@llblab/pi-telegram 0.52.0 → 0.52.2

package/dist/lib/routing.js

@@ -189,6 +189,7 @@ function formatTelegramTemporaryThreadChooserText(command) {
         "<b>🧵 Choose target thread:</b>",
         "",
         command ? `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.` : "Choose where to send your message.",
+        "Unaccepted routing expires after 60 minutes; disposable tabs are removed when clear. Accepted work and restored Threads are kept.",
         "Select the Pi thread that should handle it, or restore a Pi into this tab:",
     ].join("\n");
 }
@@ -1902,9 +1903,9 @@ export function createTelegramInboundRouteRuntime(deps) {
      * absence of chooser and journal custody, and the ordinary protection checks must all hold again. The attempt is
      * durably issued once; a skipped or unknown removal keeps the entry protecting the tab across restart.
      */
-    const runTemporaryThreadCleanup = async (token, cap) => {
-        const store = cap.store, inspect = deps.inspectRestoreSourceAbandonment;
-        if (!inspect || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent())
+    const runTemporaryThreadCleanup = async (token, cap, reconcileExpiry) => {
+        const store = cap.store;
+        if ((!deps.inspectRestoreSourceAbandonment && !deps.inspectRoutingInputGroupExpiry) || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent())
             return;
         await deps.runWorkspaceOperation({ operationId: `temporary-thread-cleanup-${randomBytes(16).toString("hex")}`,
             operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
@@ -1912,15 +1913,48 @@ export function createTelegramInboundRouteRuntime(deps) {
                 return;
             let entry = store.listTemporaryThreads().find(value => value.token === token && value.phase === "created" && !!value.target);
             const target = entry?.target;
-            if (!entry || !target || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target) ||
-                entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey)
+            if (!entry || !target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+                entry.source.journalBindingKey !== cap.journalBindingKey)
+                return;
+            const owner = `telegram-owner:${cap.operatorUserId}`;
+            if (reconcileExpiry && deps.inspectRoutingInputGroupExpiry) {
+                for (const group of Threads.getTelegramTemporaryThreadInputs(entry)) {
+                    if ([...(entry.cancelledInputs ?? []), ...(entry.completedInputs ?? [])].some(value => isDeepStrictEqual(value, group)))
+                        continue;
+                    const inspect = (id) => deps.inspectRoutingInputGroupExpiry(group)?.find(value => value.updateId === id);
+                    if (!group.updateIds.every(id => inspect(id)?.operatorAuthorityId === owner))
+                        continue;
+                    entry = cap.adopt(entry);
+                    if (!entry || !cap.isCurrent())
+                        return;
+                    let recorded, failure;
+                    try {
+                        recorded = store.recordTemporaryThreadInputExpiry(entry, group, cap.authority, inspect);
+                    }
+                    catch (error) {
+                        failure = error;
+                    }
+                    if (!cap.isCurrent())
+                        return;
+                    const retained = store.listTemporaryThreads().find(value => value.token === token);
+                    // A lost publication ACK may already have recorded the group or retired a bound tab's temporary frame.
+                    if (!retained)
+                        return;
+                    if (!recorded && !retained.cancelledInputs?.some(value => isDeepStrictEqual(value, group)))
+                        throw failure ?? new Error("Chooser expiry metadata was not confirmed.");
+                    entry = retained;
+                }
+            }
+            if (!Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target))
                 return;
-            const owner = `telegram-owner:${cap.operatorUserId}`, cancelled = entry.cancelledInputs ?? [];
-            const cancelledCurrent = () => cancelled.every(input => input.updateIds.every(updateId => {
-                const evidence = inspect(updateId, input.journalBindingKey);
-                return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
-                    evidence.operatorAuthorityId === owner;
-            }));
+            const cancelled = entry.cancelledInputs ?? [];
+            const cancelledCurrent = () => cancelled.every(input => {
+                const expiry = deps.inspectRoutingInputGroupExpiry?.(input);
+                return input.updateIds.every(updateId => {
+                    const evidence = deps.inspectRestoreSourceAbandonment?.(updateId, input.journalBindingKey) ?? expiry?.find(value => value.updateId === updateId);
+                    return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId && evidence.operatorAuthorityId === owner;
+                });
+            });
             if (!cancelledCurrent())
                 return;
             entry = cap.adopt(entry);
@@ -1940,8 +1974,40 @@ export function createTelegramInboundRouteRuntime(deps) {
             store.retireTemporaryThread(entry, cap.authority);
         });
     };
-    /** Starts the quiet period only when every known group is resolved; a new input or authority change denies it. */
-    const scheduleTemporaryThreadCleanup = (target, ctx) => {
+    // Reuse the one timer per tab for body-free metadata retries. Future retry timers do not join settlement waits;
+    // only their running attempt does. No retry is licensed once a destructive grant may have been issued.
+    const queueTemporaryThreadCleanup = (token, cap, delay, reconcileExpiry, retry = false) => {
+        cancelTemporaryThreadCleanup(token);
+        let settle = () => undefined;
+        const task = new Promise(resolve => { settle = resolve; });
+        const timer = setTimeout(() => {
+            if (temporaryCleanupTimers.get(token)?.timer !== timer)
+                return;
+            temporaryCleanupTimers.delete(token);
+            if (retry)
+                restoreSettlementTasks.add(task);
+            runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+                .catch(error => {
+                deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" });
+                if (!reconcileExpiry || !cap.isCurrent())
+                    return;
+                try {
+                    const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+                    if (retained && !retained.cleanupIssued && cap.isCurrent())
+                        queueTemporaryThreadCleanup(token, cap, 60_000, true, true);
+                }
+                catch { /* Unknown grant state never licenses a retry. */ }
+            })
+                .finally(settle);
+        }, delay);
+        timer.unref?.();
+        temporaryCleanupTimers.set(token, { timer, settle });
+        if (!retry)
+            restoreSettlementTasks.add(task);
+        void task.finally(() => restoreSettlementTasks.delete(task));
+    };
+    /** Starts the quiet period for resolved groups or body-free expiry reconciliation; fresh input/authority revokes it. */
+    const scheduleTemporaryThreadCleanup = (target, ctx, reconcileExpiry = false) => {
         const cap = captureTemporaryThreadAuthority(ctx);
         if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target))
             return;
@@ -1953,27 +2019,22 @@ export function createTelegramInboundRouteRuntime(deps) {
             deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" });
             return;
