@llblab/pi-telegram 0.52.2 → 0.53.0

package/dist/lib/commands.js

@@ -3,11 +3,44 @@
  * Zones: telegram controls, pi agent commands, queue controls
  * Owns Telegram slash-command normalization, bot command metadata, pi-side command registration, and command-initiated session replacement orchestration behind runtime ports
  */
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { addAbortListener } from "node:events";
+import { isDeepStrictEqual } from "node:util";
 import { pairTelegramUserIfNeeded, TELEGRAM_DEFAULT_PROFILE_NAME, } from "./config.js";
-import { escapeHtml } from "./rendering.js";
-import { formatTelegramConnectionFailure } from "./status.js";
+import { isPiStaleContextError } from "./pi.js";
 import { createTelegramControlItemBuilder, createTelegramControlQueueController, createTelegramQueueAdmissionReceipt, } from "./queue.js";
+import { escapeHtml } from "./rendering.js";
+import { formatTelegramConnectionFailure, } from "./status.js";
+import { TelegramApiAuthorityError, } from "./telegram-api.js";
+import { acquireTelegramUpdateRouting, carryTelegramUpdateExecutionFence, getTelegramUpdateExecutionFence, inspectTelegramDeferredSource, prepareTelegramDeferredQueueAdmission, reportTelegramQueueAdmission, } from "./updates.js";
+/** Exact singleton operator-private text command original eligible for a held follower plan. */
+export function isTelegramSelectedHeldOriginal(update, target, operator, name) {
+    if (!update ||
+        typeof update !== "object" ||
+        Array.isArray(update) ||
+        Object.keys(update).some((key) => !["update_id", "message"].includes(key)))
+        return false;
+    const value = Reflect.get(update, "message");
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const text = Reflect.get(value, "text"), chat = Reflect.get(value, "chat"), from = Reflect.get(value, "from");
+    return (typeof text === "string" &&
+        parseTelegramCommand(text)?.name === name &&
+        value.caption === undefined &&
+        value.media_group_id === undefined &&
+        chat?.type === "private" &&
+        from?.is_bot === false &&
+        from.id === operator &&
+        chat.id === operator &&
+        Number.isSafeInteger(value.message_id) &&
+        value.message_id > 0 &&
+        typeof operator === "number" &&
+        Number.isSafeInteger(operator) &&
+        operator > 0 &&
+        target.chatId === operator &&
+        Number.isSafeInteger(target.threadId) &&
+        target.threadId > 0);
+}
 const TELEGRAM_EXTENSION_COMMAND_REGISTRY_KEY = "__piTelegramCommandRegistry__";
 const TELEGRAM_BOT_COMMAND_NAME_PATTERN = /^[a-z0-9_]{1,32}$/;
 function getOrCreateTelegramCommandRegistry() {
@@ -60,6 +93,9 @@ export function registerTelegramCommand(registration) {
         showInMenu,
         emoji,
         handler: registration.handler,
+        selected: registration.selected
+            ? Object.freeze({ prepare: registration.selected.prepare })
+            : undefined,
     };
     registry.commands.set(name, command);
     return () => {
@@ -75,6 +111,64 @@ export function findTelegramExtensionCommand(name) {
         return undefined;
     return getOrCreateTelegramCommandRegistry().commands.get(normalizeTelegramExtensionCommandName(name));
 }
+/** Preparation only: no execution, admission, source freeze or binding effects. Routing owns those later. */
+export async function prepareTelegramSelectedExtensionCommand(command, authority) {
+    const registration = findTelegramExtensionCommand(command.name), selected = registration?.selected;
+    const prepare = selected?.prepare;
+    if (!registration || !selected || typeof prepare !== "function")
+        return undefined;
+    const input = Object.freeze({ name: registration.name, args: command.args });
+    const { assertSourceCurrent, assertRecipientCurrent } = authority;
+    const assertRegistrationCurrent = () => {
+        if (findTelegramExtensionCommand(input.name) !== registration ||
+            registration.selected !== selected ||
+            selected.prepare !== prepare)
+            throw new Error("Selected extension command registration changed.");
+    };
+    const assertCurrent = () => {
+        assertSourceCurrent();
+        assertRecipientCurrent();
+        assertRegistrationCurrent();
+    };
+    try {
+        assertCurrent();
+        const prepared = await prepare(input);
+        assertCurrent();
+        if (!prepared || typeof prepared !== "object" || Array.isArray(prepared))
+            return undefined;
+        const keys = Reflect.ownKeys(prepared), kind = prepared.kind;
+        let plan;
+        if (kind === "command-only" &&
+            keys.length === 2 &&
+            keys.includes("kind") &&
+            keys.includes("execute")) {
+            const execute = prepared.execute;
+            if (typeof execute !== "function")
+                return undefined;
+            plan = { kind, execute };
+        }
+        else if (kind === "generated-prompt" &&
+            keys.length === 2 &&
+            keys.includes("kind") &&
+            keys.includes("prompt")) {
+            const prompt = prepared.prompt;
+            if (typeof prompt !== "string" || !prompt.trim())
+                return undefined;
+            plan = { kind, prompt };
+        }
+        else
+            return undefined;
+        // Producer accessors can invalidate authority while the plan is being copied.
+        assertCurrent();
+        return Object.freeze({
+            plan: Object.freeze(plan),
+            assertRegistrationCurrent,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
 export function clearTelegramExtensionCommands() {
     getOrCreateTelegramCommandRegistry().commands.clear();
 }
@@ -111,11 +205,11 @@ export function formatTelegramInvalidInstanceName(validationError) {
         .split(/;\s+|(?<=\.)\s+(?=[A-Z])/)
         .map((item) => item.trim())
         .filter(Boolean)
-        .map((item) => /[.!?]$/.test(item) ? item : `${item}.`)
+        .map((item) => (/[.!?]$/.test(item) ? item : `${item}.`))
         .map((item) => item[0].toUpperCase() + item.slice(1));
     return [
         "<b>⚠️ Invalid Thread Display Name:</b>\n",
-        ...items.map((item) => `• ${escapeHtml(item)}`),
+        ...items.map((item) => `<code>-</code> ${escapeHtml(item)}`),
     ].join("\n");
 }
 export function formatTelegramThreadDisplayNameSavedHeading(name) {
@@ -176,62 +270,118 @@ export function getTelegramReservedCommandNames() {
         ...getTelegramExtensionCommands().map((command) => command.name),
     ];
 }
-export async function registerTelegramBotCommands(deps) {
+export async function registerTelegramBotCommands(deps, options) {
+    const assertAuthority = options?.assertAuthority, send = deps.setMyCommands;
+    const capturedOptions = assertAuthority ? { assertAuthority } : undefined;
+    const setMyCommands = async (commands) => {
+        assertAuthority?.();
+        await send(commands, capturedOptions);
+        assertAuthority?.();
+    };
+    assertAuthority?.();
     const extensionCommands = getVisibleTelegramExtensionBotCommands();
     if (extensionCommands.length === 0) {
-        await deps.setMyCommands(TELEGRAM_BOT_COMMANDS);
+        await setMyCommands(TELEGRAM_BOT_COMMANDS);
         return;
     }
     const nextCommandIndex = TELEGRAM_BOT_COMMANDS.findIndex((command) => command.command === "next");
     if (nextCommandIndex === -1) {
-        await deps.setMyCommands([...TELEGRAM_BOT_COMMANDS, ...extensionCommands]);
+        await setMyCommands([...TELEGRAM_BOT_COMMANDS, ...extensionCommands]);
         return;
     }
-    await deps.setMyCommands([
+    await setMyCommands([
         ...TELEGRAM_BOT_COMMANDS.slice(0, nextCommandIndex + 1),
         ...extensionCommands,
         ...TELEGRAM_BOT_COMMANDS.slice(nextCommandIndex + 1),
     ]);
 }
 export function createTelegramBotCommandRegistrar(deps) {
-    let pending;
-    return () => {
-        if (pending)
-            return pending;
+    // Only an identical local lifetime may share an in-flight sync; unguarded calls remain separate.
+    const pending = new Map();
+    return (options) => {
+        const assertAuthority = options?.assertAuthority;
+        try {
+            assertAuthority?.();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const joined = pending.get(assertAuthority);
+        if (joined)
+            return joined;
         let request;
-        request = registerTelegramBotCommands(deps).finally(() => {
-            if (pending === request)
-                pending = undefined;
+        request = registerTelegramBotCommands(deps, assertAuthority ? { assertAuthority } : undefined).finally(() => {
+            if (pending.get(assertAuthority) === request)
+                pending.delete(assertAuthority);
         });
-        pending = request;
+        pending.set(assertAuthority, request);
         return request;
     };
 }
 export function createTelegramThreadDisplayNameResetBinding() {
-    let current;
+    let current, generation = 0;
     return {
-        bind(reset) { current = reset; },
-        async reset(target) {
-            return current
-                ? current(target)
-                : { ok: false, message: "Thread display name reset is unavailable." };
+        bind(reset) {
+            current = reset;
+            generation++;
+        },
+        async reset(target, options) {
+            const reset = current, assertAuthority = options?.assertAuthority, capturedGeneration = generation;
+            const capturedTarget = {
+                chatId: target.chatId,
+                ...(target.threadId === undefined ? {} : { threadId: target.threadId }),
+            };
+            if (!reset)
+                return {
+                    ok: false,
+                    message: "Thread display name reset is unavailable.",
+                };
+            const assertCurrent = () => {
+                assertAuthority?.();
+                if (assertAuthority && generation !== capturedGeneration)
+                    throw new Error("Thread display name reset binding changed.");
+            };
+            assertCurrent();
+            const result = assertAuthority
+                ? await reset(capturedTarget, { assertAuthority: assertCurrent })
+                : await reset(capturedTarget);
+            assertCurrent();
+            return result;
         },
     };
 }
 export function createTelegramThreadDisplayNameRenameBinding() {
-    let current;
+    let current, generation = 0;
     return {
         bind(rename) {
             current = rename;
+            generation++;
         },
-        async rename(target, threadName) {
-            if (!current) {
+        async rename(target, threadName, options) {
+            const rename = current, assertAuthority = options?.assertAuthority, capturedGeneration = generation;
+            const capturedTarget = {
+                chatId: target.chatId,
+                ...(target.threadId === undefined ? {} : { threadId: target.threadId }),
+            };
+            if (!rename) {
                 return {
                     ok: false,
                     message: "Thread display naming is unavailable.",
                 };
             }
-            return current(target, threadName);
+            const assertCurrent = () => {
+                assertAuthority?.();
+                if (assertAuthority && generation !== capturedGeneration)
+                    throw new Error("Thread display naming binding changed.");
+            };
+            assertCurrent();
+            const result = assertAuthority
+                ? await rename(capturedTarget, threadName, {
+                    assertAuthority: assertCurrent,
+                })
+                : await rename(capturedTarget, threadName);
+            assertCurrent();
+            return result;
         },
     };
 }
@@ -275,11 +425,15 @@ export function registerTelegramBridgeCommands(pi, deps) {
             let intentId;
             // Pi context getters throw after replacement; check plain intent/generation first.
             const isCurrent = () => (!intentId || deps.connectionIntent?.isActive(intentId) !== false) &&
-                (sessionGeneration === undefined || deps.getSessionGeneration?.() === sessionGeneration) &&
+                (sessionGeneration === undefined ||
+                    deps.getSessionGeneration?.() === sessionGeneration) &&
                 deps.isContextCurrent?.(ctx) !== false;
             if (!isCurrent())
                 return;
-            if (args.trim().split(/\s+/).some((word) => /^as=/i.test(word))) {
+            if (args
+                .trim()
+                .split(/\s+/)
+                .some((word) => /^as=/i.test(word))) {
                 ctx.ui.notify("Thread names are configured from Telegram, not from Pi commands.", "warning");
                 deps.updateStatus(ctx);
                 return;
@@ -299,7 +453,8 @@ export function registerTelegramBridgeCommands(pi, deps) {
                     ctx.ui.notify(`Activated profile "${profileName}".`, "info");
                 }
                 else {
-                    await (deps.activateDefaultProfileConfig?.(ctx, isCurrent) ?? deps.reloadConfig());
+                    await (deps.activateDefaultProfileConfig?.(ctx, isCurrent) ??
