@llblab/pi-telegram 0.52.0 → 0.52.2

package/AGENTS.md

@@ -84,21 +84,22 @@ Use the relevant local skill before non-trivial work in its domain. Keep skill o
 
 - Admission is journal-first: validate and persist the complete `getUpdates` response before one monotonic offset commit, then signal an independent worker without awaiting semantic execution. Missing cursor with a non-empty journal, malformed/foreign authority, or capacity exhaustion fails closed. “Durable” means process-crash recovery after atomic rename, not unflushed host/kernel/filesystem/device/power-loss survival.
 - Storage cutovers must reconcile actual consumer locations before correcting path adapters. Never normalize a relative historical reference into new authority or treat equal reference strings / empty canonical storage as source completeness. Exact-path preflight is lexical only; physical identity, historical coverage, writer closure and migration remain separate proofs.
-- Workspace mutations acquire cross-process admission before their shared process-local gate and hold it through asynchronous API work and durable settlement. Topic lifecycle, complete unbound/reroute target handling, manual disconnect, and session-restart cleanup use profile-wide scope; either retained retirement-fence phase rejects them before state access. Cleanup scope spans intent publication, target mutation, persistence, and transport release. Detached reconciliation that mutates Thread state must reacquire fresh profile admission through the same gate; it cannot inherit a caller lease that ended before its timer runs. A live operation ID has one process-local caller: concurrent reuse is rejected before lease acquisition, while retry after the caller exits may resume exact durable authority.
+- Workspace mutations acquire cross-process admission before their shared process-local gate and hold it through asynchronous API work and durable settlement. Topic lifecycle, complete unbound/reroute target handling, manual disconnect, and session-restart cleanup use profile-wide scope; either retained retirement-fence phase rejects them before state access. Cleanup admission spans intent publication, target mutation, persistence, and successful transport release. Explicit manual disconnect may stop only its captured local transport after cleanup admission/effects fail; it must not bypass Thread mutation fences, release a replacement connection, claim unconfirmed deletion, or retry an uncertain stop. Session-restart cleanup retains its admission-required behavior. Detached reconciliation that mutates Thread state must reacquire fresh profile admission through the same gate; it cannot inherit a caller lease that ended before its timer runs. A live operation ID has one process-local caller: concurrent reuse is rejected before lease acquisition, while retry after the caller exits may resume exact durable authority.
 - Workspace retirement is capacity-pressure-only. Elapsed time and heartbeat silence never trigger deletion; only complete `A`–`Z` exhaustion may propose the oldest continuously proven inactive, fully unprotected binding. Exact deletion, durable retirement, and fence completion precede slot reuse. Authorized demand-driven rotation retries one failed fresh allocation after retirement; restore-only follower startup never evicts. Release ordinary registration/provisioning leases before acquiring the destructive fence, retain the shared mutation gate across retirement, and validate the exact permit immediately before one non-retried deletion. Persist an exact method/target-matched rejection before withdrawing its intent; release that fence only after durable withdrawal, retaining the binding. A later attempt requires fresh operation authority. Protection reads must never repair, quarantine, or reset journals. Non-destructive owner detachment must atomically retain one exact Workspace binding and its letter while removing only its uniquely matched owner record and stamping first inactivity; it never manufactures Thread-deletion evidence or clears accepted work. During authenticated follower registration, the exact Workspace claim owns the letter: a mismatched retained target record is repaired to that claim before binding commit, while any unrelated binding that owns the stale letter remains untouched. Retained prune observations are bounded, non-routing and registration/profile/epoch/runtime-fenced. One unfinished preservation operation retains its admission identity across fresh-PID-proof retries; it can never become deletion authority. Leader quit requires completed delivery/polling/worker teardown under the captured session generation, profile and epoch; reload/new/resume/fork never establish inactivity. Unknown deletion outcomes retain their fence; only confirmed durable completion permits reuse.
-- Foreign forwarding settles as `accepted`, `retryable`, or `terminal-rejected`. Only an authenticated acknowledgement carrying the expected `deliveryId` and `sourceUpdateId` releases leader journal authority. Negative, missing, stale, mismatched, or capacity-failed settlement remains durable; callback error answers are side effects only.
+- Foreign forwarding settles as `accepted`, `retryable`, or `terminal-rejected`. Only an authenticated acknowledgement carrying the expected `deliveryId` and `sourceUpdateId` releases leader journal authority. Negative, missing, stale, mismatched, or capacity-failed settlement remains durable; callback error answers are side effects only. Exception: the operator-approved fixed chooser deadline may discard its exact unclaimed donor pending source without a body archive or delivery-success claim. Accepted recipient queue/work and bound Threads are untouched; old donor controls and late reports cannot replay it. The lifetime and temporary cleanup contract lives in `docs/architecture.md`.
 - A forwarding delivery id is stable across registration replacement and derives from envelope kind, source `update_id`, and stable recipient binding. Runtime instance and registration generation remain separate attempt fences. Persisted message ownership carries the stable binding so replay can rebind only to its current authenticated registration.
 - A queued receipt persists its acquiring runtime instance, OS pid/process-birth identity, session generation, acquisition id, and acquisition time. Only exact authority may settle or discard it. Cached presence is not current execution proof: prepared custody must revalidate the exact queued owner/group without recovery and refuse offers or uncertain reads. Completion requires an exact removal acknowledgement, never merely `!ready`; a retained acknowledgement permits local cleanup only, not replay. Same-process session replacement may reconstruct the claim and the original process may settle after transport ownership moves; a foreign process may neither replay nor settle it through generic removal or a copied acquisition id.
 - Startup and elapsed time are not owner-death proof; queued authority has no time lease. Dead-owner cleanup groups the complete receipt and transactionally rechecks pid liveness plus process-birth identity: only an absent PID or mismatched stable Linux/macOS birth proof discards all session-owned sources without replay; a matching proof is `alive`, while Windows or inaccessible birth metadata is `unverifiable`, and both non-dead outcomes keep authority queued. Under actual `A`–`Z` allocation pressure, retirement may invoke that journal-owned CAS only for a current inactive binding after complete strict source inspection, no local work/live owner/delivery authority, whole unoffered receipt groups, and a preflight proving every grouped owner dead. It must then recapture all protection before preparing deletion; partial progress never grants deletion authority. The live-transfer contract is authenticated offer → exact-generation bounded payload staging → recipient CAS acceptance → exact receipt-and-owner ACK → donor removal → recipient readiness. The offer freezes donor settlement/recovery; controls rebuild local closures; negative/mismatched pre-acceptance ACK cancels only an unaccepted offer and retains donor work; a lost post-acceptance ACK cannot cancel recipient authority and leaves donor memory frozen for explicit reconciliation.
 - Execution failures persist bounded diagnostics and attempt state as `retry-wait`, except that an exact Telegram HTTP 400 stale/deleted-thread API failure with a proven `{chatId, threadId}` terminally settles the currently executing source after best-effort shared binding invalidation. Automatic retry continues indefinitely with exponential `1s → 2s → 4s → 8s → 16s → 32s → 60s` delay capped at 60 seconds; later independent updates continue draining, durable authority is never silently discarded, and legacy `failed` entries resume automatically at startup. Snapshot-plus-segment journals compact only after 256 unapplied revisions or 4 MiB; snapshot-first cleanup tolerates redundant segments, and empty authority may atomically rebind bot/profile identity. Missing snapshots left by the retired broad temp cleanup rebuild only from a complete provably empty segment chain, while revisionless snapshots may recover from a validated later segment predecessor; otherwise the transaction-locked reset deletes damaged segments before publishing a fresh journal, with accepted input loss and informational evidence, not a quarantine copy. Unsupported versions remain untouched; strict protection reads never reset. Startup best-effort removes obsolete current-runtime root/session `recovery/` folders without touching pre-0.52.0 storage.
 - Business connection chats are a separate namespace even when their chat/message IDs match bot-chat IDs. Default DM routing must never infer private-queue deletion intent from `deleted_business_messages`; raw companion handlers remain separate owners.
+- Clock-bearing chooser sources survive cold spending until their fixed deadline; new-world forgetting preserves their positively unbound temporary frame without restoring routing intent. Expiry is a donor discard, not recipient cancellation or source execution completion. Confirmed expiry releases worker custody before UI/cleanup awaits; metadata retries retain no prompt bodies and cannot repeat an issued delete.
 - An unresolved reaction delays only the exact governed queue item identified by chat/message sources, not unrelated queue work. An explicit immutable `preApprovalExcluded: true` cannot govern accepted work, even after re-pairing; missing or false exclusion evidence must not bypass the dependency guard. Prepared v3 drain may dispose of excluded pending input only through journal-owned `removeExcluded`, never generic raw completion; mixed requests containing non-excluded input must fail atomically. Queue receipt publication follows in-memory append and precedes dispatch request; receipt-bearing turns remain queued until every exact source commits.
 - The detailed implementation and release gates live in [`docs/architecture.md`](./docs/architecture.md), [`docs/multi-instance-bus.md`](./docs/multi-instance-bus.md), and [`BACKLOG.md`](./BACKLOG.md).
 
