@llblab/pi-telegram 0.52.2 → 0.53.1

package/lib/commands.ts

@@ -4,31 +4,149 @@
  * Owns Telegram slash-command normalization, bot command metadata, pi-side command registration, and command-initiated session replacement orchestration behind runtime ports
  */
 
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { addAbortListener } from "node:events";
+import { isDeepStrictEqual } from "node:util";
 
+import type { TelegramActivityPublicationWork } from "./activity.ts";
 import {
   pairTelegramUserIfNeeded,
-  type TelegramConfigStore,
   TELEGRAM_DEFAULT_PROFILE_NAME,
+  type TelegramConfigStore,
 } from "./config.ts";
 import type * as Pi from "./pi.ts";
 import type { ExtensionAPI, ExtensionCommandContext } from "./pi.ts";
-import { escapeHtml } from "./rendering.ts";
-import { formatTelegramConnectionFailure, type TelegramBridgeStatusLineOptions } from "./status.ts";
-import type { TelegramSessionReplacementIntent } from "./threads.ts";
+import { isPiStaleContextError } from "./pi.ts";
+import type { TelegramPromptTemplateCommand } from "./prompt-templates.ts";
 import {
   createTelegramControlItemBuilder,
   createTelegramControlQueueController,
   createTelegramQueueAdmissionReceipt,
   type PendingTelegramControlItem,
+  type TelegramControlQueueController,
+  type TelegramControlQueueControllerDeps,
   type TelegramQueueAdmissionReceipt,
 } from "./queue.ts";
+import { escapeHtml } from "./rendering.ts";
+import {
+  formatTelegramConnectionFailure,
+  type TelegramBridgeStatusLineOptions,
+} from "./status.ts";
+import {
+  TelegramApiAuthorityError,
+  type TelegramApiCallOptions,
+} from "./telegram-api.ts";
+import type { TelegramSessionReplacementIntent } from "./threads.ts";
+import {
+  acquireTelegramUpdateRouting,
+  carryTelegramUpdateExecutionFence,
+  getTelegramUpdateExecutionFence,
+  inspectTelegramDeferredSource,
+  prepareTelegramDeferredQueueAdmission,
+  reportTelegramQueueAdmission,
+  type TelegramDeferredQueueAdmissionPreparation,
+  type TelegramDeferredSourceCompletionPreparation,
+  type TelegramDeferredSourceEvidence,
+  type TelegramLiveSourceCompletionReadiness,
+  type TelegramQueueAdmissionReceiptLike,
+  type TelegramUpdateWorkerRuntimeDeps,
+} from "./updates.ts";
+
+export type TelegramHeldCommandName =
+  "status" | "abort" | "stop" | "next" | "continue";
+
+/** Commands-owned no-fold admission over the ordinary recipient queue; source reporting stays separate from removal. */
+export interface TelegramHeldTurnAdmission {
+  assertCurrent(): void;
+  report(receipts: readonly TelegramQueueAdmissionReceiptLike[]): void;
+}
+
+export interface TelegramPreparedHeldCommand {
+  readonly source: TelegramDeferredSourceEvidence;
+  readonly command: ParsedTelegramCommand;
+  bindCarrier(value: unknown): boolean;
+  execute(): Promise<boolean>;
+  /** Source disposal only, independent of detached delivery and ended source-execution/chooser callbacks. */
+  inspectCompletion(): TelegramDeferredSourceEvidence | undefined;
+}
+
+/** Saved-original admission for a held follower plan: fixed target plus independent source and recipient lifetimes. */
+export interface TelegramHeldCommandAdmission {
+  target: { chatId: number; threadId: number };
+  assertSourceCurrent(): void;
+  assertRecipientCurrent(): void;
+}
+
+/** Recipient-scoped reply sender; the plan never falls back to ordinary follower API delivery. */
+export interface TelegramHeldCommandReply {
+  sendTextReply(
+    chatId: number,
+    replyToMessageId: number,
+    text: string,
+    options: {
+      parseMode?: "HTML";
+      target: { chatId: number; threadId: number };
+      assertAuthority: () => void;
+    },
+  ): Promise<unknown>;
+}
+
+/** Captured recipient effects; a supplied but unavailable effect never falls back to ordinary dispatch. */
+export type TelegramHeldCommandEffects<TContext> = Partial<
+  TelegramHeldCommandReply &
+    Pick<
+      TelegramCommandHandlerTargetRuntimeDeps<
+        TelegramCommandRuntimeMessage,
+        TContext
+      >,
+      "showStatus"
+    >
+>;
 
