const entry of cap.store.listTemporaryThreads()) {
+          if (!cap.isCurrent()) break;
+          if (entry.phase !== "created" || !entry.target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+              entry.source.journalBindingKey !== journalBindingKey) continue;
+          if (Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)))
+            scheduleTemporaryThreadCleanup(entry.target, ctx, true);
+        }
+      });
+    } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-forget" }); }
+    return result;
+  };
+  /** Historical temporary sources await the cold policy; warm bound/unknown sources never fall into ordinary dispatch. */
+  const isRecordedTemporaryThreadInputHeld = (entry: RecoverySource["original"], ctx: TContext, signal: AbortSignal, historical = false): boolean => {
+    const store = deps.getWorkspaceRestoreStore?.(), binding = deps.getAdmissionJournalBinding?.();
+    if (!store || !binding) return false;
+    const members = store.listTemporaryThreads().filter(temporary =>
+      Threads.getTelegramTemporaryThreadInputs(temporary).some(input => input.journalBindingKey === binding && input.updateIds.includes(entry.updateId)));
+    const cap = captureTemporaryThreadAuthority(ctx, () => !signal.aborted);
+    return members.some(temporary => {
+      if (!cap?.isCurrent()) return true;
+      const observation = store.inspectTemporaryThreadTarget(temporary, cap.authority);
+      return historical || !observation || observation.kind !== "temporary";
+    });
+  };
+  const shouldHoldPendingInput = async (entry: RecoverySource["original"], ctx: TContext, signal: AbortSignal): Promise<boolean> => {
+    const binding = deps.getAdmissionJournalBinding?.();
+    const current = () => !signal.aborted && deps.isContextActive?.(ctx) === true && deps.getAdmissionJournalBinding?.() === binding;
+    if (!current()) throw new Error("Temporary Thread source generation ended.");
+    const held = isRecordedTemporaryThreadInputHeld(entry, ctx, signal);
+    if (!current()) throw new Error("Temporary Thread source authority changed.");
+    return held;
+  };
+  const shouldReviewHistoricalInput = async (entry: RecoverySource["original"], ctx: TContext, signal: AbortSignal): Promise<boolean | "retain"> => {
+    if (signal.aborted) throw new Error("Historical routing generation ended.");
+    const message = entry.update.message as Partial<TMessage> | undefined;
+    const unsupported = !reviewMessage(entry);
+    const retainable = unsupported && entry.state === "pending" && !entry.preApprovalExcluded && !entry.inputClaim && !entry.inputProvenance &&
+      !entry.queueOwner && !entry.queueReceiptId && !entry.queueHandoff && !entry.failure &&
+      Object.keys(entry.update).every(key => key === "update_id" || key === "message") &&
+      message?.chat?.type === "private" && Number.isSafeInteger(message.chat.id) &&
+      Number.isSafeInteger(message.from?.id) && message.from?.is_bot === false &&
+      Number.isSafeInteger(message.message_id) && message.message_id! > 0 &&
+      Number.isSafeInteger(message.message_thread_id) && message.message_thread_id! > 0 &&
+      !Reflect.has(message, "pi_telegram_source_update_id") && !Reflect.has(message, "business_connection_id");
+    const temporary = isRecordedTemporaryThreadInputHeld(entry, ctx, signal, true);
+    if (!retainable && temporary) return true;
+    if (!retainable && unsupported) return false;
+    if (signal.aborted) throw new Error("Historical routing generation ended.");
+    const epoch = deps.getCurrentLeaderEpoch?.();
+    const binding = deps.getAdmissionJournalBinding?.();
+    const current = () => !signal.aborted && deps.isContextActive?.(ctx) === true &&
+      epoch !== undefined && deps.getCurrentLeaderEpoch?.() === epoch && !!binding && deps.getAdmissionJournalBinding?.() === binding;
+    if (!current() || !deps.threadStore) throw new Error("Historical routing authority is unavailable.");
+    await deps.threadStore.load();
+    if (!current()) throw new Error("Historical routing authority changed.");
+    // Raw unsupported startup originals stay protected even when a bound target outlives forgotten Restore membership.
+    // Holding protects evidence, not sender authorization; owner-bearing sources keep their existing paths.
+    return retainable ? "retain" : needsHistoricalReview(message!);
+  };
+  const recoveryPreview = (source: RecoverySource, owner: number, chatId: number, binding: string): string | undefined => {
+    const entry = source.original;
+    const message = reviewMessage(entry);
+    if (!message || message.chat!.id !== chatId || message.from!.id !== owner) return undefined;
+    for (const pending of pendingUnboundReroutes.values()) {
+      if (pending.abandonment?.journalBindingKey === binding &&
+          Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(entry.updateId) &&
+          // Revoked carriers describe a past attempt, not a live selection veto.
+          // Current claim/entry authority still comes from the worker and journal CAS.
+          pending.messages.some(value => Updates.getTelegramUpdateExecutionFence(value)?.signal.aborted !== true) &&
+          (pending.selectionAttempted || pending.destinationSelected || pending.dispatching || pending.foreignForwardIssued || pending.foreignRetry || pending.cleanup ||
+            pending.abandonment.running)) return undefined;
+    }
+    const text = Array.from(message.text!.replace(/\s+/gu, " ").trim());
+    return escapeHtml(text.slice(0, 80).join("")) + (text.length > 80 ? "…" : "");
+  };
+  const expireRoutingInput = async (source: Updates.TelegramRoutingInputExpirySource, ctx: TContext, signal: AbortSignal): Promise<void> => {
+    const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.();
+    const message = source.original.update.message as Partial<TMessage> | undefined;
+    const runtimeCurrent = () => !signal.aborted && operator !== undefined && epoch !== undefined &&
+      deps.isContextActive?.(ctx) === true && deps.configStore.getAllowedUserId() === operator &&
+      deps.getCurrentLeaderEpoch?.() === epoch && deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
+      source.original.routingInput?.operatorUserId === operator && message?.from?.id === operator && message.from.is_bot !== true && message.chat?.type === "private";
+    const current = () => runtimeCurrent() && source.isCurrent();
+    if (!current() || !deps.runWorkspaceOperation) return;
+    await deps.runWorkspaceOperation({ operationId: `routing-expiry-${randomBytes(16).toString("hex")}`,
+      operationKind: "workspace.expire-unbound-routing", scopes: [{ kind: "profile" }] }, async () => {
+      if (!current()) return;
+      const restores = deps.getWorkspaceRestoreStore?.();
+      if (deps.getWorkspaceRestoreStore && !restores) return;
+      const temporary = restores?.listTemporaryThreads().find(entry => Threads.getTelegramTemporaryThreadInputs(entry).some(input =>
+        input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId)));
+      const result = source.expire();
+      if (!result) return;
+      // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
+      for (const [id, pending] of pendingUnboundReroutes) {
+        if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId)) continue;
+        removePendingReroute(id);
+        if (signal.aborted || deps.isContextActive?.(ctx) !== true || deps.configStore.getAllowedUserId() !== operator ||
+            deps.getCurrentLeaderEpoch?.() !== epoch || deps.getAdmissionJournalBinding?.() !== source.journalBindingKey) continue;
+        if (deps.editInteractiveMessage && pending.chooserMessageId !== undefined) {
+          try { await deps.editInteractiveMessage(pending.sourceTarget.chatId, pending.chooserMessageId,
+            `<b>${TELEGRAM_ROUTING_CHOICE_EXPIRED}</b>`, "html", { inline_keyboard: [] }); }
+          catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-view" }); }
+        }
+      }
+      // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
+      // never closes over this source or asks the worker to retain a terminal prompt while metadata publication fails.