 ### 4.4 Queue, Delivery, And User Surfaces
 
-- Queue lane/kind admission is explicit. Dispatch waits for active-turn, pending-dispatch, control, compaction, `ctx.isIdle()`, and Pi pending-message guards; a dispatched prompt stays queued until `agent_start` consumes it. The terminal `+N` suffix is a yellow count of executable prompts still waiting, excludes the dispatched head immediately, and never counts current agent work from any source. Each prompt is one object with one active lane and no reserved return slot. Normal and Priority are separate FIFO lanes: crossing lanes removes it from the source and appends it at the destination tail, while Keep/Skip and same-category emoji changes preserve lane position. Complete reaction sets independently derive Priority from recognized positive emoji and Skip from recognized negative emoji; both may coexist, suppressed turns retain durable receipts while waiting, and Skip settles them only when the prompt reaches dispatch before dropping it without inference. Suppressed turns remain visible at a struck-through physical ordinal without contributing to executable queue counters, while graceful session shutdown discards all remaining queue authority before clearing memory.
-- `/stop`, `/abort`, `/next`, and `/continue` respectively reset+abort, abort while preserving queue, force the next turn, and enqueue a control-lane continuation. Abort-history folding applies only to Telegram-owned active turns. A busy `/next` marks only its exact active Telegram turn: terminal abort settlement attempts one explicit abort notice before the exact selected queued prompt receives its dispatch notice. Notice failure is diagnostic and cannot block dispatch; a later `/abort` or `/stop` cancels both pending transition notices before taking ownership. Target command adapters must forward these transition ports. A successful dispatch notice keeps the queued prompt's one reply-header claim across agent start, so later messages in that turn never repeat it.
+- Queue lane/kind admission is explicit. Dispatch waits for active-turn, pending-dispatch, control, compaction, `ctx.isIdle()`, and Pi pending-message guards; a dispatched prompt stays queued until `agent_start` consumes it. The terminal `+N` suffix is a yellow count of executable prompts still waiting, excludes the dispatched head immediately, and never counts current agent work from any source. Each prompt is one object with one active lane and no reserved return slot. Normal and Priority are separate FIFO lanes: crossing lanes removes it from the source and appends it at the destination tail, while Keep/Skip and same-category emoji changes preserve lane position. For ordinary Normal/Priority prompts, complete reaction sets independently derive Priority from recognized positive emoji and Skip from recognized negative emoji; both may coexist, suppressed turns retain durable receipts while waiting, and Skip settles them only when the prompt reaches dispatch before dropping it without inference. Suppressed turns remain visible at a struck-through physical ordinal without contributing to executable queue counters, while graceful session shutdown discards all remaining queue authority before clearing memory.
+- `/stop`, `/abort`, `/next`, and `/continue` respectively reset+abort, abort while preserving queue, force the next turn, and enqueue a control-lane continuation. A negative reaction to an original standalone `/continue` settles and removes only its exact waiting source-addressed continuation; positive reactions do not change its control lane. Protect the Pi-owned pending head and already-started work, preserve other queue positions, and never address synthetic model continuations by their reply anchor. Settlement failure retains the continuation. Abort-history folding applies only to Telegram-owned active turns. A busy `/next` marks only its exact active Telegram turn: terminal abort settlement attempts one explicit abort notice before the exact selected queued prompt receives its dispatch notice. Notice failure is diagnostic and cannot block dispatch; a later `/abort` or `/stop` cancels both pending transition notices before taking ownership. Target command adapters must forward these transition ports. A successful dispatch notice keeps the queued prompt's one reply-header claim across agent start, so later messages in that turn never repeat it.
 - A model selection from an authorized Telegram target may stop and continue any interruptible active agent run in that same Pi session, including local/TUI work. Queue the synthetic control-lane continuation before aborting; when no Telegram prompt owns the run, bind continuation and reply ownership to the exact model-menu chat/Thread/message. Delay abort until every active tool execution settles, and clear both selection and fallback target on cancellation, agent start, settlement, or session replacement.
 - Telegram extension side effects must not hold Pi's core lifecycle hostage after semantic completion. Preserve ordering in extension-owned background work, record failures, and fence target/profile/transport/session authority.
 - Complete assistant/guest model answers use Telegram-native Rich Markdown. Harness-owned menus, status, diagnostics, thinking, and tool evidence remain explicit HTML/plain or their documented native surface. Before Telegram preview or final delivery, strip every assistant-authored HTML comment regardless of Markdown position while keeping action activation top-level-only; a comment-only result sends no text message. Preserve literal code outside comments and structurally safe chunking; never split invalid markup.
@@ -136,7 +137,7 @@ The detailed map is canonical in [`docs/architecture.md`](./docs/architecture.md
 - Keep interfaces consistent with their owning exported contract. Use local structural `*Like`/view types only for deliberate narrow projections, not duplicate source-of-truth models.
 - Remove dead code immediately. Reachability from composition roots, public exports, tests, registered surfaces, and documented APIs—not recent usefulness—determines whether code is live. `node scripts/audit-exports.mjs` provides a read-only TypeScript-symbol inventory including aliases, JS consumers and public `api/` reexports (including namespaces); `namespaceEscapes` flags whole-module alias usage. No-external-reference candidates are not deletion proof. Review generated text, dynamic namespace access and public declaration reachability before removing or hiding a symbol.
 - Treat every meaningful `lib/extension.ts` edit as a composition-pressure check, but keep one-off live adapter wiring there when extraction would only hide cross-domain state.
-- Follow [`docs/ui-style.md`](./docs/ui-style.md) for interface copy, emoji, buttons, menus, and dialogs. Update the registry before assigning a new UI emoji meaning. Standalone notices use one fully bold emoji-led sentence with a terminal period; menu or chooser headings use the same hierarchy with a terminal colon. Material names may add nested italic emphasis without breaking the outer bold span. Callback alerts preserve equivalent emoji-led plain text because Telegram does not support rich formatting there.
+- Follow [`docs/ui-style.md`](./docs/ui-style.md) for interface copy, emoji, buttons, menus, and dialogs. Update the registry before assigning a new UI emoji meaning. Standalone notices use one fully bold emoji-led sentence with a terminal period; menu or chooser headings use the same hierarchy with a terminal colon. Material names may add nested italic emphasis without breaking the outer bold span. Typed callback toasts preserve equivalent emoji-led plain text without a terminal sentence period; question/exclamation marks and ellipses remain. In-chat notices and explicit raw API payloads keep their punctuation.
 - Markdown lists never contain blank lines between adjacent items; list items are not paragraphs. Use blank lines only between paragraphs or independently separated blocks. Markdown tables use compact source formatting with `---` separator cells and one surrounding space per cell. Preserve vendored references unchanged.
 - Treat Windows filesystem, named-pipe, lock, heartbeat, and atomic-rename reports as high-signal evidence; reduce them to regressions or explicit platform caveats.
 - Route significant runtime failures through the redacted recent-event recorder. Keep the compact TUI status at generic `error`; details belong in diagnostics.