         }
-        if (!entry || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) ||
-            entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey)
+        if (!entry || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey)
+            return;
+        if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) {
+            try {
+                reconcileExpiry = Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group));
+            }
+            catch (error) {
+                deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" });
+                return;
+            }
+        }
+        if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry))
             return;
-        const token = entry.token;
-        cancelTemporaryThreadCleanup(token);
         const requested = deps.temporaryThreadCleanupDelayMs;
         const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
-        let settle = () => undefined;
-        const task = new Promise(resolve => { settle = resolve; });
-        const timer = setTimeout(() => {
-            if (temporaryCleanupTimers.get(token)?.timer !== timer)
-                return;
-            temporaryCleanupTimers.delete(token);
-            runTemporaryThreadCleanup(token, cap)
-                .catch(error => { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" }); })
-                .finally(settle);
-        }, delay);
-        timer.unref?.();
-        temporaryCleanupTimers.set(token, { timer, settle });
-        restoreSettlementTasks.add(task);
-        void task.finally(() => restoreSettlementTasks.delete(task));
+        queueTemporaryThreadCleanup(entry.token, cap, delay, reconcileExpiry);
     };
     const recordCancelledTemporaryThreadInput = (pending, ctx, isCurrent) => {
         const store = deps.getWorkspaceRestoreStore?.(), target = pending.sourceTarget;
@@ -2056,10 +2117,15 @@ export function createTelegramInboundRouteRuntime(deps) {
                 if (!cap.isCurrent())
                     return;
                 const self = cap.authority.executor.instanceId;
-                const disposable = cap.store.listTemporaryThreads().flatMap(entry => entry.operatorUserId === cap.operatorUserId &&
+                const entries = cap.store.listTemporaryThreads();
+                const preserved = entries.filter(entry => entry.operatorUserId === cap.operatorUserId && entry.phase === "created" &&
+                    cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" &&
+                    Threads.getTelegramTemporaryThreadInputs(entry).some(source => source.journalBindingKey === journalBindingKey &&
+                        source.updateIds.some(id => input.routingSourceIds?.includes(id)))).map(entry => entry.token);
+                const disposable = entries.flatMap(entry => entry.operatorUserId === cap.operatorUserId && !preserved.includes(entry.token) &&
                     entry.executor.instanceId !== self && entry.phase === "created" && entry.target &&
                     cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" ? [entry] : []);
-                const forgotten = cap.store.forgetPreviousWorld(cap.authority);
+                const forgotten = cap.store.forgetPreviousWorld(cap.authority, preserved);
                 if (!forgotten)
                     return;
                 result.forgotten = forgotten.operations.length + forgotten.temporaryThreads.length;
@@ -2087,6 +2153,17 @@ export function createTelegramInboundRouteRuntime(deps) {
                         deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-tab-delete" });
                     }
                 }
+                // Same-instance session replacement may have lost a metadata-only timer after the source was already spent.
+                // Reconstruct from retained tab/source proof under fresh authority, never from a prompt body or an issued delete.
+                for (const entry of cap.store.listTemporaryThreads()) {
+                    if (!cap.isCurrent())
+                        break;
+                    if (entry.phase !== "created" || !entry.target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+                        entry.source.journalBindingKey !== journalBindingKey)
+                        continue;
+                    if (Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)))
+                        scheduleTemporaryThreadCleanup(entry.target, ctx, true);
+                }
             });
         }
         catch (error) {
@@ -2172,10 +2249,11 @@ export function createTelegramInboundRouteRuntime(deps) {
     const expireRoutingInput = async (source, ctx, signal) => {
         const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.();
         const message = source.original.update.message;
-        const current = () => !signal.aborted && source.isCurrent() && operator !== undefined && epoch !== undefined &&
+        const runtimeCurrent = () => !signal.aborted && operator !== undefined && epoch !== undefined &&
             deps.isContextActive?.(ctx) === true && deps.configStore.getAllowedUserId() === operator &&
             deps.getCurrentLeaderEpoch?.() === epoch && deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
             source.original.routingInput?.operatorUserId === operator && message?.from?.id === operator && message.from.is_bot !== true && message.chat?.type === "private";
+        const current = () => runtimeCurrent() && source.isCurrent();
         if (!current() || !deps.runWorkspaceOperation)
             return;
         await deps.runWorkspaceOperation({ operationId: `routing-expiry-${randomBytes(16).toString("hex")}`,
@@ -2185,19 +2263,11 @@ export function createTelegramInboundRouteRuntime(deps) {
             const restores = deps.getWorkspaceRestoreStore?.();
             if (deps.getWorkspaceRestoreStore && !restores)
                 return;
-            if (restores?.list().some(intent => intent.request.source.journalBindingKey === source.journalBindingKey &&
-                intent.request.source.updateIds.includes(source.original.updateId)))
-                return;
-            for (const pending of pendingUnboundReroutes.values()) {
-                if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
-                    continue;
-                if (pending.selectionAttempted || pending.destinationSelected || pending.dispatching || pending.foreignForwardIssued || pending.workspaceRestore || pending.foreignRetry || pending.cleanup || pending.abandonment?.running)
-                    return;
-            }
+            const temporary = restores?.listTemporaryThreads().find(entry => Threads.getTelegramTemporaryThreadInputs(entry).some(input => input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId)));
             const result = source.expire();
             if (!result)
                 return;
-            // Retire local controls after the source ACK. Telegram UI failure cannot undo retention or trigger deletion.
+            // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
             for (const [id, pending] of pendingUnboundReroutes) {
                 if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
                     continue;
@@ -2214,6 +2284,10 @@ export function createTelegramInboundRouteRuntime(deps) {
                     }
                 }
             }
+            // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
+            // never closes over this source or asks the worker to retain a terminal prompt while metadata publication fails.
+            if (temporary?.target && runtimeCurrent())
+                scheduleTemporaryThreadCleanup(temporary.target, ctx, true);
         });
     };
     const renderCancellationReview = async (view, isCurrent) => {