+                        deps.reloadConfig());
                     if (!isCurrent())
                         return;
                 }
@@ -316,53 +471,17 @@ export function registerTelegramBridgeCommands(pi, deps) {
                     await deps.promptForConfig(ctx, profileName);
                     return;
                 }
-                let recoveryUsed = false;
-                const startWithRecovery = async (options) => {
+                const startPolling = async (options) => {
                     try {
                         return await deps.startPolling(ctx, options);
                     }
                     catch (error) {
                         if (!isCurrent())
                             return;
-                        if (!deps.recoverPollingStart || recoveryUsed)
-                            throw error;
-                        deps.recordConnectionEvent?.(error, "polling-start");
-                        const recovery = await deps.recoverPollingStart(error);
-                        if (!isCurrent())
-                            return;
-                        if (recovery.kind === "unhandled")
-                            throw error;
-                        if (recovery.kind === "blocked") {
-                            return { ok: false, message: recovery.message,
-                                notice: "Telegram recovery blocked. Check /telegram-status --debug." };
-                        }
-                        recoveryUsed = true;
-                        deps.recordConnectionEvent?.(recovery.message, "recovery");
-                        try {
-                            const retry = await deps.startPolling(ctx, options);
-                            if (!isCurrent())
-                                return;
-                            if (!retry)
-                                return { ok: true, message: "Telegram bridge connected; temporary state recovered." };
-                            return {
-                                ...retry,
-                                message: retry.ok
-                                    ? "Telegram bridge connected; temporary state recovered."
-                                    : retry.message,
-                            };
-                        }
-                        catch (error) {
-                            if (!isCurrent())
-                                return;
-                            deps.recordConnectionEvent?.(error, "recovery-retry");
-                            return {
-                                ok: false,
-                                notice: "Telegram recovery failed. Restart this Pi instance.",
-                            };
-                        }
+                        throw error;
                     }
                 };
-                let result = await startWithRecovery({ forceFreshLeaderThread: true });
+                let result = await startPolling({ forceFreshLeaderThread: true });
                 if (!isCurrent())
                     return;
                 if (result && !result.ok && result.canTakeover) {
@@ -374,14 +493,17 @@ export function registerTelegramBridgeCommands(pi, deps) {
                         deps.updateStatus(ctx);
                         return;
                     }
-                    result = await startWithRecovery({ force: true, forceFreshLeaderThread: true });
+                    result = await startPolling({
+                        force: true,
+                        forceFreshLeaderThread: true,
+                    });
                     if (!isCurrent())
                         return;
                 }
                 if (result && !result.ok) {
                     if (result.message)
                         deps.recordConnectionEvent?.(result.message, "connect-refused");
-                    ctx.ui.notify(result.notice ?? formatTelegramConnectionFailure(result.message), "warning");
+                    ctx.ui.notify(formatTelegramConnectionFailure(result.message), "warning");
                 }
                 else if (result?.message) {
                     ctx.ui.notify(result.message, "info");
@@ -407,7 +529,8 @@ export function registerTelegramBridgeCommands(pi, deps) {
         description: "Stop Telegram and delete current thread in Threaded Mode",
         handler: async (_args, ctx) => {
             const generation = deps.getSessionGeneration?.();
-            const isCurrent = () => (generation === undefined || deps.getSessionGeneration?.() === generation) &&
+            const isCurrent = () => (generation === undefined ||
+                deps.getSessionGeneration?.() === generation) &&
                 deps.isContextCurrent?.(ctx) !== false;
             if (!isCurrent())
                 return;
@@ -464,6 +587,14 @@ export function isTelegramReservedCommandName(commandName) {
     return (commandName !== undefined &&
         TELEGRAM_RESERVED_COMMAND_NAME_SET.has(commandName));
 }
+function isTelegramSessionBusy(ports) {
+    return (!ports.isIdle() ||
+        ports.hasPendingMessages() ||
+        ports.hasActiveTelegramTurn() ||
+        ports.hasDispatchPending() ||
+        ports.hasQueuedTelegramItems() ||
+        ports.isCompactionInProgress());
+}
 function canPairTelegramUserFromCommandMessage(message) {
     return message.chat.type === undefined || message.chat.type === "private";
 }
@@ -476,16 +607,6 @@ export function getTelegramCommandMessageTarget(message) {
         replyToMessageId: message.message_id,
     };
 }
-export function createTelegramCommandControlQueueRuntime(deps) {
-    const controlQueueController = createTelegramControlQueueController({
-        appendControlItem: deps.appendControlItem,
-        dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
-    });
-    return createTelegramCommandControlEnqueueAdapter({
-        createControlItem: deps.createControlItem,
-        enqueueControlItem: controlQueueController.enqueue,
-    });
-}
 export function createTelegramCommandControlEnqueueAdapter(deps) {
     return (target, ctx, controlType, statusSummary, execute, admissionReceipts, onQueued) => {
         deps.enqueueControlItem(deps.createControlItem({
@@ -498,11 +619,15 @@ export function createTelegramCommandControlEnqueueAdapter(deps) {
     };
 }
 export function createTelegramCommandTargetQueueRuntime(deps) {
+    const { createControlItem, appendControlItem, dispatchNextQueuedTelegramTurn, } = deps;
+    const controlQueueController = createTelegramControlQueueController({
+        appendControlItem,
+        dispatchNextQueuedTelegramTurn,
+    });
     return createTelegramCommandTargetRuntime({
-        enqueueControlItem: createTelegramCommandControlQueueRuntime({
-            createControlItem: deps.createControlItem,
-            appendControlItem: deps.appendControlItem,
-            dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
+        enqueueControlItem: createTelegramCommandControlEnqueueAdapter({
+            createControlItem,
+            enqueueControlItem: controlQueueController.enqueue,
         }),
         getAdmissionScope: deps.getAdmissionScope,
         getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
@@ -531,85 +656,70 @@ export function createTelegramCommandTargetRuntime(deps) {
                     ...(journalBindingKey ? { journalBindingKey } : {}),
                 }
                 : undefined;
-            deps.enqueueControlItem(getTelegramCommandMessageTarget(message), ctx, controlType, statusSummary, execute, receipt ? [receipt] : undefined, receipt
-                ? () => deps.onControlQueued?.(message, receipt)
-                : undefined);
+            deps.enqueueControlItem(getTelegramCommandMessageTarget(message), ctx, controlType, statusSummary, execute, receipt ? [receipt] : undefined, receipt ? () => deps.onControlQueued?.(message, receipt) : undefined);
         },
-        showStatus: (message, ctx) => {
+        showStatus: (message, ctx, options) => {
             const target = getTelegramCommandMessageTarget(message);
-            return deps.showStatus(target.chatId, target.replyToMessageId, ctx, target.threadId);
+            return deps.showStatus(target.chatId, target.replyToMessageId, ctx, target.threadId, options);
         },
-        openModelMenu: (message, ctx) => {
+        openModelMenu: (message, ctx, options) => {
             const target = getTelegramCommandMessageTarget(message);
-            return deps.openModelMenu(target.chatId, target.replyToMessageId, ctx, target.threadId);
+            return deps.openModelMenu(target.chatId, target.replyToMessageId, ctx, target.threadId, options);
         },
-        openSettingsMenu: async (message, ctx) => {
+        openSettingsMenu: async (message, ctx, options) => {
             const target = getTelegramCommandMessageTarget(message);
             if (!deps.openSettingsMenu) {
                 await deps.sendTextReply(target.chatId, target.replyToMessageId, formatTelegramInformationHeading("🚫", "Settings menu is unavailable."), { target, parseMode: "HTML" });
                 return;
             }
-            await deps.openSettingsMenu(target.chatId, target.replyToMessageId, ctx, target.threadId);
+            await deps.openSettingsMenu(target.chatId, target.replyToMessageId, ctx, target.threadId, options);
         },
         sendTextReply: async (message, text, options) => {
             const target = getTelegramCommandMessageTarget(message);
-            await deps.sendTextReply(target.chatId, target.replyToMessageId, text, {
-                ...options,
-                target,
-            });
+            const assertAuthority = options?.assertAuthority, send = deps.sendTextReply;
+            const capturedOptions = { ...options, target };
+            assertAuthority?.();
+            await send(target.chatId, target.replyToMessageId, text, capturedOptions);
+            assertAuthority?.();
         },
     };
 }
-export const TELEGRAM_APP_MENU_INTRO_HTML = [
-    "<b>Pi Telegram</b>",
-    "",
-    `${formatTelegramCommandEmojiPrefix("start")}/start — Open menu / Pair bridge`,
-    `${formatTelegramCommandEmojiPrefix("compact")}/compact — Compact current session`,
-    `${formatTelegramCommandEmojiPrefix("new")}/new — Start a new session`,
-    `${formatTelegramCommandEmojiPrefix("continue")}/continue — Queue continue prompt`,
-    `${formatTelegramCommandEmojiPrefix("next")}/next — Force next turn`,
-    `${formatTelegramCommandEmojiPrefix("abort")}/abort — Abort Pi`,
-    `${formatTelegramCommandEmojiPrefix("stop")}/stop — Abort Pi & Clear queue`,
-].join("\n");
-function escapeTelegramCommandMenuHtml(text) {
-    return text
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
+/** Pure intro: built-in controls with registered extension lines before the abort controls. */
+function formatTelegramAppMenuIntroHtml(extensionLines) {
+    const line = (name, label) => `${formatTelegramCommandEmojiPrefix(name)}/${name} — ${label}`;
+    return [
+        "<b>Pi Telegram</b>",
+        "",
+        line("start", "Open menu / Pair bridge"),
+        line("compact", "Compact current session"),
+        line("new", "Start a new session"),
+        line("continue", "Queue continue prompt"),
+        line("next", "Force next turn"),
+        ...extensionLines,
+        line("abort", "Abort Pi"),
+        line("stop", "Abort Pi & Clear queue"),
+    ].join("\n");
 }
+export const TELEGRAM_APP_MENU_INTRO_HTML = formatTelegramAppMenuIntroHtml([]);
 function buildTelegramPromptTemplateMenuHtml(promptTemplates = []) {
     if (promptTemplates.length === 0)
         return "";
     return promptTemplates
-        .map((template) => `🧩 /${escapeTelegramCommandMenuHtml(template.command)}`)
+        .map((template) => `🧩 /${escapeHtml(template.command)}`)
         .join("\n");
 }
 function buildTelegramExtensionCommandMenuLines() {
     return getTelegramExtensionCommands()
         .filter((command) => command.showInMenu)
         .map((command) => {
-        const prefix = `${escapeTelegramCommandMenuHtml(command.emoji ?? "")} /${escapeTelegramCommandMenuHtml(command.name)}`;
