@llblab/pi-telegram 0.52.0 → 0.52.1

package/dist/lib/routing.js

@@ -189,6 +189,7 @@ function formatTelegramTemporaryThreadChooserText(command) {
         "<b>🧵 Choose target thread:</b>",
         "",
         command ? `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.` : "Choose where to send your message.",
+        "Unaccepted routing expires after 60 minutes; disposable tabs are removed when clear. Accepted work and restored Threads are kept.",
         "Select the Pi thread that should handle it, or restore a Pi into this tab:",
     ].join("\n");
 }
@@ -1902,9 +1903,9 @@ export function createTelegramInboundRouteRuntime(deps) {
      * absence of chooser and journal custody, and the ordinary protection checks must all hold again. The attempt is
      * durably issued once; a skipped or unknown removal keeps the entry protecting the tab across restart.
      */
-    const runTemporaryThreadCleanup = async (token, cap) => {
-        const store = cap.store, inspect = deps.inspectRestoreSourceAbandonment;
-        if (!inspect || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent())
+    const runTemporaryThreadCleanup = async (token, cap, reconcileExpiry) => {
+        const store = cap.store;
+        if ((!deps.inspectRestoreSourceAbandonment && !deps.inspectRoutingInputGroupExpiry) || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent())
             return;
         await deps.runWorkspaceOperation({ operationId: `temporary-thread-cleanup-${randomBytes(16).toString("hex")}`,
             operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
@@ -1912,15 +1913,48 @@ export function createTelegramInboundRouteRuntime(deps) {
                 return;
             let entry = store.listTemporaryThreads().find(value => value.token === token && value.phase === "created" && !!value.target);
             const target = entry?.target;
-            if (!entry || !target || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target) ||
-                entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey)
+            if (!entry || !target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+                entry.source.journalBindingKey !== cap.journalBindingKey)
+                return;
+            const owner = `telegram-owner:${cap.operatorUserId}`;
+            if (reconcileExpiry && deps.inspectRoutingInputGroupExpiry) {
+                for (const group of Threads.getTelegramTemporaryThreadInputs(entry)) {
+                    if ([...(entry.cancelledInputs ?? []), ...(entry.completedInputs ?? [])].some(value => isDeepStrictEqual(value, group)))
+                        continue;
+                    const inspect = (id) => deps.inspectRoutingInputGroupExpiry(group)?.find(value => value.updateId === id);
+                    if (!group.updateIds.every(id => inspect(id)?.operatorAuthorityId === owner))
+                        continue;
+                    entry = cap.adopt(entry);
+                    if (!entry || !cap.isCurrent())
+                        return;
+                    let recorded, failure;
+                    try {
+                        recorded = store.recordTemporaryThreadInputExpiry(entry, group, cap.authority, inspect);
+                    }
+                    catch (error) {
+                        failure = error;
+                    }
+                    if (!cap.isCurrent())
+                        return;
+                    const retained = store.listTemporaryThreads().find(value => value.token === token);
+                    // A lost publication ACK may already have recorded the group or retired a bound tab's temporary frame.
+                    if (!retained)
+                        return;
+                    if (!recorded && !retained.cancelledInputs?.some(value => isDeepStrictEqual(value, group)))
+                        throw failure ?? new Error("Chooser expiry metadata was not confirmed.");
+                    entry = retained;
+                }
+            }
+            if (!Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target))
                 return;
-            const owner = `telegram-owner:${cap.operatorUserId}`, cancelled = entry.cancelledInputs ?? [];
-            const cancelledCurrent = () => cancelled.every(input => input.updateIds.every(updateId => {
-                const evidence = inspect(updateId, input.journalBindingKey);
-                return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
-                    evidence.operatorAuthorityId === owner;
-            }));
+            const cancelled = entry.cancelledInputs ?? [];
+            const cancelledCurrent = () => cancelled.every(input => {
+                const expiry = deps.inspectRoutingInputGroupExpiry?.(input);
+                return input.updateIds.every(updateId => {
+                    const evidence = deps.inspectRestoreSourceAbandonment?.(updateId, input.journalBindingKey) ?? expiry?.find(value => value.updateId === updateId);
+                    return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId && evidence.operatorAuthorityId === owner;
+                });
+            });
             if (!cancelledCurrent())
                 return;
             entry = cap.adopt(entry);
@@ -1940,8 +1974,40 @@ export function createTelegramInboundRouteRuntime(deps) {
             store.retireTemporaryThread(entry, cap.authority);
         });
     };
-    /** Starts the quiet period only when every known group is resolved; a new input or authority change denies it. */
-    const scheduleTemporaryThreadCleanup = (target, ctx) => {
+    // Reuse the one timer per tab for body-free metadata retries. Future retry timers do not join settlement waits;
+    // only their running attempt does. No retry is licensed once a destructive grant may have been issued.
+    const queueTemporaryThreadCleanup = (token, cap, delay, reconcileExpiry, retry = false) => {
+        cancelTemporaryThreadCleanup(token);
+        let settle = () => undefined;
+        const task = new Promise(resolve => { settle = resolve; });
+        const timer = setTimeout(() => {
+            if (temporaryCleanupTimers.get(token)?.timer !== timer)
+                return;
+            temporaryCleanupTimers.delete(token);
+            if (retry)
+                restoreSettlementTasks.add(task);
+            runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+                .catch(error => {
+                deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" });
+                if (!reconcileExpiry || !cap.isCurrent())
+                    return;
+                try {
+                    const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+                    if (retained && !retained.cleanupIssued && cap.isCurrent())
+                        queueTemporaryThreadCleanup(token, cap, 60_000, true, true);
+                }
+                catch { /* Unknown grant state never licenses a retry. */ }
+            })
+                .finally(settle);
+        }, delay);
+        timer.unref?.();
+        temporaryCleanupTimers.set(token, { timer, settle });
+        if (!retry)
+            restoreSettlementTasks.add(task);
+        void task.finally(() => restoreSettlementTasks.delete(task));
+    };
+    /** Starts the quiet period for resolved groups or body-free expiry reconciliation; fresh input/authority revokes it. */
+    const scheduleTemporaryThreadCleanup = (target, ctx, reconcileExpiry = false) => {
         const cap = captureTemporaryThreadAuthority(ctx);
         if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target))
             return;
@@ -1953,27 +2019,22 @@ export function createTelegramInboundRouteRuntime(deps) {
             deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" });
             return;