 export interface ParsedTelegramCommand {
   name: string;
   args: string;
 }
 
+/** Exact singleton operator-private text command original eligible for a held follower plan. */
+export function isTelegramSelectedHeldOriginal(
+  update: unknown,
+  target: { chatId: number; threadId: number },
+  operator: number | undefined,
+  name: string,
+): boolean {
+  if (
+    !update ||
+    typeof update !== "object" ||
+    Array.isArray(update) ||
+    Object.keys(update).some((key) => !["update_id", "message"].includes(key))
+  )
+    return false;
+  const value = Reflect.get(update, "message");
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const text = Reflect.get(value, "text"),
+    chat = Reflect.get(value, "chat"),
+    from = Reflect.get(value, "from");
+  return (
+    typeof text === "string" &&
+    parseTelegramCommand(text)?.name === name &&
+    value.caption === undefined &&
+    value.media_group_id === undefined &&
+    chat?.type === "private" &&
+    from?.is_bot === false &&
+    from.id === operator &&
+    chat.id === operator &&
+    Number.isSafeInteger(value.message_id) &&
+    value.message_id > 0 &&
+    typeof operator === "number" &&
+    Number.isSafeInteger(operator) &&
+    operator > 0 &&
+    target.chatId === operator &&
+    Number.isSafeInteger(target.threadId) &&
+    target.threadId > 0
+  );
+}
+
 export interface TelegramBotCommandDefinition {
   command: string;
   description: string;
@@ -49,6 +167,27 @@ export interface TelegramExtensionCommandContext {
   enqueuePrompt: (prompt: string) => Promise<void>;
 }
 
+export interface SelectedPreparationInput {
+  readonly name: string;
+  readonly args: string;
+}
+
+export interface SelectedCommandExecution {
+  /** Recheck before producer mutations and after awaits; this is a trusted contract, not a sandbox. */
+  assertCurrent(): void;
+  /** Acceptance of semantic completion only, never a source-removal ACK or delivery/cleanup proof. */
+  reportCompleted(): boolean;
+  /** Queue detached recipient text without waiting for delivery as semantic completion. */
+  reply(text: string): void;
+}
+
+export type PreparedSelectedCommand =
+  | {
+      kind: "command-only";
+      execute(ctx: SelectedCommandExecution): void | Promise<void>;
+    }
+  | { kind: "generated-prompt"; prompt: string };
+
 export interface TelegramExtensionCommandRegistration {
   name: string;
   description?: string;
@@ -56,6 +195,15 @@ export interface TelegramExtensionCommandRegistration {
   showInMenu?: boolean;
   emoji?: string;
   handler: (ctx: TelegramExtensionCommandContext) => Promise<void> | void;
+  /** Trusted side-effect-free plan preparation for single-message leader selection; ordinary dispatch still uses handler. */
+  selected?: {
+    prepare(
+      input: SelectedPreparationInput,
+    ):
+      | PreparedSelectedCommand
+      | undefined
+      | Promise<PreparedSelectedCommand | undefined>;
+  };
 }
 
 interface RegisteredTelegramExtensionCommand {
@@ -65,6 +213,7 @@ interface RegisteredTelegramExtensionCommand {
   showInMenu: boolean;
   emoji?: string;
   handler: TelegramExtensionCommandRegistration["handler"];
+  selected?: Readonly<TelegramExtensionCommandRegistration["selected"]>;
 }
 
 interface TelegramExtensionCommandRegistry {
@@ -137,6 +286,9 @@ export function registerTelegramCommand(
     showInMenu,
     emoji,
     handler: registration.handler,
+    selected: registration.selected
+      ? Object.freeze({ prepare: registration.selected.prepare })
+      : undefined,
   };
   registry.commands.set(name, command);
   return () => {
@@ -159,6 +311,76 @@ export function findTelegramExtensionCommand(
   );
 }
 
+/** Preparation only: no execution, admission, source freeze or binding effects. Routing owns those later. */
+export async function prepareTelegramSelectedExtensionCommand(
+  command: ParsedTelegramCommand,
+  authority: { assertSourceCurrent(): void; assertRecipientCurrent(): void },
+): Promise<
+  | {
+      plan: Readonly<PreparedSelectedCommand>;
+      assertRegistrationCurrent(): void;
+    }
+  | undefined
+> {
+  const registration = findTelegramExtensionCommand(command.name),
+    selected = registration?.selected;
+  const prepare = selected?.prepare;
+  if (!registration || !selected || typeof prepare !== "function")
+    return undefined;
+  const input = Object.freeze({ name: registration.name, args: command.args });
+  const { assertSourceCurrent, assertRecipientCurrent } = authority;
+  const assertRegistrationCurrent = () => {
+    if (
+      findTelegramExtensionCommand(input.name) !== registration ||
+      registration.selected !== selected ||
+      selected.prepare !== prepare
+    )
+      throw new Error("Selected extension command registration changed.");
+  };
+  const assertCurrent = () => {
+    assertSourceCurrent();
+    assertRecipientCurrent();
+    assertRegistrationCurrent();
+  };
+  try {
+    assertCurrent();
+    const prepared = await prepare(input);
+    assertCurrent();
+    if (!prepared || typeof prepared !== "object" || Array.isArray(prepared))
+      return undefined;
+    const keys = Reflect.ownKeys(prepared),
+      kind = prepared.kind;
+    let plan: PreparedSelectedCommand;
+    if (
+      kind === "command-only" &&
+      keys.length === 2 &&
+      keys.includes("kind") &&
+      keys.includes("execute")
+    ) {
+      const execute = prepared.execute;
+      if (typeof execute !== "function") return undefined;
+      plan = { kind, execute };
+    } else if (
+      kind === "generated-prompt" &&
+      keys.length === 2 &&
+      keys.includes("kind") &&
+      keys.includes("prompt")
+    ) {
+      const prompt = prepared.prompt;
+      if (typeof prompt !== "string" || !prompt.trim()) return undefined;
+      plan = { kind, prompt };
+    } else return undefined;
+    // Producer accessors can invalidate authority while the plan is being copied.
+    assertCurrent();
+    return Object.freeze({
+      plan: Object.freeze(plan),
+      assertRegistrationCurrent,
+    });
+  } catch {
+    return undefined;
+  }
+}
+
 export function clearTelegramExtensionCommands(): void {
   getOrCreateTelegramCommandRegistry().commands.clear();
 }
@@ -181,9 +403,7 @@ export const TELEGRAM_COMMAND_EMOJI = {
 