package/BACKLOG.md

@@ -2,4 +2,21 @@
 
 _This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._
 
-No open tasks.
+## Post-Release Transport Recovery Acceptance
+
+- Release boundary: The operator authorized the hotfix on native regression and CI evidence; real Telegram smoke/fault acceptance remains open below, not a claimed completed check. Installing/reloading Pi or injecting live faults needs separate authorization.
+- CI boundary: Native Linux/macOS/Windows checks exercise capped poll/admission backoff, preserved persistent-conflict stand-down and generation-fenced manual disconnect. Existing skipped strict journal witnesses remain a separate Windows boundary; green CI does not replace operator acceptance.
+- [ ] Obtain operator acceptance for ordinary disconnect, unconfirmed-cleanup reporting and outage recovery without manual reconnect on a disposable setup. Local fake-transport/storage regressions do not certify real Telegram or platform fault behavior; installation/reload and live fault injection require separate authorization.
+- Acceptance: Captured manual stop never affects a replacement connection or bypasses Thread deletion fences, uncertain stop is not retried, and accepted local work is preserved. Session-restart cleanup remains admission-required.
+
+## Windows Reliability
+
+- [ ] Strengthen native Windows reliability beyond the 0.52.0 ordinary-queue fix. Audit filesystem paths, named pipes, locking, owner fencing, heartbeat and atomic publication; cover interrupted writes, damaged state, ownership changes and lost-ACK retries with focused regressions.
+- [ ] Investigate Windows-compatible strict journal evidence for Restore and cleanup without weakening source identity, scoped ACK or fail-closed protections. Inventory witnesses currently skipped on Windows and enable them only when equivalent native evidence exists.
+- Acceptance: Local synthetic tests distinguish ordinary delivery from strict proofs; native Windows CI exercises supported paths and refusal boundaries. Linux emulation or a green matrix with skipped Restore witnesses does not establish Windows Restore acceptance.
+
+## Consistent Callback Notification Copy Across Other Extensions
+
+- [ ] Inventory Telegram button callback acknowledgements across all local extensions, including companion callbacks. Standardize the transient non-interactive notification bubbles (callback answers/toasts) to concise, consistent text with no trailing period.
+- [ ] Distinguish transient callback bubbles from in-chat notices, chooser headings and blocking alerts; reconcile the owning UI-copy contracts before implementation rather than stripping punctuation from every message.
+- Acceptance: All participating extensions follow the same callback-notification format, with focused copy checks for success, no-op and rejection outcomes; in-chat notice formatting and callback behavior remain unchanged.

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 ## Unreleased
 
+## 0.52.2: Polling recovery, safe disconnect and Windows downloads
+
+- `Polling recovery`: Non-conflict poll/admission failures back off from 1 to 30 seconds and keep retrying, allowing recovery after prolonged outages without manual reconnect. Backoff resets only after durable admission succeeds; persistent competing-client conflicts retain their existing terminal stand-down.
+- `Disconnect safety`: Failed or unavailable Thread cleanup still attempts one captured local transport stop without bypassing Workspace fences. Reconnect revokes stale cleanup/stop continuations; delayed teardown cannot release replacement ownership. Unconfirmed cleanup is reported without claiming it was skipped, while uncertain stop/release outcomes remain incomplete and are never blindly retried ([#310](https://github.com/llblab/pi-telegram/pull/310)).
+- `Windows downloads`: Publishing a complete attachment retries transient Windows `EPERM`/`EACCES` sharing failures for at most six rename attempts, without replaying HTTP. Cancellation stops the bounded wait; permanent/non-sharing failures still propagate and remove the private partial file. Concurrent downloads retain deterministic names and complete-file publication.
+
+## 0.52.1: Finite chooser lifetime, continue cancellation and callback copy
+
+- `Chooser expiry`: Fixed 60-minute clocks end unselected/unacknowledged donor routing without archives or replay. Fully resolved disposable tabs use fenced one-shot cleanup; accepted queues, independent work and restored Threads survive. Confirmed expiry clears worker custody even if cleanup fails; metadata retries use body-free proof and never repeat an issued delete. Cold startup preserves deadlines, and queue admission retains selected lifetime metadata.
+- `Continue cancellation`: Negative reactions to an original standalone `/continue` now settle and remove its exact waiting continuation, even while other work runs. Other prompts, the Pi-owned dispatched head, active work and synthetic model continuations remain untouched. Positive reactions preserve the control lane; failed receipt settlement keeps the item waiting, and duplicate reactions cannot cancel twice.
+- `Callback copy`: Shared typed callback toasts omit a terminal sentence period on direct and follower delivery. Questions, exclamations, ellipses, in-chat notices and explicit raw API payloads keep their punctuation.
+
 ## 0.52.0: Workspace Restore, routing lifetime and resilient runtime storage
 