         }
-        if (!entry || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) ||
-            entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey)
+        if (!entry || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey)
+            return;
+        if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) {
+            try {
+                reconcileExpiry = Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group));
+            }
+            catch (error) {
+                deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" });
+                return;
+            }
+        }
+        if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry))
             return;
-        const token = entry.token;
-        cancelTemporaryThreadCleanup(token);
         const requested = deps.temporaryThreadCleanupDelayMs;
         const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
-        let settle = () => undefined;
-        const task = new Promise(resolve => { settle = resolve; });
-        const timer = setTimeout(() => {
-            if (temporaryCleanupTimers.get(token)?.timer !== timer)
-                return;
-            temporaryCleanupTimers.delete(token);
-            runTemporaryThreadCleanup(token, cap)
-                .catch(error => { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" }); })
-                .finally(settle);
-        }, delay);
-        timer.unref?.();
-        temporaryCleanupTimers.set(token, { timer, settle });
-        restoreSettlementTasks.add(task);
-        void task.finally(() => restoreSettlementTasks.delete(task));
+        queueTemporaryThreadCleanup(entry.token, cap, delay, reconcileExpiry);
     };
     const recordCancelledTemporaryThreadInput = (pending, ctx, isCurrent) => {
         const store = deps.getWorkspaceRestoreStore?.(), target = pending.sourceTarget;
@@ -2056,10 +2117,15 @@ export function createTelegramInboundRouteRuntime(deps) {
                 if (!cap.isCurrent())
                     return;
                 const self = cap.authority.executor.instanceId;
-                const disposable = cap.store.listTemporaryThreads().flatMap(entry => entry.operatorUserId === cap.operatorUserId &&
+                const entries = cap.store.listTemporaryThreads();
+                const preserved = entries.filter(entry => entry.operatorUserId === cap.operatorUserId && entry.phase === "created" &&
+                    cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" &&
+                    Threads.getTelegramTemporaryThreadInputs(entry).some(source => source.journalBindingKey === journalBindingKey &&
+                        source.updateIds.some(id => input.routingSourceIds?.includes(id)))).map(entry => entry.token);
+                const disposable = entries.flatMap(entry => entry.operatorUserId === cap.operatorUserId && !preserved.includes(entry.token) &&
                     entry.executor.instanceId !== self && entry.phase === "created" && entry.target &&
                     cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" ? [entry] : []);
-                const forgotten = cap.store.forgetPreviousWorld(cap.authority);
+                const forgotten = cap.store.forgetPreviousWorld(cap.authority, preserved);
                 if (!forgotten)
                     return;
                 result.forgotten = forgotten.operations.length + forgotten.temporaryThreads.length;
@@ -2087,6 +2153,17 @@ export function createTelegramInboundRouteRuntime(deps) {
                         deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-tab-delete" });
                     }
                 }
+                // Same-instance session replacement may have lost a metadata-only timer after the source was already spent.
+                // Reconstruct from retained tab/source proof under fresh authority, never from a prompt body or an issued delete.
+                for (const entry of cap.store.listTemporaryThreads()) {
+                    if (!cap.isCurrent())
+                        break;
+                    if (entry.phase !== "created" || !entry.target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+                        entry.source.journalBindingKey !== journalBindingKey)
+                        continue;
+                    if (Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)))
+                        scheduleTemporaryThreadCleanup(entry.target, ctx, true);
+                }
             });
         }
         catch (error) {
@@ -2172,10 +2249,11 @@ export function createTelegramInboundRouteRuntime(deps) {
     const expireRoutingInput = async (source, ctx, signal) => {
         const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.();
         const message = source.original.update.message;
-        const current = () => !signal.aborted && source.isCurrent() && operator !== undefined && epoch !== undefined &&
+        const runtimeCurrent = () => !signal.aborted && operator !== undefined && epoch !== undefined &&
             deps.isContextActive?.(ctx) === true && deps.configStore.getAllowedUserId() === operator &&
             deps.getCurrentLeaderEpoch?.() === epoch && deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
             source.original.routingInput?.operatorUserId === operator && message?.from?.id === operator && message.from.is_bot !== true && message.chat?.type === "private";
+        const current = () => runtimeCurrent() && source.isCurrent();
         if (!current() || !deps.runWorkspaceOperation)
             return;
         await deps.runWorkspaceOperation({ operationId: `routing-expiry-${randomBytes(16).toString("hex")}`,
@@ -2185,19 +2263,11 @@ export function createTelegramInboundRouteRuntime(deps) {
             const restores = deps.getWorkspaceRestoreStore?.();
             if (deps.getWorkspaceRestoreStore && !restores)
                 return;
-            if (restores?.list().some(intent => intent.request.source.journalBindingKey === source.journalBindingKey &&
-                intent.request.source.updateIds.includes(source.original.updateId)))
-                return;
-            for (const pending of pendingUnboundReroutes.values()) {
-                if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
-                    continue;
-                if (pending.selectionAttempted || pending.destinationSelected || pending.dispatching || pending.foreignForwardIssued || pending.workspaceRestore || pending.foreignRetry || pending.cleanup || pending.abandonment?.running)
-                    return;
-            }
+            const temporary = restores?.listTemporaryThreads().find(entry => Threads.getTelegramTemporaryThreadInputs(entry).some(input => input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId)));
             const result = source.expire();
             if (!result)
                 return;
-            // Retire local controls after the source ACK. Telegram UI failure cannot undo retention or trigger deletion.
+            // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
             for (const [id, pending] of pendingUnboundReroutes) {
                 if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
                     continue;
@@ -2214,6 +2284,10 @@ export function createTelegramInboundRouteRuntime(deps) {
                     }
                 }
             }
+            // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
+            // never closes over this source or asks the worker to retain a terminal prompt while metadata publication fails.
+            if (temporary?.target && runtimeCurrent())
+                scheduleTemporaryThreadCleanup(temporary.target, ctx, true);
         });
     };
     const renderCancellationReview = async (view, isCurrent) => {

