@llblab/pi-telegram 0.52.0 → 0.52.1

package/lib/routing.ts

@@ -289,6 +289,7 @@ function formatTelegramTemporaryThreadChooserText(command?: string): string {
     "<b>🧵 Choose target thread:</b>",
     "",
     command ? `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.` : "Choose where to send your message.",
+    "Unaccepted routing expires after 60 minutes; disposable tabs are removed when clear. Accepted work and restored Threads are kept.",
     "Select the Pi thread that should handle it, or restore a Pi into this tab:",
   ].join("\n");
 }
@@ -674,6 +675,7 @@ export interface TelegramInboundRouteRuntimeDeps<
   captureWorkspaceExternalProtection?: ReturnType<typeof createTelegramWorkspaceExternalProtectionCapture>;
   /** Strict committed abandonment plus retained original; shared by Restore and temporary-input cancellation. */
   inspectRestoreSourceAbandonment?: (updateId: number, journalBindingKey: string) => Threads.TelegramTemporaryThreadCancellationEvidence | undefined;
+  inspectRoutingInputGroupExpiry?: (input: Threads.TelegramTemporaryThreadInput) => readonly Threads.TelegramTemporaryThreadCancellationEvidence[] | undefined;
   /** Strict active-journal observation only; a hint or missing source never substitutes for this ACK. */
   inspectRestoreSourceCompletion?: (expected: Updates.TelegramDeferredSourceEvidence & { completionSha256: string }) =>
     (Updates.TelegramDeferredSourceEvidence & { completionSha256: string }) | undefined;
@@ -2363,22 +2365,45 @@ export function createTelegramInboundRouteRuntime<
    * absence of chooser and journal custody, and the ordinary protection checks must all hold again. The attempt is
    * durably issued once; a skipped or unknown removal keeps the entry protecting the tab across restart.
    */
-  const runTemporaryThreadCleanup = async (token: string, cap: TemporaryThreadAuthority): Promise<void> => {
-    const store = cap.store, inspect = deps.inspectRestoreSourceAbandonment;
-    if (!inspect || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent()) return;
+  const runTemporaryThreadCleanup = async (token: string, cap: TemporaryThreadAuthority, reconcileExpiry: boolean): Promise<void> => {
+    const store = cap.store;
+    if ((!deps.inspectRestoreSourceAbandonment && !deps.inspectRoutingInputGroupExpiry) || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent()) return;
     await deps.runWorkspaceOperation({ operationId: `temporary-thread-cleanup-${randomBytes(16).toString("hex")}`,
       operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
       if (!cap.isCurrent()) return;
       let entry = store.listTemporaryThreads().find(value => value.token === token && value.phase === "created" && !!value.target);
       const target = entry?.target;
-      if (!entry || !target || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target) ||
-          entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
-      const owner = `telegram-owner:${cap.operatorUserId}`, cancelled = entry.cancelledInputs ?? [];
-      const cancelledCurrent = () => cancelled.every(input => input.updateIds.every(updateId => {
-        const evidence = inspect(updateId, input.journalBindingKey);
-        return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
-          evidence.operatorAuthorityId === owner;
-      }));
+      if (!entry || !target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+          entry.source.journalBindingKey !== cap.journalBindingKey) return;
+      const owner = `telegram-owner:${cap.operatorUserId}`;
+      if (reconcileExpiry && deps.inspectRoutingInputGroupExpiry) {
+        for (const group of Threads.getTelegramTemporaryThreadInputs(entry)) {
+          if ([...(entry.cancelledInputs ?? []), ...(entry.completedInputs ?? [])].some(value => isDeepStrictEqual(value, group))) continue;
+          const inspect = (id: number) => deps.inspectRoutingInputGroupExpiry!(group)?.find(value => value.updateId === id);
+          if (!group.updateIds.every(id => inspect(id)?.operatorAuthorityId === owner)) continue;
+          entry = cap.adopt(entry);
+          if (!entry || !cap.isCurrent()) return;
+          let recorded: Threads.TelegramTemporaryThreadEntry | undefined, failure: unknown;
+          try { recorded = store.recordTemporaryThreadInputExpiry(entry, group, cap.authority, inspect); }
+          catch (error) { failure = error; }
+          if (!cap.isCurrent()) return;
+          const retained = store.listTemporaryThreads().find(value => value.token === token);
+          // A lost publication ACK may already have recorded the group or retired a bound tab's temporary frame.
