@llblab/pi-telegram 0.52.0 → 0.52.2

package/lib/locks.ts

@@ -1489,6 +1489,8 @@ export interface TelegramLockedPollingRuntime<
     options?: TelegramLockedPollingStartOptions,
   ) => Promise<TelegramLockedPollingStartResult>;
   stop: () => Promise<string>;
+  /** Capture one disconnect attempt before cleanup awaits; a newer start revokes it. */
+  captureStop: () => { isCurrent: () => boolean; stop: () => Promise<string> };
   suspend: () => Promise<void>;
   isSuspended: () => boolean;
   /** Fence one owned polling generation; suspension, restart, conflict or lock loss revokes it. */
@@ -1582,6 +1584,7 @@ export function createTelegramLockedPollingRuntime<
       stopOwnershipWatcher();
       if (sessionAutoStartRun) {
         await sessionAutoStartRun;
+        if (generation !== pollingGeneration) return;
         deps.stopFollowerRegistration?.();
       }
       if (ownershipStop) {
@@ -1687,6 +1690,20 @@ export function createTelegramLockedPollingRuntime<
   const formatStartBlockedMessage = (ctx: TContext): string =>
     deps.formatStartBlockedMessage?.(ctx) ??
     "Telegram polling is unavailable in this Pi run mode.";
+  const stop = async (): Promise<string> => {
+    const generation = pollingGeneration + 1;
+    await suspendPolling();
+    if (generation !== pollingGeneration) throw new Error("Telegram disconnect was superseded by a new connection.");
+    const state = deps.lock.release();
+    deps.onTransportAvailabilityChanged?.();
+    if (state.kind === "active-elsewhere") {
+      return `Telegram bridge is active in another Pi instance (${formatTelegramLockEntry(state.lock)}).`;
+    }
+    if (state.kind === "stale") {
+      return `Removed stale Telegram bridge lock (${formatTelegramLockEntry(state.lock)}).`;
+    }
+    return "Telegram bridge disconnected.";
+  };
   return {
     start: async (ctx, options = {}) => {
       if (!deps.hasBotToken()) {
@@ -1798,17 +1815,17 @@ export function createTelegramLockedPollingRuntime<
       const staleSuffix = acquired.replacedStale ? " Replaced stale lock." : "";
       return { ok: true, message: `Telegram bridge connected.${staleSuffix}` };
     },
-    stop: async () => {
-      await suspendPolling();
-      const state = deps.lock.release();
-      deps.onTransportAvailabilityChanged?.();
-      if (state.kind === "active-elsewhere") {
-        return `Telegram bridge is active in another Pi instance (${formatTelegramLockEntry(state.lock)}).`;
-      }
-      if (state.kind === "stale") {
-        return `Removed stale Telegram bridge lock (${formatTelegramLockEntry(state.lock)}).`;
-      }
-      return "Telegram bridge disconnected.";
+    stop,
+    captureStop() {
+      const generation = pollingGeneration;
+      const isCurrent = () => generation === pollingGeneration;
+      return {
+        isCurrent,
+        async stop() {
+          if (!isCurrent()) throw new Error("Telegram disconnect was superseded by a new connection.");
+          return stop();
+        },
+      };
     },
     suspend: suspendPolling,
     captureTransportAuthority(ctx) {

package/lib/polling.ts

@@ -25,7 +25,8 @@ export const TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT = 10;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_LIMIT = 3;
 const TELEGRAM_GET_UPDATES_CONFLICT_FAST_RETRY_MS = 1_000;
 const TELEGRAM_GET_UPDATES_CONFLICT_SLOW_RETRY_MS = 3_000;
-const TELEGRAM_POLLING_RETRY_MS = 3_000;
+const TELEGRAM_POLLING_RETRY_BASE_MS = 1_000;
+const TELEGRAM_POLLING_RETRY_MAX_MS = 30_000;
 const TELEGRAM_GET_UPDATES_GRACE_MS = 10_000;
 
 // Standard Telegram DM polling does not expose ordinary message-deletion events.
@@ -79,6 +80,17 @@ export class TelegramPersistentGetUpdatesConflictError extends Error {
   }
 }
 