 - `Restore foundation`: One snapshot owns binding, slot, targets and one-shot grants. Publication and late creation receipts share a transaction; unnamed owners round-trip. Unknown or contradictory creation evidence blocks new Restore; absence and expiry never prove availability. Loading validates receipts before replacing working state, preserving disk, memory and source protection on conflict. Recovered targets survive expiry; conflicting creation stays blocked.

package/README.md

@@ -61,7 +61,7 @@ The connected Pi instance owns Telegram polling. Use `/telegram-connect <profile
 
 An eligible single-text unbound Thread chooser offers **⛔️ Cancel routing**: the original stays private and is not sent to Pi; its Telegram message and Thread are not deleted. This does not cancel already selected or accepted work. When protected cancellation attempts remain, **Status → ❌ Pending cancellations** lets the owner review and finish them, including after restart. Historical unbound startup text has no main-menu entry or historical-review submenu. Eligible raw unsupported command/media/unknown historical private-Thread originals use a separate retain-only path, including on bound Threads without surviving Restore/temporary membership. Each worker generation reclassifies them after cold forgetting, blocking handler replay, generic Cancel and cold spending. Ordinary bound startup dispatch stops for these originals; same-kind live arrivals and owner/custody paths remain unchanged. Old historical-review buttons are refused without routing or abandoning the original; removal of the UI does not cancel previously accepted work.
 
-New eligible unbound prompt choosers allow **60 minutes to choose a route**, starting at their first positively acknowledged publication. The deadline survives restart and is not renewed by refresh. At expiry, the exact unselected original is retained privately before removal from the pending journal; stale controls cannot dispatch it. TTL neither deletes the Telegram tab nor stops Pi, and does not require detecting a manually removed tab. A validated Reroute/Restore choice freezes expiry before effects; browsing Restore or an unavailable destination does not. Selected, queued, running and uncertain issued work stay protected. Older historical inputs and unconfirmed clock publication acquire no invented deadline; failed retention stays held. Reloading the candidate and live acceptance are separate operator actions.
+Eligible routing choosers and their donor sources share a **fixed 60-minute lifetime** from the first acknowledged publication, preserved across refresh/restart. Expiry drops unselected or unacknowledged routing attempts without privately archiving prompt bodies; nondelivery is accepted, so resend manually if needed. Old controls and late replies cannot replay the source. An expired disposable unbound tab is removed after all its owned groups resolve and fresh protection checks pass. Accepted queues, independent work and restored bound Threads remain intact. Confirmed expiry releases worker custody even if tab metadata fails; retries use only body-free tab/source proof, and uncertain deletion is never repeated. Explicit Cancel retains its separate private-original policy. Historical originals without a saved clock and unconfirmed publication receive no invented deadline. Local candidate checks do not certify live deletion.
 
 `/telegram-connect` keeps working when the shared runtime `state.json` is damaged. If it is malformed, foreign or contains invalid evidence, the connecting leader replaces it with a fresh empty state and continues. Every profile then forgets old Thread bindings, slots, unfinished Restore/temporary work and polling continuity; `telegram.json`, Pi history and the released `tmp/telegram` are untouched. Permission errors still stop connection. See [Damaged-State Reset](./docs/architecture.md#damaged-state-reset-operator-approved).
 
@@ -69,6 +69,8 @@ The prompt queue is session-local. Before a reload or restart, let it drain or k
 
 Journal recovery is a separate existing loss policy, not shared-envelope recovery. A snapshot removed by older broad temp cleanup is rebuilt when its complete segment history proves an empty result, while a revisionless snapshot is repaired from the first surviving segment's exact predecessor when the reconstructed tail validates. Otherwise the damaged snapshot and segments are deleted (their inputs are lost), a fresh journal is published, and startup continues with an informational diagnostic. Unsupported journal versions block recovery without rewriting or quarantining retained files; use a compatible runtime rather than deleting journals. Saved `telegram.json` configuration and runtime diagnostics are outside that journal reset. Startup best-effort removes obsolete current-runtime root/session `recovery/` folders, so those directories are not a preservation location.
 
+Ordinary network or admission failures use exponential retry pauses capped at 30 seconds, without permanently stopping after an arbitrary attempt count. The poller recovers when the outage clears. Explicit `/telegram-disconnect` still attempts to stop its captured local transport if Thread cleanup is unavailable; it reports unconfirmed cleanup rather than successful deletion, and an old disconnect cannot stop a new connection. Incomplete stop/release remains visible; check `/telegram-status --debug` and keep Pi open.
+
 Persistent competing `getUpdates` clients cause a bounded transport stand-down rather than endless retries. Accepted local work remains queued/executable, but Telegram delivery stops. Inspect `/telegram-status --debug`, stop the competing client, then reconnect. See [Runtime Ownership](./docs/architecture.md#runtime-ownership).
 