 export type TelegramCommandEmojiName = keyof typeof TELEGRAM_COMMAND_EMOJI;
 
-function getTelegramCommandEmoji(
-  command: TelegramCommandEmojiName,
-): string {
+function getTelegramCommandEmoji(command: TelegramCommandEmojiName): string {
   return TELEGRAM_COMMAND_EMOJI[command];
 }
 
@@ -215,11 +435,11 @@ export function formatTelegramInvalidInstanceName(
     .split(/;\s+|(?<=\.)\s+(?=[A-Z])/)
     .map((item) => item.trim())
     .filter(Boolean)
-    .map((item) => /[.!?]$/.test(item) ? item : `${item}.`)
+    .map((item) => (/[.!?]$/.test(item) ? item : `${item}.`))
     .map((item) => item[0]!.toUpperCase() + item.slice(1));
   return [
     "<b>⚠️ Invalid Thread Display Name:</b>\n",
-    ...items.map((item) => `• ${escapeHtml(item)}`),
+    ...items.map((item) => `<code>-</code> ${escapeHtml(item)}`),
   ].join("\n");
 }
 
@@ -235,15 +455,15 @@ export function formatTelegramAutomaticThreadDisplayNameRestoredHeading(
   return `<b>✅ Automatic Thread display name restored as <i>${escapeHtml(name)}</i>.</b>`;
 }
 
-const TELEGRAM_COMPACTION_STARTED_TEXT =
-  formatTelegramInformationHeading(
-    getTelegramCommandEmoji("compact"),
-    "Compaction started.",
-  );
-const TELEGRAM_COMPACTION_COMPLETED_TEXT =
-  formatTelegramInformationHeading("✅", "Compaction completed.");
-export const TELEGRAM_COMPACTION_STARTED_MARKDOWN =
-  `**${formatTelegramCommandEmojiPrefix("compact")}Compaction started.**`;
+const TELEGRAM_COMPACTION_STARTED_TEXT = formatTelegramInformationHeading(
+  getTelegramCommandEmoji("compact"),
+  "Compaction started.",
+);
+const TELEGRAM_COMPACTION_COMPLETED_TEXT = formatTelegramInformationHeading(
+  "✅",
+  "Compaction completed.",
+);
+export const TELEGRAM_COMPACTION_STARTED_MARKDOWN = `**${formatTelegramCommandEmojiPrefix("compact")}Compaction started.**`;
 export const TELEGRAM_COMPACTION_COMPLETED_MARKDOWN =
   "**✅ Compaction completed.**";
 
@@ -254,55 +474,51 @@ function formatTelegramBotCommandDescription(
   return `${formatTelegramCommandEmojiPrefix(command)}${description}`;
 }
 
-const TELEGRAM_BUILTIN_BOT_COMMANDS: readonly TelegramBotCommandDefinition[] =
-  [
-    {
-      command: "start",
-      description: formatTelegramBotCommandDescription(
-        "start",
-        "Open menu / Pair bridge",
-      ),
-    },
-    {
-      command: "compact",
-      description: formatTelegramBotCommandDescription(
-        "compact",
-        "Compact current session",
-      ),
-    },
-    {
-      command: "new",
-      description: formatTelegramBotCommandDescription(
-        "new",
-        "Start a new session",
-      ),
-    },
-    {
-      command: "continue",
-      description: formatTelegramBotCommandDescription(
-        "continue",
-        "Queue continue prompt",
-      ),
-    },
-    {
-      command: "next",
-      description: formatTelegramBotCommandDescription(
-        "next",
-        "Force next turn",
-      ),
-    },
-    {
-      command: "abort",
-      description: formatTelegramBotCommandDescription("abort", "Abort Pi"),
-    },
-    {
-      command: "stop",
-      description: formatTelegramBotCommandDescription(
-        "stop",
-        "Abort Pi & Clear queue",
-      ),
-    },
-  ];
+const TELEGRAM_BUILTIN_BOT_COMMANDS: readonly TelegramBotCommandDefinition[] = [
+  {
+    command: "start",
+    description: formatTelegramBotCommandDescription(
+      "start",
+      "Open menu / Pair bridge",
+    ),
+  },
+  {
+    command: "compact",
+    description: formatTelegramBotCommandDescription(
+      "compact",
+      "Compact current session",
+    ),
+  },
+  {
+    command: "new",
+    description: formatTelegramBotCommandDescription(
+      "new",
+      "Start a new session",
+    ),
+  },
+  {
+    command: "continue",
+    description: formatTelegramBotCommandDescription(
+      "continue",
+      "Queue continue prompt",
+    ),
+  },
+  {
+    command: "next",
+    description: formatTelegramBotCommandDescription("next", "Force next turn"),
+  },
+  {
+    command: "abort",
+    description: formatTelegramBotCommandDescription("abort", "Abort Pi"),
+  },
+  {
+    command: "stop",
+    description: formatTelegramBotCommandDescription(
+      "stop",
+      "Abort Pi & Clear queue",
+    ),
+  },
+];
 