+/** Exponential backoff for non-conflict polling/admission failures. */
+export function getTelegramPollingRetryDelayMs(
+  consecutiveFailures: number,
+): number {
+  const exponent = Math.max(0, Math.min(consecutiveFailures - 1, 16));
+  return Math.min(
+    TELEGRAM_POLLING_RETRY_BASE_MS * 2 ** exponent,
+    TELEGRAM_POLLING_RETRY_MAX_MS,
+  );
+}
+
 export class TelegramGetUpdatesTimeoutError extends Error {
   readonly timeoutMs: number;
 
@@ -1709,6 +1721,7 @@ export async function runTelegramPollLoop<
 >(deps: TelegramPollLoopDeps<TUpdate, TContext>): Promise<void> {
   if (!deps.config.botToken) return;
   let consecutiveGetUpdatesConflicts = 0;
+  let consecutiveFailures = 0;
   const retryConflict = async () => {
     consecutiveGetUpdatesConflicts += 1;
     if (consecutiveGetUpdatesConflicts >= TELEGRAM_GET_UPDATES_CONFLICT_STOP_LIMIT) {
@@ -1791,6 +1804,7 @@ export async function runTelegramPollLoop<
         onPhaseChange: deps.onPhaseChange,
         recordRuntimeEvent: deps.recordRuntimeEvent,
       });
+      consecutiveFailures = 0;
       currentUpdateId = undefined;
     } catch (error) {
       if (shouldStopTelegramPolling(deps.signal.aborted, error)) return;
@@ -1809,8 +1823,13 @@ export async function runTelegramPollLoop<
           : {}),
       });
       consecutiveGetUpdatesConflicts = 0;
+      consecutiveFailures += 1;
       deps.onErrorStatus(getTelegramPollingErrorMessage(error));
-      await deps.sleep(TELEGRAM_POLLING_RETRY_MS, deps.signal);
+      // Cap the pause, not retry count: outages must recover without manual reconnect.
+      await deps.sleep(
+        getTelegramPollingRetryDelayMs(consecutiveFailures),
+        deps.signal,
+      );
       if (deps.signal.aborted) return;
       deps.onStatusReset();
     }

package/lib/queue.ts

@@ -1028,7 +1028,7 @@ export function applyTelegramQueuePromptReactionDisposition<
   let nextItems = items;
   for (const [index, item] of items.entries()) {
     if (
-      !isPendingTelegramTurn(item) ||
+      !isPendingTelegramTurn(item) || item.queueLane === "control" ||
       !isTelegramQueueItemInMessageScope(item, scope) ||
       !item.sourceMessageIds.includes(messageId)
     ) {
@@ -2405,6 +2405,7 @@ export interface TelegramQueueMutationRuntimeDeps<
   TContext,
 > extends TelegramQueueStore<TContext>, TelegramRuntimeEventRecorderPort {
   ctx: TContext;
+  hasPendingDispatch?: () => boolean;
   allocateLaneOrder?: () => number;
   onItemsDiscarded?: (
     items: readonly TelegramQueueItem<TContext>[],
@@ -2416,6 +2417,7 @@ export interface TelegramQueueMutationRuntimeDeps<
 export interface TelegramQueueMutationControllerDeps<
   TContext,
 > extends TelegramQueueStore<TContext>, TelegramRuntimeEventRecorderPort {
+  hasPendingDispatch?: () => boolean;
   allocateLaneOrder?: () => number;
   onItemsDiscarded?: (
     items: readonly TelegramQueueItem<TContext>[],
@@ -2739,7 +2741,14 @@ function commitReorderedTelegramQueueItemsRuntime<TContext>(
   items: TelegramQueueItem<TContext>[],
   deps: TelegramQueueMutationRuntimeDeps<TContext>,
 ): void {
-  deps.setQueuedItems([...items].sort(compareTelegramQueueItems));
+  const pendingHead = deps.hasPendingDispatch?.() ? deps.getQueuedItems()[0] : undefined;
+  const ordered = [...items].sort(compareTelegramQueueItems);
+  if (pendingHead) {
+    const index = ordered.findIndex(item => item.queueOrder === pendingHead.queueOrder && item.kind === pendingHead.kind &&
+      item.chatId === pendingHead.chatId && item.replyToMessageId === pendingHead.replyToMessageId);
+    if (index > 0) ordered.unshift(ordered.splice(index, 1)[0]!);
+  }
+  deps.setQueuedItems(ordered);
   updateTelegramQueueStatusRuntime(deps);
 }
 