 ### 4. Pair your Telegram account
@@ -214,11 +216,12 @@ Queue policy:
 - Priority and Normal are separate FIFO lanes; Priority dispatches first.
 - Moving `Normal → Priority` removes the prompt from Normal and places it at the Priority tail. Moving `Priority → Normal` removes it from Priority and places it at the Normal tail; no former position is restored.
 - Keep/Skip never changes lane position. Skip preserves durable authority while waiting so Keep remains reversible, then settles that authority and drops the prompt without a model turn when dispatch reaches it. Skipped prompts stay visible at their physical queue position with a struck-through ordinal, but are excluded immediately from the executable queue count shown in both the Pi status bar and Telegram main menu. Graceful session shutdown discards all remaining queued authority, so a new session starts empty.
-- Reactions control two independent dimensions; changing one category preserves the other:
+- For ordinary prompts, reactions control two independent dimensions; changing one category preserves the other:
   - `Positive`: `👍`, `⚡️`, `❤️`, `🕊`, `🔥` — controls Priority.
   - `Negative`: `👎`, `👻`, `💔`, `💩`, `🗑` — controls Skip.
 - Priority and Skip can coexist—for example `👍 + 💩`. Skip wins at dispatch, regardless of which negative emoji is selected.
 - Menu selectors and reactions share queue state, but the bot cannot remove a user's reaction; Keep may clear internal Skip while the user's emoji remains visible until they remove it.
+- A negative reaction to your original standalone `/continue` immediately cancels its exact waiting continuation, even while other work is active. This is irreversible cancellation, not reversible Skip. Positive reactions do not change its control lane; already-dispatched or running work and synthetic model-switch continuations are untouched.
 
 The detailed contract lives in [Priority, Reactions, Keep, and Skip](./docs/architecture.md#priority-reactions-keep-and-skip). If Pi automatically retries a transient provider failure, the active Telegram turn stays bound until the successful reply arrives or Pi confirms that the run has settled.
 

package/dist/lib/bindings.js

@@ -34,6 +34,7 @@ export function createTelegramQueueBindingRuntime(deps) {
     };
     const mutation = Queue.createTelegramQueueMutationController({
         ...deps.store,
+        hasPendingDispatch: deps.lifecycle.hasDispatchPending,
         allocateLaneOrder: deps.queue.allocateItemOrder,
         onItemsDiscarded(items, ctx) {
             if (!settleDiscardedItems(items, ctx)) {

package/dist/lib/bus-api.js

@@ -4,7 +4,7 @@
  * Wraps the direct Telegram Bot API runtime so follower instances can route outbound calls through the bus leader
  */
 import { markTelegramBusCrossTargetDelivery, stripTelegramBusApiMetadata, } from "./bus.js";
-import { buildTelegramAnswerGuestQueryBody, isTelegramMessageNotModifiedError, } from "./telegram-api.js";
+import { buildTelegramAnswerGuestQueryBody, formatTelegramCallbackAnswerText, isTelegramMessageNotModifiedError, } from "./telegram-api.js";
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -201,15 +201,16 @@ export function createTelegramBusAwareApiRuntime(deps) {
             ]);
         },
         async answerCallbackQuery(callbackQueryId, text) {
+            const answer = formatTelegramCallbackAnswerText(text);
             if (deps.ownsDirect()) {
-                await deps.directRuntime.answerCallbackQuery(callbackQueryId, text);
+                await deps.directRuntime.answerCallbackQuery(callbackQueryId, answer);
                 return;
             }
             await deps.callFollowerApi("call", [
                 "answerCallbackQuery",
                 {
                     callback_query_id: callbackQueryId,
-                    ...(text !== undefined ? { text } : {}),
+                    ...(answer !== undefined ? { text: answer } : {}),
                 },
             ]);
         },

package/dist/lib/extension.js

@@ -943,6 +943,9 @@ export default function (pi) {
                 return telegramJournalBindingRuntime.inspectSourceAbandonment(journalBindingKey, updateId);
             });
         },
+        inspectRoutingInputGroupExpiry(input) {
+            return telegramJournalReferenceRegistry.withReference({ referenceClass: "operator-disposition", recoveryKey: input.journalBindingKey }, function () { return telegramJournalBindingRuntime.inspectSourceGroupExpiry(input.journalBindingKey, input.updateIds); });
+        },
         inspectTemporaryThreadSources(_target, requiredJournalBindingKeys) {
             const binding = resolveTelegramUpdateJournalBinding();
             const botToken = configStore.getBotToken();
@@ -1548,6 +1551,7 @@ export default function (pi) {
         getSyncState: telegramSyncStateRuntime.getState,
         setSyncState: telegramSyncStateRuntime.setState,
         stopPolling: lockedPollingRuntime.stop,
+        captureStopPolling: lockedPollingRuntime.captureStop,
         suspendPolling: lockedPollingRuntime.suspend,
         recordRuntimeEvent,
         runWorkspaceOperation: telegramWorkspaceOperationRuntime.run,

package/dist/lib/journal.d.ts

@@ -374,6 +374,9 @@ export interface TelegramRoutingInputAuthority {
     operatorUserId: number;
     isCurrent(): boolean;
 }
+/** Expiry drops a donor attempt without retaining its body or claiming recipient execution/cancellation. */
+export type TelegramRoutingInputExpiryResult = Omit<TelegramUpdateJournalPendingAbandonmentResult, "retainedPath">;
+export type TelegramRoutingInputExpiryEvidence = Omit<TelegramUpdateJournalAbandonedPendingEvidence, "retainedPath">;
 /** Package-private v1 capability; raw input custody does not expose it. */
 export interface TelegramRoutingInputJournal {
     arm(input: TelegramRoutingInputAuthority & {
@@ -385,7 +388,9 @@ export interface TelegramRoutingInputJournal {
     };
     expire(input: Omit<TelegramRoutingInputAuthority, "entries"> & {
         entry: TelegramUpdateJournalEntry;
-    }): TelegramUpdateJournalPendingAbandonmentResult;
+    }): TelegramRoutingInputExpiryResult;
+    inspectExpiry(updateId: number): TelegramRoutingInputExpiryEvidence | undefined;
+    inspectGroupExpiry(updateIds: readonly number[]): TelegramRoutingInputExpiryEvidence[] | undefined;
 }
 export interface TelegramUpdateJournalStore {
     routingInputs?: TelegramRoutingInputJournal;
@@ -804,6 +809,7 @@ export interface TelegramUpdateJournalBindingRuntime {
     getActiveRecoveryKey: () => string | undefined;
     /** Exact historical proof lookup; no store, admission, execution, recovery or mutation port. */
     inspectSourceAbandonment: (journalBindingKey: string, updateId: number) => TelegramUpdateJournalAbandonedPendingEvidence | undefined;
+    inspectSourceGroupExpiry: (journalBindingKey: string, updateIds: readonly number[]) => TelegramRoutingInputExpiryEvidence[] | undefined;
     inspectSourceCompletion: (journalBindingKey: string, expected: TelegramUpdateJournalSourceCompletion) => TelegramUpdateJournalSourceCompletion | undefined;
     inspectQueuedReceipt: (journalBindingKey: string, expected: TelegramUpdateJournalQueuedCompletion) => TelegramUpdateJournalQueuedReceiptEvidence | undefined;
     /** In-process `/new` succession: move unclaimed predecessor pending inputs into the successor session journal. */