+        const prefix = `${escapeHtml(command.emoji ?? "")} /${escapeHtml(command.name)}`;
         if (!command.description)
             return prefix;
-        return `${prefix} — ${escapeTelegramCommandMenuHtml(command.description)}`;
+        return `${prefix} — ${escapeHtml(command.description)}`;
     });
 }
 function buildTelegramAppMenuIntroHtml() {
-    const extensionLines = buildTelegramExtensionCommandMenuLines();
-    if (extensionLines.length === 0)
-        return TELEGRAM_APP_MENU_INTRO_HTML;
-    return [
-        "<b>Pi Telegram</b>",
-        "",
-        `${formatTelegramCommandEmojiPrefix("start")}/start — Open menu / Pair bridge`,
-        `${formatTelegramCommandEmojiPrefix("compact")}/compact — Compact current session`,
-        `${formatTelegramCommandEmojiPrefix("new")}/new — Start a new session`,
-        `${formatTelegramCommandEmojiPrefix("continue")}/continue — Queue continue prompt`,
-        `${formatTelegramCommandEmojiPrefix("next")}/next — Force next turn`,
-        ...extensionLines,
-        `${formatTelegramCommandEmojiPrefix("abort")}/abort — Abort Pi`,
-        `${formatTelegramCommandEmojiPrefix("stop")}/stop — Abort Pi & Clear queue`,
-    ].join("\n");
+    return formatTelegramAppMenuIntroHtml(buildTelegramExtensionCommandMenuLines());
 }
 export function buildTelegramAppMenuHtml(statusHtml, promptTemplates = []) {
     const introHtml = buildTelegramAppMenuIntroHtml();
@@ -677,9 +787,6 @@ export function buildTelegramCommandAction(commandName) {
     }
     return TELEGRAM_COMMAND_ACTIONS[commandName];
 }
-export function getTelegramCommandExecutionMode(action) {
-    return action.executionMode;
-}
 function formatTelegramQueuedTurnCount(count) {
     return count === 1 ? "1 queued turn" : `${count} queued turns`;
 }
@@ -758,13 +865,26 @@ function buildTelegramNewConfirmationReplyMarkup() {
         ],
     };
 }
+/** Send one confirmation to an exact copied recipient, with authority checks around the issued request. */
+async function sendTelegramConfirmation(target, deps, html, markup, assertAuthority) {
+    const recipientTarget = {
+        chatId: target.chatId,
+        ...(target.threadId !== undefined ? { threadId: target.threadId } : {}),
+    };
+    const options = assertAuthority
+        ? { target: recipientTarget, assertAuthority }
+        : target.threadId !== undefined
+            ? { target: recipientTarget }
+            : undefined;
+    assertAuthority?.();
+    await deps.sendInteractiveMessage(recipientTarget.chatId, html, "html", markup, options);
+    assertAuthority?.();
+}
 function getTelegramNewConfirmationHtml() {
     return "<b>Start a new session?</b>";
 }
-export async function openTelegramNewConfirmation(target, deps) {
-    await deps.sendInteractiveMessage(target.chatId, getTelegramNewConfirmationHtml(), "html", buildTelegramNewConfirmationReplyMarkup(), target.threadId !== undefined
-        ? { target: { chatId: target.chatId, threadId: target.threadId } }
-        : undefined);
+export async function openTelegramNewConfirmation(target, deps, assertAuthority) {
+    await sendTelegramConfirmation(target, deps, getTelegramNewConfirmationHtml(), buildTelegramNewConfirmationReplyMarkup(), assertAuthority);
 }
 export async function handleTelegramNewConfirmationCallback(query, deps) {
     if (query.data !== "new:confirm" && query.data !== "new:cancel")
@@ -772,7 +892,7 @@ export async function handleTelegramNewConfirmationCallback(query, deps) {
     const chatId = query.message?.chat?.id;
     const messageId = query.message?.message_id;
     if (typeof chatId !== "number" || typeof messageId !== "number") {
-        await deps.answerCallbackQuery(query.id, "⌛ Interactive message expired.");
+        await deps.answerCallbackQuery(query.id, "Interactive message expired");
         return true;
     }
     if (query.data === "new:cancel") {
@@ -798,10 +918,8 @@ function buildTelegramCompactConfirmationReplyMarkup() {
 function getTelegramCompactConfirmationHtml() {
     return "<b>Compact session?</b>";
 }
-async function openTelegramCompactConfirmation(target, deps) {
-    await deps.sendInteractiveMessage(target.chatId, getTelegramCompactConfirmationHtml(), "html", buildTelegramCompactConfirmationReplyMarkup(), target.threadId !== undefined
-        ? { target: { chatId: target.chatId, threadId: target.threadId } }
-        : undefined);
+async function openTelegramCompactConfirmation(target, deps, assertAuthority) {
+    await sendTelegramConfirmation(target, deps, getTelegramCompactConfirmationHtml(), buildTelegramCompactConfirmationReplyMarkup(), assertAuthority);
 }
 export async function handleTelegramCompactConfirmationCallback(query, deps) {
     if (query.data !== "compact:confirm" && query.data !== "compact:cancel") {
@@ -811,7 +929,7 @@ export async function handleTelegramCompactConfirmationCallback(query, deps) {
     const chatId = callbackMessage?.chat?.id;
     const messageId = callbackMessage?.message_id;
     if (typeof chatId !== "number" || typeof messageId !== "number") {
-        await deps.answerCallbackQuery(query.id, "⌛ Interactive message expired.");
+        await deps.answerCallbackQuery(query.id, "Interactive message expired");
         return true;
     }
     if (query.data === "compact:cancel") {
@@ -826,12 +944,7 @@ export async function handleTelegramCompactConfirmationCallback(query, deps) {
     return true;
 }
 export async function handleTelegramNewCommand(deps) {
-    if (!deps.isIdle() ||
-        deps.hasPendingMessages() ||
-        deps.hasActiveTelegramTurn() ||
-        deps.hasDispatchPending() ||
-        deps.hasQueuedTelegramItems() ||
-        deps.isCompactionInProgress()) {
+    if (isTelegramSessionBusy(deps)) {
         await deps.sendTextReply(formatTelegramInformationHeading("⏳", "Cannot start a new session while Pi or the Telegram queue is busy. Wait for queued turns to finish or send /abort first."), { parseMode: "HTML" });
         return;
     }
@@ -842,12 +955,7 @@ export async function handleTelegramNewCommand(deps) {
     deps.requestNewSession();
 }
 export async function handleTelegramCompactCommand(deps) {
-    if (!deps.isIdle() ||
-        deps.hasPendingMessages() ||
-        deps.hasActiveTelegramTurn() ||
-        deps.hasDispatchPending() ||
-        deps.hasQueuedTelegramItems() ||
-        deps.isCompactionInProgress()) {
+    if (isTelegramSessionBusy(deps)) {
         await deps.sendTextReply(formatTelegramInformationHeading("⏳", "Cannot compact while Pi or the Telegram queue is busy. Wait for queued turns to finish or send /abort first."), { parseMode: "HTML" });
         return;
     }
@@ -889,26 +997,12 @@ export async function handleTelegramCompactCommand(deps) {
         });
     }
 }
-function isTelegramStaleContextError(error) {
-    return (error instanceof Error &&
-        (error.message.includes("stale after session") ||
-            error.message.includes("stale ctx")));
-}
-export async function handleTelegramStatusCommand(deps) {
-    try {
-        await deps.showStatus(deps.ctx);
-    }
-    catch (error) {
-        if (!isTelegramStaleContextError(error))
-            throw error;
-    }
-}
 export async function handleTelegramModelCommand(deps) {
     try {
         await deps.openModelMenu(deps.ctx);
     }
     catch (error) {
-        if (!isTelegramStaleContextError(error))
+        if (!isPiStaleContextError(error))
             throw error;
     }
 }
@@ -976,6 +1070,7 @@ export function createTelegramCommandHandlerTargetRuntime(deps) {
         sendTextReply: deps.sendTextReply,
     });
     return createTelegramCommandHandler({
+        assertExecutionCurrent: deps.assertExecutionCurrent,
         hasAbortHandler: deps.hasAbortHandler,
         clearPendingModelSwitch: deps.clearPendingModelSwitch,
         hasQueuedTelegramItems: deps.hasQueuedTelegramItems,
@@ -990,6 +1085,7 @@ export function createTelegramCommandHandlerTargetRuntime(deps) {
         setCompactionInProgress: deps.setCompactionInProgress,
         updateStatus: deps.updateStatus,
         isContextActive: deps.isContextActive,
+        beginCommandEffectWork: deps.beginCommandEffectWork,
         dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
         requestNextDispatchAnnouncement: deps.requestNextDispatchAnnouncement,
         markActiveTurnNextAbortAnnouncement: deps.markActiveTurnNextAbortAnnouncement,
@@ -997,6 +1093,7 @@ export function createTelegramCommandHandlerTargetRuntime(deps) {
         startTypingLoop: deps.startTypingLoop,
         stopTypingLoop: deps.stopTypingLoop,
         enqueueContinueTurn: deps.enqueueContinueTurn,
+        heldTurn: deps.heldTurn,
         compact: deps.compact,
         requestNewSession: deps.requestNewSession,
         sendInteractiveMessage: deps.sendInteractiveMessage,
@@ -1020,61 +1117,1009 @@ export function createTelegramCommandHandlerTargetRuntime(deps) {
         recordRuntimeEvent: deps.recordRuntimeEvent,
     });
 }
-export function createTelegramCommandHandler(deps) {
-    return async (commandName, message, ctx, commandArgs) => {
-        return handleTelegramCommandRuntime(commandName, message, ctx, deps, commandArgs);
+/**
+ * Captures admission ports now and checks source → execution → recipient; `strict` rechecks the source after the
+ * recipient, for owners whose effects outlive one synchronous step.
+ */
+function createSelectedSemanticGuard(admission, assertExecution, strict) {
+    const assertSourceCurrent = admission.assertSourceCurrent, assertRecipientCurrent = admission.assertRecipientCurrent;
+    return () => {
+        assertSourceCurrent();
+        assertExecution();
+        assertRecipientCurrent();
+        if (!strict)
+            return;
+        assertSourceCurrent();
+        assertExecution();
+    };
+}
+/** Wrap one synchronous command effect between semantic checks. */
+function guardSelectedEffect(assertCurrent) {
+    return (effect) => (...args) => {
+        assertCurrent();
+        const result = effect(...args);
+        assertCurrent();
+        return result;
+    };
+}
+/** One issuance only: later calls return false without assertions or effects, never replay. */
+function issueSelectedOnce(assertCurrent, run) {
+    let issued = false;
+    return async () => {
+        if (issued)
+            return false;
+        assertCurrent();
+        issued = true;
+        return run();
     };
 }
-export function createTelegramCommandOrPromptRuntime(deps) {
+/** Body-free reply anchor: chat, message and Thread only, never the original's admission symbols. */
+function copySelectedReplyAnchor(original) {
     return {
-        dispatchMessages: async (messages, ctx) => {
-            const firstMessage = messages[0];
-            if (!firstMessage)
-                return;
-            if (deps.shouldIgnoreMessages?.(messages))
-                return;
-            deps.assertExecutionCurrent?.(firstMessage);
-            if (await deps.consumeThreadNameInput?.(messages, ctx)) {
-                deps.assertExecutionCurrent?.(firstMessage);
-                return;
+        chat: { ...original.chat },
+        message_id: original.message_id,
+        message_thread_id: original.message_thread_id,
+    };
+}
+function copySelectedMenuCarrier(original) {
+    const message = Object.fromEntries(Object.entries(original).filter(([key]) => key !== "pi_telegram_source_update_id"));
+    message.chat = { ...original.chat };
+    return message;
+}
+export function createTelegramCommandHandler(deps) {
+    const handle = async (commandName, message, ctx, commandArgs) => {
+        return handleTelegramCommandRuntime(commandName, message, ctx, deps, commandArgs);
+    };
+    const heldQueueReceipts = new Map();
+    const heldQueueOwners = new WeakSet();
+    const watchHeldQueueOwner = (signal) => {
+        if (heldQueueOwners.has(signal))
+            return;
+        addAbortListener(signal, () => {
+            // Native owner end is irreversible; keep refusal identity, not its context/carrier closures or a fallback grant.