@@ -2817,9 +2826,23 @@ export function applyTelegramQueuePromptReactionDispositionRuntime<TContext>(
   scope?: TelegramQueueMessageScope,
 ): boolean {
   const queuedItems = deps.getQueuedItems();
+  const suppression = disposition.kind === "reaction-transition" ? disposition.suppressionEmoji :
+    disposition.kind === "suppressed" ? disposition.emoji : disposition.kind === "priority-suppressed" ? disposition.suppressionEmoji : undefined;
+  // Source-addressed control-lane prompts are explicit continuations. Synthetic model-switch turns have no source IDs.
+  // A Pi-owned dispatched head cannot be removed: agent_start must consume that exact item, not its successor.
+  const cancelled = suppression && deps.hasPendingDispatch ? queuedItems.filter((item, index) =>
+    isPendingTelegramTurn(item) && item.queueLane === "control" && isTelegramQueueItemInMessageScope(item, scope) &&
+    item.sourceMessageIds.includes(messageId) && !(index === 0 && deps.hasPendingDispatch!())) : [];
+  if (cancelled.length) {
+    if (cancelled.some(item => (item.admissionReceipts?.length ?? 0) > 0) && !deps.onItemsDiscarded) return false;
+    deps.onItemsDiscarded?.(cancelled, deps.ctx);
+    deps.setQueuedItems(queuedItems.filter(item => !cancelled.includes(item)));
+    updateTelegramQueueStatusRuntime(deps);
+    return true;
+  }
   const changesLane = queuedItems.some((item) => {
     if (
-      !isPendingTelegramTurn(item) ||
+      !isPendingTelegramTurn(item) || item.queueLane === "control" ||
       !isTelegramQueueItemInMessageScope(item, scope) ||
       !item.sourceMessageIds.includes(messageId)
     ) {