package/dist/lib/telegram-api.d.ts

@@ -514,6 +514,8 @@ export declare function fetchTelegramBotIdentity(botToken: string, fetchImpl?: t
  */
 export declare function callTelegramMultipart<TResponse>(botToken: string | undefined, method: string, fields: Record<string, string>, fileField: string, filePath: string, fileName: string, options?: TelegramApiCallOptions): Promise<TResponse>;
 export declare function downloadTelegramFile(botToken: string | undefined, fileId: string, suggestedName: string, tempDir: string, options?: TelegramFileDownloadOptions): Promise<string>;
+/** Tooltip-like callback answers omit a terminal sentence period; ellipses and other punctuation stay literal. */
+export declare function formatTelegramCallbackAnswerText(text: string | undefined): string | undefined;
 export declare function answerTelegramCallbackQuery(botToken: string | undefined, callbackQueryId: string, text?: string, options?: TelegramAnswerCallbackQueryOptions): Promise<void>;
 export declare function createTelegramChatActionSender<TAction extends string>(sendChatAction: (chatId: number, action: TAction, options?: {
     message_thread_id?: number;

package/dist/lib/telegram-api.js

@@ -795,6 +795,10 @@ export async function downloadTelegramFile(botToken, fileId, suggestedName, temp
     }
     return targetPath;
 }
+/** Tooltip-like callback answers omit a terminal sentence period; ellipses and other punctuation stay literal. */
+export function formatTelegramCallbackAnswerText(text) {
+    return text?.replace(/(?<!\.)\.\s*$/u, "");
+}
 export async function answerTelegramCallbackQuery(botToken, callbackQueryId, text, options = {}) {
     try {
         await callTelegram(botToken, "answerCallbackQuery", text