 export const TELEGRAM_BOT_COMMANDS = TELEGRAM_BUILTIN_BOT_COMMANDS;
 
@@ -325,25 +541,38 @@ export function getTelegramReservedCommandNames(): string[] {
 export interface TelegramBotCommandRegistrationDeps {
   setMyCommands: (
     commands: readonly TelegramBotCommandDefinition[],
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<unknown>;
 }
 
 export async function registerTelegramBotCommands(
   deps: TelegramBotCommandRegistrationDeps,
+  options?: Pick<TelegramApiCallOptions, "assertAuthority">,
 ): Promise<void> {
+  const assertAuthority = options?.assertAuthority,
+    send = deps.setMyCommands;
+  const capturedOptions = assertAuthority ? { assertAuthority } : undefined;
+  const setMyCommands = async (
+    commands: readonly TelegramBotCommandDefinition[],
+  ) => {
+    assertAuthority?.();
+    await send(commands, capturedOptions);
+    assertAuthority?.();
+  };
+  assertAuthority?.();
   const extensionCommands = getVisibleTelegramExtensionBotCommands();
   if (extensionCommands.length === 0) {
-    await deps.setMyCommands(TELEGRAM_BOT_COMMANDS);
+    await setMyCommands(TELEGRAM_BOT_COMMANDS);
     return;
   }
   const nextCommandIndex = TELEGRAM_BOT_COMMANDS.findIndex(
     (command) => command.command === "next",
   );
   if (nextCommandIndex === -1) {
-    await deps.setMyCommands([...TELEGRAM_BOT_COMMANDS, ...extensionCommands]);
+    await setMyCommands([...TELEGRAM_BOT_COMMANDS, ...extensionCommands]);
     return;
   }
-  await deps.setMyCommands([
+  await setMyCommands([
     ...TELEGRAM_BOT_COMMANDS.slice(0, nextCommandIndex + 1),
     ...extensionCommands,
     ...TELEGRAM_BOT_COMMANDS.slice(nextCommandIndex + 1),
@@ -352,15 +581,32 @@ export async function registerTelegramBotCommands(
 
 export function createTelegramBotCommandRegistrar(
   deps: TelegramBotCommandRegistrationDeps,
-): () => Promise<void> {
-  let pending: Promise<void> | undefined;
-  return () => {
-    if (pending) return pending;
+): (
+  options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+) => Promise<void> {
+  // Only an identical local lifetime may share an in-flight sync; unguarded calls remain separate.
+  const pending = new Map<
+    TelegramApiCallOptions["assertAuthority"],
+    Promise<void>
+  >();
+  return (options) => {
+    const assertAuthority = options?.assertAuthority;
+    try {
+      assertAuthority?.();
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    const joined = pending.get(assertAuthority);
+    if (joined) return joined;
     let request: Promise<void>;
-    request = registerTelegramBotCommands(deps).finally(() => {
-      if (pending === request) pending = undefined;
+    request = registerTelegramBotCommands(
+      deps,
+      assertAuthority ? { assertAuthority } : undefined,
+    ).finally(() => {
+      if (pending.get(assertAuthority) === request)
+        pending.delete(assertAuthority);
     });
-    pending = request;
+    pending.set(assertAuthority, request);
     return request;
   };
 }
@@ -377,13 +623,11 @@ export interface TelegramBridgeCommandStartPollingResult {
   owner?: string;
 }
 
-export type TelegramPollingStartRecoveryResult =
-  | { kind: "unhandled" }
-  | { kind: "retry"; message: string }
-  | { kind: "blocked"; message: string };
-
 export interface TelegramBridgeCommandRegistrationDeps {
-  promptForConfig: (ctx: ExtensionCommandContext, profileName?: string) => Promise<void>;
+  promptForConfig: (
+    ctx: ExtensionCommandContext,
+    profileName?: string,
+  ) => Promise<void>;
   getStatusLines: (options?: TelegramBridgeStatusLineOptions) => string[];
   reloadConfig: () => Promise<void>;
   hasBotToken: () => boolean;
@@ -396,9 +640,6 @@ export interface TelegramBridgeCommandRegistrationDeps {
     | Promise<void | TelegramBridgeCommandStartPollingResult>
     | TelegramBridgeCommandStartPollingResult;
   stopPolling: () => Promise<void | string>;
-  recoverPollingStart?: (
-    error: unknown,
-  ) => Promise<TelegramPollingStartRecoveryResult>;
   recordConnectionEvent?: (error: unknown, phase: string) => void;
   getDisconnectThreadName?: () => string | undefined;
   queueAgentConnectionContext?: (connected: boolean) => void;
@@ -412,7 +653,10 @@ export interface TelegramBridgeCommandRegistrationDeps {
     cancel(): void;
   };
   getProfileNames?: () => string[];
-  activateDefaultProfileConfig?: (ctx: ExtensionCommandContext, isCurrent: () => boolean) => Promise<void>;
+  activateDefaultProfileConfig?: (
+    ctx: ExtensionCommandContext,
+    isCurrent: () => boolean,
+  ) => Promise<void>;
   activateProfileConfig?: (
     ctx: ExtensionCommandContext,
     profileName: string,
@@ -420,13 +664,17 @@ export interface TelegramBridgeCommandRegistrationDeps {
   ) => Promise<boolean>;
 }
 