+          if (!retained) return;
+          if (!recorded && !retained.cancelledInputs?.some(value => isDeepStrictEqual(value, group)))
+            throw failure ?? new Error("Chooser expiry metadata was not confirmed.");
+          entry = retained;
+        }
+      }
+      if (!Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target)) return;
+      const cancelled = entry.cancelledInputs ?? [];
+      const cancelledCurrent = () => cancelled.every(input => {
+        const expiry = deps.inspectRoutingInputGroupExpiry?.(input);
+        return input.updateIds.every(updateId => {
+          const evidence = deps.inspectRestoreSourceAbandonment?.(updateId, input.journalBindingKey) ?? expiry?.find(value => value.updateId === updateId);
+          return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId && evidence.operatorAuthorityId === owner;
+        });
+      });
       if (!cancelledCurrent()) return;
       entry = cap.adopt(entry);
       if (!entry || !cap.isCurrent() || isRerouteTargetProtected(target, undefined, entry)) return;
@@ -2394,33 +2419,49 @@ export function createTelegramInboundRouteRuntime<
       store.retireTemporaryThread(entry, cap.authority);
     });
   };
-  /** Starts the quiet period only when every known group is resolved; a new input or authority change denies it. */
-  const scheduleTemporaryThreadCleanup = (target: Queue.TelegramQueueTarget, ctx: TContext): void => {
-    const cap = captureTemporaryThreadAuthority(ctx);
-    if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target)) return;
-    let entry: Threads.TelegramTemporaryThreadEntry | undefined;
-    try { entry = cap.store.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target)); }
-    catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
-    if (!entry || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) ||
-        entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
-    const token = entry.token;
+  // Reuse the one timer per tab for body-free metadata retries. Future retry timers do not join settlement waits;
+  // only their running attempt does. No retry is licensed once a destructive grant may have been issued.
+  const queueTemporaryThreadCleanup = (token: string, cap: TemporaryThreadAuthority, delay: number, reconcileExpiry: boolean, retry = false): void => {
     cancelTemporaryThreadCleanup(token);
-    const requested = deps.temporaryThreadCleanupDelayMs;
-    const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
     let settle = (): void => undefined;
     const task = new Promise<void>(resolve => { settle = resolve; });
     const timer = setTimeout(() => {
       if (temporaryCleanupTimers.get(token)?.timer !== timer) return;
       temporaryCleanupTimers.delete(token);
-      runTemporaryThreadCleanup(token, cap)
-        .catch(error => { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" }); })
+      if (retry) restoreSettlementTasks.add(task);
+      runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+        .catch(error => {
+          deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" });
+          if (!reconcileExpiry || !cap.isCurrent()) return;
+          try {
+            const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+            if (retained && !retained.cleanupIssued && cap.isCurrent()) queueTemporaryThreadCleanup(token, cap, 60_000, true, true);
+          } catch { /* Unknown grant state never licenses a retry. */ }
+        })
         .finally(settle);
     }, delay);
     timer.unref?.();
     temporaryCleanupTimers.set(token, { timer, settle });
-    restoreSettlementTasks.add(task);
+    if (!retry) restoreSettlementTasks.add(task);
     void task.finally(() => restoreSettlementTasks.delete(task));
   };
+  /** Starts the quiet period for resolved groups or body-free expiry reconciliation; fresh input/authority revokes it. */
+  const scheduleTemporaryThreadCleanup = (target: Queue.TelegramQueueTarget, ctx: TContext, reconcileExpiry = false): void => {
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target)) return;
+    let entry: Threads.TelegramTemporaryThreadEntry | undefined;
+    try { entry = cap.store.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target)); }
+    catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
+    if (!entry || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
+    if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) {
+      try { reconcileExpiry = Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)); }
+      catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
+    }
+    if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) return;
+    const requested = deps.temporaryThreadCleanupDelayMs;
+    const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
+    queueTemporaryThreadCleanup(entry.token, cap, delay, reconcileExpiry);
+  };
   const recordCancelledTemporaryThreadInput = (pending: PendingUnboundReroute, ctx: TContext, isCurrent: () => boolean): boolean => {
     const store = deps.getWorkspaceRestoreStore?.(), target = pending.sourceTarget;
     if (!store || target.threadId === undefined) return !pending.temporaryThread;
@@ -2490,10 +2531,15 @@ export function createTelegramInboundRouteRuntime<
         await threads.load();
         if (!cap.isCurrent()) return;
         const self = cap.authority.executor.instanceId;
-        const disposable = cap.store.listTemporaryThreads().flatMap(entry => entry.operatorUserId === cap.operatorUserId &&
+        const entries = cap.store.listTemporaryThreads();
+        const preserved = entries.filter(entry => entry.operatorUserId === cap.operatorUserId && entry.phase === "created" &&
+          cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" &&
+          Threads.getTelegramTemporaryThreadInputs(entry).some(source => source.journalBindingKey === journalBindingKey &&
+            source.updateIds.some(id => input.routingSourceIds?.includes(id)))).map(entry => entry.token);
+        const disposable = entries.flatMap(entry => entry.operatorUserId === cap.operatorUserId && !preserved.includes(entry.token) &&
           entry.executor.instanceId !== self && entry.phase === "created" && entry.target &&
           cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" ? [entry] : []);
-        const forgotten = cap.store.forgetPreviousWorld(cap.authority);
+        const forgotten = cap.store.forgetPreviousWorld(cap.authority, preserved);
         if (!forgotten) return;
         result.forgotten = forgotten.operations.length + forgotten.temporaryThreads.length;
         for (const entry of disposable) {
@@ -2514,6 +2560,15 @@ export function createTelegramInboundRouteRuntime<
               { maxAttempts: 1, retrySafety: "non-idempotent" }) === true) result.deleted++;
           } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-tab-delete" }); }
         }
+        // Same-instance session replacement may have lost a metadata-only timer after the source was already spent.