+            for (const [id, record] of heldQueueReceipts)
+                if (record?.signal === signal)
+                    heldQueueReceipts.set(id, null);
+        });
+        heldQueueOwners.add(signal);
+    };
+    const prepareHeldSelectedCommand = (name, readiness, admission, captured, portsCurrent, completion, run, inspectQueuedCompletion) => {
+        const snapshot = readiness.snapshot, raw = snapshot.update.message, target = { ...admission.target };
+        const bind = readiness.bindCarrier, isCurrent = readiness.isCurrent, assertSource = admission.assertSourceCurrent, assertRecipient = admission.assertRecipientCurrent;
+        if (typeof bind !== "function" ||
+            typeof isCurrent !== "function" ||
+            typeof assertSource !== "function" ||
+            typeof assertRecipient !== "function" ||
+            !isCurrent.call(readiness) ||
+            !raw ||
+            typeof raw !== "object" ||
+            Array.isArray(raw) ||
+            Object.keys(snapshot.update).some((key) => !["update_id", "message"].includes(key)))
+            return undefined;
+        const value = raw, chat = value.chat, from = value.from;
+        if (typeof captured.getAllowedUserId !== "function")
+            return undefined;
+        const command = typeof value.text === "string"
+            ? parseTelegramCommand(value.text)
+            : undefined, operator = captured.getAllowedUserId();
+        if (!command ||
+            !chat ||
+            !from ||
+            !isTelegramSelectedHeldOriginal(snapshot.update, target, operator, name))
+            return undefined;
+        const source = { ...snapshot.source }, preparedCommand = { ...command };
+        const message = {
+            ...structuredClone(value),
+            chat: { ...chat },
+            message_thread_id: target.threadId,
+        };
+        delete message.pi_telegram_source_update_id;
+        let bound, issued = false;
+        const ownerCurrent = () => portsCurrent() &&
+            readiness.bindCarrier === bind &&
+            readiness.isCurrent === isCurrent &&
+            isCurrent.call(readiness) &&
+            captured.getAllowedUserId() === operator;
+        const completionCurrent = () => !!bound &&
+            Object.entries(bound.ports).every(([key, port]) => Reflect.get(bound.completion, key) === port) &&
+            bound.ports.isCurrent.call(bound.completion);
+        const assertSourceCurrent = () => {
+            assertSource.call(admission);
+            if (!ownerCurrent() || !completionCurrent() || !bound)
+                throw new Error(`Held ${name} source owner is unavailable.`);
+            captured.assertExecutionCurrent?.(bound.carrier);
+            const current = inspectTelegramDeferredSource(bound.carrier);
+            if (!current ||
+                current.updateId !== source.updateId ||
+                current.journalBindingKey !== source.journalBindingKey ||
+                current.sourceSha256 !== source.sourceSha256 ||
+                !ownerCurrent() ||
+                !completionCurrent())
+                throw new Error(`Held ${name} original changed.`);
+        };
+        return {
+            get source() {
+                return { ...source };
+            },
+            get command() {
+                return { ...preparedCommand };
+            },
+            bindCarrier(value) {
+                if (!ownerCurrent())
+                    return false;
+                if (bound)
+                    return value === bound.carrier && completionCurrent();
+                const completion = bind.call(readiness, value);
+                if (!completion ||
+                    completion.source.updateId !== source.updateId ||
+                    completion.source.journalBindingKey !== source.journalBindingKey ||
+                    completion.source.sourceSha256 !== source.sourceSha256 ||
+                    !ownerCurrent())
+                    return false;
+                const ports = {
+                    isCurrent: completion.isCurrent,
+                    reportCompleted: completion.reportCompleted,
+                    inspectCompletion: completion.inspectCompletion,
+                };
+                if (Object.values(ports).some((port) => typeof port !== "function"))
+                    return false;
+                bound = { carrier: value, completion, ports };
+                return completionCurrent();
+            },
+            async execute() {
+                if (issued)
+                    return false;
+                assertSourceCurrent();
+                assertRecipient.call(admission);
+                assertSourceCurrent();
+                issued = true;
+                if (completion === "before-effect" &&
+                    !bound.ports.reportCompleted.call(bound.completion))
+                    return false;
+                return run({
+                    message,
+                    carrier: bound.carrier,
+                    source: { ...source },
+                    command: { ...preparedCommand },
+                    assertRecipient,
+                    reportCompleted: () => bound.ports.reportCompleted.call(bound.completion),
+                    assertSemantic() {
+                        assertSourceCurrent();
+                        assertRecipient.call(admission);
+                    },
+                });
+            },
+            inspectCompletion() {
+                return ownerCurrent() && completionCurrent()
+                    ? completion === "queue-receipt"
+                        ? inspectQueuedCompletion?.()
+                        : bound.ports.inspectCompletion.call(bound.completion)
+                    : undefined;
+            },
+        };
+    };
+    const prepareHeldReplyPlan = (ctx, effects, run, replyDelivery = "detached") => {
+        const send = effects.sendTextReply, captured = { ...deps };
+        return {
+            captured,
+            portsCurrent: () => effects.sendTextReply === send,
+            async run(input) {
+                const semantic = guardSelectedEffect(input.assertSemantic);
+                const complete = () => {
+                    input.assertSemantic();
+                    if (!input.reportCompleted())
+                        throw new Error(`Held ${input.command.name} source completion refused.`);
+                    input.assertRecipient();
+                };
+                await run(captured, semantic, complete, async (text, options) => {
+                    complete();
+                    const deliver = async () => {
+                        input.assertRecipient();
+                        await send.call(effects, input.message.chat.id, input.message.message_id, text, {
+                            ...options,
+                            target: {
+                                chatId: input.message.chat.id,
+                                threadId: input.message.message_thread_id,
+                            },
+                            assertAuthority: input.assertRecipient,
+                        });
+                        input.assertRecipient();
+                    };
+                    // Transport waiting never changes the already reported semantic completion or licenses another effect.
+                    if (replyDelivery === "inline")
+                        await deliver();
+                    else
+                        scheduleTelegramCommandEffect(ctx, input.command.name, "selected-reply", captured, deliver, input.assertRecipient);
+                });
+                return true;
+            },
+        };
+    };
+    const prepareHeldQueuePlan = (ctx, template) => {
+        const captured = { ...deps }, owner = captured.heldTurn, enqueue = owner.enqueue;
+        let retained;
+        const portsCurrent = () => deps.heldTurn === owner &&
+            owner.enqueue === enqueue &&
+            (!template || template.isCurrent()) &&
+            deps.heldTurn === owner &&
+            owner.enqueue === enqueue;
+        return {
+            captured,
+            portsCurrent,
+            async run(input) {
+                input.assertSemantic();
+                if (template && !isDeepStrictEqual(input.command, template.command))
+                    return false;
+                const { carrier, source } = input;
+                if (!carrier || !source)
+                    return false;
+                const signal = getTelegramUpdateExecutionFence(carrier)?.signal;
+                if (!signal || signal.aborted)
+                    return false;
+                const queue = input.queue ?? prepareTelegramDeferredQueueAdmission(carrier);
+                if (!queue || !queue.isCurrent())
+                    return false;
+                const ports = {
+                    isCurrent: queue.isCurrent,
+                    prepareCompletionScope: queue.prepareCompletionScope,
+                    inspectCompletion: queue.inspectCompletion,
+                };
+                if (Object.values(ports).some((port) => typeof port !== "function"))
+                    return false;
+                const current = () => {
+                    if (!portsCurrent() ||
+                        !Object.entries(ports).every(([key, value]) => Reflect.get(queue, key) === value) ||
+                        !ports.isCurrent.call(queue))
+                        return false;
+                    try {
+                        input.assertRecipient();
+                        return portsCurrent() && ports.isCurrent.call(queue);
+                    }
+                    catch {
+                        return false;
+                    }
+                };
+                const sameTarget = carrier.message_thread_id === input.message.message_thread_id;
+                const message = carryTelegramUpdateExecutionFence(carrier, {
+                    ...carrier,
+                    ...input.message,
+                    pi_telegram_source_update_id: source.updateId,
+                    ...(template ? { text: template.expanded, caption: undefined } : {}),
+                    ...(sameTarget ? {} : { message_id: 0, reply_to_message: undefined }),
+                });
+                const completionSha256 = createHash("sha256")
+                    .update(JSON.stringify([
+                    "held-command-v1",
+                    randomUUID(),
+                    source,
+                    input.command,
+                    getTelegramCommandMessageTarget(message),
+                ]))
+                    .digest("hex");
+                const admission = {
+                    assertCurrent: input.assertSemantic,
+                    report(receipts) {
+                        input.assertSemantic();
+                        const receipt = receipts[0];
+                        if (retained ||
+                            receipts.length !== 1 ||
+                            !receipt ||
+                            receipt.queueKind !== "prompt" ||
+                            receipt.journalBindingKey !== source.journalBindingKey ||
+                            receipt.sourceUpdateIds.length !== 1 ||
+                            receipt.sourceUpdateIds[0] !== source.updateId ||
+                            heldQueueReceipts.has(receipt.receiptId) ||
+                            !current())
+                            throw new Error("Held command needs one exact original queue receipt.");
+                        const expected = structuredClone(receipt);
+                        retained = {
+                            ctx,
+                            signal,
+                            receipt,
+                            queue,
+                            completionSha256,
+                            current: () => current() && isDeepStrictEqual(receipt, expected),
+                        };
+                        watchHeldQueueOwner(signal);
+                        heldQueueReceipts.set(receipt.receiptId, signal.aborted ? null : retained);
+                        if (!reportTelegramQueueAdmission([carrier], [receipt]))
+                            throw new Error("Held command queue admission refused.");
+                    },
+                };
+                if (template)
+                    await enqueue.call(owner, message, ctx, "prompt", admission);
+                else
+                    await handleTelegramContinueCommand(message, ctx, {
+                        enqueueContinueTurn: (value, context) => enqueue.call(owner, value, context, "continue", admission),
+                    });
+                return !!retained && current();
+            },
+            inspectQueuedCompletion() {
+                if (!retained || !retained.current())
+                    return undefined;
+                const proof = retained.queue.inspectCompletion(retained.receipt);
+                if (proof && retained.current()) {
+                    heldQueueReceipts.delete(retained.receipt.receiptId);
+                    return { ...proof };
+                }
+                return undefined;
+            },
+        };
+    };
+    const heldPlans = {
+        status: {
+            completion: "before-effect",
+            effect: "showStatus",
+            prepare(ctx, effects) {
+                const scopedStatus = effects?.showStatus;
+                const captured = {
+                    ...deps,
+                    showStatus: scopedStatus
+                        ? (message, context, options) => {
+                            const address = getTelegramCommandMessageTarget(message);
+                            return scopedStatus.call(effects, address.chatId, address.replyToMessageId, context, address.threadId, options);
+                        }
+                        : deps.showStatus,
+                };
+                return {
+                    captured,
+                    portsCurrent: () => !effects || effects.showStatus === scopedStatus,
+                    async run({ message, command, assertRecipient }) {
+                        const recipientOptions = { assertAuthority: assertRecipient };
+                        return handleTelegramCommandRuntime(command.name, message, ctx, {
+                            ...captured,
+                            assertExecutionCurrent: assertRecipient,
+                            showStatus: (value, context) => captured.showStatus(value, context, recipientOptions),
+                        }, command.args);
+                    },
+                };
+            },
+        },
+        abort: {
+            completion: "after-semantics",
+            effect: "sendTextReply",
+            prepare(ctx, effects, _command, delivery) {
+                return prepareHeldReplyPlan(ctx, effects, async (captured, semantic, _complete, reply) => {
+                    await handleTelegramAbortCommand({
+                        hasAbortHandler: semantic(captured.hasAbortHandler),
+                        hasActiveTelegramTurn: semantic(captured.hasActiveTelegramTurn),