+/** Bound adapters must carry the optional recipient guard through their own effect/publication awaits. */
 export type TelegramThreadDisplayNameRenamePort = (
   target: { chatId: number; threadId?: number },
   threadName: string,
+  options?: Pick<TelegramApiCallOptions, "assertAuthority">,
 ) => Promise<{ ok: boolean; threadName?: string; message?: string }>;
 
+/** Reset adapters must preserve the same optional recipient lifetime as manual rename adapters. */
 export type TelegramThreadDisplayNameResetPort = (
   target: { chatId: number; threadId?: number },
+  options?: Pick<TelegramApiCallOptions, "assertAuthority">,
 ) => Promise<{
   ok: boolean;
   threadName?: string;
@@ -437,13 +685,37 @@ export function createTelegramThreadDisplayNameResetBinding(): {
   bind: (reset: TelegramThreadDisplayNameResetPort) => void;
   reset: TelegramThreadDisplayNameResetPort;
 } {
-  let current: TelegramThreadDisplayNameResetPort | undefined;
+  let current: TelegramThreadDisplayNameResetPort | undefined,
+    generation = 0;
   return {
-    bind(reset) { current = reset; },
-    async reset(target) {
-      return current
-        ? current(target)
-        : { ok: false, message: "Thread display name reset is unavailable." };
+    bind(reset) {
+      current = reset;
+      generation++;
+    },
+    async reset(target, options) {
+      const reset = current,
+        assertAuthority = options?.assertAuthority,
+        capturedGeneration = generation;
+      const capturedTarget = {
+        chatId: target.chatId,
+        ...(target.threadId === undefined ? {} : { threadId: target.threadId }),
+      };
+      if (!reset)
+        return {
+          ok: false,
+          message: "Thread display name reset is unavailable.",
+        };
+      const assertCurrent = () => {
+        assertAuthority?.();
+        if (assertAuthority && generation !== capturedGeneration)
+          throw new Error("Thread display name reset binding changed.");
+      };
+      assertCurrent();
+      const result = assertAuthority
+        ? await reset(capturedTarget, { assertAuthority: assertCurrent })
+        : await reset(capturedTarget);
+      assertCurrent();
+      return result;
     },
   };
 }
@@ -452,19 +724,40 @@ export function createTelegramThreadDisplayNameRenameBinding(): {
   bind: (rename: TelegramThreadDisplayNameRenamePort) => void;
   rename: TelegramThreadDisplayNameRenamePort;
 } {
-  let current: TelegramThreadDisplayNameRenamePort | undefined;
+  let current: TelegramThreadDisplayNameRenamePort | undefined,
+    generation = 0;
   return {
     bind(rename) {
       current = rename;
+      generation++;
     },
-    async rename(target, threadName) {
-      if (!current) {
+    async rename(target, threadName, options) {
+      const rename = current,
+        assertAuthority = options?.assertAuthority,
+        capturedGeneration = generation;
+      const capturedTarget = {
+        chatId: target.chatId,
+        ...(target.threadId === undefined ? {} : { threadId: target.threadId }),
+      };
+      if (!rename) {
         return {
           ok: false,
           message: "Thread display naming is unavailable.",
         };
       }
-      return current(target, threadName);
+      const assertCurrent = () => {
+        assertAuthority?.();
+        if (assertAuthority && generation !== capturedGeneration)
+          throw new Error("Thread display naming binding changed.");
+      };
+      assertCurrent();
+      const result = assertAuthority
+        ? await rename(capturedTarget, threadName, {
+            assertAuthority: assertCurrent,
+          })
+        : await rename(capturedTarget, threadName);
+      assertCurrent();
+      return result;
     },
   };
 }
@@ -519,10 +812,16 @@ export function registerTelegramBridgeCommands(
       // Pi context getters throw after replacement; check plain intent/generation first.
       const isCurrent = () =>
         (!intentId || deps.connectionIntent?.isActive(intentId) !== false) &&
-        (sessionGeneration === undefined || deps.getSessionGeneration?.() === sessionGeneration) &&
+        (sessionGeneration === undefined ||
+          deps.getSessionGeneration?.() === sessionGeneration) &&
         deps.isContextCurrent?.(ctx) !== false;
       if (!isCurrent()) return;
-      if (args.trim().split(/\s+/).some((word) => /^as=/i.test(word))) {
+      if (
+        args
+          .trim()
+          .split(/\s+/)
+          .some((word) => /^as=/i.test(word))
+      ) {
         ctx.ui.notify(
           "Thread names are configured from Telegram, not from Pi commands.",
           "warning",
@@ -534,7 +833,11 @@ export function registerTelegramBridgeCommands(
       intentId = deps.connectionIntent?.begin(ctx.cwd, profileName);
       try {
         if (profileName && deps.activateProfileConfig) {
-          const ok = await deps.activateProfileConfig(ctx, profileName, isCurrent);
+          const ok = await deps.activateProfileConfig(
+            ctx,
+            profileName,
+            isCurrent,
+          );