package/dist/lib/sync.d.ts

@@ -92,6 +92,7 @@ export interface TelegramManualThreadDisconnectDeps<TSyncState> {
     recordRuntimeEvent: (category: string, error: unknown, details?: Record<string, unknown>) => void;
     runWorkspaceOperation: TelegramSyncWorkspaceOperationRunner;
     workspaceOperationKind?: string;
+    isDisconnectCurrent?: () => boolean;
     getNowMs?: () => number;
 }
 export declare function createTelegramPreservedLeaderQuitHandler(deps: {
@@ -112,6 +113,10 @@ export interface TelegramThreadDisconnectAssembly {
 }
 export declare function createTelegramThreadDisconnectAssembly<TSyncState extends TelegramSyncState>(deps: Omit<TelegramManualThreadDisconnectDeps<TSyncState>, "stopPolling"> & {
     stopPolling: () => Promise<string>;
+    captureStopPolling?: () => {
+        isCurrent: () => boolean;
+        stop: () => Promise<string>;
+    };
     suspendPolling: () => Promise<void>;
 }): TelegramThreadDisconnectAssembly;
 export declare function createTelegramManualThreadDisconnectHandler<TSyncState extends TelegramSyncState>(deps: TelegramManualThreadDisconnectDeps<TSyncState>): () => Promise<string>;