+      if (temporary?.target && runtimeCurrent()) scheduleTemporaryThreadCleanup(temporary.target, ctx, true);
+    });
+  };
+  const renderCancellationReview = async (view: CancellationReview, isCurrent: () => boolean): Promise<void> => {
+    if (!isCurrent()) return;
+    const data = (action: string) => `${TELEGRAM_PENDING_CANCELLATION_REVIEW_PREFIX}${view.id}:${action}`;
+    const rows: Menu.TelegramReplyMarkup["inline_keyboard"] = [[{ text: "⬆️ Main menu", callback_data: "menu:back" }]];
+    const lines = ["<b>☑️ Review pending cancellations:</b>", "",
+      "Finish stopping routing retries to retain the original privately. No new delivery is started; previously accepted work may continue. No Telegram message or Thread is deleted."];
+    if (!view.sources.length) lines.push("", "No supported pending cancellations on this page.");
+    for (const [index, source] of view.sources.entries()) {
+      lines.push("", `<b>${index + 1}. ${source.result ? "⛔️ Routing cancelled." : "Protected input"}</b>`, source.preview);
+      if (!source.result) rows.push([{ text: `❌ Finish cancellation ${index + 1}`, callback_data: data(`retry:${index}`) }]);
+    }
+    if (view.unsupported) lines.push("", "Other protected inputs are not available in this view and remain untouched.");
+    if (view.nextAfterUpdateId !== undefined) rows.push([{ text: "🟣 More", callback_data: data("more") }]);
+    rows.push([{ text: "🔄 Refresh", callback_data: data("refresh") }]);
+    await deps.editInteractiveMessage!(view.target.chatId, view.messageId, lines.join("\n"), "html", { inline_keyboard: rows });
+  };
+  const handleCancellationReview = async (query: TCallbackQuery, ctx: TContext): Promise<boolean> => {
+    const matches = (view: CancellationReview) => query.message?.message_id === view.messageId &&
+      query.message.chat.id === view.target.chatId &&
+      (query.message.message_thread_id === undefined || query.message.message_thread_id === view.target.threadId);
+    if (query.data?.startsWith(TELEGRAM_RETIRED_HISTORICAL_REVIEW_PREFIX)) {
+      await deps.answerCallbackQuery(query.id, "🚫 This control is no longer available.");
+      return true;
+    }
+    const ownsReview = query.data?.startsWith(TELEGRAM_PENDING_CANCELLATION_REVIEW_PREFIX) === true;
+    const prefix = TELEGRAM_PENDING_CANCELLATION_REVIEW_PREFIX;
+    if (!ownsReview && cancellationReview && matches(cancellationReview)) {
+      if (cancellationReview.running && cancellationReview.isCurrent()) {
+        await deps.answerCallbackQuery(query.id, "⏳ Cancellation is in progress.");
+        return true;
+      }
+      cancellationReview = undefined;
+      return false;
+    }
+    if (!ownsReview) return false;
+    const unavailable = async () => { await deps.answerCallbackQuery(query.id, "🚫 Cancellation review expired or unavailable. Open Status again."); return true; };
+    const execution = Updates.getTelegramUpdateExecutionFence(query);
+    const chatId = query.message?.chat.id;
+    const messageId = query.message?.message_id;
+    if (execution?.isCurrent() !== true || deps.isContextActive?.(ctx) !== true ||
+        !deps.editInteractiveMessage || !deps.runWorkspaceOperation || query.message?.chat.type !== "private" ||
+        typeof chatId !== "number" || !Number.isSafeInteger(chatId) ||
+        typeof messageId !== "number" || !Number.isSafeInteger(messageId) || messageId <= 0) return unavailable();
+    const owner = deps.configStore.getAllowedUserId();
+    const journalBindingKey = deps.getAdmissionJournalBinding?.();
+    const epoch = deps.getCurrentLeaderEpoch?.();
+    if (owner === undefined || query.from.id !== owner || query.from.is_bot || !journalBindingKey || epoch === undefined) return unavailable();
+    const current = () => execution.isCurrent() && deps.isContextActive?.(ctx) === true &&
+      deps.configStore.getAllowedUserId() === owner && deps.getAdmissionJournalBinding?.() === journalBindingKey &&
+      deps.getCurrentLeaderEpoch?.() === epoch;
+    const parsed = query.data!.slice(prefix.length).match(/^([a-z0-9]+):(retry:(\d+)|refresh|more)$/);
+    const prior = cancellationReview;
+    const open = query.data === `${prefix}open`;
+    if (!open && (!parsed || !prior || parsed[1] !== prior.id || !matches(prior) || !prior.isCurrent())) return unavailable();
+    if (prior?.running && prior.isCurrent()) {
+      await deps.answerCallbackQuery(query.id, "⏳ Cancellation is in progress.");
+      return true;
+    }
+    let view = prior;
+    let selected: CancellationReview["sources"][number] | undefined;
+    try {
+      if (open || parsed?.[2] === "refresh" || parsed?.[2] === "more") {
+        if (parsed?.[2] === "more" && prior?.nextAfterUpdateId === undefined) return unavailable();
+        const next: CancellationReview = { id: randomBytes(16).toString("hex"),
+          target: { chatId, ...(query.message.message_thread_id !== undefined ? { threadId: query.message.message_thread_id } : {}) },
+          messageId, ownerUserId: owner, journalBindingKey, sources: [], unsupported: false,
+          isCurrent: () => cancellationReview === next && current() };
+        cancellationReview = view = next;
+        const page = Updates.inspectTelegramAbandoningUpdates(query, { journalBindingKey, isCurrent: next.isCurrent,
+          ...(parsed?.[2] === "more" ? { afterUpdateId: prior!.nextAfterUpdateId } : {}) });
+        if (!page) { if (cancellationReview === next) cancellationReview = undefined; return unavailable(); }
+        for (const source of page.sources) {
+          const preview = recoveryPreview(source, owner, next.target.chatId, journalBindingKey);
+          if (preview === undefined) { next.unsupported = true; continue; }
+          if (next.sources.length === 5) { next.nextAfterUpdateId = next.sources.at(-1)!.original.updateId; break; }
+          next.sources.push({ ...source, preview });
+        }
+        next.nextAfterUpdateId ??= page.nextAfterUpdateId;
+        next.running = true;
+        await renderCancellationReview(next, next.isCurrent);
+        if (next.isCurrent()) await deps.answerCallbackQuery(query.id);
+      } else {
+        if (!view || !parsed?.[3] || !parsed[2].startsWith("retry:")) return unavailable();
+        selected = view.sources[Number(parsed[3])];
+        if (!selected) return unavailable();
+        const activeView = view;
+        const source = selected;
+        const isCurrent = () => current() && activeView.isCurrent() &&
+          recoveryPreview(source, owner, activeView.target.chatId, journalBindingKey) !== undefined;
+        view.running = true;
+        await deps.runWorkspaceOperation({ operationId: `workspace-cancellation-recovery:${query.id}`,
+          operationKind: "workspace.recover-unbound-cancellation", scopes: [{ kind: "profile" }] }, async () => {
+          if (!isCurrent()) return;
+          source.result ??= source.retry({ operatorAuthorityId: `telegram-owner:${owner}`, isCurrent });
+          if (!source.result) { await unavailable(); return; }
+          for (const [id, pending] of pendingUnboundReroutes) {
+            if (pending.abandonment?.ownerUserId !== owner || pending.abandonment.journalBindingKey !== journalBindingKey ||
+                !Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId)) continue;
+            pending.abandonment.result = source.result;
+            pending.abandonment.attempted = true;
+            try { await retireCancellationChooser(id, pending, isCurrent); }
+            catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "recovered-chooser-cleanup" }); }
+          }
+          await renderCancellationReview(activeView, isCurrent);
+          if (isCurrent()) await deps.answerCallbackQuery(query.id, "⛔️ Routing cancelled.");
+        });
+      }
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "unbound-cancellation-recovery" });
+      if (current()) await deps.answerCallbackQuery(query.id, selected?.result
+        ? "⚠️ Routing cancelled; view update failed. Retry the same button."
+        : "⚠️ Recovery incomplete; inputs stay protected. Check /telegram-status --debug.");
+    } finally { if (view) view.running = false; }
+    return true;
+  };
+  const handleUnboundRerouteCancelCallback = async (query: TCallbackQuery, ctx: TContext): Promise<boolean> => {
+    if (!query.data?.startsWith(TELEGRAM_UNBOUND_REROUTE_CANCEL_CALLBACK_PREFIX)) return false;
+    const rerouteId = query.data.match(/^reroutecancel:([a-z0-9]+)$/)?.[1];
+    const pending = rerouteId ? pendingUnboundReroutes.get(rerouteId) : undefined;
+    const cancellation = pending?.abandonment;
+    const source = pending?.messages[0];
+    const execution = Updates.getTelegramUpdateExecutionFence(query);
+    const sourceExecution = Updates.getTelegramUpdateExecutionFence(source);
+    const isAuthorityCurrent = () => !!cancellation && execution?.isCurrent() === true &&
+      sourceExecution?.signal.aborted === false && deps.isContextActive?.(ctx) === true &&
+      query.from.id === cancellation.ownerUserId && !query.from.is_bot &&
+      deps.configStore.getAllowedUserId() === cancellation.ownerUserId &&
+      deps.getAdmissionJournalBinding?.() === cancellation.journalBindingKey &&
+      deps.getCurrentLeaderEpoch?.() === cancellation.leaderEpoch;
+    const isCurrent = () => isAuthorityCurrent() && !!pending && !!cancellation && !!source &&
+      pendingUnboundReroutes.get(rerouteId!) === pending && pending.abandonment === cancellation &&
+      matchesRerouteChooser(pending, query) && query.message?.chat.type === "private" &&
+      source.from?.id === cancellation.ownerUserId &&
+      pending.messages.length === 1 &&
+      !pending.destinationSelected && !pending.selectionAttempted && !pending.dispatching &&
+      !pending.foreignForwardIssued && !pending.foreignRetry && !pending.cleanup && !pending.finalizeMessage;
+    if (!isCurrent() || !deps.runWorkspaceOperation || !deps.editInteractiveMessage) {
+      // A chooser from a previous process (new world) or an expired one simply reads as expired.