           if (!isCurrent()) return;
           if (!ok) {
             ctx.ui.notify(`Profile "${profileName}" not found.`, "error");
@@ -543,7 +846,8 @@ export function registerTelegramBridgeCommands(
           }
           ctx.ui.notify(`Activated profile "${profileName}".`, "info");
         } else {
-          await (deps.activateDefaultProfileConfig?.(ctx, isCurrent) ?? deps.reloadConfig());
+          await (deps.activateDefaultProfileConfig?.(ctx, isCurrent) ??
+            deps.reloadConfig());
           if (!isCurrent()) return;
         }
         if (!deps.hasBotToken()) {
@@ -561,46 +865,17 @@ export function registerTelegramBridgeCommands(
           await deps.promptForConfig(ctx, profileName);
           return;
         }
-        let recoveryUsed = false;
-        const startWithRecovery = async (
+        const startPolling = async (
           options: TelegramBridgeCommandStartPollingOptions,
-        ): Promise<void | (TelegramBridgeCommandStartPollingResult & { notice?: string })> => {
+        ): Promise<void | TelegramBridgeCommandStartPollingResult> => {
           try {
             return await deps.startPolling(ctx, options);
           } catch (error) {
             if (!isCurrent()) return;
-            if (!deps.recoverPollingStart || recoveryUsed) throw error;
-            deps.recordConnectionEvent?.(error, "polling-start");
-            const recovery = await deps.recoverPollingStart(error);
-            if (!isCurrent()) return;
-            if (recovery.kind === "unhandled") throw error;
-            if (recovery.kind === "blocked") {
-              return { ok: false, message: recovery.message,
-                notice: "Telegram recovery blocked. Check /telegram-status --debug." };
-            }
-            recoveryUsed = true;
-            deps.recordConnectionEvent?.(recovery.message, "recovery");
-            try {
-              const retry = await deps.startPolling(ctx, options);
-              if (!isCurrent()) return;
-              if (!retry) return { ok: true, message: "Telegram bridge connected; temporary state recovered." };
-              return {
-                ...retry,
-                message: retry.ok
-                  ? "Telegram bridge connected; temporary state recovered."
-                  : retry.message,
-              };
-            } catch (error) {
-              if (!isCurrent()) return;
-              deps.recordConnectionEvent?.(error, "recovery-retry");
-              return {
-                ok: false,
-                notice: "Telegram recovery failed. Restart this Pi instance.",
-              };
-            }
+            throw error;
           }
         };
-        let result = await startWithRecovery({ forceFreshLeaderThread: true });
+        let result = await startPolling({ forceFreshLeaderThread: true });
         if (!isCurrent()) return;
         if (result && !result.ok && result.canTakeover) {
           const confirmed = await ctx.ui.confirm(
@@ -613,12 +888,19 @@ export function registerTelegramBridgeCommands(
             deps.updateStatus(ctx);
             return;
           }
-          result = await startWithRecovery({ force: true, forceFreshLeaderThread: true });
+          result = await startPolling({
+            force: true,
+            forceFreshLeaderThread: true,
+          });
           if (!isCurrent()) return;
         }
         if (result && !result.ok) {
-          if (result.message) deps.recordConnectionEvent?.(result.message, "connect-refused");
-          ctx.ui.notify(result.notice ?? formatTelegramConnectionFailure(result.message), "warning");
+          if (result.message)
+            deps.recordConnectionEvent?.(result.message, "connect-refused");
+          ctx.ui.notify(
+            formatTelegramConnectionFailure(result.message),
+            "warning",
+          );
         } else if (result?.message) {
           ctx.ui.notify(result.message, "info");
         }
@@ -639,7 +921,8 @@ export function registerTelegramBridgeCommands(
     handler: async (_args, ctx) => {
       const generation = deps.getSessionGeneration?.();
       const isCurrent = () =>
-        (generation === undefined || deps.getSessionGeneration?.() === generation) &&
+        (generation === undefined ||
+          deps.getSessionGeneration?.() === generation) &&
         deps.isContextCurrent?.(ctx) !== false;
       if (!isCurrent()) return;
       deps.connectionIntent?.cancel();
@@ -663,7 +946,10 @@ export function registerTelegramBridgeCommands(
       } catch (error) {
         deps.recordConnectionEvent?.(error, "disconnect");
         if (!isCurrent()) return;
-        ctx.ui.notify("Telegram disconnect incomplete; keep Pi open. Check /telegram-status --debug.", "warning");
+        ctx.ui.notify(
+          "Telegram disconnect incomplete; keep Pi open. Check /telegram-status --debug.",
+          "warning",
+        );
       } finally {
         if (isCurrent()) deps.updateStatus(ctx);
       }
@@ -724,8 +1010,6 @@ export type TelegramCommandAction =
       executionMode: "immediate";
     };
 