package/dist/lib/sync.js

@@ -74,11 +74,41 @@ function createTelegramSessionRestartThreadCleanupHandler(deps) {
 }
 export function createTelegramThreadDisconnectAssembly(deps) {
     return {
-        disconnect: createTelegramManualThreadDisconnectHandler({
-            ...deps,
-            workspaceOperationKind: "workspace.disconnect-thread",
-            stopPolling: deps.stopPolling,
-        }),
+        async disconnect() {
+            const captured = deps.captureStopPolling?.();
+            const stop = captured?.stop ?? deps.stopPolling;
+            let stopAttempted = false;
+            const disconnect = createTelegramManualThreadDisconnectHandler({
+                ...deps,
+                workspaceOperationKind: "workspace.disconnect-thread",
+                isDisconnectCurrent: captured?.isCurrent ?? deps.isDisconnectCurrent,
+                stopPolling() {
+                    stopAttempted = true;
+                    return stop();
+                },
+            });
+            try {
+                return await disconnect();
+            }
+            catch (error) {
+                // Never retry a stop whose teardown/release outcome may already have committed.
+                if (stopAttempted) {
+                    deps.recordRuntimeEvent("connection", error, { phase: "disconnect-stop" });
+                    throw error;
+                }
+                deps.recordRuntimeEvent("connection", error, { phase: "disconnect-cleanup" });
+                let stopped;
+                try {
+                    stopped = await stop();
+                }
+                catch (stopError) {
+                    deps.recordRuntimeEvent("connection", stopError, { phase: "disconnect-stop" });
+                    throw stopError;
+                }
+                const separator = /[.!?]$/u.test(stopped) ? " " : ". ";
+                return `${stopped}${separator}Thread cleanup was not confirmed. Check /telegram-status --debug.`;
+            }
+        },
         cleanupForSessionRestart: createTelegramSessionRestartThreadCleanupHandler({
             ...deps,
             suspendPolling: deps.suspendPolling,
@@ -86,7 +116,12 @@ export function createTelegramThreadDisconnectAssembly(deps) {
     };
 }
 export function createTelegramManualThreadDisconnectHandler(deps) {
+    const assertCurrent = () => {
+        if (deps.isDisconnectCurrent?.() === false)
+            throw new Error("Telegram disconnect was superseded by a new connection.");
+    };
     const operation = async () => {
+        assertCurrent();
         const currentRecord = deps.getCurrentThreadRecord();
         let cleanupPending = false;
         if (currentRecord?.target.threadId) {
@@ -98,6 +133,7 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
             if (isManualFollower && !ownsLeader) {
                 if (deps.disconnectFollowerThread) {
                     const disconnected = await deps.disconnectFollowerThread();
+                    assertCurrent();
                     if (!disconnected) {
                         throw new Error("Telegram follower thread deletion requires a live leader registration.");
                     }
@@ -122,6 +158,7 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
                 const isCleanupTargetProtected = createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
                 deps.topicTargetStore.upsertPendingCleanup(intent);
                 await deps.topicTargetStore.persist();
+                assertCurrent();
                 const cleanupPlan = ThreadReconciler.planThreadReconciliation({
                     nowMs: (deps.getNowMs ?? Date.now)(),
                     currentLeaderEpoch: leaderEpoch,
@@ -131,20 +168,25 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
                 const cleanup = await ThreadReconciler.applyThreadReconciliationPlan(cleanupPlan, {
                     isCleanupTargetProtected,
                     callApi(method, body) {
+                        assertCurrent();
                         return deps.callApi(method, body);
                     },
                     markStaleByTarget(targetToMark, syncStatus, lastSyncError) {
+                        assertCurrent();
                         return deps.topicTargetStore.markStaleByTarget(targetToMark, syncStatus, lastSyncError);
                     },
                     removeCleanupIntentById(id) {
+                        assertCurrent();
                         return deps.topicTargetStore.removePendingCleanup(id);
                     },
                     persist() {
+                        assertCurrent();
                         return deps.topicTargetStore.persist();
                     },
                     getCurrentLeaderEpoch: deps.getCurrentLeaderEpoch,
                     recordRuntimeEvent: deps.recordRuntimeEvent,
                 });
+                assertCurrent();
                 if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) {
                     return "Thread disconnect superseded by a new binding.";
                 }
@@ -160,6 +202,7 @@ export function createTelegramManualThreadDisconnectHandler(deps) {
                 action: "manual-disconnect",
             }));
         }
+        assertCurrent();
         const stopped = await deps.stopPolling();
         return cleanupPending
             ? `${stopped} Telegram thread cleanup remains pending for the next leader.`

package/dist/lib/telegram-api.d.ts

@@ -514,6 +514,8 @@ export declare function fetchTelegramBotIdentity(botToken: string, fetchImpl?: t
  */
 export declare function callTelegramMultipart<TResponse>(botToken: string | undefined, method: string, fields: Record<string, string>, fileField: string, filePath: string, fileName: string, options?: TelegramApiCallOptions): Promise<TResponse>;
 export declare function downloadTelegramFile(botToken: string | undefined, fileId: string, suggestedName: string, tempDir: string, options?: TelegramFileDownloadOptions): Promise<string>;
+/** Tooltip-like callback answers omit a terminal sentence period; ellipses and other punctuation stay literal. */
+export declare function formatTelegramCallbackAnswerText(text: string | undefined): string | undefined;
 export declare function answerTelegramCallbackQuery(botToken: string | undefined, callbackQueryId: string, text?: string, options?: TelegramAnswerCallbackQueryOptions): Promise<void>;
 export declare function createTelegramChatActionSender<TAction extends string>(sendChatAction: (chatId: number, action: TAction, options?: {
     message_thread_id?: number;