+        // Reconstruct from retained tab/source proof under fresh authority, never from a prompt body or an issued delete.
+        for (const entry of cap.store.listTemporaryThreads()) {
+          if (!cap.isCurrent()) break;
+          if (entry.phase !== "created" || !entry.target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+              entry.source.journalBindingKey !== journalBindingKey) continue;
+          if (Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)))
+            scheduleTemporaryThreadCleanup(entry.target, ctx, true);
+        }
       });
     } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-forget" }); }
     return result;
@@ -2585,25 +2640,22 @@ export function createTelegramInboundRouteRuntime<
   const expireRoutingInput = async (source: Updates.TelegramRoutingInputExpirySource, ctx: TContext, signal: AbortSignal): Promise<void> => {
     const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.();
     const message = source.original.update.message as Partial<TMessage> | undefined;
-    const current = () => !signal.aborted && source.isCurrent() && operator !== undefined && epoch !== undefined &&
+    const runtimeCurrent = () => !signal.aborted && operator !== undefined && epoch !== undefined &&
       deps.isContextActive?.(ctx) === true && deps.configStore.getAllowedUserId() === operator &&
       deps.getCurrentLeaderEpoch?.() === epoch && deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
       source.original.routingInput?.operatorUserId === operator && message?.from?.id === operator && message.from.is_bot !== true && message.chat?.type === "private";
+    const current = () => runtimeCurrent() && source.isCurrent();
     if (!current() || !deps.runWorkspaceOperation) return;
     await deps.runWorkspaceOperation({ operationId: `routing-expiry-${randomBytes(16).toString("hex")}`,
       operationKind: "workspace.expire-unbound-routing", scopes: [{ kind: "profile" }] }, async () => {
       if (!current()) return;
       const restores = deps.getWorkspaceRestoreStore?.();
       if (deps.getWorkspaceRestoreStore && !restores) return;
-      if (restores?.list().some(intent => intent.request.source.journalBindingKey === source.journalBindingKey &&
-          intent.request.source.updateIds.includes(source.original.updateId))) return;
-      for (const pending of pendingUnboundReroutes.values()) {
-        if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId)) continue;
-        if (pending.selectionAttempted || pending.destinationSelected || pending.dispatching || pending.foreignForwardIssued || pending.workspaceRestore || pending.foreignRetry || pending.cleanup || pending.abandonment?.running) return;
-      }
+      const temporary = restores?.listTemporaryThreads().find(entry => Threads.getTelegramTemporaryThreadInputs(entry).some(input =>
+        input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId)));
       const result = source.expire();
       if (!result) return;
-      // Retire local controls after the source ACK. Telegram UI failure cannot undo retention or trigger deletion.
+      // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
       for (const [id, pending] of pendingUnboundReroutes) {
         if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId)) continue;
         removePendingReroute(id);
@@ -2615,6 +2667,9 @@ export function createTelegramInboundRouteRuntime<
           catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-view" }); }
         }
       }
+      // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
+      // never closes over this source or asks the worker to retain a terminal prompt while metadata publication fails.