package/dist/lib/threads.d.ts

@@ -252,7 +252,7 @@ export interface TelegramTemporaryThreadInput {
     journalBindingKey: string;
     updateIds: number[];
 }
-/** A strict journal observation of committed cancellation plus matching private retention. */
+/** Journal-owned donor discard evidence: retained manual cancellation or body-free chooser expiry, never recipient cancellation. */
 export interface TelegramTemporaryThreadCancellationEvidence {
     journalBindingKey: string;
     updateId: number;
@@ -266,7 +266,7 @@ export interface TelegramTemporaryThreadEntry {
     };
     /** Append-only known source groups. Missing legacy metadata never proves that the creation source was alone. */
     inputs?: TelegramTemporaryThreadInput[];
-    /** Whole known groups with positively observed cancellation; never proof that deletion may be issued. */
+    /** Whole known groups with positively observed donor cancellation or expiry; never recipient cancellation or deletion authority. */
     cancelledInputs?: TelegramTemporaryThreadInput[];
     /** Whole known groups whose Forward was positively completed by the journal owner; never deletion authority alone. */
     completedInputs?: TelegramTemporaryThreadInput[];
@@ -361,6 +361,8 @@ export interface TelegramWorkspaceRestore {
     recordTemporaryThreadForwardIssued(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority): TelegramTemporaryThreadEntry | undefined;
     recordTemporaryThreadInputCompletion(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority): TelegramTemporaryThreadEntry | undefined;
     recordTemporaryThreadInputCancellation(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority, inspect: (updateId: number) => TelegramTemporaryThreadCancellationEvidence | undefined): TelegramTemporaryThreadEntry | undefined;
+    /** Body-free chooser expiry may terminate an uncertain donor Forward/Restore, never accepted recipient work or a bound target. */
+    recordTemporaryThreadInputExpiry(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority, inspect: (updateId: number) => TelegramTemporaryThreadCancellationEvidence | undefined): TelegramTemporaryThreadEntry | undefined;
     /** Caller holds profile admission and proves fresh source/protection clearance; publication grants one attempt, never retry. */
     issueTemporaryThreadCleanup(expected: TelegramTemporaryThreadEntry, authority: TelegramWorkspaceRestoreAuthority): {
         issued: true;
@@ -370,8 +372,8 @@ export interface TelegramWorkspaceRestore {
     /** `completed` names one newly completed group; every other known group must already be cancelled or completed. */
     retireTemporaryThread(expected: TelegramTemporaryThreadEntry, authority: TelegramWorkspaceRestoreAuthority, completed?: TelegramTemporaryThreadInput): TelegramTemporaryThreadEntry | undefined;
     /** New-world restart: atomically forgets this operator's Restore intents and temporary entries from previous runtime instances.
-     * Committed bindings stay; nothing is rolled back, replayed or deleted here. */
-    forgetPreviousWorld(authority: TelegramWorkspaceRestoreAuthority): {
+     * Caller may preserve exact unbound temporary tokens for clock-bearing sources. Committed bindings stay; nothing is rolled back, replayed or deleted here. */
+    forgetPreviousWorld(authority: TelegramWorkspaceRestoreAuthority, preserveTemporaryTokens?: readonly string[]): {
         operations: TelegramWorkspaceRestoreIntent[];
         temporaryThreads: TelegramTemporaryThreadEntry[];
     } | undefined;