package/lib/routing.ts

@@ -289,6 +289,7 @@ function formatTelegramTemporaryThreadChooserText(command?: string): string {
     "<b>🧵 Choose target thread:</b>",
     "",
     command ? `You used <code>/${escapeHtml(command)}</code> from the <b>All</b> tab.` : "Choose where to send your message.",
+    "Unaccepted routing expires after 60 minutes; disposable tabs are removed when clear. Accepted work and restored Threads are kept.",
     "Select the Pi thread that should handle it, or restore a Pi into this tab:",
   ].join("\n");
 }
@@ -674,6 +675,7 @@ export interface TelegramInboundRouteRuntimeDeps<
   captureWorkspaceExternalProtection?: ReturnType<typeof createTelegramWorkspaceExternalProtectionCapture>;
   /** Strict committed abandonment plus retained original; shared by Restore and temporary-input cancellation. */
   inspectRestoreSourceAbandonment?: (updateId: number, journalBindingKey: string) => Threads.TelegramTemporaryThreadCancellationEvidence | undefined;
+  inspectRoutingInputGroupExpiry?: (input: Threads.TelegramTemporaryThreadInput) => readonly Threads.TelegramTemporaryThreadCancellationEvidence[] | undefined;
   /** Strict active-journal observation only; a hint or missing source never substitutes for this ACK. */
   inspectRestoreSourceCompletion?: (expected: Updates.TelegramDeferredSourceEvidence & { completionSha256: string }) =>
     (Updates.TelegramDeferredSourceEvidence & { completionSha256: string }) | undefined;
@@ -2363,22 +2365,45 @@ export function createTelegramInboundRouteRuntime<
    * absence of chooser and journal custody, and the ordinary protection checks must all hold again. The attempt is
    * durably issued once; a skipped or unknown removal keeps the entry protecting the tab across restart.
    */
-  const runTemporaryThreadCleanup = async (token: string, cap: TemporaryThreadAuthority): Promise<void> => {
-    const store = cap.store, inspect = deps.inspectRestoreSourceAbandonment;
-    if (!inspect || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent()) return;
+  const runTemporaryThreadCleanup = async (token: string, cap: TemporaryThreadAuthority, reconcileExpiry: boolean): Promise<void> => {
+    const store = cap.store;
+    if ((!deps.inspectRestoreSourceAbandonment && !deps.inspectRoutingInputGroupExpiry) || !deps.runWorkspaceOperation || !deps.callApi || !cap.isCurrent()) return;
     await deps.runWorkspaceOperation({ operationId: `temporary-thread-cleanup-${randomBytes(16).toString("hex")}`,
       operationKind: "workspace.temporary-thread", scopes: [{ kind: "profile" }] }, async () => {
       if (!cap.isCurrent()) return;
       let entry = store.listTemporaryThreads().find(value => value.token === token && value.phase === "created" && !!value.target);
       const target = entry?.target;
-      if (!entry || !target || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target) ||
-          entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
-      const owner = `telegram-owner:${cap.operatorUserId}`, cancelled = entry.cancelledInputs ?? [];
-      const cancelledCurrent = () => cancelled.every(input => input.updateIds.every(updateId => {
-        const evidence = inspect(updateId, input.journalBindingKey);
-        return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId &&
-          evidence.operatorAuthorityId === owner;
-      }));
+      if (!entry || !target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+          entry.source.journalBindingKey !== cap.journalBindingKey) return;
+      const owner = `telegram-owner:${cap.operatorUserId}`;
+      if (reconcileExpiry && deps.inspectRoutingInputGroupExpiry) {
+        for (const group of Threads.getTelegramTemporaryThreadInputs(entry)) {
+          if ([...(entry.cancelledInputs ?? []), ...(entry.completedInputs ?? [])].some(value => isDeepStrictEqual(value, group))) continue;
+          const inspect = (id: number) => deps.inspectRoutingInputGroupExpiry!(group)?.find(value => value.updateId === id);
+          if (!group.updateIds.every(id => inspect(id)?.operatorAuthorityId === owner)) continue;
+          entry = cap.adopt(entry);
+          if (!entry || !cap.isCurrent()) return;
+          let recorded: Threads.TelegramTemporaryThreadEntry | undefined, failure: unknown;
+          try { recorded = store.recordTemporaryThreadInputExpiry(entry, group, cap.authority, inspect); }
+          catch (error) { failure = error; }
+          if (!cap.isCurrent()) return;
+          const retained = store.listTemporaryThreads().find(value => value.token === token);
+          // A lost publication ACK may already have recorded the group or retired a bound tab's temporary frame.
+          if (!retained) return;
+          if (!recorded && !retained.cancelledInputs?.some(value => isDeepStrictEqual(value, group)))
+            throw failure ?? new Error("Chooser expiry metadata was not confirmed.");
+          entry = retained;
+        }
+      }
+      if (!Threads.isTelegramTemporaryThreadFullyResolved(entry) || hasPendingRerouteForTarget(target)) return;
+      const cancelled = entry.cancelledInputs ?? [];
+      const cancelledCurrent = () => cancelled.every(input => {
+        const expiry = deps.inspectRoutingInputGroupExpiry?.(input);
+        return input.updateIds.every(updateId => {
+          const evidence = deps.inspectRestoreSourceAbandonment?.(updateId, input.journalBindingKey) ?? expiry?.find(value => value.updateId === updateId);