+      if (temporary?.target && runtimeCurrent()) scheduleTemporaryThreadCleanup(temporary.target, ctx, true);
     });
   };
   const renderCancellationReview = async (view: CancellationReview, isCurrent: () => boolean): Promise<void> => {

package/lib/telegram-api.ts

@@ -1701,6 +1701,11 @@ export async function downloadTelegramFile(
   return targetPath;
 }
 
+/** Tooltip-like callback answers omit a terminal sentence period; ellipses and other punctuation stay literal. */
+export function formatTelegramCallbackAnswerText(text: string | undefined): string | undefined {
+  return text?.replace(/(?<!\.)\.\s*$/u, "");
+}
+
 export async function answerTelegramCallbackQuery(
   botToken: string | undefined,
   callbackQueryId: string,

package/lib/threads.ts

@@ -332,7 +332,7 @@ export interface TelegramTemporaryThreadInput {
   journalBindingKey: string;
   updateIds: number[];
 }
-/** A strict journal observation of committed cancellation plus matching private retention. */
+/** Journal-owned donor discard evidence: retained manual cancellation or body-free chooser expiry, never recipient cancellation. */
 export interface TelegramTemporaryThreadCancellationEvidence {
   journalBindingKey: string;
   updateId: number;
@@ -343,7 +343,7 @@ export interface TelegramTemporaryThreadEntry {
   source: { journalBindingKey: string; updateId: number };
   /** Append-only known source groups. Missing legacy metadata never proves that the creation source was alone. */
   inputs?: TelegramTemporaryThreadInput[];
-  /** Whole known groups with positively observed cancellation; never proof that deletion may be issued. */
+  /** Whole known groups with positively observed donor cancellation or expiry; never recipient cancellation or deletion authority. */
   cancelledInputs?: TelegramTemporaryThreadInput[];
   /** Whole known groups whose Forward was positively completed by the journal owner; never deletion authority alone. */
   completedInputs?: TelegramTemporaryThreadInput[];
@@ -415,6 +415,10 @@ export interface TelegramWorkspaceRestore {
   recordTemporaryThreadInputCancellation(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput,
     authority: TelegramWorkspaceRestoreAuthority,
     inspect: (updateId: number) => TelegramTemporaryThreadCancellationEvidence | undefined): TelegramTemporaryThreadEntry | undefined;
+  /** Body-free chooser expiry may terminate an uncertain donor Forward/Restore, never accepted recipient work or a bound target. */
+  recordTemporaryThreadInputExpiry(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput,
+    authority: TelegramWorkspaceRestoreAuthority,
+    inspect: (updateId: number) => TelegramTemporaryThreadCancellationEvidence | undefined): TelegramTemporaryThreadEntry | undefined;
   /** Caller holds profile admission and proves fresh source/protection clearance; publication grants one attempt, never retry. */
   issueTemporaryThreadCleanup(expected: TelegramTemporaryThreadEntry, authority: TelegramWorkspaceRestoreAuthority):
     { issued: true; entry: TelegramTemporaryThreadEntry } | undefined;
@@ -423,8 +427,8 @@ export interface TelegramWorkspaceRestore {
   retireTemporaryThread(expected: TelegramTemporaryThreadEntry, authority: TelegramWorkspaceRestoreAuthority,
     completed?: TelegramTemporaryThreadInput): TelegramTemporaryThreadEntry | undefined;
   /** New-world restart: atomically forgets this operator's Restore intents and temporary entries from previous runtime instances.
-   * Committed bindings stay; nothing is rolled back, replayed or deleted here. */
-  forgetPreviousWorld(authority: TelegramWorkspaceRestoreAuthority):
+   * Caller may preserve exact unbound temporary tokens for clock-bearing sources. Committed bindings stay; nothing is rolled back, replayed or deleted here. */
+  forgetPreviousWorld(authority: TelegramWorkspaceRestoreAuthority, preserveTemporaryTokens?: readonly string[]):
     { operations: TelegramWorkspaceRestoreIntent[]; temporaryThreads: TelegramTemporaryThreadEntry[] } | undefined;
 }
 export interface TelegramWorkspaceRestoreOptions {
@@ -3595,6 +3599,40 @@ export function createTelegramTopicTargetStore(
           });
           return recorded && current() ? recorded : undefined;
         },
+        recordTemporaryThreadInputExpiry(expected, inputValue, authority, inspect) {
+          const input = structuredClone(inputValue);
+          if (!isTemporaryThreadInput(input) || typeof inspect !== "function") return undefined;
+          const operator = authority.operatorUserId, executor = structuredClone(authority.executor);
+          const bound = classifyTemporaryTarget(read(), expected).kind === "bound";
+          const current = () => authority.isCurrent() && authority.operatorUserId === operator &&
+            isDeepStrictEqual(authority.executor, executor) && input.updateIds.every(updateId => {
+              const evidence = inspect(updateId);
+              return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
+                evidence.operatorAuthorityId === `telegram-owner:${operator}`;
+            }) && authority.isCurrent();
+          return advanceTemporary(expected, { ...authority, isCurrent: current }, (entry, file) => {
+            if (entry.phase !== "created" || !getTelegramTemporaryThreadInputs(entry).some(value => isDeepStrictEqual(value, input)) ||
+                entry.completedInputs?.some(value => isDeepStrictEqual(value, input))) return false;
+            const cancelled = entry.cancelledInputs ?? [];
+            if (cancelled.some(value => isDeepStrictEqual(value, input))) return "unchanged";
+            const operations = file.operations.filter(({ request }) => request.source.journalBindingKey === input.journalBindingKey &&
+              request.source.updateIds.some(id => input.updateIds.includes(id)));
+            if (operations.some(({ request }) => !request.source.updateIds.every(id => input.updateIds.includes(id)))) return false;
+            // Forget only expired donor intent; canonical binding, recipient queue and immutable settlement proofs are untouched.