package/dist/lib/threads.js

@@ -2750,6 +2750,47 @@ export function createTelegramTopicTargetStore(options) {
                     });
                     return recorded && current() ? recorded : undefined;
                 },
+                recordTemporaryThreadInputExpiry(expected, inputValue, authority, inspect) {
+                    const input = structuredClone(inputValue);
+                    if (!isTemporaryThreadInput(input) || typeof inspect !== "function")
+                        return undefined;
+                    const operator = authority.operatorUserId, executor = structuredClone(authority.executor);
+                    const bound = classifyTemporaryTarget(read(), expected).kind === "bound";
+                    const current = () => authority.isCurrent() && authority.operatorUserId === operator &&
+                        isDeepStrictEqual(authority.executor, executor) && input.updateIds.every(updateId => {
+                        const evidence = inspect(updateId);
+                        return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
+                            evidence.operatorAuthorityId === `telegram-owner:${operator}`;
+                    }) && authority.isCurrent();
+                    return advanceTemporary(expected, { ...authority, isCurrent: current }, (entry, file) => {
+                        if (entry.phase !== "created" || !getTelegramTemporaryThreadInputs(entry).some(value => isDeepStrictEqual(value, input)) ||
+                            entry.completedInputs?.some(value => isDeepStrictEqual(value, input)))
+                            return false;
+                        const cancelled = entry.cancelledInputs ?? [];
+                        if (cancelled.some(value => isDeepStrictEqual(value, input)))
+                            return "unchanged";
+                        const operations = file.operations.filter(({ request }) => request.source.journalBindingKey === input.journalBindingKey &&
+                            request.source.updateIds.some(id => input.updateIds.includes(id)));
+                        if (operations.some(({ request }) => !request.source.updateIds.every(id => input.updateIds.includes(id))))
+                            return false;
+                        // Forget only expired donor intent; canonical binding, recipient queue and immutable settlement proofs are untouched.
+                        file.operations = file.operations.filter(value => !operations.includes(value));
+                        // Once bound, this is no longer a disposable tab. Forget its temporary frame, not the binding or other journal sources.
+                        if (bound) {
+                            file.temporaryThreads = file.temporaryThreads?.filter(value => value !== entry);
+                            if (!file.temporaryThreads?.length)
+                                delete file.temporaryThreads;
+                            return true;
+                        }
+                        const forwarded = entry.forwardedInputs?.filter(value => !isDeepStrictEqual(value, input));
+                        if (forwarded?.length)
+                            entry.forwardedInputs = forwarded;
+                        else
+                            delete entry.forwardedInputs;
+                        entry.cancelledInputs = [...cancelled, input];
+                        return true;
+                    });
+                },
                 recordTemporaryThreadForwardIssued(expected, inputValue, authority) {
                     const input = structuredClone(inputValue);
                     if (!isTemporaryThreadInput(input))
@@ -2808,7 +2849,7 @@ export function createTelegramTopicTargetStore(options) {
                         return entry;
                     });
                 },
-                forgetPreviousWorld(authority) {
+                forgetPreviousWorld(authority, preserveTemporaryTokens = []) {
                     if (!authority.isCurrent())
                         return undefined;
                     const executor = structuredClone(authority.executor), operator = authority.operatorUserId;
@@ -2817,13 +2858,14 @@ export function createTelegramTopicTargetStore(options) {
                     const current = () => authority.isCurrent() && authority.operatorUserId === operator && isDeepStrictEqual(authority.executor, executor);
                     const previous = (value) => value.operatorUserId === operator && value.executor.instanceId !== executor.instanceId;
                     const before = storage.read(), file = structuredClone(before);
-                    const operations = file.operations.filter(previous), temporaryThreads = (file.temporaryThreads ?? []).filter(previous);
+                    const forgetTemporary = (value) => previous(value) && !preserveTemporaryTokens.includes(value.token);
+                    const operations = file.operations.filter(previous), temporaryThreads = (file.temporaryThreads ?? []).filter(forgetTemporary);
                     if (!current())
                         return undefined;
                     if (!operations.length && !temporaryThreads.length)
                         return { operations, temporaryThreads };
                     file.operations = file.operations.filter(value => !previous(value));
-                    const remaining = (file.temporaryThreads ?? []).filter(value => !previous(value));
+                    const remaining = (file.temporaryThreads ?? []).filter(value => !forgetTemporary(value));
                     if (remaining.length)
                         file.temporaryThreads = remaining;
                     else