package/dist/lib/journal.js

@@ -285,6 +285,27 @@ export const TELEGRAM_ROUTING_INPUT_TTL_MS = 60 * 60 * 1000;
 export function createTelegramUpdateJournalEntryDigest(entry) {
     return { updateId: entry.updateId, sourceSha256: createHash("sha256").update(JSON.stringify(entry)).digest("hex") };
 }
+function inspectRoutingInputExpiry(file, journalBindingKey, updateId) {
+    const disposition = file.operatorDispositions?.find(value => value.updateId === updateId &&
+        "dispositionKind" in value && value.dispositionKind === "legacy-custody" && value.action === "discard" &&
+        value.failureId === `routing-expiry:${value.evidenceSha256}`);
+    if (!disposition || !("operatorAuthorityId" in disposition) || file.entries.some(entry => entry.updateId === updateId))
+        return undefined;
+    return { journalBindingKey, updateId, operatorAuthorityId: disposition.operatorAuthorityId };
+}
+function inspectRoutingGroupExpiry(file, journalBindingKey, updateIds) {
+    if (!Array.isArray(updateIds) || !updateIds.length || updateIds.length > TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES ||
+        updateIds.some((id, index) => !isSafeNonNegativeInteger(id) || (index > 0 && id <= updateIds[index - 1])))
+        return undefined;
+    if (file.entries.some(entry => updateIds.includes(entry.updateId)))
+        return undefined;
+    const expired = updateIds.map(id => inspectRoutingInputExpiry(file, journalBindingKey, id)).filter(value => value !== undefined);
+    if (!expired.length || expired.some(value => value.operatorAuthorityId !== expired[0].operatorAuthorityId))
+        return undefined;
+    // Some members may have been acknowledged earlier. Whole donor absence plus one exact expiry ends this known cohort,
+    // not recipient custody; fresh Thread protection still independently gates deletion.
+    return updateIds.map(updateId => ({ journalBindingKey, updateId, operatorAuthorityId: expired[0].operatorAuthorityId }));
+}
 function createJournalError(code, path, detail, cause) {
     return new TelegramUpdateJournalError(code, path, `Telegram update journal ${detail}: ${path}`, cause === undefined ? undefined : { cause });
 }
@@ -2064,6 +2085,9 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
                 return { journalBindingKey, updateId, retainedPath: original.path, operatorAuthorityId: disposition.operatorAuthorityId };
             });
         },
+        inspectSourceGroupExpiry(journalBindingKey, updateIds) {
+            return inspectHistoricalSource(journalBindingKey, file => inspectRoutingGroupExpiry(file, journalBindingKey, updateIds));
+        },
         inspectSourceCompletion(journalBindingKey, expected) {
             const completion = validateJournalSourceCompletion(expected, getTelegramUpdateJournalBindingPath(journalBindingKey) ?? "journal");
             return inspectHistoricalSource(journalBindingKey, (file, _originals, path) => inspectJournalSourceCompletion(file, completion, path));
@@ -3401,6 +3425,7 @@ function createJournalStoreCore(options, getInputContext) {
                         update: entry.update,
                         admittedAtMs: entry.admittedAtMs,
                         ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+                        ...(entry.routingInput ? { routingInput: { ...entry.routingInput } } : {}),
                         state: "queued",
                         queueKind: receipt.queueKind,
                         queueReceiptId: receipt.receiptId,
@@ -4069,22 +4094,58 @@ function createJournalStoreCore(options, getInputContext) {
             });
         },
     };
-    const abandonRoutingPending = journal.abandonPending.bind(journal);
     if (isTelegramUpdateJournalLegacyFamilyVersion(version))
         journal.routingInputs = {
             arm(input) { return mutateRoutingInputs(input, false, input.publishedAtMs).entries; },
             select(input) { return mutateRoutingInputs(input, true); },
+            inspectExpiry(updateId) {
+                return runMutation(readCurrent => {
+                    if (!isSafeNonNegativeInteger(updateId))
+                        throw createJournalError("invalid", path, "invalid routing expiry update ID");
+                    return inspectRoutingInputExpiry(readCurrent().file, createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity }), updateId);
+                });
+            },
+            inspectGroupExpiry(updateIds) {
+                return runMutation(readCurrent => inspectRoutingGroupExpiry(readCurrent().file, createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity }), updateIds));
+            },
             expire(input) {
-                const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
-                if (!lifetime || lifetime.phase !== "waiting" || lifetime.operatorUserId !== input.operatorUserId ||
-                    !isSafePositiveInteger(input.operatorUserId) || typeof input.isCurrent !== "function") {
-                    throw createJournalError("conflict", path, "routing input expiry lacks exact waiting authority");
-                }
-                const current = () => { const now = getNowMs(); return isSafeNonNegativeInteger(now) && now >= lifetime.expiresAtMs && input.isCurrent(); };
-                if (!current())
-                    throw createJournalError("conflict", path, "routing input has not expired under current authority");
-                return abandonRoutingPending({ journalBindingKey: input.journalBindingKey, entry: original,
-                    operatorAuthorityId: `telegram-owner:${input.operatorUserId}`, isCurrent: current });
+                return runMutation(readCurrent => {
+                    const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
+                    const binding = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+                    if (!lifetime || original.state !== "pending" || original.inputClaim || original.inputProvenance || original.queueOwner ||
+                        original.queueReceiptId || original.queueHandoff || original.failure || input.journalBindingKey !== binding ||
+                        lifetime.operatorUserId !== input.operatorUserId || !isSafePositiveInteger(input.operatorUserId) || typeof input.isCurrent !== "function") {
+                        throw createJournalError("conflict", path, "routing expiry requires an exact unclaimed chooser source");
+                    }
+                    const assertCurrent = () => {
+                        const now = getNowMs();
+                        if (!isSafeNonNegativeInteger(now) || now < lifetime.expiresAtMs || !input.isCurrent())
+                            throw createJournalError("conflict", path, "routing source has not expired under current authority");
+                    };
+                    assertCurrent();
+                    const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
+                    const evidenceSha256 = createHash("sha256").update(JSON.stringify(original)).digest("hex");
+                    const failureId = `routing-expiry:${evidenceSha256}`;
+                    const existing = current.file.operatorDispositions?.find(value => value.updateId === original.updateId);
+                    const entry = current.file.entries.find(value => value.updateId === original.updateId);
+                    if (existing) {
+                        if (entry || !("dispositionKind" in existing) || existing.dispositionKind !== "legacy-custody" || existing.action !== "discard" ||
+                            existing.failureId !== failureId || existing.evidenceSha256 !== evidenceSha256 || existing.operatorAuthorityId !== `telegram-owner:${input.operatorUserId}`)
+                            throw createJournalError("conflict", path, "routing source has contradictory expiry evidence");
+                        assertCurrent();
+                        return { disposition: existing, duplicate: true, entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    }
+                    if (!entry || !isDeepStrictEqual(entry, original))
+                        throw createJournalError("conflict", path, "routing source changed before expiry");
+                    // A discard tombstone prevents old readers and delayed reports from replaying; no prompt-body archive is written.
+                    const now = getNowMs();
+                    const disposition = { dispositionKind: "legacy-custody", failureId,
+                        updateId: original.updateId, action: "discard", committedAtMs: now, authorizedAtMs: now, evidenceSha256,
+                        operatorAuthorityId: `telegram-owner:${input.operatorUserId}` };
+                    const published = publishMutation(current, current.file.entries.filter(value => value.updateId !== original.updateId), true, [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId, (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
+                    assertCurrent();
+                    return { disposition, duplicate: false, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                });
             },
         };
     if (!getInputContext)