+            file.operations = file.operations.filter(value => !operations.includes(value));
+            // Once bound, this is no longer a disposable tab. Forget its temporary frame, not the binding or other journal sources.
+            if (bound) {
+              file.temporaryThreads = file.temporaryThreads?.filter(value => value !== entry);
+              if (!file.temporaryThreads?.length) delete file.temporaryThreads;
+              return true;
+            }
+            const forwarded = entry.forwardedInputs?.filter(value => !isDeepStrictEqual(value, input));
+            if (forwarded?.length) entry.forwardedInputs = forwarded;
+            else delete entry.forwardedInputs;
+            entry.cancelledInputs = [...cancelled, input];
+            return true;
+          });
+        },
         recordTemporaryThreadForwardIssued(expected, inputValue, authority) {
           const input = structuredClone(inputValue);
           if (!isTemporaryThreadInput(input)) return undefined;
@@ -3644,7 +3682,7 @@ export function createTelegramTopicTargetStore(
             return entry;
           });
         },
-        forgetPreviousWorld(authority) {
+        forgetPreviousWorld(authority, preserveTemporaryTokens = []) {
           if (!authority.isCurrent()) return undefined;
           const executor = structuredClone(authority.executor), operator = authority.operatorUserId;
           if (!isTelegramWorkspaceRestoreExecutor(executor) || !restoreInteger(operator)) return undefined;
@@ -3652,11 +3690,12 @@ export function createTelegramTopicTargetStore(
           const previous = (value: { operatorUserId: number; executor: TelegramWorkspaceRestoreExecutor }) =>
             value.operatorUserId === operator && value.executor.instanceId !== executor.instanceId;
           const before = storage.read(), file = structuredClone(before);
-          const operations = file.operations.filter(previous), temporaryThreads = (file.temporaryThreads ?? []).filter(previous);
+          const forgetTemporary = (value: TelegramTemporaryThreadEntry) => previous(value) && !preserveTemporaryTokens.includes(value.token);
+          const operations = file.operations.filter(previous), temporaryThreads = (file.temporaryThreads ?? []).filter(forgetTemporary);
           if (!current()) return undefined;
           if (!operations.length && !temporaryThreads.length) return { operations, temporaryThreads };
           file.operations = file.operations.filter(value => !previous(value));
-          const remaining = (file.temporaryThreads ?? []).filter(value => !previous(value));
+          const remaining = (file.temporaryThreads ?? []).filter(value => !forgetTemporary(value));
           if (remaining.length) file.temporaryThreads = remaining;
           else delete file.temporaryThreads;
           if (file.revision === Number.MAX_SAFE_INTEGER) throw new Error("Workspace Restore revision exhausted.");

package/lib/updates.ts

@@ -56,6 +56,7 @@ import {
   type TelegramUpdateJournalEntry,
   type TelegramUpdateJournalRoutingInput,
   type TelegramRoutingInputJournal,
+  type TelegramRoutingInputExpiryResult,
   type TelegramUpdateJournalQueueDiscardResult,
   type TelegramUpdateJournalQueueHandoffAcceptResult,
   type TelegramUpdateJournalQueueHandoffCancelResult,
@@ -495,6 +496,8 @@ export interface TelegramHeldSourcePreparation<TContext> {
   /** Exact prepared worker owner, context, key and authority; the consumer adds its own domain fences. */
   isCurrent: () => boolean;
   signal: AbortSignal;
+  /** Chooser-clock sources that must survive cold spending until their fixed expiry. */
+  routingSourceIds?: readonly number[];
 }
 
 export interface TelegramDeferredAbandonmentRecoveryPage {
@@ -1922,7 +1925,7 @@ export interface TelegramRoutingInputExpirySource {
   original: TelegramUpdateJournalEntry;
   journalBindingKey: string;
   isCurrent(): boolean;
-  expire(): TelegramUpdateJournalPendingAbandonmentResult | undefined;
+  expire(): TelegramRoutingInputExpiryResult | undefined;
 }
 
 export interface TelegramUpdateWorkerJournalPort {