+                        clearPendingModelSwitch: semantic(captured.clearPendingModelSwitch),
+                        cancelNextTransitionAnnouncements: captured.cancelNextTransitionAnnouncements &&
+                            semantic(captured.cancelNextTransitionAnnouncements),
+                        abortCurrentTurn: semantic(captured.abortCurrentTurn),
+                        setFoldQueuedPromptsIntoHistory: semantic(captured.setFoldQueuedPromptsIntoHistory),
+                        updateStatus: semantic(() => captured.updateStatus(ctx)),
+                        sendTextReply: reply,
+                    });
+                }, delivery);
+            },
+        },
+        stop: {
+            completion: "after-semantics",
+            effect: "sendTextReply",
+            available: () => typeof deps.cancelNextTransitionAnnouncements === "function" &&
+                typeof deps.clearQueuedTelegramItems === "function",
+            prepare(ctx, effects, _command, delivery) {
+                return prepareHeldReplyPlan(ctx, effects, async (captured, semantic, _complete, reply) => {
+                    await handleTelegramStopCommand({
+                        hasAbortHandler: semantic(captured.hasAbortHandler),
+                        clearPendingModelSwitch: semantic(captured.clearPendingModelSwitch),
+                        cancelNextTransitionAnnouncements: semantic(captured.cancelNextTransitionAnnouncements),
+                        clearQueuedTelegramItems: semantic(() => captured.clearQueuedTelegramItems(ctx)),
+                        setFoldQueuedPromptsIntoHistory: semantic(captured.setFoldQueuedPromptsIntoHistory),
+                        abortCurrentTurn: semantic(captured.abortCurrentTurn),
+                        updateStatus: semantic(() => captured.updateStatus(ctx)),
+                        sendTextReply: reply,
+                    });
+                }, delivery);
+            },
+        },
+        next: {
+            completion: "after-semantics",
+            effect: "sendTextReply",
+            available: () => typeof deps.requestNextDispatchAnnouncement === "function" &&
+                typeof deps.markActiveTurnNextAbortAnnouncement === "function",
+            prepare(ctx, effects, _command, delivery) {
+                return prepareHeldReplyPlan(ctx, effects, async (captured, semantic, complete, reply) => {
+                    await handleTelegramNextCommand({
+                        hasAbortHandler: semantic(captured.hasAbortHandler),
+                        isIdle: semantic(() => captured.isIdle(ctx)),
+                        hasQueuedItems: semantic(captured.hasQueuedTelegramItems),
+                        clearPendingModelSwitch: semantic(captured.clearPendingModelSwitch),
+                        abortCurrentTurn: semantic(captured.abortCurrentTurn),
+                        dispatchNextQueuedTurn: semantic(() => captured.dispatchNextQueuedTelegramTurn(ctx)),
+                        requestNextDispatchAnnouncement: semantic(captured.requestNextDispatchAnnouncement),
+                        markActiveTurnNextAbortAnnouncement: semantic(captured.markActiveTurnNextAbortAnnouncement),
+                        clearFoldForDispatch: semantic(() => captured.setFoldQueuedPromptsIntoHistory(false)),
+                        updateStatus() {
+                            semantic(() => captured.updateStatus(ctx))();
+                            complete();
+                        },
+                        sendTextReply: reply,
+                    });
+                }, delivery);
+            },
+        },
+        continue: {
+            completion: "queue-receipt",
+            available: () => typeof deps.heldTurn?.enqueue === "function",
+            prepare(ctx) {
+                return prepareHeldQueuePlan(ctx);
+            },
+        },
+    };
+    const getHeldTemplatePlan = (name) => {
+        const owner = deps.heldTurn, templates = owner?.templates, get = templates?.getCommands, expand = templates?.expand;
+        if (!owner ||
+            !templates ||
+            typeof owner.enqueue !== "function" ||
+            typeof get !== "function" ||
+            typeof expand !== "function" ||
+            getTelegramReservedCommandNames().includes(name) ||
+            findTelegramExtensionCommand(name))
+            return undefined;
+        const getIdentity = () => {
+            const matching = get
+                .call(templates)
+                .filter((value) => value.command === name);
+            const selected = matching[0];
+            return matching.length === 1 &&
+                selected &&
+                typeof selected.path === "string" &&
+                selected.path.trim()
+                ? { command: selected.command, path: selected.path }
+                : undefined;
+        };
+        let identity;
+        try {
+            identity = getIdentity();
+        }
+        catch {
+            return undefined;
+        }
+        if (!identity)
+            return undefined;
+        const current = () => {
+            if (deps.heldTurn !== owner ||
+                owner.templates !== templates ||
+                templates.getCommands !== get ||
+                templates.expand !== expand ||
+                findTelegramExtensionCommand(name))
+                return false;
+            try {
+                return (isDeepStrictEqual(getIdentity(), identity) &&
+                    deps.heldTurn === owner &&
+                    owner.templates === templates &&
+                    templates.getCommands === get &&
+                    templates.expand === expand &&
+                    !findTelegramExtensionCommand(name));
             }
-            const command = parseTelegramCommand(deps.extractRawText(messages));
-            const handled = await deps.handleCommand(command?.name, firstMessage, ctx, command?.args);
-            deps.assertExecutionCurrent?.(firstMessage);
-            if (handled)
-                return;
-            if (command && deps.executeExtensionCommand) {
-                const handledByExtension = await deps.executeExtensionCommand(command, messages[0], ctx);
-                deps.assertExecutionCurrent?.(firstMessage);
-                if (handledByExtension)
-                    return;
+            catch {
+                return false;
             }
-            if (command?.name && deps.expandPromptTemplateCommand) {
-                const expanded = deps.expandPromptTemplateCommand(command.name, command.args);
-                if (expanded !== undefined) {
-                    deps.assertExecutionCurrent?.(firstMessage);
-                    await deps.enqueueTurn([
-                        deps.replaceMessageText(firstMessage, expanded),
-                        ...messages.slice(1),
-                    ], ctx);
-                    return;
+        };
+        if (!current())
+            return undefined;
+        return {
+            completion: "queue-receipt",
+            template: true,
+            prepare(ctx, _effects, command) {
+                if (!command || command.name !== name || !current())
+                    return undefined;
+                const captured = { ...command };
+                let expanded;
+                try {
+                    expanded = expand.call(templates, captured.name, captured.args);
                 }
+                catch {
+                    return undefined;
+                }
+                if (typeof expanded !== "string" || !current())
+                    return undefined;
+                return prepareHeldQueuePlan(ctx, {
+                    command: captured,
+                    expanded,
+                    isCurrent() {
+                        if (!current())
+                            return false;
+                        try {
+                            return (expand.call(templates, captured.name, captured.args) ===
+                                expanded && current());
+                        }
+                        catch {
+                            return false;
+                        }
+                    },
+                });
+            },
+        };
+    };
+    const getHeldPlan = (name, effects) => {
+        if (!Object.hasOwn(heldPlans, name))
+            return getHeldTemplatePlan(name);
+        const plan = heldPlans[name];
+        if (plan.available?.() === false)
+            return undefined;
+        if ((plan.effect &&
+            effects !== undefined &&
+            (!effects || typeof effects[plan.effect] !== "function")) ||
+            (plan.effect === "sendTextReply" && !effects) ||
+            (plan.effect === "showStatus" &&
+                effects === undefined &&
+                typeof deps.showStatus !== "function"))
+            return undefined;
+        return plan;
+    };
+    const prepareSelectedPlan = (command, messages, ctx, admission) => {
+        const original = messages[0];
+        if (!["status", "abort", "stop", "next"].includes(command.name) ||
+            messages.length !== 1 ||
+            !original ||
+            typeof admission.assertSourceCurrent !== "function" ||
+            typeof admission.assertRecipientCurrent !== "function" ||
+            typeof admission.reportCompleted !== "function")
+            return undefined;
+        const captured = { ...deps }, parsed = { ...command }, message = parsed.name === "status"
+            ? copySelectedMenuCarrier(original)
+            : copySelectedReplyAnchor(original);
+        const assertRecipientCurrent = admission.assertRecipientCurrent, report = admission.reportCompleted;
+        const effects = parsed.name === "status"
+            ? undefined
+            : {
+                async sendTextReply(_chat, _anchor, text, options) {
+                    await captured.sendTextReply(message, text, {
+                        parseMode: options.parseMode,
+                        assertAuthority: options.assertAuthority,
+                    });
+                },
+            };
+        const plan = getHeldPlan(parsed.name, effects);
+        if (!plan ||
+            plan.completion === "queue-receipt" ||
+            (parsed.name !== "status" && typeof captured.sendTextReply !== "function"))
+            return undefined;
+        const prepared = plan.prepare(ctx, effects, parsed, "inline");
+        if (!prepared)
+            return undefined;
+        const semantic = createSelectedSemanticGuard(admission, () => captured.assertExecutionCurrent?.(original), plan.completion === "before-effect");
+        const assertCurrent = () => {
+            semantic();
+            if (!prepared.portsCurrent())
+                throw new Error(`Selected ${parsed.name} plan owner is unavailable.`);
+        };
+        return issueSelectedOnce(assertCurrent, async () => {
+            if (plan.completion === "before-effect" && !report.call(admission))
+                return false;
+            return prepared.run({
+                message,
+                command: parsed,
+                assertSemantic: assertCurrent,
+                assertRecipient: assertRecipientCurrent,
+                reportCompleted: () => report.call(admission),
+            });
+        });
+    };
+    const prepareSelectedHelp = (name) => (command, messages, ctx, admission) => {
+        const original = messages[0];
+        if (command.name !== name ||
+            messages.length !== 1 ||
+            !original ||
+            !canPairTelegramUserFromCommandMessage(original) ||
+            original.from?.id === undefined ||
+            original.from.is_bot)
+            return undefined;
+        const captured = { ...deps }, userId = original.from.id;
+        if (captured.getAllowedUserId() !== userId)
+            return undefined;
+        const message = {
+            ...copySelectedReplyAnchor(original),
+            from: { ...original.from },
+        };
+        const assertRecipientCurrent = admission.assertRecipientCurrent, reportCompleted = admission.reportCompleted;
+        const assertAdmissionCurrent = createSelectedSemanticGuard(admission, () => captured.assertExecutionCurrent?.(original), false);
+        const assertSemanticCurrent = () => {
+            assertAdmissionCurrent();
+            if (captured.getAllowedUserId() !== userId)
+                throw new Error(`Selected ${name} operator authority is unavailable.`);
+        };
+        return issueSelectedOnce(assertSemanticCurrent, () => handleTelegramHelpCommand(name, message, ctx, {
+            ...captured,
+            persistAllowedUserId: async () => {
+                throw new Error(`Selected ${name} cannot acquire pairing authority.`);
+            },
+        }, { assertSemanticCurrent, assertRecipientCurrent, reportCompleted }));
+    };
+    const prepareSelectedConfirmation = (name) => (command, messages, ctx, admission) => {
+        const original = messages[0], captured = { ...deps };
+        if (command.name !== name ||
+            messages.length !== 1 ||
+            !original ||
+            !captured.sendInteractiveMessage)
+            return undefined;
+        const target = getTelegramCommandMessageTarget(original);
+        const assertRecipientCurrent = admission.assertRecipientCurrent, reportCompleted = admission.reportCompleted;
+        const openConfirmation = name === "new"
+            ? openTelegramNewConfirmation
+            : openTelegramCompactConfirmation;
+        const assertSemanticCurrent = createSelectedSemanticGuard(admission, () => captured.assertExecutionCurrent?.(original), true);
+        return issueSelectedOnce(assertSemanticCurrent, async () => {
+            if (!reportCompleted())
+                return false;
+            assertRecipientCurrent();
+            scheduleTelegramCommandEffect(ctx, name, "confirmation-render", captured, () => openConfirmation(target, { sendInteractiveMessage: captured.sendInteractiveMessage }, assertRecipientCurrent), assertRecipientCurrent);
+            return true;
+        });
+    };
+    return Object.assign(handle, {
+        /** Command-only producer execution; Routing must supply the captured plan and released exact-source authority. */
+        prepareSelectedExtensionCommand(prepared, messages, ctx, admission) {
+            const original = messages[0], captured = { ...deps }, plan = prepared.plan;
+            if (messages.length !== 1 ||
+                !original ||
+                plan.kind !== "command-only" ||
+                typeof captured.sendTextReply !== "function" ||
+                typeof admission.reportCompleted !== "function")
+                return undefined;
+            const execute = plan.execute, assertRegistrationCurrent = prepared.assertRegistrationCurrent;
+            const assertSourceCurrent = admission.assertSourceCurrent, recipientCurrent = admission.assertRecipientCurrent;
+            const reportCompleted = admission.reportCompleted;
+            // Only a body-free fixed recipient/anchor enters detached delivery, never the original's admission symbols.