+      await deps.answerCallbackQuery(query.id, pending ? "🚫 Message route is unavailable for cancellation." : TELEGRAM_ROUTING_CHOICE_EXPIRED);
+      return true;
+    }
+    if (cancellation!.running) {
+      await deps.answerCallbackQuery(query.id, "⏳ Cancellation is already in progress.");
+      return true;
+    }
+    cancellation!.running = true;
+    try {
+      await deps.runWorkspaceOperation({ operationId: `workspace-reroute-cancel:${query.id}`,
+        operationKind: "workspace.cancel-unbound-routing", scopes: [{ kind: "profile" }] }, async () => {
+        if (!isCurrent()) return;
+        if (!cancellation!.result) {
+          const wasAttempted = cancellation!.attempted;
+          cancellation!.attempted = true;
+          const result = Updates.abandonTelegramDeferredUpdate(source, {
+            operatorAuthorityId: `telegram-owner:${cancellation!.ownerUserId}`, isCurrent,
+          });
+          if (!result) {
+            cancellation!.attempted = wasAttempted;
+            await deps.answerCallbackQuery(query.id, "🚫 Message routing cannot be cancelled now.");
+            return;
+          }
+          cancellation!.result = result;
+        }
+        if (!isCurrent()) return;
+        if (!recordCancelledTemporaryThreadInput(pending!, ctx, isCurrent)) {
+          if (isAuthorityCurrent()) await deps.answerCallbackQuery(query.id, "⚠️ Routing cancelled; Thread cleanup remains protected. Retry Cancel routing.");
+          return;
+        }
+        if (await retireCancellationChooser(rerouteId!, pending!, isCurrent) && isAuthorityCurrent()) {
+          scheduleTemporaryThreadCleanup(pending!.sourceTarget, ctx);
+          await deps.answerCallbackQuery(query.id, "⛔️ Routing cancelled.");
+        }
+      });
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "unbound-cancellation", rerouteId });
+      if (isCurrent()) await deps.answerCallbackQuery(query.id,
+        cancellation!.result ? "⚠️ Routing cancelled; chooser update failed. Retry Cancel routing." :
+          "⚠️ Cancellation incomplete. Retry Cancel routing.");
+    } finally { cancellation!.running = false; }
+    return true;
+  };
+  const withPendingRerouteSelection = async (
+    rerouteId: string, query: TCallbackQuery, operation: () => Promise<boolean>,
+  ): Promise<boolean> => {
+    Updates.assertTelegramUpdateExecutionCurrent(query);
+    const pending = pendingUnboundReroutes.get(rerouteId);
+    if (pending?.foreignForwardIssued && matchesRerouteChooser(pending, query)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Forward is pending; this button will not resend uncertain input.");
+      return true;
+    }
+    if (pending && matchesRerouteChooser(pending, query) &&
+        (pending.abandonment?.attempted || pending.abandonment?.running || pending.messages.some(message =>
+          Updates.getTelegramUpdateExecutionFence(message)?.isCurrent() === false))) {
+      await deps.answerCallbackQuery(query.id, TELEGRAM_ROUTING_CHOICE_EXPIRED);
+      return true;
+    }
+    const releases: Array<() => void> = [];
+    try {
+      if (pending && matchesRerouteChooser(pending, query)) {
+        try {
+          for (const message of pending.messages) releases.push(Updates.acquireTelegramUpdateRouting(message));
+        } catch (error) {
+          deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-selection" });
+          await deps.answerCallbackQuery(query.id, "🚫 Message route expired or unavailable.");
+          return true;
+        }
+      }
+      return await operation();
+    } finally { for (const release of releases) release(); }
+  };
+  const executeUnboundRerouteRestoreMenuCallback = async (
     query: TCallbackQuery,
     _ctx: TContext,
   ): Promise<boolean> => {
@@ -1340,12 +2901,13 @@ export function createTelegramInboundRouteRuntime<
       !deps.threadStore ||
       !pending ||
       !matchesRerouteChooser(pending, query) ||
+      (parsed.root && pending.rootChooserText === undefined) ||
       expirePendingCommand(parsed.rerouteId, pending)
     ) {
-      await deps.answerCallbackQuery(query.id, "Message route expired.");
+      await deps.answerCallbackQuery(query.id, TELEGRAM_ROUTING_CHOICE_EXPIRED);
       return true;
     }
-    if (pending.sourceTarget.threadId === undefined) {
+    if (parsed.restore && pending.sourceTarget.threadId === undefined) {
       await deps.answerCallbackQuery(query.id, "Restore needs a destination thread. Send a plain message in a new Telegram thread first.");
       return true;
     }
@@ -1355,23 +2917,36 @@ export function createTelegramInboundRouteRuntime<
       deps.threadStore.list(),
       deps.getLiveThreadTargets?.(),
     );
-    const replyMarkup = buildTelegramUnboundRerouteRestoreChooserMarkup(
-      parsed.rerouteId,
-      activeRecords,
-      deps.getDisplayTitle,
-    );
+    const replyMarkup = parsed.root
+      ? buildTelegramUnboundRerouteChooserMarkup(parsed.rerouteId, activeRecords, {
+          canRestore: pending.sourceTarget.threadId !== undefined, canCancel: !!pending.abandonment,
+          getDisplayTitle: deps.getDisplayTitle,
+        })
+      : parsed.restore
+        ? buildTelegramUnboundRerouteRestoreChooserMarkup(parsed.rerouteId, activeRecords, deps.getDisplayTitle)
+        : { inline_keyboard: activeRecords.map(record => [{
+            text: `↪️ ${getTelegramThreadRecordLabel(record, deps.getDisplayTitle)}`,
+            callback_data: formatTelegramUnboundRerouteCallbackData(parsed.rerouteId, record.target.threadId),
+          }]) };
+    const chooserText = parsed.root
+      ? pending.rootChooserText!