@@ -2035,7 +2038,7 @@ export interface TelegramUpdateWorkerRuntimeDeps<TContext> {
   getRecipientBindingKey?: () => string | undefined;
   /** True selects legacy historical review/spending; retain protects unsupported originals without disposition authority. */
   shouldReviewHistoricalInput?: (entry: TelegramUpdateJournalEntry, ctx: TContext, signal: AbortSignal) => boolean | "retain" | Promise<boolean | "retain">;
-  /** New-world restart: spend previous-process routing inputs (classified or armed) without delivery, copy or completion observers. Interrupted private abandonment keeps its own exact recovery. */
+  /** New-world restart: spend unclocked classified routing input without delivery, copy or completion. Chooser clocks wait for expiry; interrupted private abandonment keeps exact recovery. */
   spendHistoricalInput?: boolean;
   /** Holds protected live or retry sources before execution; never cancels or disposes them. */
   shouldHoldPendingInput?: (entry: TelegramUpdateJournalEntry, ctx: TContext, signal: AbortSignal) => boolean | Promise<boolean>;
@@ -2090,6 +2093,7 @@ export interface TelegramUpdateWorkerRuntime<TContext> {
   }) => void;
   armRoutingInput?: (input: { updateId: number; signal: AbortSignal; operatorUserId: number; sourceUpdateIds: readonly number[] }) => TelegramUpdateJournalRoutingInput | undefined;
   selectRoutingInput?: (input: { updateId: number; signal: AbortSignal; operatorUserId: number; sourceUpdateIds: readonly number[] }) => boolean;
+  isRoutingInputCurrent?: (input: { updateId: number; signal: AbortSignal }) => boolean;
   supportsDeferredAbandonment?: (input: { updateId: number; signal: AbortSignal; journalBindingKey: string }) => boolean;
   inspectAbandoning?: (input: TelegramDeferredAbandonmentRecoveryRequest & { signal: AbortSignal }) =>
     TelegramDeferredAbandonmentRecoveryPage | undefined;
@@ -3215,18 +3219,29 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
     if (!isTelegramUpdateJournalLegacyFamilyVersion(snapshot.version) || !expireRouting || !expireRoutingObserver) return false;
     let nextAtMs: number | undefined, changed = false;
     const binding = deps.getJournalBindingKey?.(), snapshotIds = new Set(snapshot.entries.map(entry => entry.updateId));
-    // Lost removal ACKs reconcile only the exact held original through the retained copy/tombstone.
+    // Lost expiry ACKs reconcile the exact held original against its body-free discard tombstone.
     const candidates = [...snapshot.entries, ...[...deferredSources.values()]
       .filter(source => source.journalBindingKey === binding && !snapshotIds.has(source.entry.updateId))
       .map(source => source.entry)];
     for (const entry of candidates) {
       const lifetime = entry.routingInput;
-      if (claims.get(entry.updateId) === "retained" || (expectedOwner.startupUpdateIds?.has(entry.updateId) &&
-          !claims.has(entry.updateId) && deps.shouldReviewHistoricalInput)) continue;
-      if (!lifetime || lifetime.phase !== "waiting" || entry.state !== "pending" || !binding || unsettledExecutionsByUpdateId.get(entry.updateId)?.size) continue;
+      if (!lifetime || entry.state !== "pending" || !binding || claims.get(entry.updateId) === "queued" ||
+          unsettledExecutionsByUpdateId.get(entry.updateId)?.size) continue;
+      // Classify the first startup snapshot before constructing any historical expiry carrier.
+      if (expectedOwner.startupUpdateIds?.has(entry.updateId) && !claims.has(entry.updateId) && deps.shouldReviewHistoricalInput) {
+        nextAtMs = Math.min(nextAtMs ?? Infinity, Math.max(getNowMs() + 1, lifetime.expiresAtMs));
+        continue;
+      }
       if (getNowMs() < lifetime.expiresAtMs) { nextAtMs = Math.min(nextAtMs ?? Infinity, lifetime.expiresAtMs); continue; }
       const existing = deferredSources.get(entry.updateId);
-      if (existing && !isDeepStrictEqual(existing.entry, entry)) continue;
+      if (existing && !isDeepStrictEqual(existing.entry, entry)) {
+        // Lost clock/selection ACKs may leave only this immutable metadata behind its exact source; reconciliation grants expiry, never another dispatch.