package/dist/lib/telegram-api.js

@@ -30,6 +30,7 @@ function getTelegramApiTempDir() {
     return resolveTelegramAttachmentsDir();
 }
 const TELEGRAM_TEMP_FILE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+const TELEGRAM_DOWNLOAD_RENAME_MAX_ATTEMPTS = 6;
 const activeTelegramApiWorkspaceAdmissionOperationIds = new Set();
 const TELEGRAM_INBOUND_FILE_MAX_BYTES = getTelegramInboundFileByteLimitFromEnv(process.env, ["PI_TELEGRAM_INBOUND_FILE_MAX_BYTES", "TELEGRAM_MAX_FILE_SIZE_BYTES"], TELEGRAM_FILE_MAX_BYTES);
 const TELEGRAM_NETWORK_FAMILY_ENV = "PI_TELEGRAM_NETWORK_FAMILY";
@@ -391,6 +392,22 @@ async function writeTelegramDownloadResponse(response, targetPath, maxFileSizeBy
     }
     await pipeline(Readable.from(response.body, { objectMode: false }), createTelegramDownloadLimitTransform(maxFileSizeBytes), createWriteStream(targetPath, { mode: 0o600 }));
 }
+async function publishTelegramDownload(partPath, targetPath, signal) {
+    for (let attempt = 0;; attempt++) {
+        throwIfTelegramApiCallAborted(signal);
+        try {
+            await rename(partPath, targetPath);
+            return;
+        }
+        catch (error) {
+            const code = error?.code;
+            // Windows may briefly deny replacement while another publisher/scanner holds the file.
+            if (process.platform !== "win32" || (code !== "EPERM" && code !== "EACCES") || attempt + 1 >= TELEGRAM_DOWNLOAD_RENAME_MAX_ATTEMPTS)
+                throw error;
+            await sleepTelegramRetry(50 * 2 ** attempt, signal);
+        }
+    }
+}
 async function removeTelegramPartialDownload(path) {
     try {
         await unlink(path);
@@ -787,7 +804,7 @@ export async function downloadTelegramFile(botToken, fileId, suggestedName, temp
     assertTelegramFileSizeWithinLimit(contentLength ? Number.parseInt(contentLength, 10) : undefined, options?.maxFileSizeBytes);
     try {
         await writeTelegramDownloadResponse(response, partPath, options?.maxFileSizeBytes);
-        await rename(partPath, targetPath);
+        await publishTelegramDownload(partPath, targetPath, options?.signal);
     }
     catch (error) {
         await removeTelegramPartialDownload(partPath);
@@ -795,6 +812,10 @@ export async function downloadTelegramFile(botToken, fileId, suggestedName, temp
     }
     return targetPath;
 }
+/** Tooltip-like callback answers omit a terminal sentence period; ellipses and other punctuation stay literal. */
+export function formatTelegramCallbackAnswerText(text) {
+    return text?.replace(/(?<!\.)\.\s*$/u, "");
+}
 export async function answerTelegramCallbackQuery(botToken, callbackQueryId, text, options = {}) {
     try {
         await callTelegram(botToken, "answerCallbackQuery", text

package/dist/lib/threads.d.ts

@@ -252,7 +252,7 @@ export interface TelegramTemporaryThreadInput {
     journalBindingKey: string;
     updateIds: number[];
 }
-/** A strict journal observation of committed cancellation plus matching private retention. */
+/** Journal-owned donor discard evidence: retained manual cancellation or body-free chooser expiry, never recipient cancellation. */
 export interface TelegramTemporaryThreadCancellationEvidence {
     journalBindingKey: string;
     updateId: number;
@@ -266,7 +266,7 @@ export interface TelegramTemporaryThreadEntry {
     };
     /** Append-only known source groups. Missing legacy metadata never proves that the creation source was alone. */
     inputs?: TelegramTemporaryThreadInput[];
-    /** Whole known groups with positively observed cancellation; never proof that deletion may be issued. */
+    /** Whole known groups with positively observed donor cancellation or expiry; never recipient cancellation or deletion authority. */
     cancelledInputs?: TelegramTemporaryThreadInput[];
     /** Whole known groups whose Forward was positively completed by the journal owner; never deletion authority alone. */
     completedInputs?: TelegramTemporaryThreadInput[];
@@ -361,6 +361,8 @@ export interface TelegramWorkspaceRestore {
     recordTemporaryThreadForwardIssued(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority): TelegramTemporaryThreadEntry | undefined;
     recordTemporaryThreadInputCompletion(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority): TelegramTemporaryThreadEntry | undefined;
     recordTemporaryThreadInputCancellation(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority, inspect: (updateId: number) => TelegramTemporaryThreadCancellationEvidence | undefined): TelegramTemporaryThreadEntry | undefined;
+    /** Body-free chooser expiry may terminate an uncertain donor Forward/Restore, never accepted recipient work or a bound target. */
+    recordTemporaryThreadInputExpiry(expected: TelegramTemporaryThreadEntry, input: TelegramTemporaryThreadInput, authority: TelegramWorkspaceRestoreAuthority, inspect: (updateId: number) => TelegramTemporaryThreadCancellationEvidence | undefined): TelegramTemporaryThreadEntry | undefined;
     /** Caller holds profile admission and proves fresh source/protection clearance; publication grants one attempt, never retry. */
     issueTemporaryThreadCleanup(expected: TelegramTemporaryThreadEntry, authority: TelegramWorkspaceRestoreAuthority): {
         issued: true;
@@ -370,8 +372,8 @@ export interface TelegramWorkspaceRestore {
     /** `completed` names one newly completed group; every other known group must already be cancelled or completed. */
     retireTemporaryThread(expected: TelegramTemporaryThreadEntry, authority: TelegramWorkspaceRestoreAuthority, completed?: TelegramTemporaryThreadInput): TelegramTemporaryThreadEntry | undefined;
     /** New-world restart: atomically forgets this operator's Restore intents and temporary entries from previous runtime instances.
-     * Committed bindings stay; nothing is rolled back, replayed or deleted here. */
-    forgetPreviousWorld(authority: TelegramWorkspaceRestoreAuthority): {
+     * Caller may preserve exact unbound temporary tokens for clock-bearing sources. Committed bindings stay; nothing is rolled back, replayed or deleted here. */
+    forgetPreviousWorld(authority: TelegramWorkspaceRestoreAuthority, preserveTemporaryTokens?: readonly string[]): {
         operations: TelegramWorkspaceRestoreIntent[];
         temporaryThreads: TelegramTemporaryThreadEntry[];
     } | undefined;