+      : parsed.restore ? formatTelegramUnboundRerouteRestoreChooserText()
+        : "<b>🧵 Reroute:</b>\n\nChoose the thread that should handle this input:";
+    if (!parsed.root) replyMarkup.inline_keyboard.unshift([{
+      text: "⬆️ Back", callback_data: `${TELEGRAM_UNBOUND_REROUTE_ROOT_CALLBACK_PREFIX}${parsed.rerouteId}`,
+    }]);
     if (deps.editInteractiveMessage) {
       await deps.editInteractiveMessage(
         chatId,
         messageId,
-        formatTelegramUnboundRerouteRestoreChooserText(),
+        chooserText,
         "html",
         replyMarkup,
       );
     } else if (deps.sendInteractiveMessage) {
       const chooserId = await deps.sendInteractiveMessage(
         chatId,
-        formatTelegramUnboundRerouteRestoreChooserText(),
+        chooserText,
         "html",
         replyMarkup,
         { target: pending.sourceTarget, replyToMessageId: messageId },
@@ -1380,7 +2955,7 @@ export function createTelegramInboundRouteRuntime<
       rememberRerouteChooser(parsed.rerouteId, chooserId);
     }
     assertExecutionCurrent();
-    await deps.answerCallbackQuery(query.id, "Choose instance to restore.");
+    await deps.answerCallbackQuery(query.id, parsed.root ? "Choose routing mode." : parsed.restore ? "Choose instance to restore." : "Choose target thread.");
     return true;
   };
   const executeUnboundRerouteCallbackOperation = async (
@@ -1396,14 +2971,14 @@ export function createTelegramInboundRouteRuntime<
     const pending = pendingUnboundReroutes.get(parsed.rerouteId);
     if (typeof chatId !== "number" || !deps.threadStore || !pending ||
       !matchesRerouteChooser(pending, query) || expirePendingCommand(parsed.rerouteId, pending)) {
-      await deps.answerCallbackQuery(query.id, "Message route expired.");
+      await deps.answerCallbackQuery(query.id, TELEGRAM_ROUTING_CHOICE_EXPIRED);
       return true;
     }
     await deps.threadStore.load();
     assertExecutionCurrent();
     if (pendingUnboundReroutes.get(parsed.rerouteId) !== pending ||
       expirePendingCommand(parsed.rerouteId, pending)) {
-      await deps.answerCallbackQuery(query.id, "Message route expired.");
+      await deps.answerCallbackQuery(query.id, TELEGRAM_ROUTING_CHOICE_EXPIRED);
       return true;
     }
     if (pending.finalizeMessage) {
@@ -1416,6 +2991,11 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
+    if (pending.workspaceRestore && (!restoreWorkspace || !parsed.useNewSlot ||
+        pending.workspaceRestore.record.target.threadId !== parsed.threadId)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Restore is already selected. Use the original Restore choice.");
+      return true;
+    }
     if (pending.foreignRetry) {
       const retry = pending.foreignRetry;
       const allForwarded = await forwardPendingRerouteMessages(
@@ -1428,7 +3008,8 @@ export function createTelegramInboundRouteRuntime<
       if (!allForwarded) {
         await deps.answerCallbackQuery(
           query.id,
-          "Target thread is unavailable; retrying will send only remaining messages.",
+          pending.foreignForwardIssued ? "🚫 Forward is pending; this button will not resend uncertain input." :
+            "Target thread is unavailable; retrying will send only remaining messages.",
         );
         return true;
       }
@@ -1457,7 +3038,11 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
-    const record = getTelegramRoutableThreadRecords(
+    if (!pending.workspaceRestore && isTemporaryReroute(pending) && isTemporaryThreadForwardIssued(pending)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Forward is pending; this button will not resend uncertain input.");
+      return true;
+    }
+    const record = pending.workspaceRestore?.record ?? getTelegramRoutableThreadRecords(
       deps.threadStore.list(),
       deps.getLiveThreadTargets?.(),
     ).find(
@@ -1487,137 +3072,92 @@ export function createTelegramInboundRouteRuntime<
       await deps.answerCallbackQuery(query.id, "🚫 Selected thread is already the destination.");
       return true;
     }
-    if (parsed.useNewSlot && sourceTarget && isRerouteTargetProtected(sourceTarget)) {
+    // A source's own temporary tab is its Restore destination; only other protection refuses it.
+    if (parsed.useNewSlot && sourceTarget && !pending.workspaceRestore &&
+        isRerouteTargetProtected(sourceTarget, undefined, pending.temporaryThread ?? findCreatedTemporaryThread(sourceTarget), pending)) {
       await deps.answerCallbackQuery(query.id, "🚫 Thread restore source is already owned.");
       return true;
     }
-    pending.destinationSelected = true;
-    pending.selectionAttempted = true;
-    pending.pauseExpiry?.();
+    // Restore has one controller. Without it or its negotiated authority, refuse before selection so the chooser keeps
+    // its other routes and Cancel.
+    if (parsed.useNewSlot && sourceTarget && !pending.workspaceRestore &&
+        (!restoreWorkspace || deps.hasWorkspaceRestoreAuthority?.() !== true)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Thread restore is unavailable right now. The message stays pending; choose another route or cancel.");
+      return true;
+    }
     const currentInstanceId = deps.getCurrentInstanceId?.();
     const leaderProfileKey = getLeaderTopicProfileKey(ctx, currentInstanceId);
-    const isCurrentLeaderRecord = isCurrentLeaderTopicRecord(
-      record,
-      leaderProfileKey,
-      currentInstanceId,
-    );
-    if (parsed.useNewSlot && !isCurrentLeaderRecord) {
-      if (!record.slot || !/^[A-Z]$/u.test(record.slot)) {
-        await deps.answerCallbackQuery(
-          query.id,
-          "Follower thread slot authority is unavailable.",
-        );
-        return true;
-      }
-      if (
-        !sourceTarget ||
-        !deps.replaceFollowerThreadTarget ||
-        !deps.foreignOwnedUpdateForwarder?.forwardMessage
-      ) {
-        await deps.answerCallbackQuery(
-          query.id,
-          "Follower thread restore is not available yet.",
-        );
-        return true;
-      }
-      assertExecutionCurrent();
-      const replaced = await deps.replaceFollowerThreadTarget({
-        record,
-        target: sourceTarget,
-        oldTarget: record.target,
-      });
-      assertExecutionCurrent();
-      if (!replaced) {
-        await deps.answerCallbackQuery(
-          query.id,
-          "Follower thread is unavailable.",
-        );
-        return true;
-      }
-      const nowMs = Date.now();
-      const slot = record.slot;
-      const threadName = getRestoredThreadName(record, slot);
-      assertExecutionCurrent();
-      deps.threadStore.markStaleByTarget(
-        record.target,
-        "deleted",
-        "Follower thread was replaced by restore source.",
-      );
-      deps.threadStore.upsert({
-        ...record,
-        target: sourceTarget,
-        status: "active",
-        syncStatus: "open",
-        updatedAtMs: nowMs,
-        threadName,
-        lastSyncObservedAtMs: nowMs,
-        lastReconcileAction: "follower-thread-restore",
-        rerouteConfirmedAtMs: nowMs,
-      });
-      await deps.threadStore.persist();
-      assertExecutionCurrent();
-      if (deps.callApi) {
-        try {
-          assertExecutionCurrent();
-          await deps.callApi("editForumTopic", {
-            chat_id: sourceTarget.chatId,
-            message_thread_id: sourceTarget.threadId,
-            name:
-              deps.getDisplayTitle?.(sourceTarget) ??
-              Threads.getTelegramTopicTitleForThreadName(threadName, slot),
-          });
-          assertExecutionCurrent();
-        } catch (renameError) {
-          deps.recordRuntimeEvent?.("telegram", renameError, {
-            phase: "follower-topic-reroute-restore-rename",
-            chatId: sourceTarget.chatId,
-            threadId: sourceTarget.threadId,
-            slot: record.slot,
-          });
-        }
+    const isCurrentLeaderRecord = isCurrentLeaderTopicRecord(record, leaderProfileKey, currentInstanceId);
+    if (!parsed.useNewSlot && record.instanceId && record.instanceId !== currentInstanceId && !isCurrentLeaderRecord &&
+        !deps.foreignOwnedUpdateForwarder?.forwardMessage) {
+      if (pending.routingOperatorUserId === undefined) {
+        pending.destinationSelected = true; pending.selectionAttempted = true; pending.pauseExpiry?.();
       }
-      const cleanup: PendingRerouteCleanup = {
-        kind: "replaced-follower",
-        target: record.target,
-        instanceId: record.instanceId,
+      await deps.answerCallbackQuery(query.id, "Open that thread and resend the message there.");
+      return true;
+    }
+    if (pending.routingOperatorUserId !== undefined && (pending.routingOperatorUserId !== query.from.id ||
+        pending.routingOperatorUserId !== deps.configStore.getAllowedUserId())) {
+      await deps.answerCallbackQuery(query.id, "🚫 Message route authority changed.");
+      return true;
+    }
+    // Freeze only a validated actual destination, inside the same admission as its effect. Menu browsing,
+    // unavailable recipients and refused Restore capability never turn a waiting source into a selected grant.