+          return evidence?.journalBindingKey === input.journalBindingKey && evidence.updateId === updateId && evidence.operatorAuthorityId === owner;
+        });
+      });
       if (!cancelledCurrent()) return;
       entry = cap.adopt(entry);
       if (!entry || !cap.isCurrent() || isRerouteTargetProtected(target, undefined, entry)) return;
@@ -2394,33 +2419,49 @@ export function createTelegramInboundRouteRuntime<
       store.retireTemporaryThread(entry, cap.authority);
     });
   };
-  /** Starts the quiet period only when every known group is resolved; a new input or authority change denies it. */
-  const scheduleTemporaryThreadCleanup = (target: Queue.TelegramQueueTarget, ctx: TContext): void => {
-    const cap = captureTemporaryThreadAuthority(ctx);
-    if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target)) return;
-    let entry: Threads.TelegramTemporaryThreadEntry | undefined;
-    try { entry = cap.store.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target)); }
-    catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
-    if (!entry || entry.cleanupIssued || !Threads.isTelegramTemporaryThreadFullyResolved(entry) ||
-        entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
-    const token = entry.token;
+  // Reuse the one timer per tab for body-free metadata retries. Future retry timers do not join settlement waits;
+  // only their running attempt does. No retry is licensed once a destructive grant may have been issued.
+  const queueTemporaryThreadCleanup = (token: string, cap: TemporaryThreadAuthority, delay: number, reconcileExpiry: boolean, retry = false): void => {
     cancelTemporaryThreadCleanup(token);
-    const requested = deps.temporaryThreadCleanupDelayMs;
-    const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
     let settle = (): void => undefined;
     const task = new Promise<void>(resolve => { settle = resolve; });
     const timer = setTimeout(() => {
       if (temporaryCleanupTimers.get(token)?.timer !== timer) return;
       temporaryCleanupTimers.delete(token);
-      runTemporaryThreadCleanup(token, cap)
-        .catch(error => { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" }); })
+      if (retry) restoreSettlementTasks.add(task);
+      runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+        .catch(error => {
+          deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup" });
+          if (!reconcileExpiry || !cap.isCurrent()) return;
+          try {
+            const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+            if (retained && !retained.cleanupIssued && cap.isCurrent()) queueTemporaryThreadCleanup(token, cap, 60_000, true, true);
+          } catch { /* Unknown grant state never licenses a retry. */ }
+        })
         .finally(settle);
     }, delay);
     timer.unref?.();
     temporaryCleanupTimers.set(token, { timer, settle });
-    restoreSettlementTasks.add(task);
+    if (!retry) restoreSettlementTasks.add(task);
     void task.finally(() => restoreSettlementTasks.delete(task));
   };
+  /** Starts the quiet period for resolved groups or body-free expiry reconciliation; fresh input/authority revokes it. */
+  const scheduleTemporaryThreadCleanup = (target: Queue.TelegramQueueTarget, ctx: TContext, reconcileExpiry = false): void => {
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!cap || !deps.runWorkspaceOperation || target.threadId === undefined || hasPendingRerouteForTarget(target)) return;
+    let entry: Threads.TelegramTemporaryThreadEntry | undefined;
+    try { entry = cap.store.listTemporaryThreads().find(value => value.phase === "created" && isDeepStrictEqual(value.target, target)); }
+    catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
+    if (!entry || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId || entry.source.journalBindingKey !== cap.journalBindingKey) return;
+    if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) {
+      try { reconcileExpiry = Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)); }
+      catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-schedule" }); return; }
+    }
+    if (!reconcileExpiry && !Threads.isTelegramTemporaryThreadFullyResolved(entry)) return;
+    const requested = deps.temporaryThreadCleanupDelayMs;
+    const delay = typeof requested === "number" && Number.isFinite(requested) ? Math.max(0, requested) : 1000;
+    queueTemporaryThreadCleanup(entry.token, cap, delay, reconcileExpiry);
+  };
   const recordCancelledTemporaryThreadInput = (pending: PendingUnboundReroute, ctx: TContext, isCurrent: () => boolean): boolean => {
     const store = deps.getWorkspaceRestoreStore?.(), target = pending.sourceTarget;
     if (!store || target.threadId === undefined) return !pending.temporaryThread;
@@ -2490,10 +2531,15 @@ export function createTelegramInboundRouteRuntime<
         await threads.load();
         if (!cap.isCurrent()) return;
         const self = cap.authority.executor.instanceId;
-        const disposable = cap.store.listTemporaryThreads().flatMap(entry => entry.operatorUserId === cap.operatorUserId &&
+        const entries = cap.store.listTemporaryThreads();
+        const preserved = entries.filter(entry => entry.operatorUserId === cap.operatorUserId && entry.phase === "created" &&
+          cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" &&