-export type TelegramCommandExecutionMode = "ignored" | "immediate";
-
 export interface TelegramCommandActionDeps<TMessage, TContext> {
   handleStop: (message: TMessage, ctx: TContext) => Promise<void>;
   handleName: (message: TMessage, ctx: TContext, name: string) => Promise<void>;
@@ -772,13 +1056,29 @@ export interface TelegramCompactConfirmationReplyMarkup {
   inline_keyboard: { text: string; callback_data: string }[][];
 }
 
-export interface TelegramCompactCommandDeps extends TelegramRuntimeEventRecorderPort {
+/** Pi or Telegram work that must drain before a session-level command may replace or compact the session. */
+export interface TelegramSessionBusyPorts {
   isIdle: () => boolean;
   hasPendingMessages: () => boolean;
   hasActiveTelegramTurn: () => boolean;
   hasDispatchPending: () => boolean;
   hasQueuedTelegramItems: () => boolean;
   isCompactionInProgress: () => boolean;
+}
+
+function isTelegramSessionBusy(ports: TelegramSessionBusyPorts): boolean {
+  return (
+    !ports.isIdle() ||
+    ports.hasPendingMessages() ||
+    ports.hasActiveTelegramTurn() ||
+    ports.hasDispatchPending() ||
+    ports.hasQueuedTelegramItems() ||
+    ports.isCompactionInProgress()
+  );
+}
+
+export interface TelegramCompactCommandDeps
+  extends TelegramRuntimeEventRecorderPort, TelegramSessionBusyPorts {
   setCompactionInProgress: (inProgress: boolean) => void;
   updateStatus: () => void;
   dispatchNextQueuedTelegramTurn: () => void;
@@ -804,7 +1104,10 @@ export interface TelegramCompactConfirmationDeps {
     text: string,
     mode: "markdown" | "html" | "plain",
     replyMarkup: TelegramCompactConfirmationReplyMarkup,
-    options?: { target?: { chatId: number; threadId?: number } },
+    options?: {
+      target?: { chatId: number; threadId?: number };
+      assertAuthority?: TelegramApiCallOptions["assertAuthority"];
+    },
   ) => Promise<number | undefined>;
 }
 
@@ -863,7 +1166,7 @@ export interface TelegramCommandRuntimeMessage {
   chat: { id: number; type?: string; title?: string };
   message_id: number;
   message_thread_id?: number;
-  from?: { id?: number };
+  from?: { id?: number; is_bot?: boolean };
   pi_telegram_source_update_id?: number;
 }
 
@@ -900,18 +1203,21 @@ export interface TelegramCommandTargetRuntimeDeps<TContext> {
     replyToMessageId: number,
     ctx: TContext,
     threadId?: number,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   openModelMenu: (
     chatId: number,
     replyToMessageId: number,
     ctx: TContext,
     threadId?: number,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   openSettingsMenu?: (
     chatId: number,
     replyToMessageId: number,
     ctx: TContext,
     threadId?: number,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<void>;
   sendTextReply: (
     chatId: number,
@@ -920,6 +1226,7 @@ export interface TelegramCommandTargetRuntimeDeps<TContext> {
     options?: {
       parseMode?: "HTML";
       target?: { chatId: number; threadId?: number };
+      assertAuthority?: TelegramApiCallOptions["assertAuthority"];
     },
   ) => Promise<unknown>;
 }
@@ -935,13 +1242,28 @@ export interface TelegramCommandTargetRuntime<
     statusSummary: string,
     execute: (ctx: TContext) => Promise<void>,
   ) => void;
-  showStatus: (message: TMessage, ctx: TContext) => Promise<void>;
-  openModelMenu: (message: TMessage, ctx: TContext) => Promise<void>;
-  openSettingsMenu: (message: TMessage, ctx: TContext) => Promise<void>;
+  showStatus: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
+  openModelMenu: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
+  openSettingsMenu: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
   sendTextReply: (
     message: TMessage,
     text: string,
-    options?: { parseMode?: "HTML" },
+    options?: {
+      parseMode?: "HTML";
+      assertAuthority?: TelegramApiCallOptions["assertAuthority"];
+    },
   ) => Promise<void>;
 }
 