+            const message = copySelectedReplyAnchor(original);
+            const assertRecipientCurrent = () => {
+                if (captured.isContextActive?.(ctx) === false)
+                    throw new Error("Selected extension context changed.");
+                assertRegistrationCurrent();
+                recipientCurrent();
+                assertRegistrationCurrent();
+                if (captured.isContextActive?.(ctx) === false)
+                    throw new Error("Selected extension context changed.");
+            };
+            const assertCurrent = () => {
+                assertSourceCurrent();
+                captured.assertExecutionCurrent?.(original);
+                assertRecipientCurrent();
+                assertSourceCurrent();
+                captured.assertExecutionCurrent?.(original);
+            };
+            try {
+                assertCurrent();
             }
-            deps.assertExecutionCurrent?.(firstMessage);
-            await deps.enqueueTurn(messages, ctx);
+            catch {
+                return undefined;
+            }
+            let issued = false, reportAttempted = false;
+            const execution = Object.freeze({
+                assertCurrent,
+                reportCompleted() {
+                    if (!issued || reportAttempted)
+                        return false;
+                    // Lost/refused reports never authorize another completion attempt or producer execution.
+                    reportAttempted = true;
+                    assertCurrent();
+                    return reportCompleted();
+                },
+                reply(text) {
+                    assertRecipientCurrent();
+                    if (typeof text !== "string")
+                        throw new Error("Selected extension reply requires text.");
+                    scheduleTelegramCommandEffect(ctx, "extension", "selected-reply", captured, () => captured.sendTextReply(message, text, {
+                        assertAuthority: assertRecipientCurrent,
+                    }), assertRecipientCurrent);
+                },
+            });
+            return async () => {
+                if (issued)
+                    return;
+                issued = true;
+                assertCurrent();
+                await execute(execution);
+                // Return, rejection and reply delivery are deliberately not semantic completion reports.
+            };
+        },
+        /** Selected help/start require the existing authenticated owner; cold pairing remains ordinary first contact. */
+        prepareSelectedStartCommand: prepareSelectedHelp("start"),
+        prepareSelectedHelpCommand: prepareSelectedHelp("help"),
+        /** Selected new handles only confirmation; the later authenticated callback owns replacement admission. */
+        prepareSelectedNewCommand: prepareSelectedConfirmation("new"),
+        /** Selected compaction handles only confirmation; the later authenticated callback owns actual compaction. */
+        prepareSelectedCompactCommand: prepareSelectedConfirmation("compact"),
+        /** Bare naming completes only after the exact dialog owner confirms current publication, not delivery alone. */
+        prepareSelectedNameDialogCommand(command, messages, ctx, admission) {
+            const original = messages[0], captured = { ...deps };
+            if (command.name !== "name" ||
+                command.args.trim() ||
+                messages.length !== 1 ||
+                !original ||
+                !captured.openThreadNameDialog)
+                return undefined;
+            const message = copySelectedReplyAnchor(original);
+            const assertSourceCurrent = admission.assertSourceCurrent, assertRecipientCurrent = admission.assertRecipientCurrent;
+            const reportCompleted = admission.reportCompleted;
+            const assertSemanticCurrent = createSelectedSemanticGuard(admission, () => captured.assertExecutionCurrent?.(original), true);
+            return issueSelectedOnce(assertSemanticCurrent, async () => {
+                const publication = await captured.openThreadNameDialog(message, ctx, {
+                    assertSemanticCurrent,
+                    assertRecipientCurrent,
+                });
+                assertSemanticCurrent();
+                const assertPublished = publication?.assertPublished;
+                if (typeof assertPublished !== "function")
+                    throw new Error("Selected name dialog publication is unconfirmed.");
+                assertPublished();
+                assertSemanticCurrent();
+                assertPublished();
+                assertSourceCurrent();
+                captured.assertExecutionCurrent?.(original);
+                if (!reportCompleted())
+                    throw new Error("Selected name source completion refused.");
+                return true;
+            });
+        },
+        /** Explicit naming retains source authority until its owner result; bare dialogs use their own publication leaf. */
+        prepareSelectedNameCommand(command, messages, ctx, admission) {
+            const original = messages[0], threadName = command.args.trim(), captured = { ...deps };
+            if (command.name !== "name" ||
+                messages.length !== 1 ||
+                !original ||
+                !threadName ||
+                (/^[A-Z]$/.test(threadName)
+                    ? !captured.resetCurrentThreadName
+                    : !captured.renameCurrentThread))
+                return undefined;
+            const message = copySelectedReplyAnchor(original);
+            const assertRecipientCurrent = admission.assertRecipientCurrent, reportCompleted = admission.reportCompleted;
+            const assertSemanticCurrent = createSelectedSemanticGuard(admission, () => captured.assertExecutionCurrent?.(original), true);
+            return issueSelectedOnce(assertSemanticCurrent, async () => {
+                await handleTelegramNameCommand(message, ctx, threadName, captured, {
+                    assertSemanticCurrent,
+                    assertRecipientCurrent,
+                    reportCompleted,
+                });
+                return true;
+            });
         },
+        /** Genuine leader originals capture their warm queue owner before release; no hold copy or semantic-completion report. */
+        prepareSelectedQueueCommand(command, messages, ctx, admission) {
+            const original = messages[0], parsed = { ...command };
+            if (messages.length !== 1 ||
+                !original ||
+                typeof admission.assertSourceCurrent !== "function" ||
+                typeof admission.assertRecipientCurrent !== "function")
+                return undefined;
+            const raw = Reflect.get(original, "text") ?? Reflect.get(original, "caption"), operator = deps.getAllowedUserId();
+            const actual = typeof raw === "string" ? parseTelegramCommand(raw) : undefined;
+            if (!isDeepStrictEqual(actual, parsed) ||
+                typeof operator !== "number" ||
+                original.chat.type !== "private" ||
+                original.chat.id !== operator ||
+                original.from?.id !== operator ||
+                original.from.is_bot ||
+                admission.target.chatId !== operator ||
+                !Number.isSafeInteger(admission.target.threadId) ||
+                admission.target.threadId < 1)
+                return undefined;
+            const plan = getHeldPlan(parsed.name);
+            if (!plan || plan.completion !== "queue-receipt")
+                return undefined;
+            const source = inspectTelegramDeferredSource(original), queue = prepareTelegramDeferredQueueAdmission(original);
+            if (!source || source.completionSha256 || !queue?.isCurrent())
+                return undefined;
+            const prepared = plan.prepare(ctx, undefined, parsed);
+            if (!prepared)
+                return undefined;
+            const target = { ...admission.target }, originalProjection = structuredClone(copySelectedMenuCarrier(original));
+            const message = structuredClone(originalProjection);
+            message.message_thread_id = target.threadId;
+            const assertSource = admission.assertSourceCurrent, assertRecipient = admission.assertRecipientCurrent;
+            const assertCurrent = () => {
+                assertSource.call(admission);
+                prepared.captured.assertExecutionCurrent?.(original);
+                assertRecipient.call(admission);
+                if (deps.getAllowedUserId() !== operator ||
+                    !queue.isCurrent() ||
+                    !prepared.portsCurrent() ||
+                    !isDeepStrictEqual(copySelectedMenuCarrier(original), originalProjection) ||
+                    !isDeepStrictEqual(inspectTelegramDeferredSource(original), source))
+                    throw new Error("Selected queue command source/owner changed.");
+                assertSource.call(admission);
+                prepared.captured.assertExecutionCurrent?.(original);
+            };
+            const execute = issueSelectedOnce(assertCurrent, async () => {
+                const release = acquireTelegramUpdateRouting(original);
+                try {
+                    assertCurrent();
+                    return await prepared.run({
+                        message,
+                        carrier: original,
+                        source: { ...source },
+                        queue,
+                        command: { ...parsed },
+                        assertSemantic: assertCurrent,
+                        assertRecipient,
+                        reportCompleted() {
+                            throw new Error("Queue admission cannot report semantic source removal.");
+                        },
+                    });
+                }
+                finally {
+                    release();
+                }
+            });
+            return {
+                get source() {
+                    return { ...source };
+                },
+                get command() {
+                    return { ...parsed };
+                },
+                execute,
+                inspectCompletion() {
+                    try {
+                        assertRecipient.call(admission);
+                        if (deps.getAllowedUserId() !== operator ||
+                            !queue.isCurrent() ||
+                            !prepared.portsCurrent())
+                            return undefined;
+                        const proof = prepared.inspectQueuedCompletion?.();
+                        assertRecipient.call(admission);
+                        return deps.getAllowedUserId() === operator &&
+                            queue.isCurrent() &&
+                            prepared.portsCurrent()
+                            ? proof
+                            : undefined;
+                    }
+                    catch {
+                        return undefined;
+                    }
+                },
+            };
+        },
+        /** Selected leaders reuse registry semantics; native source/recipient admission and inline transport remain role-owned. */
+        prepareSelectedCommand: prepareSelectedPlan,
+        /** Existing native publication boundary; unrelated/legacy receipts keep their ordinary owner. */
+        prepareHeldQueueReceipt: ((receipt, queueOwner, context, isWorkerCurrent) => {
+            const record = heldQueueReceipts.get(receipt.receiptId);
+            if (record === null)
+                throw new Error("Held queue receipt publication authority changed.");
+            if (!record)
+                return undefined;
+            if (context !== record.ctx ||
+                !isWorkerCurrent() ||
+                !record.current() ||
+                !isDeepStrictEqual(record.receipt, receipt))
+                throw new Error("Held queue receipt publication authority changed.");
+            const scope = record.queue.prepareCompletionScope(record.receipt, queueOwner, record.completionSha256);
+            if (!scope || !isWorkerCurrent() || !record.current())
+                throw new Error("Held queue receipt original scope is unavailable.");
+            return [scope];
+        }),
+        /** Pure registry/effect availability; never reads a source or activates future recipient authority. */
+        canPrepareHeldCommand(name, effects) {
+            return getHeldPlan(name, effects) !== undefined;
+        },
+        /** Compile one registry plan from a saved original; no admission, recipient activation or update-handler replay. */
+        prepareHeldCommand(name, readiness, ctx, admission, effects) {
+            const plan = getHeldPlan(name, effects);
+            if (!plan)
+                return undefined;
+            const value = plan.template
+                ? readiness.snapshot.update.message
+                : undefined;
+            const command = value &&
+                typeof value === "object" &&
+                typeof Reflect.get(value, "text") === "string"
+                ? parseTelegramCommand(Reflect.get(value, "text"))
+                : undefined;
+            const prepared = plan.prepare(ctx, effects, command);
+            if (!prepared)
+                return undefined;
+            return prepareHeldSelectedCommand(name, readiness, admission, prepared.captured, prepared.portsCurrent, plan.completion, prepared.run, prepared.inspectQueuedCompletion);
+        },
+        /** Warm menu-only issuance; completion reporting is not a receipt or a durable removal ACK. */
+        prepareSelectedMenuCommand(command, messages, ctx, admission) {
+            const action = buildTelegramCommandAction(command.name);
+            if (messages.length !== 1 ||
+                !messages[0] ||
+                !["status", "model", "thinking", "queue", "settings"].includes(action.kind) ||
+                (action.kind === "settings" && !deps.openSettingsMenu))
+                return undefined;
+            if (action.kind === "status")
+                return prepareSelectedPlan(command, messages, ctx, admission);
+            const original = messages[0], name = command.name, args = command.args;
+            if (typeof admission.assertSourceCurrent !== "function" ||
+                typeof admission.assertRecipientCurrent !== "function" ||
+                typeof admission.reportCompleted !== "function")
+                return undefined;
+            const assertSourceCurrent = admission.assertSourceCurrent, assertRecipientCurrent = admission.assertRecipientCurrent;
+            const reportCompleted = admission.reportCompleted, assertExecutionCurrent = deps.assertExecutionCurrent;
+            const assertIssuanceCurrent = () => {
+                assertSourceCurrent.call(admission);
+                assertExecutionCurrent?.call(deps, original);
+                assertRecipientCurrent();
+                // Recipient observations can revoke the source too; never complete from an earlier source sample.