package/dist/lib/locks.d.ts

@@ -215,6 +215,11 @@ type TelegramLockedPollingStartResult = {
 export interface TelegramLockedPollingRuntime<TContext extends TelegramLockContext> {
     start: (ctx: TContext, options?: TelegramLockedPollingStartOptions) => Promise<TelegramLockedPollingStartResult>;
     stop: () => Promise<string>;
+    /** Capture one disconnect attempt before cleanup awaits; a newer start revokes it. */
+    captureStop: () => {
+        isCurrent: () => boolean;
+        stop: () => Promise<string>;
+    };
     suspend: () => Promise<void>;
     isSuspended: () => boolean;
     /** Fence one owned polling generation; suspension, restart, conflict or lock loss revokes it. */

package/dist/lib/locks.js

@@ -1210,6 +1210,8 @@ export function createTelegramLockedPollingRuntime(deps) {
             stopOwnershipWatcher();
             if (sessionAutoStartRun) {
                 await sessionAutoStartRun;
+                if (generation !== pollingGeneration)
+                    return;
                 deps.stopFollowerRegistration?.();
             }
             if (ownershipStop) {
@@ -1325,6 +1327,21 @@ export function createTelegramLockedPollingRuntime(deps) {
     const canStartPolling = (ctx) => deps.canStartPolling?.(ctx) ?? true;
     const formatStartBlockedMessage = (ctx) => deps.formatStartBlockedMessage?.(ctx) ??
         "Telegram polling is unavailable in this Pi run mode.";
+    const stop = async () => {
+        const generation = pollingGeneration + 1;
+        await suspendPolling();
+        if (generation !== pollingGeneration)
+            throw new Error("Telegram disconnect was superseded by a new connection.");
+        const state = deps.lock.release();
+        deps.onTransportAvailabilityChanged?.();
+        if (state.kind === "active-elsewhere") {
+            return `Telegram bridge is active in another Pi instance (${formatTelegramLockEntry(state.lock)}).`;
+        }
+        if (state.kind === "stale") {
+            return `Removed stale Telegram bridge lock (${formatTelegramLockEntry(state.lock)}).`;
+        }
+        return "Telegram bridge disconnected.";
+    };
     return {
         start: async (ctx, options = {}) => {
             if (!deps.hasBotToken()) {
@@ -1440,17 +1457,18 @@ export function createTelegramLockedPollingRuntime(deps) {
             const staleSuffix = acquired.replacedStale ? " Replaced stale lock." : "";
             return { ok: true, message: `Telegram bridge connected.${staleSuffix}` };
         },
-        stop: async () => {
-            await suspendPolling();
-            const state = deps.lock.release();
-            deps.onTransportAvailabilityChanged?.();
-            if (state.kind === "active-elsewhere") {
-                return `Telegram bridge is active in another Pi instance (${formatTelegramLockEntry(state.lock)}).`;
-            }
-            if (state.kind === "stale") {
-                return `Removed stale Telegram bridge lock (${formatTelegramLockEntry(state.lock)}).`;
-            }
-            return "Telegram bridge disconnected.";
+        stop,
+        captureStop() {
+            const generation = pollingGeneration;
+            const isCurrent = () => generation === pollingGeneration;
+            return {
+                isCurrent,
+                async stop() {
+                    if (!isCurrent())
+                        throw new Error("Telegram disconnect was superseded by a new connection.");
+                    return stop();
+                },
+            };
         },
         suspend: suspendPolling,
         captureTransportAuthority(ctx) {

package/dist/lib/polling.d.ts

@@ -28,6 +28,8 @@ export declare class TelegramPersistentGetUpdatesConflictError extends Error {
     readonly count: number;
     constructor(count: number);
 }
+/** Exponential backoff for non-conflict polling/admission failures. */
+export declare function getTelegramPollingRetryDelayMs(consecutiveFailures: number): number;
 export declare class TelegramGetUpdatesTimeoutError extends Error {
     readonly timeoutMs: number;
     constructor(timeoutMs: number);

package/dist/lib/polling.js

@@ -14,7 +14,8 @@ export const TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT = 10;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_LIMIT = 3;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS = 1_000;
 const TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS = 3_000;
-const TELEGRAM_POLLING_RETRY_MS = 3_000;
+const TELEGRAM_POLLING_RETRY_BASE_MS = 1_000;
+const TELEGRAM_POLLING_RETRY_MAX_MS = 30_000;
 const TELEGRAM_GET_UPDATES_GRACE_MS = 10_000;
 // Standard Telegram DM polling does not expose ordinary message-deletion events.
 // Business deletions belong to a separate namespace and default routing ignores them.
@@ -51,6 +52,11 @@ export class TelegramPersistentGetUpdatesConflictError extends Error {
         this.count = count;
     }
 }
+/** Exponential backoff for non-conflict polling/admission failures. */
+export function getTelegramPollingRetryDelayMs(consecutiveFailures) {
+    const exponent = Math.max(0, Math.min(consecutiveFailures - 1, 16));
+    return Math.min(TELEGRAM_POLLING_RETRY_BASE_MS * 2 ** exponent, TELEGRAM_POLLING_RETRY_MAX_MS);
+}
 export class TelegramGetUpdatesTimeoutError extends Error {
     timeoutMs;
     constructor(timeoutMs) {
@@ -1103,6 +1109,7 @@ export async function runTelegramPollLoop(deps) {
     if (!deps.config.botToken)
         return;
     let consecutiveGetUpdatesConflicts = 0;
+    let consecutiveFailures = 0;
     const retryConflict = async () => {
         consecutiveGetUpdatesConflicts += 1;
         if (consecutiveGetUpdatesConflicts >= TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT) {
@@ -1171,6 +1178,7 @@ export async function runTelegramPollLoop(deps) {
                 onPhaseChange: deps.onPhaseChange,
                 recordRuntimeEvent: deps.recordRuntimeEvent,
             });
+            consecutiveFailures = 0;
             currentUpdateId = undefined;
         }
         catch (error) {
@@ -1190,8 +1198,10 @@ export async function runTelegramPollLoop(deps) {
                     : {}),
             });
             consecutiveGetUpdatesConflicts = 0;
+            consecutiveFailures += 1;
             deps.onErrorStatus(getTelegramPollingErrorMessage(error));
-            await deps.sleep(TELEGRAM_POLLING_RETRY_MS, deps.signal);
+            // Cap the pause, not retry count: outages must recover without manual reconnect.
+            await deps.sleep(getTelegramPollingRetryDelayMs(consecutiveFailures), deps.signal);
             if (deps.signal.aborted)
                 return;
             deps.onStatusReset();