+          Threads.getTelegramTemporaryThreadInputs(entry).some(source => source.journalBindingKey === journalBindingKey &&
+            source.updateIds.some(id => input.routingSourceIds?.includes(id)))).map(entry => entry.token);
+        const disposable = entries.flatMap(entry => entry.operatorUserId === cap.operatorUserId && !preserved.includes(entry.token) &&
           entry.executor.instanceId !== self && entry.phase === "created" && entry.target &&
           cap.store.inspectTemporaryThreadTarget(entry, cap.authority)?.kind === "temporary" ? [entry] : []);
-        const forgotten = cap.store.forgetPreviousWorld(cap.authority);
+        const forgotten = cap.store.forgetPreviousWorld(cap.authority, preserved);
         if (!forgotten) return;
         result.forgotten = forgotten.operations.length + forgotten.temporaryThreads.length;
         for (const entry of disposable) {
@@ -2514,6 +2560,15 @@ export function createTelegramInboundRouteRuntime<
               { maxAttempts: 1, retrySafety: "non-idempotent" }) === true) result.deleted++;
           } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-tab-delete" }); }
         }
+        // Same-instance session replacement may have lost a metadata-only timer after the source was already spent.
+        // Reconstruct from retained tab/source proof under fresh authority, never from a prompt body or an issued delete.
+        for (const entry of cap.store.listTemporaryThreads()) {
+          if (!cap.isCurrent()) break;
+          if (entry.phase !== "created" || !entry.target || entry.cleanupIssued || entry.operatorUserId !== cap.operatorUserId ||
+              entry.source.journalBindingKey !== journalBindingKey) continue;
+          if (Threads.getTelegramTemporaryThreadInputs(entry).some(group => !!deps.inspectRoutingInputGroupExpiry?.(group)))
+            scheduleTemporaryThreadCleanup(entry.target, ctx, true);
+        }
       });
     } catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "new-world-forget" }); }
     return result;
@@ -2585,25 +2640,22 @@ export function createTelegramInboundRouteRuntime<
   const expireRoutingInput = async (source: Updates.TelegramRoutingInputExpirySource, ctx: TContext, signal: AbortSignal): Promise<void> => {
     const operator = deps.configStore.getAllowedUserId(), epoch = deps.getCurrentLeaderEpoch?.();
     const message = source.original.update.message as Partial<TMessage> | undefined;
-    const current = () => !signal.aborted && source.isCurrent() && operator !== undefined && epoch !== undefined &&
+    const runtimeCurrent = () => !signal.aborted && operator !== undefined && epoch !== undefined &&
       deps.isContextActive?.(ctx) === true && deps.configStore.getAllowedUserId() === operator &&
       deps.getCurrentLeaderEpoch?.() === epoch && deps.getAdmissionJournalBinding?.() === source.journalBindingKey &&
       source.original.routingInput?.operatorUserId === operator && message?.from?.id === operator && message.from.is_bot !== true && message.chat?.type === "private";
+    const current = () => runtimeCurrent() && source.isCurrent();
     if (!current() || !deps.runWorkspaceOperation) return;
     await deps.runWorkspaceOperation({ operationId: `routing-expiry-${randomBytes(16).toString("hex")}`,
       operationKind: "workspace.expire-unbound-routing", scopes: [{ kind: "profile" }] }, async () => {
       if (!current()) return;
       const restores = deps.getWorkspaceRestoreStore?.();
       if (deps.getWorkspaceRestoreStore && !restores) return;
-      if (restores?.list().some(intent => intent.request.source.journalBindingKey === source.journalBindingKey &&
-          intent.request.source.updateIds.includes(source.original.updateId))) return;
-      for (const pending of pendingUnboundReroutes.values()) {
-        if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId)) continue;
-        if (pending.selectionAttempted || pending.destinationSelected || pending.dispatching || pending.foreignForwardIssued || pending.workspaceRestore || pending.foreignRetry || pending.cleanup || pending.abandonment?.running) return;
-      }
+      const temporary = restores?.listTemporaryThreads().find(entry => Threads.getTelegramTemporaryThreadInputs(entry).some(input =>
+        input.journalBindingKey === source.journalBindingKey && input.updateIds.includes(source.original.updateId)));
       const result = source.expire();
       if (!result) return;
-      // Retire local controls after the source ACK. Telegram UI failure cannot undo retention or trigger deletion.
+      // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
       for (const [id, pending] of pendingUnboundReroutes) {
         if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId)) continue;
         removePendingReroute(id);
@@ -2615,6 +2667,9 @@ export function createTelegramInboundRouteRuntime<
           catch (error) { deps.recordRuntimeEvent?.("routing", error, { phase: "routing-input-expiry-view" }); }
         }
       }
+      // The scheduled stage captures only context/epoch and a tab token. It reconstructs disposition from body-free proof,
+      // never closes over this source or asks the worker to retain a terminal prompt while metadata publication fails.
+      if (temporary?.target && runtimeCurrent()) scheduleTemporaryThreadCleanup(temporary.target, ctx, true);
     });
   };
   const renderCancellationReview = async (view: CancellationReview, isCurrent: () => boolean): Promise<void> => {