package/dist/lib/updates.d.ts

@@ -6,7 +6,7 @@
 import { type TelegramTarget } from "./target.ts";
 import type { TelegramBusEnvelope, TelegramBusFollowerView, TelegramBusForwardOwnership, TelegramBusForeignUpdateSettlement, TelegramProcessLiveness } from "./bus.ts";
 import type { TelegramMessageOwnershipStore } from "./ownership.ts";
-import { TELEGRAM_UPDATE_JOURNAL_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, type TelegramUpdateJournalEntryDigest, type TelegramUpdateJournalSourceCompletion, type TelegramUpdateJournalQueuedCompletion, type TelegramUpdateJournalQueuedReceiptEvidence, type TelegramInputJournalReceipt, type TelegramInputJournalSourceReference, type TelegramInputJournalStore, type TelegramJournaledUpdate, type TelegramUpdateJournalDeadQueueOwnerRecoveryResult, type TelegramUpdateJournalAppendResult, type TelegramUpdateJournalInputClaim, type TelegramUpdateJournalOperatorDispositionInput, type TelegramUpdateJournalOperatorDispositionResult, type TelegramUpdateJournalPendingAbandonmentInput, type TelegramUpdateJournalPendingAbandonmentResult, type TelegramUpdateJournalPendingRetentionEvidence, type TelegramUpdateJournalEntry, type TelegramUpdateJournalRoutingInput, type TelegramRoutingInputJournal, type TelegramUpdateJournalQueueDiscardResult, type TelegramUpdateJournalQueueHandoffAcceptResult, type TelegramUpdateJournalQueueHandoffCancelResult, type TelegramUpdateJournalQueueHandoffInput, type TelegramUpdateJournalQueueHandoffOfferResult, type TelegramUpdateJournalQueueOwner, type TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
+import { TELEGRAM_UPDATE_JOURNAL_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, type TelegramUpdateJournalEntryDigest, type TelegramUpdateJournalSourceCompletion, type TelegramUpdateJournalQueuedCompletion, type TelegramUpdateJournalQueuedReceiptEvidence, type TelegramInputJournalReceipt, type TelegramInputJournalSourceReference, type TelegramInputJournalStore, type TelegramJournaledUpdate, type TelegramUpdateJournalDeadQueueOwnerRecoveryResult, type TelegramUpdateJournalAppendResult, type TelegramUpdateJournalInputClaim, type TelegramUpdateJournalOperatorDispositionInput, type TelegramUpdateJournalOperatorDispositionResult, type TelegramUpdateJournalPendingAbandonmentInput, type TelegramUpdateJournalPendingAbandonmentResult, type TelegramUpdateJournalPendingRetentionEvidence, type TelegramUpdateJournalEntry, type TelegramUpdateJournalRoutingInput, type TelegramRoutingInputJournal, type TelegramRoutingInputExpiryResult, type TelegramUpdateJournalQueueDiscardResult, type TelegramUpdateJournalQueueHandoffAcceptResult, type TelegramUpdateJournalQueueHandoffCancelResult, type TelegramUpdateJournalQueueHandoffInput, type TelegramUpdateJournalQueueHandoffOfferResult, type TelegramUpdateJournalQueueOwner, type TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
 import { type PendingTelegramControlItem, type TelegramControlQueueHandoffPayload, type TelegramQueueAdmissionReceipt, type TelegramQueueHandoffPayload, type TelegramQueueHandoffStageResult, type TelegramQueueReactionDisposition, type TelegramQueueHandoffStagingRuntime, type TelegramQueueItem } from "./queue.ts";
 import { type TelegramAuthorizationState, type TelegramUserPairingRuntimeDeps } from "./config.ts";
 export interface TelegramReactionTypeEmoji {
@@ -189,6 +189,8 @@ export interface TelegramHeldSourcePreparation<TContext> {
     /** Exact prepared worker owner, context, key and authority; the consumer adds its own domain fences. */
     isCurrent: () => boolean;
     signal: AbortSignal;
+    /** Chooser-clock sources that must survive cold spending until their fixed expiry. */
+    routingSourceIds?: readonly number[];
 }
 export interface TelegramDeferredAbandonmentRecoveryPage {
     sources: {
@@ -504,7 +506,7 @@ export interface TelegramRoutingInputExpirySource {
     original: TelegramUpdateJournalEntry;
     journalBindingKey: string;
     isCurrent(): boolean;
-    expire(): TelegramUpdateJournalPendingAbandonmentResult | undefined;
+    expire(): TelegramRoutingInputExpiryResult | undefined;
 }
 export interface TelegramUpdateWorkerJournalPort {
     routingInputs?: TelegramRoutingInputJournal;
@@ -585,7 +587,7 @@ export interface TelegramUpdateWorkerRuntimeDeps<TContext> {
     getRecipientBindingKey?: () => string | undefined;
     /** True selects legacy historical review/spending; retain protects unsupported originals without disposition authority. */
     shouldReviewHistoricalInput?: (entry: TelegramUpdateJournalEntry, ctx: TContext, signal: AbortSignal) => boolean | "retain" | Promise<boolean | "retain">;
-    /** New-world restart: spend previous-process routing inputs (classified or armed) without delivery, copy or completion observers. Interrupted private abandonment keeps its own exact recovery. */
+    /** New-world restart: spend unclocked classified routing input without delivery, copy or completion. Chooser clocks wait for expiry; interrupted private abandonment keeps exact recovery. */
     spendHistoricalInput?: boolean;
     /** Holds protected live or retry sources before execution; never cancels or disposes them. */
     shouldHoldPendingInput?: (entry: TelegramUpdateJournalEntry, ctx: TContext, signal: AbortSignal) => boolean | Promise<boolean>;
@@ -633,6 +635,10 @@ export interface TelegramUpdateWorkerRuntime<TContext> {
         operatorUserId: number;
         sourceUpdateIds: readonly number[];
     }) => boolean;
+    isRoutingInputCurrent?: (input: {
+        updateId: number;
+        signal: AbortSignal;
+    }) => boolean;
     supportsDeferredAbandonment?: (input: {
         updateId: number;
         signal: AbortSignal;
@@ -744,6 +750,7 @@ export interface TelegramUpdateAdmissionHandleDeps<TUpdate extends TelegramUpdat
     abandonDeferred?: TelegramUpdateWorkerRuntime<TContext>["abandonDeferred"];
     armRoutingInput?: TelegramUpdateWorkerRuntime<TContext>["armRoutingInput"];
     selectRoutingInput?: TelegramUpdateWorkerRuntime<TContext>["selectRoutingInput"];
+    isRoutingInputCurrent?: TelegramUpdateWorkerRuntime<TContext>["isRoutingInputCurrent"];
     supportsDeferredAbandonment?: TelegramUpdateWorkerRuntime<TContext>["supportsDeferredAbandonment"];
     inspectAbandoning?: TelegramUpdateWorkerRuntime<TContext>["inspectAbandoning"];
     inspectHistorical?: TelegramUpdateWorkerRuntime<TContext>["inspectHistorical"];
@@ -1135,7 +1142,7 @@ export declare function executeTelegramCustodiedInput(input: {
 export declare function createTelegramUpdateAdmissionHandle<TUpdate extends TelegramUpdateFlow & {
     update_id: number;
 }, TContext>(deps: TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>): (update: TUpdate, ctx: TContext, signal: AbortSignal) => Promise<TelegramUpdateAdmissionOutcome>;
-export declare function createTelegramCustodiedUpdateAdmissionHandle<TUpdate extends TelegramJournaledUpdate & TelegramUpdateFlow, TContext>(deps: Omit<TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>, "onLateOutcome" | "onLateOutcomeError" | "abandonDeferred" | "armRoutingInput" | "selectRoutingInput" | "supportsDeferredAbandonment" | "inspectAbandoning" | "inspectHistorical" | "inspectDeferredSource" | "isHistoricalSource"> & {
+export declare function createTelegramCustodiedUpdateAdmissionHandle<TUpdate extends TelegramJournaledUpdate & TelegramUpdateFlow, TContext>(deps: Omit<TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>, "onLateOutcome" | "onLateOutcomeError" | "abandonDeferred" | "armRoutingInput" | "selectRoutingInput" | "isRoutingInputCurrent" | "supportsDeferredAbandonment" | "inspectAbandoning" | "inspectHistorical" | "inspectDeferredSource" | "isHistoricalSource"> & {
     journal: TelegramCustodyExecutionJournal;
     recipientBindingKey: string;
     onLateOutcomeError(error: unknown, updateId: number): void;