package/dist/lib/threads.js

@@ -2750,6 +2750,47 @@ export function createTelegramTopicTargetStore(options) {
                     });
                     return recorded && current() ? recorded : undefined;
                 },
+                recordTemporaryThreadInputExpiry(expected, inputValue, authority, inspect) {
+                    const input = structuredClone(inputValue);
+                    if (!isTemporaryThreadInput(input) || typeof inspect !== "function")
+                        return undefined;
+                    const operator = authority.operatorUserId, executor = structuredClone(authority.executor);
+                    const bound = classifyTemporaryTarget(read(), expected).kind === "bound";
+                    const current = () => authority.isCurrent() && authority.operatorUserId === operator &&
+                        isDeepStrictEqual(authority.executor, executor) && input.updateIds.every(updateId => {
+                        const evidence = inspect(updateId);
+                        return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
+                            evidence.operatorAuthorityId === `telegram-owner:${operator}`;
+                    }) && authority.isCurrent();
+                    return advanceTemporary(expected, { ...authority, isCurrent: current }, (entry, file) => {
+                        if (entry.phase !== "created" || !getTelegramTemporaryThreadInputs(entry).some(value => isDeepStrictEqual(value, input)) ||
+                            entry.completedInputs?.some(value => isDeepStrictEqual(value, input)))
+                            return false;
+                        const cancelled = entry.cancelledInputs ?? [];
+                        if (cancelled.some(value => isDeepStrictEqual(value, input)))
+                            return "unchanged";
+                        const operations = file.operations.filter(({ request }) => request.source.journalBindingKey === input.journalBindingKey &&
+                            request.source.updateIds.some(id => input.updateIds.includes(id)));
+                        if (operations.some(({ request }) => !request.source.updateIds.every(id => input.updateIds.includes(id))))
+                            return false;
+                        // Forget only expired donor intent; canonical binding, recipient queue and immutable settlement proofs are untouched.
+                        file.operations = file.operations.filter(value => !operations.includes(value));
+                        // Once bound, this is no longer a disposable tab. Forget its temporary frame, not the binding or other journal sources.
+                        if (bound) {
+                            file.temporaryThreads = file.temporaryThreads?.filter(value => value !== entry);
+                            if (!file.temporaryThreads?.length)
+                                delete file.temporaryThreads;
+                            return true;
+                        }
+                        const forwarded = entry.forwardedInputs?.filter(value => !isDeepStrictEqual(value, input));
+                        if (forwarded?.length)
+                            entry.forwardedInputs = forwarded;
+                        else
+                            delete entry.forwardedInputs;
+                        entry.cancelledInputs = [...cancelled, input];
+                        return true;
+                    });
+                },
                 recordTemporaryThreadForwardIssued(expected, inputValue, authority) {
                     const input = structuredClone(inputValue);
                     if (!isTemporaryThreadInput(input))
@@ -2808,7 +2849,7 @@ export function createTelegramTopicTargetStore(options) {
                         return entry;
                     });
                 },
-                forgetPreviousWorld(authority) {
+                forgetPreviousWorld(authority, preserveTemporaryTokens = []) {
                     if (!authority.isCurrent())
                         return undefined;
                     const executor = structuredClone(authority.executor), operator = authority.operatorUserId;
@@ -2817,13 +2858,14 @@ export function createTelegramTopicTargetStore(options) {
                     const current = () => authority.isCurrent() && authority.operatorUserId === operator && isDeepStrictEqual(authority.executor, executor);
                     const previous = (value) => value.operatorUserId === operator && value.executor.instanceId !== executor.instanceId;
                     const before = storage.read(), file = structuredClone(before);
-                    const operations = file.operations.filter(previous), temporaryThreads = (file.temporaryThreads ?? []).filter(previous);
+                    const forgetTemporary = (value) => previous(value) && !preserveTemporaryTokens.includes(value.token);
+                    const operations = file.operations.filter(previous), temporaryThreads = (file.temporaryThreads ?? []).filter(forgetTemporary);
                     if (!current())
                         return undefined;
                     if (!operations.length && !temporaryThreads.length)
                         return { operations, temporaryThreads };
                     file.operations = file.operations.filter(value => !previous(value));
-                    const remaining = (file.temporaryThreads ?? []).filter(value => !previous(value));
+                    const remaining = (file.temporaryThreads ?? []).filter(value => !forgetTemporary(value));
                     if (remaining.length)
                         file.temporaryThreads = remaining;
                     else