package/lib/sync.ts

@@ -176,6 +176,7 @@ export interface TelegramManualThreadDisconnectDeps<TSyncState> {
   ) => void;
   runWorkspaceOperation: TelegramSyncWorkspaceOperationRunner;
   workspaceOperationKind?: string;
+  isDisconnectCurrent?: () => boolean;
   getNowMs?: () => number;
 }
 
@@ -270,15 +271,44 @@ export function createTelegramThreadDisconnectAssembly<
 >(
   deps: Omit<TelegramManualThreadDisconnectDeps<TSyncState>, "stopPolling"> & {
     stopPolling: () => Promise<string>;
+    captureStopPolling?: () => { isCurrent: () => boolean; stop: () => Promise<string> };
     suspendPolling: () => Promise<void>;
   },
 ): TelegramThreadDisconnectAssembly {
   return {
-    disconnect: createTelegramManualThreadDisconnectHandler({
-      ...deps,
-      workspaceOperationKind: "workspace.disconnect-thread",
-      stopPolling: deps.stopPolling,
-    }),
+    async disconnect() {
+      const captured = deps.captureStopPolling?.();
+      const stop = captured?.stop ?? deps.stopPolling;
+      let stopAttempted = false;
+      const disconnect = createTelegramManualThreadDisconnectHandler({
+        ...deps,
+        workspaceOperationKind: "workspace.disconnect-thread",
+        isDisconnectCurrent: captured?.isCurrent ?? deps.isDisconnectCurrent,
+        stopPolling() {
+          stopAttempted = true;
+          return stop();
+        },
+      });
+      try {
+        return await disconnect();
+      } catch (error) {
+        // Never retry a stop whose teardown/release outcome may already have committed.
+        if (stopAttempted) {
+          deps.recordRuntimeEvent("connection", error, { phase: "disconnect-stop" });
+          throw error;
+        }
+        deps.recordRuntimeEvent("connection", error, { phase: "disconnect-cleanup" });
+        let stopped: string;
+        try {
+          stopped = await stop();
+        } catch (stopError) {
+          deps.recordRuntimeEvent("connection", stopError, { phase: "disconnect-stop" });
+          throw stopError;
+        }
+        const separator = /[.!?]$/u.test(stopped) ? " " : ". ";
+        return `${stopped}${separator}Thread cleanup was not confirmed. Check /telegram-status --debug.`;
+      }
+    },
     cleanupForSessionRestart:
       createTelegramSessionRestartThreadCleanupHandler({
         ...deps,
@@ -290,7 +320,11 @@ export function createTelegramThreadDisconnectAssembly<
 export function createTelegramManualThreadDisconnectHandler<
   TSyncState extends TelegramSyncState,
 >(deps: TelegramManualThreadDisconnectDeps<TSyncState>): () => Promise<string> {
+  const assertCurrent = () => {
+    if (deps.isDisconnectCurrent?.() === false) throw new Error("Telegram disconnect was superseded by a new connection.");
+  };
   const operation = async (): Promise<string> => {
+    assertCurrent();
     const currentRecord = deps.getCurrentThreadRecord();
     let cleanupPending = false;
     if (currentRecord?.target.threadId) {
@@ -302,6 +336,7 @@ export function createTelegramManualThreadDisconnectHandler<
       if (isManualFollower && !ownsLeader) {
         if (deps.disconnectFollowerThread) {
           const disconnected = await deps.disconnectFollowerThread();
+          assertCurrent();
           if (!disconnected) {
             throw new Error(
               "Telegram follower thread deletion requires a live leader registration.",
@@ -329,6 +364,7 @@ export function createTelegramManualThreadDisconnectHandler<
         const isCleanupTargetProtected = createTelegramCleanupTargetProtection(deps.topicTargetStore, departingRecord);
         deps.topicTargetStore.upsertPendingCleanup(intent);
         await deps.topicTargetStore.persist();
+        assertCurrent();
         const cleanupPlan = ThreadReconciler.planThreadReconciliation({
           nowMs: (deps.getNowMs ?? Date.now)(),
           currentLeaderEpoch: leaderEpoch,
@@ -340,9 +376,11 @@ export function createTelegramManualThreadDisconnectHandler<
           {
             isCleanupTargetProtected,
             callApi(method, body) {
+              assertCurrent();
               return deps.callApi(method, body);
             },
             markStaleByTarget(targetToMark, syncStatus, lastSyncError) {
+              assertCurrent();
               return deps.topicTargetStore.markStaleByTarget(
                 targetToMark,
                 syncStatus,
@@ -350,15 +388,18 @@ export function createTelegramManualThreadDisconnectHandler<
               );
             },
             removeCleanupIntentById(id) {
+              assertCurrent();
               return deps.topicTargetStore.removePendingCleanup(id);
             },
             persist() {
+              assertCurrent();
               return deps.topicTargetStore.persist();
             },
             getCurrentLeaderEpoch: deps.getCurrentLeaderEpoch,
             recordRuntimeEvent: deps.recordRuntimeEvent,
           },
         );
+        assertCurrent();
         if (cleanupPlan.actions.some((action) => isCleanupTargetProtected(action.target, action))) {
           return "Thread disconnect superseded by a new binding.";
         }
@@ -378,6 +419,7 @@ export function createTelegramManualThreadDisconnectHandler<
         }) as TSyncState,
       );
     }
+    assertCurrent();
     const stopped = await deps.stopPolling();
     return cleanupPending
       ? `${stopped} Telegram thread cleanup remains pending for the next leader.`