+        const previous = existing.entry.routingInput;
+        if (!isDeepStrictEqual({ ...existing.entry, routingInput: lifetime }, entry) ||
+            (previous && (!isDeepStrictEqual({ ...previous, phase: lifetime.phase }, lifetime) ||
+              (previous.phase === "selected" && lifetime.phase !== "selected")))) continue;
+        existing.entry = structuredClone(entry);
+      }
       const source = existing ?? { entry: structuredClone(entry), journalBindingKey: binding, historical: true as const };
       deferredSources.set(entry.updateId, source);
       if (!claims.has(entry.updateId)) claims.set(entry.updateId, "historical");
@@ -3234,7 +3249,7 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
         deps.isContextCurrent?.(expectedOwner.ctx) !== false && deps.getJournalBindingKey?.() === binding &&
         deps.hasAuthority(expectedOwner.ctx) && isQueueOwnerIdentityCurrent(expectedOwner) && deferredSources.get(entry.updateId) === source &&
         isDeepStrictEqual(source.entry, entry) && claims.get(entry.updateId) !== "queued";
-      let committed: TelegramUpdateJournalPendingAbandonmentResult | undefined;
+      let committed: TelegramRoutingInputExpiryResult | undefined;
       try {
         if (current()) await expireRoutingObserver({ original: structuredClone(entry), journalBindingKey: binding, isCurrent: current,
           expire() {
@@ -3242,9 +3257,10 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
             if (committed) return { ...committed, duplicate: true };
             claims.set(entry.updateId, "abandoning");
             committed = expireRouting!({ entry: source.entry, journalBindingKey: binding, operatorUserId: lifetime.operatorUserId, isCurrent: current });
+            // Source expiry is terminal before chooser/cleanup awaits; later failures must not retain a deferred/retry source.
             claims.delete(entry.updateId); deferredSources.delete(entry.updateId);
             state.journalEntryCount = committed.entryCount; state.journalSerializedBytes = committed.serializedBytes;
-            updateClaimCounts(); notifyStateChange(); changed = true;
+            updateClaimCounts(); notifyStateChange(); changed ||= !committed.duplicate;
             return committed;
           } }, expectedOwner.ctx, expectedOwner.controller.signal);
       } catch (error) { recordRuntimeEvent(error, { phase: "routing-input-expiry", updateId: entry.updateId }); }
@@ -3445,7 +3461,7 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
               transition("deferred", entry.updateId);
               continue;
             }
-            if (review && historical && spendHistorical && classifyPending === deps.shouldReviewHistoricalInput) {
+            if (review && historical && spendHistorical && !entry.routingInput && classifyPending === deps.shouldReviewHistoricalInput) {
               completedUpdateIds.push({ updateId: entry.updateId, spent: true });
               continue;
             }
@@ -3456,10 +3472,6 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
             }
           }
           if (entry.state === "pending" && entry.routingInput) {
-            if (historical && spendHistorical) {
-              completedUpdateIds.push({ updateId: entry.updateId, spent: true });
-              continue;
-            }
             claims.set(entry.updateId, "historical");
             transition("deferred", entry.updateId);
             continue;
@@ -3628,7 +3640,9 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
             expectedOwner.heldSourcesPreparedIssued = true;
             // Do not couple lifecycle/stop or the worker drain to a held controller/API reply.
             void Promise.resolve().then(() => isCurrent() ? onHeldSourcesPrepared({ ctx,
-              journalBindingKey: key, signal: expectedOwner.controller.signal, isCurrent }) : undefined).catch(error => {
+              journalBindingKey: key, signal: expectedOwner.controller.signal, isCurrent,
+              routingSourceIds: [...deferredSources].filter(([, source]) => source.journalBindingKey === key && !!source.entry.routingInput)
+                .map(([id]) => id) }) : undefined).catch(error => {
                 try { deps.recordRuntimeEvent?.("inbound-worker", error, { phase: "held-source-preparation" }); } catch { /* Diagnostic only. */ }
               });
           } catch (error) {
@@ -3784,6 +3798,10 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
     },
     armRoutingInput(input) { return mutateRoutingSource(input, false)?.lifetime; },
     selectRoutingInput(input) { return mutateRoutingSource(input, true)?.issued === true; },
+    isRoutingInputCurrent(input) {
+      return owner?.controller.signal === input.signal && !input.signal.aborted &&
+        deferredSources.has(input.updateId) && claims.get(input.updateId) !== "abandoning";
+    },
     inspectDeferredSource(input) {
       const expectedOwner = owner;
       const source = deferredSources.get(input.updateId);
@@ -3843,7 +3861,8 @@ export function createTelegramUpdateWorkerRuntime<TContext>(
         return;
       }
       const claim = claims.get(input.updateId);
-      if (claim === "abandoning" || claim === "historical" || claim === "retained") return;
+      if (claim === "abandoning" || claim === "historical" || claim === "retained" ||
+          (!claim && routingJournal?.inspectExpiry(input.updateId))) return;
       if (input.outcome.kind === "complete") {
         // Expiry may retire only a still-deferred source, never accepted queue work.