package/dist/lib/updates.js

@@ -1701,24 +1701,34 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             return false;
         let nextAtMs, changed = false;
         const binding = deps.getJournalBindingKey?.(), snapshotIds = new Set(snapshot.entries.map(entry => entry.updateId));
-        // Lost removal ACKs reconcile only the exact held original through the retained copy/tombstone.
+        // Lost expiry ACKs reconcile the exact held original against its body-free discard tombstone.
         const candidates = [...snapshot.entries, ...[...deferredSources.values()]
                 .filter(source => source.journalBindingKey === binding && !snapshotIds.has(source.entry.updateId))
                 .map(source => source.entry)];
         for (const entry of candidates) {
             const lifetime = entry.routingInput;
-            if (claims.get(entry.updateId) === "retained" || (expectedOwner.startupUpdateIds?.has(entry.updateId) &&
-                !claims.has(entry.updateId) && deps.shouldReviewHistoricalInput))
+            if (!lifetime || entry.state !== "pending" || !binding || claims.get(entry.updateId) === "queued" ||
+                unsettledExecutionsByUpdateId.get(entry.updateId)?.size)
                 continue;
-            if (!lifetime || lifetime.phase !== "waiting" || entry.state !== "pending" || !binding || unsettledExecutionsByUpdateId.get(entry.updateId)?.size)
+            // Classify the first startup snapshot before constructing any historical expiry carrier.
+            if (expectedOwner.startupUpdateIds?.has(entry.updateId) && !claims.has(entry.updateId) && deps.shouldReviewHistoricalInput) {
+                nextAtMs = Math.min(nextAtMs ?? Infinity, Math.max(getNowMs() + 1, lifetime.expiresAtMs));
                 continue;
+            }
             if (getNowMs() < lifetime.expiresAtMs) {
                 nextAtMs = Math.min(nextAtMs ?? Infinity, lifetime.expiresAtMs);
                 continue;
             }
             const existing = deferredSources.get(entry.updateId);
-            if (existing && !isDeepStrictEqual(existing.entry, entry))
-                continue;
+            if (existing && !isDeepStrictEqual(existing.entry, entry)) {
+                // Lost clock/selection ACKs may leave only this immutable metadata behind its exact source; reconciliation grants expiry, never another dispatch.
+                const previous = existing.entry.routingInput;
+                if (!isDeepStrictEqual({ ...existing.entry, routingInput: lifetime }, entry) ||
+                    (previous && (!isDeepStrictEqual({ ...previous, phase: lifetime.phase }, lifetime) ||
+                        (previous.phase === "selected" && lifetime.phase !== "selected"))))
+                    continue;
+                existing.entry = structuredClone(entry);
+            }
             const source = existing ?? { entry: structuredClone(entry), journalBindingKey: binding, historical: true };
             deferredSources.set(entry.updateId, source);
             if (!claims.has(entry.updateId))
@@ -1738,13 +1748,14 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                                 return { ...committed, duplicate: true };
                             claims.set(entry.updateId, "abandoning");
                             committed = expireRouting({ entry: source.entry, journalBindingKey: binding, operatorUserId: lifetime.operatorUserId, isCurrent: current });
+                            // Source expiry is terminal before chooser/cleanup awaits; later failures must not retain a deferred/retry source.
                             claims.delete(entry.updateId);
                             deferredSources.delete(entry.updateId);
                             state.journalEntryCount = committed.entryCount;
                             state.journalSerializedBytes = committed.serializedBytes;
                             updateClaimCounts();
                             notifyStateChange();
-                            changed = true;
+                            changed ||= !committed.duplicate;
                             return committed;
                         } }, expectedOwner.ctx, expectedOwner.controller.signal);
             }
@@ -1964,7 +1975,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                             transition("deferred", entry.updateId);
                             continue;
                         }
-                        if (review && historical && spendHistorical && classifyPending === deps.shouldReviewHistoricalInput) {
+                        if (review && historical && spendHistorical && !entry.routingInput && classifyPending === deps.shouldReviewHistoricalInput) {
                             completedUpdateIds.push({ updateId: entry.updateId, spent: true });
                             continue;
                         }
@@ -1975,10 +1986,6 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                         }
                     }
                     if (entry.state === "pending" && entry.routingInput) {