package/lib/telegram-api.ts

@@ -38,6 +38,7 @@ function getTelegramApiTempDir(): string {
   return resolveTelegramAttachmentsDir();
 }
 const TELEGRAM_TEMP_FILE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+const TELEGRAM_DOWNLOAD_RENAME_MAX_ATTEMPTS = 6;
 const activeTelegramApiWorkspaceAdmissionOperationIds = new Set<string>();
 const TELEGRAM_INBOUND_FILE_MAX_BYTES = getTelegramInboundFileByteLimitFromEnv(
   process.env,
@@ -1106,6 +1107,25 @@ async function writeTelegramDownloadResponse(
   );
 }
 
+async function publishTelegramDownload(
+  partPath: string,
+  targetPath: string,
+  signal?: AbortSignal,
+): Promise<void> {
+  for (let attempt = 0; ; attempt++) {
+    throwIfTelegramApiCallAborted(signal);
+    try {
+      await rename(partPath, targetPath);
+      return;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException | undefined)?.code;
+      // Windows may briefly deny replacement while another publisher/scanner holds the file.
+      if (process.platform !== "win32" || (code !== "EPERM" && code !== "EACCES") || attempt + 1 >= TELEGRAM_DOWNLOAD_RENAME_MAX_ATTEMPTS) throw error;
+      await sleepTelegramRetry(50 * 2 ** attempt, signal);
+    }
+  }
+}
+
 async function removeTelegramPartialDownload(path: string): Promise<void> {
   try {
     await unlink(path);
@@ -1693,7 +1713,7 @@ export async function downloadTelegramFile(
       partPath,
       options?.maxFileSizeBytes,
     );
-    await rename(partPath, targetPath);
+    await publishTelegramDownload(partPath, targetPath, options?.signal);
   } catch (error) {
     await removeTelegramPartialDownload(partPath);
     throw error;
@@ -1701,6 +1721,11 @@ export async function downloadTelegramFile(
   return targetPath;
 }
 
+/** Tooltip-like callback answers omit a terminal sentence period; ellipses and other punctuation stay literal. */
+export function formatTelegramCallbackAnswerText(text: string | undefined): string | undefined {
+  return text?.replace(/(?<!\.)\.\s*$/u, "");
+}
+
 export async function answerTelegramCallbackQuery(
   botToken: string | undefined,
   callbackQueryId: string,