+    try {
+      const release = Updates.acquireTelegramUpdateRouting(pending.messages[0], true,
+        Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages));
+      release();
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-selection" });
+      await deps.answerCallbackQuery(query.id, "🚫 Message route expired or unavailable.");
+      return true;
+    }
+    pending.destinationSelected = true;
+    pending.selectionAttempted = true;
+    pending.pauseExpiry?.();
+    if (parsed.useNewSlot && sourceTarget && restoreWorkspace) {
+      const selection = pending.workspaceRestore ??= { operationId: `restore-${randomBytes(16).toString("hex")}`,
+        record: structuredClone(record), messages: [...pending.messages] };
+      let active = true;
+      const ownerUserId = deps.configStore.getAllowedUserId();
+      const leaderEpoch = deps.getCurrentLeaderEpoch?.();
+      const admissionScope = deps.getAdmissionScope?.();
+      const journalBinding = deps.getAdmissionJournalBinding?.();
+      const selectionCurrent = (): boolean => {
+        try { assertExecutionCurrent(); } catch { return false; }
+        return ownerUserId === query.from.id && deps.configStore.getAllowedUserId() === ownerUserId &&
+          deps.getCurrentLeaderEpoch?.() === leaderEpoch && deps.getAdmissionScope?.() === admissionScope &&
+          deps.getAdmissionJournalBinding?.() === journalBinding && deps.isContextActive?.(ctx) !== false &&
+          pendingUnboundReroutes.get(parsed.rerouteId) === pending && pending.workspaceRestore === selection;
       };
-      const allForwarded = await forwardPendingRerouteMessages(
-        pending,
-        record.instanceId!,
-        sourceTarget.threadId,
-        ctx,
-        assertExecutionCurrent,
-      );
-      if (!allForwarded) {
-        pending.foreignRetry = {
-          instanceId: record.instanceId!,
-          threadId: sourceTarget.threadId,
-          cleanup,
-        };
-        await deps.answerCallbackQuery(
-          query.id,
-          "Thread restored; retrying will send only remaining messages before old-thread cleanup.",
-        );
-        return true;
-      }
-      const cleanupComplete = await retryPendingRerouteCleanup(
-        cleanup,
-        assertExecutionCurrent,
-      );
-      if (!cleanupComplete) {
-        pending.cleanup = cleanup;
-        await deps.answerCallbackQuery(
-          query.id,
-          "Thread restored, but old-thread cleanup is still pending. Try again.",
-        );
-        return true;
-      }
-      await finalizePendingReroute(
-        parsed.rerouteId,
-        pending,
-        query,
-        "Message routed.",
-      );
+      const current = (): boolean => active && selectionCurrent();
+      const assertRestoreCurrent = (): void => {
+        assertExecutionCurrent();
+        if (!current()) throw new Error("Stale Workspace Restore callback.");
+      };
+      try { await restoreWorkspace({ operationId: selection.operationId, record: structuredClone(selection.record),
+        target: { ...sourceTarget }, messages: [...selection.messages], ctx, isCurrent: current,
+        async dispatch(recipient, isRecipientCurrent, recordForwardAcceptance, recordLocalAcceptance) {
+          const assertRecipientCurrent = (): void => {
+            assertRestoreCurrent();
+            if (!isRecipientCurrent()) throw new Error("Workspace Restore recipient authority changed.");
+          };
+          assertRecipientCurrent();
+          if (recipient.kind === "leader") {
+            if (recipient.instanceId !== currentInstanceId) return false;
+            const routed = cloneTelegramMessagesForThread(pending.messages, sourceTarget.threadId);
+            const messages = pending.dispatchKind === "command" ? routed.map((message, index) =>
+              Updates.bindTelegramUpdateCompletionAcceptance(message, () => recordLocalAcceptance(pending.messages[index]!))) : routed;
+            await dispatchPendingRerouteMessages(pending, messages, ctx);
+            assertRecipientCurrent();
+            return true;
+          }
+          return forwardPendingRerouteMessages(pending, recipient.instanceId, sourceTarget.threadId, ctx, assertRecipientCurrent, recordForwardAcceptance);
+        },
+      }); } finally { active = false; }
+      assertExecutionCurrent();
+      if (!selectionCurrent()) return true;
+      await deps.answerCallbackQuery(query.id, "🚫 Restore is pending; this button will not resend uncertain input.");
       return true;
     }
     if (
@@ -1625,13 +3165,6 @@ export function createTelegramInboundRouteRuntime<
       record.instanceId !== currentInstanceId &&
       !isCurrentLeaderRecord
     ) {
-      if (!deps.foreignOwnedUpdateForwarder?.forwardMessage) {
-        await deps.answerCallbackQuery(
-          query.id,
-          "Open that thread and resend the message there.",
-        );
-        return true;
-      }
       const allForwarded = await forwardPendingRerouteMessages(
         pending,
         record.instanceId,
@@ -1642,14 +3175,17 @@ export function createTelegramInboundRouteRuntime<
       if (!allForwarded) {
         await deps.answerCallbackQuery(
           query.id,
-          "Target thread is unavailable; retrying will send only remaining messages.",
+          pending.foreignForwardIssued ? "🚫 Forward is pending; this button will not resend uncertain input." :
+            "Target thread is unavailable; retrying will send only remaining messages.",
         );
         return true;
       }
-      const cleanupComplete = await closeReroutedUnboundTopic(
+      // A temporary tab is removed only after every input in it resolves, never by one Forward.
+      const cleanupComplete = isTemporaryTabTarget(sourceTarget) || await closeReroutedUnboundTopic(
         sourceTarget,
         sourceMessageId,
         assertExecutionCurrent,
+        pending.temporaryThread,
       );
       if (!cleanupComplete && sourceTarget) {
         pending.cleanup = {
@@ -1658,6 +3194,7 @@ export function createTelegramInboundRouteRuntime<
           ...(typeof sourceMessageId === "number"
             ? { messageId: sourceMessageId }
             : {}),
+          ...(pending.temporaryThread ? { temporaryThread: pending.temporaryThread } : {}),
         };
         await deps.answerCallbackQuery(
           query.id,
@@ -1671,116 +3208,22 @@ export function createTelegramInboundRouteRuntime<
         query,
         "Message routed.",
       );
+      if (sourceTarget && isTemporaryTabTarget(sourceTarget)) scheduleTemporaryThreadCleanup(sourceTarget, ctx);
       return true;
     }
-    if (
-      sourceTarget &&
-      isCurrentLeaderRecord &&
-      parsed.useNewSlot &&
-      (record.target.chatId !== sourceTarget.chatId ||
-        record.target.threadId !== sourceTarget.threadId)
-    ) {
-      const slot = deps.threadStore.allocateSlot(
-        leaderProfileKey ?? record.profileKey,
-        getNextTelegramSlotPreference(record.slot),
-        undefined,
-        { excludeCurrentRecord: true },
-      );
-      if (!slot) {
-        await deps.answerCallbackQuery(query.id, TELEGRAM_SLOT_CAPACITY_MESSAGE);
-        return true;
-      }
-      deps.threadStore.markStaleByTarget(
-        record.target,
-        "deleted",
-        "Current leader thread was replaced by a new-slot reroute source.",
-      );
-      const nowMs = Date.now();
-      const threadName = getRestoredThreadName(record, slot);
-      deps.threadStore.upsert({
-        ...record,
-        target: sourceTarget,
-        status: "active",
-        updatedAtMs: nowMs,
-        threadName,
-        instanceId: currentInstanceId,
-        slot,
-        lastReconcileAction: "reroute-new-slot",
-        rerouteConfirmedAtMs: nowMs,
-      });
-      await deps.threadStore.persist();
-      assertExecutionCurrent();
-      deps.setCurrentLeaderIdentity?.({
-        target: sourceTarget,
-        slot,
-        threadName,
-      });
-      if (deps.callApi) {
-        try {
-          assertExecutionCurrent();
-          await deps.callApi("editForumTopic", {
-            chat_id: sourceTarget.chatId,
-            message_thread_id: sourceTarget.threadId,
-            name:
-              deps.getDisplayTitle?.(sourceTarget) ??
-              Threads.getTelegramTopicTitleForThreadName(threadName, slot),
-          });
-          assertExecutionCurrent();
-        } catch (renameError) {
-          deps.recordRuntimeEvent?.("telegram", renameError, {
-            phase: "leader-topic-reroute-reclaim-rename",
-            chatId: sourceTarget.chatId,
-            threadId: sourceTarget.threadId,
-            slot,
-          });
-        }
-      }
-      deps.recordRuntimeEvent?.(
-        "bus",
-        "Bus leader reclaimed reroute source thread",
-        {
-          phase: "leader-topic-reroute-reclaim",
-          chatId: sourceTarget.chatId,
-          threadId: sourceTarget.threadId,
-          staleThreadId: record.target.threadId,
-          slot,
-        },
-      );
-      await dispatchPendingRerouteMessages(
-        pending,
-        cloneTelegramMessagesForThread(pending.messages, sourceTarget.threadId),
-        ctx,
-      );
-      pending.messages = [];
-      const cleanupComplete = await closePreviousLeaderThread(
-        record.target,
-        assertExecutionCurrent,
-      );
-      if (!cleanupComplete) {
-        pending.cleanup = {
-          kind: "previous-leader",
-          target: record.target,
-        };
-        await deps.answerCallbackQuery(
-          query.id,
-          "Thread restored, but old-thread cleanup is still pending. Try again.",
-        );
-        return true;
-      }
-      await finalizePendingReroute(
-        parsed.rerouteId,
-        pending,
-        query,
-        "Message routed.",
-      );
+    // Local handlers and queue admission consume the same one-time group grant as follower forwarding.