package/dist/lib/updates.d.ts

@@ -6,7 +6,7 @@
 import { type TelegramTarget } from "./target.ts";
 import type { TelegramBusEnvelope, TelegramBusFollowerView, TelegramBusForwardOwnership, TelegramBusForeignUpdateSettlement, TelegramProcessLiveness } from "./bus.ts";
 import type { TelegramMessageOwnershipStore } from "./ownership.ts";
-import { TELEGRAM_UPDATE_JOURNAL_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, type TelegramUpdateJournalEntryDigest, type TelegramUpdateJournalSourceCompletion, type TelegramUpdateJournalQueuedCompletion, type TelegramUpdateJournalQueuedReceiptEvidence, type TelegramInputJournalReceipt, type TelegramInputJournalSourceReference, type TelegramInputJournalStore, type TelegramJournaledUpdate, type TelegramUpdateJournalDeadQueueOwnerRecoveryResult, type TelegramUpdateJournalAppendResult, type TelegramUpdateJournalInputClaim, type TelegramUpdateJournalOperatorDispositionInput, type TelegramUpdateJournalOperatorDispositionResult, type TelegramUpdateJournalPendingAbandonmentInput, type TelegramUpdateJournalPendingAbandonmentResult, type TelegramUpdateJournalPendingRetentionEvidence, type TelegramUpdateJournalEntry, type TelegramUpdateJournalRoutingInput, type TelegramRoutingInputJournal, type TelegramUpdateJournalQueueDiscardResult, type TelegramUpdateJournalQueueHandoffAcceptResult, type TelegramUpdateJournalQueueHandoffCancelResult, type TelegramUpdateJournalQueueHandoffInput, type TelegramUpdateJournalQueueHandoffOfferResult, type TelegramUpdateJournalQueueOwner, type TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
+import { TELEGRAM_UPDATE_JOURNAL_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, type TelegramUpdateJournalEntryDigest, type TelegramUpdateJournalSourceCompletion, type TelegramUpdateJournalQueuedCompletion, type TelegramUpdateJournalQueuedReceiptEvidence, type TelegramInputJournalReceipt, type TelegramInputJournalSourceReference, type TelegramInputJournalStore, type TelegramJournaledUpdate, type TelegramUpdateJournalDeadQueueOwnerRecoveryResult, type TelegramUpdateJournalAppendResult, type TelegramUpdateJournalInputClaim, type TelegramUpdateJournalOperatorDispositionInput, type TelegramUpdateJournalOperatorDispositionResult, type TelegramUpdateJournalPendingAbandonmentInput, type TelegramUpdateJournalPendingAbandonmentResult, type TelegramUpdateJournalPendingRetentionEvidence, type TelegramUpdateJournalEntry, type TelegramUpdateJournalRoutingInput, type TelegramRoutingInputJournal, type TelegramRoutingInputExpiryResult, type TelegramUpdateJournalQueueDiscardResult, type TelegramUpdateJournalQueueHandoffAcceptResult, type TelegramUpdateJournalQueueHandoffCancelResult, type TelegramUpdateJournalQueueHandoffInput, type TelegramUpdateJournalQueueHandoffOfferResult, type TelegramUpdateJournalQueueOwner, type TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
 import { type PendingTelegramControlItem, type TelegramControlQueueHandoffPayload, type TelegramQueueAdmissionReceipt, type TelegramQueueHandoffPayload, type TelegramQueueHandoffStageResult, type TelegramQueueReactionDisposition, type TelegramQueueHandoffStagingRuntime, type TelegramQueueItem } from "./queue.ts";
 import { type TelegramAuthorizationState, type TelegramUserPairingRuntimeDeps } from "./config.ts";
 export interface TelegramReactionTypeEmoji {
@@ -189,6 +189,8 @@ export interface TelegramHeldSourcePreparation<TContext> {
     /** Exact prepared worker owner, context, key and authority; the consumer adds its own domain fences. */
     isCurrent: () => boolean;
     signal: AbortSignal;
+    /** Chooser-clock sources that must survive cold spending until their fixed expiry. */
+    routingSourceIds?: readonly number[];
 }
 export interface TelegramDeferredAbandonmentRecoveryPage {
     sources: {
@@ -504,7 +506,7 @@ export interface TelegramRoutingInputExpirySource {
     original: TelegramUpdateJournalEntry;