+                assertSourceCurrent.call(admission);
+                assertExecutionCurrent?.call(deps, original);
+            };
+            // Preparation proves branch availability, not the future released recipient's active authority.
+            // Detached rendering must not inherit the original admission/fence or a mutable target carrier.
+            const message = copySelectedMenuCarrier(original);
+            const menuDeps = { ...deps };
+            const recipientOptions = { assertAuthority: assertRecipientCurrent };
+            const recipientDeps = {
+                ...deps,
+                assertExecutionCurrent: assertRecipientCurrent,
+                showStatus: (value, context) => menuDeps.showStatus(value, context, recipientOptions),
+                openModelMenu: (value, context) => menuDeps.openModelMenu(value, context, recipientOptions),
+                openThinkingMenu: (value, context) => menuDeps.openThinkingMenu(value, context, recipientOptions),
+                openQueueMenu: (value, context) => menuDeps.openQueueMenu(value, context, recipientOptions),
+                openSettingsMenu: menuDeps.openSettingsMenu &&
+                    ((value, context) => menuDeps.openSettingsMenu(value, context, recipientOptions)),
+            };
+            return issueSelectedOnce(assertIssuanceCurrent, async () => reportCompleted.call(admission) &&
+                handleTelegramCommandRuntime(name, message, ctx, recipientDeps, args));
+        },
+    });
+}
+export function createTelegramCommandOrPromptDispatcher(deps) {
+    const dispatchPromptTemplate = async (command, messages, ctx) => {
+        const first = messages[0];
+        if (!first)
+            return false;
+        deps.assertExecutionCurrent?.(first);
+        const expanded = command && deps.expandPromptTemplateCommand?.(command.name, command.args);
+        if (expanded === undefined)
+            return false;
+        deps.assertExecutionCurrent?.(first);
+        const replaced = deps.replaceMessageText(first, expanded);
+        deps.assertExecutionCurrent?.(first);
+        await deps.enqueueTurn([replaced, ...messages.slice(1)], ctx);
+        return true;
+    };
+    return async (messages, ctx) => {
+        const firstMessage = messages[0];
+        if (!firstMessage)
+            return;
+        if (deps.shouldIgnoreMessages?.(messages))
+            return;
+        deps.assertExecutionCurrent?.(firstMessage);
+        if (await deps.consumeThreadNameInput?.(messages, ctx)) {
+            deps.assertExecutionCurrent?.(firstMessage);
+            return;
+        }
+        const command = parseTelegramCommand(deps.extractRawText(messages));
+        const handled = await deps.handleCommand(command?.name, firstMessage, ctx, command?.args);
+        deps.assertExecutionCurrent?.(firstMessage);
+        if (handled)
+            return;
+        if (command && deps.executeExtensionCommand) {
+            const handledByExtension = await deps.executeExtensionCommand(command, messages[0], ctx);
+            deps.assertExecutionCurrent?.(firstMessage);
+            if (handledByExtension)
+                return;
+        }
+        if (await dispatchPromptTemplate(command, messages, ctx))
+            return;
+        deps.assertExecutionCurrent?.(firstMessage);
+        await deps.enqueueTurn(messages, ctx);
     };
 }
 function scheduleTelegramCommandEffect(ctx, command, phase, deps, effect, assertExecutionCurrent) {
+    const work = deps.beginCommandEffectWork?.();
+    let started = false, outcome = "settled";
     void Promise.resolve()
         .then(async () => {
         if (deps.isContextActive?.(ctx) === false)
             return;
         assertExecutionCurrent?.();
+        started = true;
         await effect();
         assertExecutionCurrent?.();
     })
         .catch((error) => {
+        // A failed started effect cannot prove non-issuance; never turn its uncertainty into known idle.
+        if (started &&
+            !(error instanceof TelegramApiAuthorityError && !error.requestIssued))
+            outcome = "unconfirmed";
         try {
             deps.recordRuntimeEvent?.("telegram-command", error, {
                 command,
@@ -1084,9 +2129,129 @@ function scheduleTelegramCommandEffect(ctx, command, phase, deps, effect, assert
         catch {
             // Effect diagnostics cannot create an unhandled detached Promise.
         }
-    });
+    })
+        .finally(() => work?.settle(outcome));
+}
+async function handleTelegramHelpCommand(commandName, message, ctx, deps, admission) {
+    const assertSemanticCurrent = admission?.assertSemanticCurrent ??
+        (() => deps.assertExecutionCurrent?.(message));
+    admission?.assertSemanticCurrent();
+    if (message.from?.id !== undefined &&
+        canPairTelegramUserFromCommandMessage(message)) {
+        const allowed = await pairTelegramUserIfNeeded(message.from.id, {
+            allowedUserId: deps.getAllowedUserId(),
+            ctx: undefined,
+            persistAllowedUserId: deps.persistAllowedUserId,
+            updateStatus: () => deps.updateStatus(ctx),
+            assertExecutionCurrent: assertSemanticCurrent,
+        });
+        if (!allowed)
+            return false;
+    }
+    if (admission) {
+        assertSemanticCurrent();
+        if (!admission.reportCompleted())
+            return false;
+        admission.assertRecipientCurrent();
+    }
+    const assertEffectCurrent = admission?.assertRecipientCurrent ??