+    if (isTemporaryReroute(pending) && !issueTemporaryThreadForward(pending, ctx)) {
+      await deps.answerCallbackQuery(query.id, "🚫 Forward is pending; this button will not resend uncertain input.");
       return true;
     }
     await dispatchPendingRerouteMessages(pending, reroutedMessages, ctx);
     pending.messages = [];
-    const cleanupComplete = await closeReroutedUnboundTopic(
+    // A temporary tab is removed only after every input in it resolves, never by one Forward.
+    const cleanupComplete = isTemporaryTabTarget(sourceTarget) || await closeReroutedUnboundTopic(
       sourceTarget,
       sourceMessageId,
       assertExecutionCurrent,
+      pending.temporaryThread,
     );
     if (!cleanupComplete && sourceTarget) {
       pending.cleanup = {
@@ -1789,6 +3232,7 @@ export function createTelegramInboundRouteRuntime<
         ...(typeof sourceMessageId === "number"
           ? { messageId: sourceMessageId }
           : {}),
+        ...(pending.temporaryThread ? { temporaryThread: pending.temporaryThread } : {}),
       };
       await deps.answerCallbackQuery(
         query.id,
@@ -1802,24 +3246,26 @@ export function createTelegramInboundRouteRuntime<
       query,
       "Message routed.",
     );
+    if (sourceTarget && isTemporaryTabTarget(sourceTarget)) scheduleTemporaryThreadCleanup(sourceTarget, ctx);
     return true;
   };
-  const executeUnboundRerouteCallback = (
+  const executeUnboundRerouteCallback = async (
     query: TCallbackQuery,
     ctx: TContext,
   ): Promise<boolean> => {
-    if (!parseTelegramUnboundRerouteCallbackData(query.data) ||
-        !deps.runWorkspaceOperation) {
-      return executeUnboundRerouteCallbackOperation(query, ctx);
-    }
-    return deps.runWorkspaceOperation(
-      {
-        operationId: `workspace-reroute:${query.id}`,
-        operationKind: "workspace.route-unbound-thread",
-        scopes: [{ kind: "profile" }],
-      },
-      () => executeUnboundRerouteCallbackOperation(query, ctx),
-    );
+    const parsed = parseTelegramUnboundRerouteCallbackData(query.data);
+    if (!parsed) return false;
+    return withPendingRerouteSelection(parsed.rerouteId, query, () => {
+      if (!deps.runWorkspaceOperation) return executeUnboundRerouteCallbackOperation(query, ctx);
+      return deps.runWorkspaceOperation(
+        {
+          operationId: `workspace-reroute:${query.id}`,
+          operationKind: "workspace.route-unbound-thread",
+          scopes: [{ kind: "profile" }],
+        },
+        () => executeUnboundRerouteCallbackOperation(query, ctx),
+      );
+    });
   };
   const handleUnboundRerouteCallback = async (
     query: TCallbackQuery,
@@ -1828,7 +3274,7 @@ export function createTelegramInboundRouteRuntime<
     const parsed = parseTelegramUnboundRerouteCallbackData(query.data);
     const pending = parsed && pendingUnboundReroutes.get(parsed.rerouteId);
     if (!parsed || !pending || pending.dispatchKind !== "command" ||
-        pending.sourceTarget.threadId !== undefined || !matchesRerouteChooser(pending, query)) {
+        (pending.sourceTarget.threadId !== undefined && !pending.temporaryThread) || !matchesRerouteChooser(pending, query)) {
       return executeUnboundRerouteCallback(query, ctx);
     }
     if (pending.dispatching) {
@@ -1855,7 +3301,11 @@ export function createTelegramInboundRouteRuntime<
     const assertExecutionCurrent =
       Updates.createTelegramUpdateExecutionFenceGuard(query);
     assertExecutionCurrent();
-    if (await handleUnboundRerouteRestoreMenuCallback(query, ctx)) return;
+    if (await handleCancellationReview(query, ctx)) return;
+    if (await handleUnboundRerouteCancelCallback(query, ctx)) return;
+    const restore = parseTelegramUnboundRerouteRestoreMenuCallbackData(query.data);
+    if (restore && await withPendingRerouteSelection(restore.rerouteId, query,
+      () => executeUnboundRerouteRestoreMenuCallback(query, ctx))) return;
     if (await handleUnboundRerouteCallback(query, ctx)) return;
     if (deps.buttonActionStore) {
       const handled = await OutboundHandlers.handleTelegramButtonCallbackQuery(
@@ -2348,9 +3798,55 @@ export function createTelegramInboundRouteRuntime<
       reportQueueAdmission(messages, turn.admissionReceipts ?? []);
     });
   };
+  const recordUnboundTemporaryThreadInput = async (messages: TMessage[], ctx: TContext): Promise<boolean> => {
+    const message = messages[0], target = message && Updates.getTelegramMessageTarget(message);
+    const store = deps.getWorkspaceRestoreStore?.();
+    if (!target?.threadId || !store) return false;
+    let found = store.listTemporaryThreads().find(entry => entry.phase === "created" && entry.target &&
+      entry.target.chatId === target.chatId && entry.target.threadId === target.threadId);
+    const key = formatTelegramTargetKey(target), implicit = implicitThreadCreations.get(key);
+    if (!found && !implicit) return false;
+    const updateIds = Updates.collectTelegramAdmissionSourceUpdateIds(messages);
+    const operatorUserId = deps.configStore.getAllowedUserId();
+    const cap = captureTemporaryThreadAuthority(ctx, () => messages.every(source =>
+      Updates.getTelegramUpdateExecutionFence(source)?.isCurrent() === true &&
+      source.chat.type === "private" && source.chat.id === target.chatId && source.message_thread_id === target.threadId &&
+      source.from?.id === operatorUserId && source.from?.is_bot === false));
+    if (!found && implicit) {
+      if (updateIds.length !== 1) { implicitThreadCreations.delete(key); return false; }
+      if (!deps.runWorkspaceOperation || !cap || implicit.ctx !== ctx || implicit.operatorUserId !== cap.operatorUserId ||
+          implicit.journalBindingKey !== cap.journalBindingKey || !isDeepStrictEqual(implicit.executor, cap.authority.executor) ||
+          implicit.generation !== deps.getSessionGeneration?.() || implicit.scope !== deps.getAdmissionScope?.() ||
+          !updateIds.length || updateIds.some(id => id <= implicit.updateId) || !cap.isCurrent()) {
+        implicitThreadCreations.delete(key);
+        return false;
+      }
+      found = store.registerImplicitTemporaryThread({ journalBindingKey: cap.journalBindingKey, updateIds },
+        { chatId: target.chatId, threadId: target.threadId }, randomBytes(16).toString("hex"), {
+          ...cap.authority, isCurrent: () => cap.isCurrent() && implicitThreadCreations.get(key) === implicit,
+        });
+      if (!found || !cap.isCurrent()) throw new Error("Implicit Telegram Thread registration was not acknowledged; source remains protected.");
+      implicitThreadCreations.delete(key);
+    }
+    if (!found) return false;
+    cancelTemporaryThreadCleanup(found.token);
+    if (!deps.runWorkspaceOperation || !cap || cap.operatorUserId !== found.operatorUserId ||
+        cap.journalBindingKey !== found.source.journalBindingKey || !updateIds.length || !cap.isCurrent()) {
+      throw new Error("Temporary Thread input membership requires exact current source authority.");
+    }
+    // The caller already holds the profile Workspace admission (the non-reentrant gate): no nested operation here.