     journalBindingKey: string;
     isCurrent(): boolean;
-    expire(): TelegramUpdateJournalPendingAbandonmentResult | undefined;
+    expire(): TelegramRoutingInputExpiryResult | undefined;
 }
 export interface TelegramUpdateWorkerJournalPort {
     routingInputs?: TelegramRoutingInputJournal;
@@ -585,7 +587,7 @@ export interface TelegramUpdateWorkerRuntimeDeps<TContext> {
     getRecipientBindingKey?: () => string | undefined;
     /** True selects legacy historical review/spending; retain protects unsupported originals without disposition authority. */
     shouldReviewHistoricalInput?: (entry: TelegramUpdateJournalEntry, ctx: TContext, signal: AbortSignal) => boolean | "retain" | Promise<boolean | "retain">;
-    /** New-world restart: spend previous-process routing inputs (classified or armed) without delivery, copy or completion observers. Interrupted private abandonment keeps its own exact recovery. */
+    /** New-world restart: spend unclocked classified routing input without delivery, copy or completion. Chooser clocks wait for expiry; interrupted private abandonment keeps exact recovery. */
     spendHistoricalInput?: boolean;
     /** Holds protected live or retry sources before execution; never cancels or disposes them. */
     shouldHoldPendingInput?: (entry: TelegramUpdateJournalEntry, ctx: TContext, signal: AbortSignal) => boolean | Promise<boolean>;
@@ -633,6 +635,10 @@ export interface TelegramUpdateWorkerRuntime<TContext> {
         operatorUserId: number;
         sourceUpdateIds: readonly number[];
     }) => boolean;
+    isRoutingInputCurrent?: (input: {
+        updateId: number;
+        signal: AbortSignal;
+    }) => boolean;
     supportsDeferredAbandonment?: (input: {
         updateId: number;
         signal: AbortSignal;
@@ -744,6 +750,7 @@ export interface TelegramUpdateAdmissionHandleDeps<TUpdate extends TelegramUpdat
     abandonDeferred?: TelegramUpdateWorkerRuntime<TContext>["abandonDeferred"];
     armRoutingInput?: TelegramUpdateWorkerRuntime<TContext>["armRoutingInput"];
     selectRoutingInput?: TelegramUpdateWorkerRuntime<TContext>["selectRoutingInput"];
+    isRoutingInputCurrent?: TelegramUpdateWorkerRuntime<TContext>["isRoutingInputCurrent"];
     supportsDeferredAbandonment?: TelegramUpdateWorkerRuntime<TContext>["supportsDeferredAbandonment"];
     inspectAbandoning?: TelegramUpdateWorkerRuntime<TContext>["inspectAbandoning"];
     inspectHistorical?: TelegramUpdateWorkerRuntime<TContext>["inspectHistorical"];
@@ -1135,7 +1142,7 @@ export declare function executeTelegramCustodiedInput(input: {
 export declare function createTelegramUpdateAdmissionHandle<TUpdate extends TelegramUpdateFlow & {
     update_id: number;
 }, TContext>(deps: TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>): (update: TUpdate, ctx: TContext, signal: AbortSignal) => Promise<TelegramUpdateAdmissionOutcome>;
-export declare function createTelegramCustodiedUpdateAdmissionHandle<TUpdate extends TelegramJournaledUpdate & TelegramUpdateFlow, TContext>(deps: Omit<TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>, "onLateOutcome" | "onLateOutcomeError" | "abandonDeferred" | "armRoutingInput" | "selectRoutingInput" | "supportsDeferredAbandonment" | "inspectAbandoning" | "inspectHistorical" | "inspectDeferredSource" | "isHistoricalSource"> & {
+export declare function createTelegramCustodiedUpdateAdmissionHandle<TUpdate extends TelegramJournaledUpdate & TelegramUpdateFlow, TContext>(deps: Omit<TelegramUpdateAdmissionHandleDeps<TUpdate, TContext>, "onLateOutcome" | "onLateOutcomeError" | "abandonDeferred" | "armRoutingInput" | "selectRoutingInput" | "isRoutingInputCurrent" | "supportsDeferredAbandonment" | "inspectAbandoning" | "inspectHistorical" | "inspectDeferredSource" | "isHistoricalSource"> & {
     journal: TelegramCustodyExecutionJournal;
     recipientBindingKey: string;
     onLateOutcomeError(error: unknown, updateId: number): void;