package/dist/lib/queue.d.ts

@@ -613,11 +613,13 @@ export type TelegramSessionLifecycleHookEvent = unknown;
 export declare function createTelegramSessionStateApplier<TQueueItem, TModel>(deps: TelegramSessionStateApplierDeps<TQueueItem, TModel>): TelegramSessionStateApplier<TQueueItem, TModel>;
 export interface TelegramQueueMutationRuntimeDeps<TContext> extends TelegramQueueStore<TContext>, TelegramRuntimeEventRecorderPort {
     ctx: TContext;
+    hasPendingDispatch?: () => boolean;
     allocateLaneOrder?: () => number;
     onItemsDiscarded?: (items: readonly TelegramQueueItem<TContext>[], ctx: TContext) => void;
     updateStatus: (ctx: TContext) => void;
 }
 export interface TelegramQueueMutationControllerDeps<TContext> extends TelegramQueueStore<TContext>, TelegramRuntimeEventRecorderPort {
+    hasPendingDispatch?: () => boolean;
     allocateLaneOrder?: () => number;
     onItemsDiscarded?: (items: readonly TelegramQueueItem<TContext>[], ctx: TContext) => void;
     updateStatus: (ctx: TContext) => void;

package/dist/lib/queue.js

@@ -582,7 +582,7 @@ function removeTelegramQueuedGuestPromptByOrder(items, queueOrder) {
 export function applyTelegramQueuePromptReactionDisposition(items, messageId, disposition, destinationLaneOrder, scope) {
     let nextItems = items;
     for (const [index, item] of items.entries()) {
-        if (!isPendingTelegramTurn(item) ||
+        if (!isPendingTelegramTurn(item) || item.queueLane === "control" ||
             !isTelegramQueueItemInMessageScope(item, scope) ||
             !item.sourceMessageIds.includes(messageId)) {
             continue;
@@ -1550,7 +1550,15 @@ function updateTelegramQueueStatusRuntime(deps) {
     }
 }
 function commitReorderedTelegramQueueItemsRuntime(items, deps) {
-    deps.setQueuedItems([...items].sort(compareTelegramQueueItems));
+    const pendingHead = deps.hasPendingDispatch?.() ? deps.getQueuedItems()[0] : undefined;
+    const ordered = [...items].sort(compareTelegramQueueItems);
+    if (pendingHead) {
+        const index = ordered.findIndex(item => item.queueOrder === pendingHead.queueOrder && item.kind === pendingHead.kind &&
+            item.chatId === pendingHead.chatId && item.replyToMessageId === pendingHead.replyToMessageId);
+        if (index > 0)
+            ordered.unshift(ordered.splice(index, 1)[0]);
+    }
+    deps.setQueuedItems(ordered);
     updateTelegramQueueStatusRuntime(deps);
 }
 function appendTelegramQueueItemRuntime(item, deps) {
@@ -1602,8 +1610,22 @@ function removeTelegramQueuedGuestPromptByOrderRuntime(queueOrder, deps) {
 }
 export function applyTelegramQueuePromptReactionDispositionRuntime(messageId, disposition, deps, scope) {
     const queuedItems = deps.getQueuedItems();
+    const suppression = disposition.kind === "reaction-transition" ? disposition.suppressionEmoji :
+        disposition.kind === "suppressed" ? disposition.emoji : disposition.kind === "priority-suppressed" ? disposition.suppressionEmoji : undefined;
+    // Source-addressed control-lane prompts are explicit continuations. Synthetic model-switch turns have no source IDs.
+    // A Pi-owned dispatched head cannot be removed: agent_start must consume that exact item, not its successor.
+    const cancelled = suppression && deps.hasPendingDispatch ? queuedItems.filter((item, index) => isPendingTelegramTurn(item) && item.queueLane === "control" && isTelegramQueueItemInMessageScope(item, scope) &&
+        item.sourceMessageIds.includes(messageId) && !(index === 0 && deps.hasPendingDispatch())) : [];
+    if (cancelled.length) {
+        if (cancelled.some(item => (item.admissionReceipts?.length ?? 0) > 0) && !deps.onItemsDiscarded)
+            return false;
+        deps.onItemsDiscarded?.(cancelled, deps.ctx);
+        deps.setQueuedItems(queuedItems.filter(item => !cancelled.includes(item)));
+        updateTelegramQueueStatusRuntime(deps);
+        return true;
+    }
     const changesLane = queuedItems.some((item) => {
-        if (!isPendingTelegramTurn(item) ||
+        if (!isPendingTelegramTurn(item) || item.queueLane === "control" ||
             !isTelegramQueueItemInMessageScope(item, scope) ||
             !item.sourceMessageIds.includes(messageId)) {
             return false;

package/dist/lib/routing.d.ts

@@ -121,6 +121,7 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     captureWorkspaceExternalProtection?: ReturnType<typeof createTelegramWorkspaceExternalProtectionCapture>;
     /** Strict committed abandonment plus retained original; shared by Restore and temporary-input cancellation. */
     inspectRestoreSourceAbandonment?: (updateId: number, journalBindingKey: string) => Threads.TelegramTemporaryThreadCancellationEvidence | undefined;
+    inspectRoutingInputGroupExpiry?: (input: Threads.TelegramTemporaryThreadInput) => readonly Threads.TelegramTemporaryThreadCancellationEvidence[] | undefined;
     /** Strict active-journal observation only; a hint or missing source never substitutes for this ACK. */
     inspectRestoreSourceCompletion?: (expected: Updates.TelegramDeferredSourceEvidence & {
         completionSha256: string;