         if (claim !== "deferred") return;
@@ -4453,6 +4472,7 @@ export interface TelegramUpdateAdmissionHandleDeps<
   abandonDeferred?: TelegramUpdateWorkerRuntime<TContext>["abandonDeferred"];
   armRoutingInput?: TelegramUpdateWorkerRuntime<TContext>["armRoutingInput"];
   selectRoutingInput?: TelegramUpdateWorkerRuntime<TContext>["selectRoutingInput"];
+  isRoutingInputCurrent?: TelegramUpdateWorkerRuntime<TContext>["isRoutingInputCurrent"];
   supportsDeferredAbandonment?: TelegramUpdateWorkerRuntime<TContext>["supportsDeferredAbandonment"];
   inspectAbandoning?: TelegramUpdateWorkerRuntime<TContext>["inspectAbandoning"];
   inspectHistorical?: TelegramUpdateWorkerRuntime<TContext>["inspectHistorical"];
@@ -5483,9 +5503,10 @@ export function createTelegramUpdateAdmissionHandle<
       generation,
       updateId: update.update_id,
       signal,
-      isCurrent: () => !signal.aborted && !suspended,
+      isCurrent: () => !signal.aborted && !suspended && ((!routingLifetime && !routingClockUnknown) || immediate || settlementReported ||
+        deps.isRoutingInputCurrent?.({ updateId: update.update_id, signal }) !== false),
       assertCurrent() {
-        if (signal.aborted || suspended) {
+        if (!execution.isCurrent()) {
           throw signal.reason ?? new DOMException("Aborted", "AbortError");
         }
       },
@@ -5499,7 +5520,7 @@ export function createTelegramUpdateAdmissionHandle<
     let outcome: TelegramUpdateAdmissionOutcome | undefined;
     const boundUpdate = bindTelegramUpdateExecutionFence(
       bindTelegramUpdateAdmissionSource(update, (next) => {
-        if (suspended || signal.aborted) return;
+        if (!execution.isCurrent()) return;
         if (next.kind === "deferred" && next.routingReview) {
           if (!immediate || settlementReported || routingClaims > 0 || !deps.isHistoricalSource?.({ updateId: update.update_id, signal })) {
             throw new TelegramUpdateAdmissionOutcomeError("Historical review cannot override accepted or selected work.");
@@ -5522,7 +5543,7 @@ export function createTelegramUpdateAdmissionHandle<
         }
         void Promise.resolve()
           .then(() => {
-            if (suspended || signal.aborted) return;
+            if (!execution.isCurrent()) return;
             return deps.onLateOutcome!(next, {
               updateId: update.update_id,
               ctx,
@@ -5605,7 +5626,7 @@ export function createTelegramCustodiedUpdateAdmissionHandle<
   TUpdate extends TelegramJournaledUpdate & TelegramUpdateFlow,
   TContext,
 >(deps: Omit<TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>,
-  "onLateOutcome" | "onLateOutcomeError" | "abandonDeferred" | "armRoutingInput" | "selectRoutingInput" | "supportsDeferredAbandonment" | "inspectAbandoning" | "inspectHistorical" | "inspectDeferredSource" | "isHistoricalSource"> & {
+  "onLateOutcome" | "onLateOutcomeError" | "abandonDeferred" | "armRoutingInput" | "selectRoutingInput" | "isRoutingInputCurrent" | "supportsDeferredAbandonment" | "inspectAbandoning" | "inspectHistorical" | "inspectDeferredSource" | "isHistoricalSource"> & {
   journal: TelegramCustodyExecutionJournal;
   recipientBindingKey: string;
   onLateOutcomeError(error: unknown, updateId: number): void;
@@ -6983,6 +7004,7 @@ export function createTelegramUpdateAdmissionWorkerRuntime<
     abandonDeferred: input => worker?.abandonDeferred?.(input),
     armRoutingInput: input => worker?.armRoutingInput?.(input),
     selectRoutingInput: input => worker?.selectRoutingInput?.(input) === true,
+    isRoutingInputCurrent: input => worker?.isRoutingInputCurrent?.(input) !== false,
     supportsDeferredAbandonment: input => worker?.supportsDeferredAbandonment?.(input) === true,
     inspectAbandoning: input => worker?.inspectAbandoning?.(input),
     inspectHistorical: input => worker?.inspectHistorical?.(input),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.52.0",
+  "version": "0.52.1",
   "private": false,
   "publishConfig": {
     "access": "public"