+    let entry = store.listTemporaryThreads().find(value => value.token === found.token &&
+      isDeepStrictEqual(value.source, found.source) && isDeepStrictEqual(value.target, target));
+    if (!entry) throw new Error("Temporary Thread input target changed before membership publication.");
+    entry = cap.adopt(entry);
+    if (!entry || !cap.isCurrent() || !store.recordTemporaryThreadInput(entry, { journalBindingKey: cap.journalBindingKey, updateIds }, cap.authority) || !cap.isCurrent()) {
+      throw new Error("Temporary Thread input membership was not acknowledged; the source remains protected.");
+    }
+    return true;
+  };
   const sendUnboundRerouteChooserNow = async (
     messages: TMessage[],
-    _ctx: TContext,
+    ctx: TContext,
     reportDeferred = true,
   ): Promise<void> => {
     const message = messages[0];
@@ -2385,19 +3881,44 @@ export function createTelegramInboundRouteRuntime<
       );
       return;
     }
-    const rerouteId = storePendingUnboundReroute(messages);
+    const command = messages.length === 1 ? getKnownTelegramAllTabCommand(Media.extractFirstTelegramMessageText(messages).trim()) : undefined;
+    const rerouteId = storePendingUnboundReroute(messages, command ? "command" : "prompt");
     if (reportDeferred) {
       for (const source of messages) {
         Updates.reportTelegramUpdateDeferred(source);
       }
     }
-    const text = formatTelegramUnboundRerouteChooserText(activeRecords, {
-      includeGuidance,
-    });
+    const inTemporaryThread = await recordUnboundTemporaryThreadInput(messages, ctx);
+    const pending = pendingUnboundReroutes.get(rerouteId)!;
+    if (inTemporaryThread) pending.temporaryMembership = true;
+    if (messages.length === 1 && sourceTarget &&
+        message.chat.type === "private" && typeof message.text === "string" && message.text.trim() &&
+        deps.runWorkspaceOperation && deps.editInteractiveMessage &&
+        deps.getAdmissionJournalBinding && deps.getCurrentLeaderEpoch &&
+        Updates.getTelegramUpdateExecutionFence(message)?.isCurrent() === true && deps.isContextActive?.(ctx) === true) {
+      const ownerUserId = deps.configStore.getAllowedUserId();
+      const journalBindingKey = deps.getAdmissionJournalBinding();
+      if (ownerUserId !== undefined && message.from?.id === ownerUserId && journalBindingKey &&
+          Updates.supportsTelegramDeferredAbandonment(message, journalBindingKey)) {
+        const leaderEpoch = deps.getCurrentLeaderEpoch();
+        if (leaderEpoch !== undefined) pending.abandonment = { ownerUserId, journalBindingKey, leaderEpoch };
+      }
+    }
+    if (command && sourceTarget && !inTemporaryThread && includeGuidance && deps.callApi) {
+      // Telegram can create a private tab before delivering an All command not listed in the bot menu.
+      // Naming that unbound tab is not creation evidence or authority to delete it.
+      Updates.createTelegramUpdateExecutionFenceGuard(message)();
+      try {
+        await deps.callApi("editForumTopic", { chat_id: sourceTarget.chatId, message_thread_id: sourceTarget.threadId, name: `/${command.name}` });
+      } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "unbound-command-title" }); }
+      Updates.createTelegramUpdateExecutionFenceGuard(message)();
+    }
+    const text = formatTelegramTemporaryThreadChooserText(command?.name);
+    pending.rootChooserText = text;
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
-      { canRestore: sourceTarget !== undefined, getDisplayTitle: deps.getDisplayTitle },
+      { canRestore: sourceTarget !== undefined, canCancel: !!pending.abandonment, getDisplayTitle: deps.getDisplayTitle },
     );
     if (deps.sendInteractiveMessage) {
       const chooserId = await deps.sendInteractiveMessage(
@@ -2432,7 +3953,13 @@ export function createTelegramInboundRouteRuntime<
     const messages = [...(existing?.messages ?? []), message];
     const timer = setTimeout(() => {
       pendingUnboundRerouteMediaGroups.delete(groupKey);
-      void sendUnboundRerouteChooserNow(messages, ctx, false);
+      // A media group's timer runs outside any request, so it takes the same profile admission as a single message.
+      const send = (): Promise<void> => sendUnboundRerouteChooserNow(messages, ctx, false);
+      const task = deps.runWorkspaceOperation
+        ? deps.runWorkspaceOperation({ operationId: `workspace-unbound-group:${groupKey}:${randomBytes(8).toString("hex")}`,
+          operationKind: "workspace.route-unbound-thread", scopes: [{ kind: "profile" }] }, send)
+        : send();
+      void task.catch(error => { deps.recordRuntimeEvent?.("routing", error, { phase: "unbound-media-group-chooser" }); });
     }, 1200);
     timer.unref?.();
     pendingUnboundRerouteMediaGroups.set(groupKey, { messages, timer });
@@ -2454,6 +3981,83 @@ export function createTelegramInboundRouteRuntime<
     }
     return undefined;
   };
+  /**
+   * An All input gets one source-bound tab. The original stays deferred in All until explicit routing,
+   * and an existing entry is reused on replay, so restart never creates a second tab or retries an unknown one.
+   */
+  const sendAllTabTemporaryInputChooser = async (
+    command: Commands.ParsedTelegramCommand | undefined,
+    commandText: string,
+    message: TMessage,
+    ctx: TContext,
+  ): Promise<boolean> => {
+    const [updateId] = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+    const execution = Updates.getTelegramUpdateExecutionFence(message);
+    const cap = captureTemporaryThreadAuthority(ctx, () => execution?.isCurrent() === true);
+    if (!cap || !deps.runWorkspaceOperation || !deps.callApi || updateId === undefined ||
+        message.chat.type !== "private" || message.chat.id !== cap.operatorUserId || message.from?.id !== cap.operatorUserId ||
+        !cap.isCurrent()) return false;
+    const { store, operatorUserId, journalBindingKey, epoch, authority } = cap, current = cap.isCurrent;
+    const source = { journalBindingKey, updateId };
+    const find = () => store.listTemporaryThreads().find(entry =>
+      entry.source.journalBindingKey === journalBindingKey && entry.source.updateId === updateId);
+    let entry: Threads.TelegramTemporaryThreadEntry | undefined;
+    await deps.runWorkspaceOperation({ operationId: `temporary-thread-${randomBytes(16).toString("hex")}`,
+      operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
+      if (!current()) return;
+      let found = find();
+      found = found && cap.adopt(found);
+      if (found) { entry = found; return; }
+      const reservation = store.reserveTemporaryThread(source, randomBytes(16).toString("hex"), authority);
+      entry = reservation?.entry;
+      if (!reservation?.reserved || !current()) return;
+      let created: { message_thread_id?: unknown } | undefined;
+      try {
+        // The single creation attempt; any failure leaves `creating` as an unknown outcome, never a retry.
+        created = await deps.callApi!<{ message_thread_id?: unknown }>("createForumTopic",
+          { chat_id: operatorUserId, name: command ? `/${command.name}` : "New chat" });
+      } catch (error) {
+        deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-create" });
+        return;
+      }
+      const threadId = created?.message_thread_id;
+      if (!current() || typeof threadId !== "number" || !Number.isSafeInteger(threadId) || threadId <= 0) return;
+      entry = store.acknowledgeTemporaryThread(reservation.entry, { chatId: operatorUserId, threadId }, authority) ?? entry;
+    });
+    if (!current() || !entry) throw new Error("Temporary Thread authority changed; the input remains retryable.");
+    const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
+      ...message, text: commandText, caption: undefined } as TMessage);
+    if (entry.phase !== "created" || !entry.target) {
+      Updates.reportTelegramUpdateDeferred(commandMessage);
+      await deps.sendTextReply(message.chat.id, message.message_id,
+        "<b>⚠️ The routing tab for this command could not be confirmed.</b> It stays held and was not sent to Pi.",
+        { parseMode: "HTML" });
+      return true;
+    }
+    const target = entry.target;
+    const records = getTelegramRoutableThreadRecords(deps.threadStore?.list() ?? [], deps.getLiveThreadTargets?.());
+    const rerouteId = storePendingUnboundReroute([commandMessage], command ? "command" : "prompt", target);
+    const pending = pendingUnboundReroutes.get(rerouteId)!;
+    pending.temporaryThread = entry;
+    Updates.reportTelegramUpdateDeferred(commandMessage);
+    // Cancel is offered only when the exact source can still be abandoned; the tab removal needs that retention first.