-                        if (historical && spendHistorical) {
-                            completedUpdateIds.push({ updateId: entry.updateId, spent: true });
-                            continue;
-                        }
                         claims.set(entry.updateId, "historical");
                         transition("deferred", entry.updateId);
                         continue;
@@ -2123,7 +2130,9 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                         expectedOwner.heldSourcesPreparedIssued = true;
                         // Do not couple lifecycle/stop or the worker drain to a held controller/API reply.
                         void Promise.resolve().then(() => isCurrent() ? onHeldSourcesPrepared({ ctx,
-                            journalBindingKey: key, signal: expectedOwner.controller.signal, isCurrent }) : undefined).catch(error => {
+                            journalBindingKey: key, signal: expectedOwner.controller.signal, isCurrent,
+                            routingSourceIds: [...deferredSources].filter(([, source]) => source.journalBindingKey === key && !!source.entry.routingInput)
+                                .map(([id]) => id) }) : undefined).catch(error => {
                             try {
                                 deps.recordRuntimeEvent?.("inbound-worker", error, { phase: "held-source-preparation" });
                             }
@@ -2286,6 +2295,10 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         },
         armRoutingInput(input) { return mutateRoutingSource(input, false)?.lifetime; },
         selectRoutingInput(input) { return mutateRoutingSource(input, true)?.issued === true; },
+        isRoutingInputCurrent(input) {
+            return owner?.controller.signal === input.signal && !input.signal.aborted &&
+                deferredSources.has(input.updateId) && claims.get(input.updateId) !== "abandoning";
+        },
         inspectDeferredSource(input) {
             const expectedOwner = owner;
             const source = deferredSources.get(input.updateId);
@@ -2346,7 +2359,8 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 return;
             }
             const claim = claims.get(input.updateId);
-            if (claim === "abandoning" || claim === "historical" || claim === "retained")
+            if (claim === "abandoning" || claim === "historical" || claim === "retained" ||
+                (!claim && routingJournal?.inspectExpiry(input.updateId)))
                 return;
             if (input.outcome.kind === "complete") {
                 // Expiry may retire only a still-deferred source, never accepted queue work.
@@ -3551,9 +3565,10 @@ export function createTelegramUpdateAdmissionHandle(deps) {
             generation,
             updateId: update.update_id,
             signal,
-            isCurrent: () => !signal.aborted && !suspended,
+            isCurrent: () => !signal.aborted && !suspended && ((!routingLifetime && !routingClockUnknown) || immediate || settlementReported ||
+                deps.isRoutingInputCurrent?.({ updateId: update.update_id, signal }) !== false),
             assertCurrent() {
-                if (signal.aborted || suspended) {
+                if (!execution.isCurrent()) {
                     throw signal.reason ?? new DOMException("Aborted", "AbortError");
                 }
             },
@@ -3567,7 +3582,7 @@ export function createTelegramUpdateAdmissionHandle(deps) {
         let settlementReported = false;
         let outcome;
         const boundUpdate = bindTelegramUpdateExecutionFence(bindTelegramUpdateAdmissionSource(update, (next) => {
-            if (suspended || signal.aborted)
+            if (!execution.isCurrent())
                 return;
             if (next.kind === "deferred" && next.routingReview) {
                 if (!immediate || settlementReported || routingClaims > 0 || !deps.isHistoricalSource?.({ updateId: update.update_id, signal })) {
@@ -3586,7 +3601,7 @@ export function createTelegramUpdateAdmissionHandle(deps) {
             }
             void Promise.resolve()
                 .then(() => {
-                if (suspended || signal.aborted)
+                if (!execution.isCurrent())
                     return;
                 return deps.onLateOutcome(next, {
                     updateId: update.update_id,
@@ -4487,6 +4502,7 @@ export function createTelegramUpdateAdmissionWorkerRuntime(deps) {
         abandonDeferred: input => worker?.abandonDeferred?.(input),
         armRoutingInput: input => worker?.armRoutingInput?.(input),
         selectRoutingInput: input => worker?.selectRoutingInput?.(input) === true,
+        isRoutingInputCurrent: input => worker?.isRoutingInputCurrent?.(input) !== false,
         supportsDeferredAbandonment: input => worker?.supportsDeferredAbandonment?.(input) === true,
         inspectAbandoning: input => worker?.inspectAbandoning?.(input),
         inspectHistorical: input => worker?.inspectHistorical?.(input),

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.52.0",
+  "version": "0.52.1",
   "private": false,
   "publishConfig": {
     "access": "public"