+        (() => deps.assertExecutionCurrent?.(message));
+    const options = admission && {
+        assertAuthority: admission.assertRecipientCurrent,
+    };
+    const isContextActive = () => deps.isContextActive?.(ctx) !== false;
+    scheduleTelegramCommandEffect(ctx, commandName, "menu-render", deps, async () => {
+        let forumBootstrapMessage;
+        if (commandName === "start" && deps.handleForumBootstrap) {
+            forumBootstrapMessage = await deps.handleForumBootstrap(message, ctx, options);
+        }
+        if (!isContextActive())
+            return;
+        assertEffectCurrent();
+        if (forumBootstrapMessage) {
+            await deps.sendTextReply(message, forumBootstrapMessage, options);
+            assertEffectCurrent();
+        }
+        if (!isContextActive())
+            return;
+        assertEffectCurrent();
+        await deps.showStatus(message, ctx, options);
+    }, assertEffectCurrent);
+    scheduleTelegramCommandEffect(ctx, commandName, "bot-command-sync", deps, () => deps.registerBotCommands(options), assertEffectCurrent);
+    return true;
+}
+async function handleTelegramNameCommand(message, ctx, requestedName, deps, admission) {
+    const threadName = requestedName.trim();
+    const reply = async (text) => {
+        if (admission) {
+            admission.assertSemanticCurrent();
+            if (!admission.reportCompleted())
+                throw new Error("Selected name source completion refused.");
+            admission.assertRecipientCurrent();
+            await deps.sendTextReply(message, text, {
+                parseMode: "HTML",
+                assertAuthority: admission.assertRecipientCurrent,
+            });
+            admission.assertRecipientCurrent();
+        }
+        else {
+            deps.assertExecutionCurrent?.(message);
+            await deps.sendTextReply(message, text, { parseMode: "HTML" });
+            deps.assertExecutionCurrent?.(message);
+        }
+    };
+    if (!threadName) {
+        if (deps.openThreadNameDialog)
+            await deps.openThreadNameDialog(message, ctx);
+        else
+            await reply(formatTelegramInformationHeading("🏷️", "Usage: /name Navigator"));
+        return;
+    }
+    if (/^[A-Z]$/.test(threadName) && deps.resetCurrentThreadName) {
+        admission?.assertSemanticCurrent();
+        const target = getTelegramCommandMessageTarget(message);
+        const result = admission
+            ? await deps.resetCurrentThreadName(target, {
+                assertAuthority: admission.assertSemanticCurrent,
+            })
+            : await deps.resetCurrentThreadName(target);
+        admission?.assertSemanticCurrent();
+        await reply(result.ok && !result.message
+            ? formatTelegramAutomaticThreadDisplayNameRestoredHeading(result.threadName ?? threadName)
+            : formatTelegramInformationHeading(result.ok ? "✅" : "⚠️", result.message ?? "Thread display name reset failed."));
+        return;
+    }
+    admission?.assertSemanticCurrent();
+    const validationError = deps.validateThreadName?.(threadName);
+    admission?.assertSemanticCurrent();
+    if (validationError) {
+        await reply(formatTelegramInvalidInstanceName(validationError));
+        return;
+    }
+    if (!deps.renameCurrentThread) {
+        await reply(formatTelegramInformationHeading("🚫", "Thread display naming is unavailable."));
+        return;
+    }
+    if (admission)
+        admission.assertSemanticCurrent();
+    else
+        deps.assertExecutionCurrent?.(message);
+    const target = getTelegramCommandMessageTarget(message);
+    const result = admission
+        ? await deps.renameCurrentThread(target, threadName, {
+            assertAuthority: admission.assertSemanticCurrent,
+        })
+        : await deps.renameCurrentThread(target, threadName);
+    if (admission)
+        admission.assertSemanticCurrent();
+    else
+        deps.assertExecutionCurrent?.(message);
+    await reply(result.ok && !result.message
+        ? formatTelegramThreadDisplayNameSavedHeading(result.threadName ?? threadName)
+        : formatTelegramInformationHeading(result.ok ? "✅" : "⚠️", result.message ?? "Thread display name update failed."));
 }
 async function handleTelegramCommandRuntime(commandName, message, ctx, deps, commandArgs = "") {
+    deps.assertExecutionCurrent?.(message);
     const assertExecutionCurrentFor = (nextMessage) => () => deps.assertExecutionCurrent?.(nextMessage);
     const sendReplyFor = (nextMessage) => async (text, options) => {
         deps.assertExecutionCurrent?.(nextMessage);
@@ -1107,40 +2272,7 @@ async function handleTelegramCommandRuntime(commandName, message, ctx, deps, com
                 sendTextReply: sendReplyFor(nextMessage),
             });
         },
-        handleName: async (nextMessage, _commandCtx, requestedName) => {
-            const threadName = requestedName.trim();
-            if (!threadName) {
-                if (deps.openThreadNameDialog) {
-                    await deps.openThreadNameDialog(nextMessage, _commandCtx);
-                }
-                else {
-                    await sendReplyFor(nextMessage)(formatTelegramInformationHeading("🏷️", "Usage: /name Navigator"), { parseMode: "HTML" });
-                }
-                return;
-            }
-            if (/^[A-Z]$/.test(threadName) && deps.resetCurrentThreadName) {
-                const result = await deps.resetCurrentThreadName(getTelegramCommandMessageTarget(nextMessage));
-                await sendReplyFor(nextMessage)(result.ok && !result.message
-                    ? formatTelegramAutomaticThreadDisplayNameRestoredHeading(result.threadName ?? threadName)
-                    : formatTelegramInformationHeading(result.ok ? "✅" : "⚠️", result.message ?? "Thread display name reset failed."), { parseMode: "HTML" });
-                return;
-            }
-            const validationError = deps.validateThreadName?.(threadName);
-            if (validationError) {
-                await sendReplyFor(nextMessage)(formatTelegramInvalidInstanceName(validationError), { parseMode: "HTML" });
-                return;
-            }
-            if (!deps.renameCurrentThread) {
-                await sendReplyFor(nextMessage)(formatTelegramInformationHeading("🚫", "Thread display naming is unavailable."), { parseMode: "HTML" });
-                return;
-            }
-            deps.assertExecutionCurrent?.(nextMessage);
-            const result = await deps.renameCurrentThread(getTelegramCommandMessageTarget(nextMessage), threadName);
-            deps.assertExecutionCurrent?.(nextMessage);
-            await sendReplyFor(nextMessage)(result.ok && !result.message
-                ? formatTelegramThreadDisplayNameSavedHeading(result.threadName ?? threadName)
-                : formatTelegramInformationHeading(result.ok ? "✅" : "⚠️", result.message ?? "Thread display name update failed."), { parseMode: "HTML" });
-        },
+        handleName: (nextMessage, commandCtx, requestedName) => handleTelegramNameCommand(nextMessage, commandCtx, requestedName, deps),
         handleAbort: async (nextMessage, commandCtx) => {
             await handleTelegramAbortCommand({
                 hasAbortHandler: deps.hasAbortHandler,
@@ -1243,34 +2375,7 @@ async function handleTelegramCommandRuntime(commandName, message, ctx, deps, com
             }
             : undefined,
         handleHelp: async (nextMessage, nextCommandName, commandCtx) => {
-            if (nextMessage.from?.id !== undefined &&
-                canPairTelegramUserFromCommandMessage(nextMessage)) {
-                const allowed = await pairTelegramUserIfNeeded(nextMessage.from.id, {
-                    allowedUserId: deps.getAllowedUserId(),
-                    ctx: undefined,
-                    persistAllowedUserId: deps.persistAllowedUserId,
-                    updateStatus: updateStatusFor(commandCtx),
-                    assertExecutionCurrent: assertExecutionCurrentFor(nextMessage),
-                });
-                if (!allowed)
-                    return;
-            }
-            const isContextActive = () => deps.isContextActive?.(commandCtx) !== false;
-            scheduleTelegramCommandEffect(commandCtx, nextCommandName, "menu-render", deps, async () => {
-                let forumBootstrapMessage;
-                if (nextCommandName === "start" && deps.handleForumBootstrap) {
-                    forumBootstrapMessage = await deps.handleForumBootstrap(nextMessage, commandCtx);
-                }
-                if (!isContextActive())
-                    return;
-                if (forumBootstrapMessage) {
-                    await deps.sendTextReply(nextMessage, forumBootstrapMessage);
-                }
-                if (!isContextActive())
-                    return;
-                await deps.showStatus(nextMessage, commandCtx);
-            }, assertExecutionCurrentFor(nextMessage));
-            scheduleTelegramCommandEffect(commandCtx, nextCommandName, "bot-command-sync", deps, deps.registerBotCommands, assertExecutionCurrentFor(nextMessage));
+            await handleTelegramHelpCommand(nextCommandName, nextMessage, commandCtx, deps);
         },
     }, commandArgs);
 }
@@ -1282,7 +2387,8 @@ function delayTelegramSessionAction(delayMs) {
 }
 export async function settleTelegramSessionReplacement(deps) {
     const now = deps.now ?? Date.now;
-    const sleep = deps.sleep ?? ((delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs)));
+    const sleep = deps.sleep ??
+        ((delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs)));
     while (deps.isCurrent?.() !== false) {
         const intent = await deps.getIntent();
         if (!intent || intent.sourceSessionId === deps.sessionId)
@@ -1295,7 +2401,7 @@ export async function settleTelegramSessionReplacement(deps) {
             await sleep(100);
             continue;
         }
-        if (!await deps.clearIntent(intent))
+        if (!(await deps.clearIntent(intent)))
             return "failed";
         do {
             const delivered = await deps.editSuccess(intent);
@@ -1319,8 +2425,7 @@ function createTelegramSessionReplacementSettlementRuntime(deps) {
                 return;
             void settleTelegramSessionReplacement({
                 ...resolved,
-                isCurrent: () => currentGeneration === generation &&
-                    resolved.isCurrent?.() !== false,
+                isCurrent: () => currentGeneration === generation && resolved.isCurrent?.() !== false,
             }).then(deps.onResult, deps.onError);
         },
     };
@@ -1329,8 +2434,10 @@ export function createTelegramSessionActionAssembly(deps) {
     const now = deps.now ?? Date.now;
     const report = (error) => deps.recordRuntimeEvent?.("new-session", error);
     const sendTerminalResult = async (target, result) => {
-        const text = result === "success" ? "<b>🆕 New session started.</b>"
-            : result === "cancelled" ? "<b>🚫 New session cancelled.</b>"
+        const text = result === "success"
+            ? "<b>🆕 New session started.</b>"
+            : result === "cancelled"
+                ? "<b>🚫 New session cancelled.</b>"
                 : "<b>⚠️ New session failed.</b>";
         const deadline = now() + 10_000;
         do {
@@ -1346,9 +2453,12 @@ export function createTelegramSessionActionAssembly(deps) {
     const action = createTelegramSessionActionRuntime({
         registerCommand: deps.registerCommand,
         sendUserMessage: deps.sendUserMessage,
-        notifyResult(target, result) { return sendTerminalResult(target, result); },
+        notifyResult(target, result) {
+            return sendTerminalResult(target, result);
+        },
         async prepareReplacement(ctx, updateId, target) {
-            const follower = !deps.ownsPersistence() && typeof target.threadId === "number" &&
+            const follower = !deps.ownsPersistence() &&
+                typeof target.threadId === "number" &&
                 deps.follower?.isRegisteredFor(target)
                 ? deps.follower
                 : undefined;
@@ -1375,15 +2485,16 @@ export function createTelegramSessionActionAssembly(deps) {
                 target: binding ? { ...binding.target } : { chatId: target.chatId },
                 messageId: target.messageId,
                 ...(binding?.slot ? { slot: binding.slot } : {}),
-                ...(binding?.manualThreadName ?? binding?.threadName
-                    ? { threadName: binding.manualThreadName ?? binding.threadName } : {}),
+                ...((binding?.manualThreadName ?? binding?.threadName)
+                    ? { threadName: binding.manualThreadName ?? binding.threadName }
+                    : {}),
                 createdAtMs,
                 expiresAtMs: createdAtMs + deps.handoffTtlMs,
                 ...(follower ? { sourceInstanceId: follower.instanceId } : {}),
             };
-            if (!await (follower
+            if (!(await (follower
                 ? follower.requestSessionReplacement("publish", intent)
-                : deps.store.commitSessionReplacementIntent(intent, deps.ownsPersistence))) {
+                : deps.store.commitSessionReplacementIntent(intent, deps.ownsPersistence)))) {
                 throw new Error("Telegram session replacement intent was not persisted.");
             }
         },
@@ -1395,23 +2506,30 @@ export function createTelegramSessionActionAssembly(deps) {
             if (!sessionId)
                 return undefined;
             return {
-                async getIntent() { await deps.store.refresh?.(); return deps.store.getSessionReplacementIntent(); },
+                async getIntent() {
+                    await deps.store.refresh?.();
+                    return deps.store.getSessionReplacementIntent();
+                },
                 hasSuccessorContinuity(intent) {
                     if (intent.continuity === "classic-chat")
                         return true;
-                    if (deps.store.getWorkspaceBindingByTarget(intent.target, sessionId)?.cwd !==
-                        intent.cwd)
+                    if (deps.store.getWorkspaceBindingByTarget(intent.target, sessionId)
+                        ?.cwd !== intent.cwd)
                         return false;
                     // A follower successor claims only after its own re-registration is live.
-                    return intent.sourceInstanceId === undefined || deps.ownsPersistence() ||
-                        deps.follower?.isRegisteredFor(intent.target) === true;
+                    return (intent.sourceInstanceId === undefined ||
+                        deps.ownsPersistence() ||
+                        deps.follower?.isRegisteredFor(intent.target) === true);
+                },
+                editSuccess(intent) {
+                    return deps.sendResult(intent.target, "<b>🆕 New session started.</b>");
                 },
-                editSuccess(intent) { return deps.sendResult(intent.target, "<b>🆕 New session started.</b>"); },
                 async clearIntent(intent) {
-                    if (intent.sourceInstanceId === undefined || deps.ownsPersistence()) {
+                    if (intent.sourceInstanceId === undefined ||
+                        deps.ownsPersistence()) {
                         return deps.store.removeSessionReplacementIntent(intent, deps.ownsPersistence);
                     }
-                    return await deps.follower?.requestSessionReplacement("settle", intent) ?? false;
+                    return ((await deps.follower?.requestSessionReplacement("settle", intent)) ?? false);
                 },
                 profileName: deps.getProfileName() ?? "default",
                 cwd: ctx.cwd,