+    if (deps.editInteractiveMessage && Updates.supportsTelegramDeferredAbandonment(commandMessage, journalBindingKey)) {
+      pending.abandonment = { ownerUserId: operatorUserId, journalBindingKey, leaderEpoch: epoch };
+    }
+    pending.rootChooserText = formatTelegramTemporaryThreadChooserText(command?.name);
+    try {
+      if (!deps.sendInteractiveMessage) throw new Error("Temporary Thread chooser publication is unavailable.");
+      const chooserId = await deps.sendInteractiveMessage(target.chatId, pending.rootChooserText, "html",
+        buildTelegramUnboundRerouteChooserMarkup(rerouteId, records, { canRestore: true, canCancel: !!pending.abandonment,
+          getDisplayTitle: deps.getDisplayTitle }),
+        { target });
+      rememberRerouteChooser(rerouteId, chooserId);
+    } catch (error) {
+      removePendingReroute(rerouteId);
+      throw error;
+    }
+    return true;
+  };
   const sendAllTabCommandChooser = async (
     command: Commands.ParsedTelegramCommand,
     commandText: string,
@@ -2478,6 +4082,7 @@ export function createTelegramInboundRouteRuntime<
     const rerouteId = storePendingUnboundReroute([commandMessage], "command");
     Updates.reportTelegramUpdateDeferred(commandMessage);
     const text = formatTelegramAllTabMenuChooserText(command.name);
+    pendingUnboundReroutes.get(rerouteId)!.rootChooserText = text;
     const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
       rerouteId,
       activeRecords,
@@ -2749,11 +4354,24 @@ export function createTelegramInboundRouteRuntime<
     assertExecutionCurrent();
     await deps.handleTelegramTopicLifecycleUpdate?.(lifecycle, ctx);
     assertExecutionCurrent();
+    const key = formatTelegramTargetKey(lifecycle.target);
     if (lifecycle.kind !== "created" || !deps.threadStore) {
+      implicitThreadCreations.delete(key);
       return;
     }
     await deps.threadStore.load();
     assertExecutionCurrent();
+    const message = lifecycle.message, created = message.forum_topic_created;
+    const [updateId] = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+    const cap = captureTemporaryThreadAuthority(ctx, () => Updates.getTelegramUpdateExecutionFence(message)?.isCurrent() === true);
+    if (created && typeof created === "object" && "is_name_implicit" in created && created.is_name_implicit === true &&
+        cap && deps.runWorkspaceOperation && updateId !== undefined && !Updates.isTelegramHistoricalInput(message) &&
+        message.chat.type === "private" && message.chat.id === cap.operatorUserId && message.from?.id === cap.operatorUserId &&
+        message.from.is_bot === false && cap.isCurrent() && implicitThreadCreations.size < 100) {
+      implicitThreadCreations.set(key, { ctx, updateId, operatorUserId: cap.operatorUserId,
+        journalBindingKey: cap.journalBindingKey, executor: structuredClone(cap.authority.executor),
+        generation: deps.getSessionGeneration?.(), scope: deps.getAdmissionScope?.() });
+    } else implicitThreadCreations.delete(key);
   };
   // Answer the guest query immediately so the agent-end edit can replace the
   // early ACK once the turn settles. The ACK is the first placeholder frame and
@@ -2795,7 +4413,8 @@ export function createTelegramInboundRouteRuntime<
       }
       assertExecutionCurrent();
     }
-    const text = guestMessage.text ?? "";
+    // Media messages carry the user's text as a caption.
+    const text = guestMessage.text ?? guestMessage.caption ?? "";
     const gm = guestMessage as unknown as Record<string, unknown>;
     // Build telegram prefix with guest context
     const chatRaw = gm.chat as Record<string, unknown>;
@@ -2842,10 +4461,15 @@ export function createTelegramInboundRouteRuntime<
       : "";
     // Download files, run inbound handlers
     const guestMsg = guestMessage as unknown as Media.TelegramMediaMessage;
+    // Guest message IDs belong to the peer's chat; scope files to that peer so they cannot collide with bot-chat files.
+    const guestScope = resolveTelegramGuestFileScope({ chatType, chat: chatRaw, from: fromRaw, replyFrom: replyFromRaw,
+      guestBotCallerUser, guestBotCallerChat, ownerUserId });
+    const downloadGuestFile: typeof deps.downloadFile = (fileId, fileName, source) =>
+      deps.downloadFile(fileId, fileName, source ? { ...source, scope: guestScope } : source);
     const replyFiles = guestMsg.reply_to_message
       ? await Media.downloadTelegramMessageFiles(
           [guestMsg.reply_to_message as Media.TelegramMediaMessage],
-          { downloadFile: deps.downloadFile },
+          { downloadFile: downloadGuestFile },
         )
       : [];
     assertExecutionCurrent();
@@ -2855,7 +4479,7 @@ export function createTelegramInboundRouteRuntime<
         : undefined;
     assertExecutionCurrent();
     const files = await Media.downloadTelegramMessageFiles([guestMsg], {
-      downloadFile: deps.downloadFile,
+      downloadFile: downloadGuestFile,
     });
     assertExecutionCurrent();
     const processed = await deps.inboundHandlerRuntime.process(
@@ -2941,7 +4565,7 @@ export function createTelegramInboundRouteRuntime<
     deps.updateStatus(ctx);
     requestDispatchNextQueuedTelegramTurn(ctx);
   };
-  return Updates.createTelegramPairedUpdateRuntime<TContext, TUpdate>({
+  const runtime = Updates.createTelegramPairedUpdateRuntime<TContext, TUpdate>({
     getAllowedUserId: deps.configStore.getAllowedUserId,
     getCurrentInstanceId: deps.getCurrentInstanceId,
     getMessageOwnership: deps.getMessageOwnership,
@@ -2992,8 +4616,14 @@ export function createTelegramInboundRouteRuntime<
           deps.getLiveThreadTargets?.(),
         );
         const command = getKnownTelegramAllTabCommand(text);
-        // Returning before deferral lets the admission worker terminally settle expired replay.
-        if (command && command.name !== "thread" && isTelegramAllTabCommandExpired(message)) return;
+        const [sourceUpdateId] = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+        const presented = sourceUpdateId !== undefined && deps.getWorkspaceRestoreStore?.()?.listTemporaryThreads().some(entry =>
+          entry.source.updateId === sourceUpdateId && entry.source.journalBindingKey === deps.getAdmissionJournalBinding?.()) === true;
+        // Returning before deferral lets the admission worker terminally settle expired replay; a presented tab is not expiry.
+        if (command && command.name !== "thread" && !presented && isTelegramAllTabCommandExpired(message)) return;
+        if (command?.name !== "thread" && (bindings.length > 0 || presented) &&
+            typeof message.text === "string" && message.text.trim() &&
+            await sendAllTabTemporaryInputChooser(command, text, message as TMessage, ctx)) return;
         if (bindings.length > 0 && command && command.name !== "thread") {
           if (
             await sendAllTabCommandChooser(command, text, message as TMessage, {
@@ -3058,6 +4688,11 @@ export function createTelegramInboundRouteRuntime<
       }
       await deps.threadStore.load();
       assertExecutionCurrent();
+      if (Updates.isTelegramHistoricalInput(message, entry => reviewMessage(entry) !== undefined) && isReviewText(message as TMessage) &&
+          deps.getCurrentLeaderEpoch?.() !== undefined && needsHistoricalReview(message as TMessage)) {
+        if (!Updates.reportTelegramHistoricalRoutingReview(message)) throw new Error("Historical routing hold is unavailable.");
+        return;
+      }
       if (deps.threadStore.getBotState().threadMode === "disabled") {
         await textDispatch.handleMessage(message as TMessage, ctx);
         return;
@@ -3181,14 +4816,8 @@ export function createTelegramInboundRouteRuntime<
       }
       const command = getKnownTelegramAllTabCommand(text);
       if (command && hasAnyRoutableThread) {
-        if (
-          await sendAllTabCommandChooser(command, text, message as TMessage, {
-            target: { chatId: target.chatId, threadId: target.threadId },
-            replyToSource: true,
-          })
-        ) {
-          return;
-        }
+        await sendUnboundRerouteChooser(message as TMessage, ctx);
+        return;
       }
       if (leaderProfileKey && deps.callApi) {
         const currentLeaderRecord = records.find((record) => {
@@ -3303,7 +4932,7 @@ export function createTelegramInboundRouteRuntime<
         }
         const identityThreadName =
           priorLeaderIdentity?.threadName &&
-          Threads.isTelegramTopicThreadNameValidForSlot(
+          ThreadNaming.isTelegramTopicThreadNameValidForSlot(
             priorLeaderIdentity.threadName,
             slot,
           )
@@ -3312,7 +4941,7 @@ export function createTelegramInboundRouteRuntime<
         const threadName =
           priorLeaderRecord?.threadName ??
           identityThreadName ??
-          Threads.chooseTelegramThreadName({ slot }) ??
+          ThreadNaming.chooseTelegramThreadName({ slot }) ??
           "Pi";
         deps.threadStore.upsert({
           profileKey: leaderProfileKey,
@@ -3367,6 +4996,12 @@ export function createTelegramInboundRouteRuntime<
       );
     },
   });
+  return { ...runtime, expireRoutingInput, shouldReviewHistoricalInput, shouldHoldPendingInput, forgetPreviousWorld, beforeQueueReceiptPublished, onQueueReceiptCommitted, onQueueReceiptCompleted, onUpdateCompleted,
+    onWorkspaceRestoreRecipientObserved(follower, isCurrent, ctx) {
+      if (ctx !== undefined) return observeRestoreSettlement({ kind: "recipient", follower, isCurrent }, ctx);
+      return undefined;
+    },
+    async waitForRestoreSettlement() { await Promise.all([...restoreSettlementTasks]); } };
 }
 
 // --- Assistant Output Delivery Authority ---