@@ -958,51 +1280,11 @@ export function getTelegramCommandMessageTarget(
   };
 }
 
-export interface TelegramCommandControlQueueRuntimeDeps<TContext> {
-  createControlItem: (options: {
-    chatId: number;
-    target?: { chatId: number; threadId?: number };
-    replyToMessageId: number;
-    controlType: TelegramControlCommandType;
-    statusSummary: string;
-    admissionReceipts?: TelegramQueueAdmissionReceipt[];
-    execute: (ctx: TContext) => Promise<void>;
-  }) => PendingTelegramControlItem<TContext>;
-  appendControlItem: (
-    item: PendingTelegramControlItem<TContext>,
-    ctx: TContext,
-  ) => void;
-  dispatchNextQueuedTelegramTurn: (ctx: TContext) => void;
-}
-
-export function createTelegramCommandControlQueueRuntime<TContext>(
-  deps: TelegramCommandControlQueueRuntimeDeps<TContext>,
-): TelegramCommandTargetRuntimeDeps<TContext>["enqueueControlItem"] {
-  const controlQueueController = createTelegramControlQueueController({
-    appendControlItem: deps.appendControlItem,
-    dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
-  });
-  return createTelegramCommandControlEnqueueAdapter({
-    createControlItem: deps.createControlItem,
-    enqueueControlItem: controlQueueController.enqueue,
-  });
-}
-
 export function createTelegramCommandControlEnqueueAdapter<TContext>(deps: {
-  createControlItem: (options: {
-    chatId: number;
-    target?: { chatId: number; threadId?: number };
-    replyToMessageId: number;
-    controlType: TelegramControlCommandType;
-    statusSummary: string;
-    admissionReceipts?: TelegramQueueAdmissionReceipt[];
-    execute: (ctx: TContext) => Promise<void>;
-  }) => PendingTelegramControlItem<TContext>;
-  enqueueControlItem: (
-    item: PendingTelegramControlItem<TContext>,
-    ctx: TContext,
-    onQueued?: (item: PendingTelegramControlItem<TContext>) => void,
-  ) => void;
+  createControlItem: ReturnType<
+    typeof createTelegramControlItemBuilder<TContext>
+  >;
+  enqueueControlItem: TelegramControlQueueController<TContext>["enqueue"];
 }): TelegramCommandTargetRuntimeDeps<TContext>["enqueueControlItem"] {
   return (
     target,
@@ -1028,8 +1310,11 @@ export function createTelegramCommandControlEnqueueAdapter<TContext>(deps: {
 }
 
 export type TelegramCommandTargetQueueRuntimeDeps<TContext> =
-  TelegramCommandControlQueueRuntimeDeps<TContext> &
-    Omit<TelegramCommandTargetRuntimeDeps<TContext>, "enqueueControlItem">;
+  TelegramControlQueueControllerDeps<TContext> & {
+    createControlItem: ReturnType<
+      typeof createTelegramControlItemBuilder<TContext>
+    >;
+  } & Omit<TelegramCommandTargetRuntimeDeps<TContext>, "enqueueControlItem">;
 
 export function createTelegramCommandTargetQueueRuntime<
   TMessage extends TelegramCommandRuntimeMessage,
@@ -1037,11 +1322,19 @@ export function createTelegramCommandTargetQueueRuntime<
 >(
   deps: TelegramCommandTargetQueueRuntimeDeps<TContext>,
 ): TelegramCommandTargetRuntime<TMessage, TContext> {
+  const {
+    createControlItem,
+    appendControlItem,
+    dispatchNextQueuedTelegramTurn,
+  } = deps;
+  const controlQueueController = createTelegramControlQueueController({
+    appendControlItem,
+    dispatchNextQueuedTelegramTurn,
+  });
   return createTelegramCommandTargetRuntime({
-    enqueueControlItem: createTelegramCommandControlQueueRuntime({
-      createControlItem: deps.createControlItem,
-      appendControlItem: deps.appendControlItem,
-      dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
+    enqueueControlItem: createTelegramCommandControlEnqueueAdapter({
+      createControlItem,
+      enqueueControlItem: controlQueueController.enqueue,
     }),
     getAdmissionScope: deps.getAdmissionScope,
     getAdmissionJournalBinding: deps.getAdmissionJournalBinding,
@@ -1084,30 +1377,30 @@ export function createTelegramCommandTargetRuntime<
         statusSummary,
         execute,
         receipt ? [receipt] : undefined,
-        receipt
-          ? () => deps.onControlQueued?.(message, receipt)
-          : undefined,
+        receipt ? () => deps.onControlQueued?.(message, receipt) : undefined,
       );
     },
-    showStatus: (message, ctx) => {
+    showStatus: (message, ctx, options) => {
       const target = getTelegramCommandMessageTarget(message);
       return deps.showStatus(
         target.chatId,
         target.replyToMessageId,
         ctx,
         target.threadId,
+        options,
       );
     },
-    openModelMenu: (message, ctx) => {
+    openModelMenu: (message, ctx, options) => {
       const target = getTelegramCommandMessageTarget(message);
       return deps.openModelMenu(
         target.chatId,
         target.replyToMessageId,
         ctx,
         target.threadId,
+        options,
       );
     },
-    openSettingsMenu: async (message, ctx) => {
+    openSettingsMenu: async (message, ctx, options) => {
       const target = getTelegramCommandMessageTarget(message);
       if (!deps.openSettingsMenu) {
         await deps.sendTextReply(
@@ -1126,19 +1419,22 @@ export function createTelegramCommandTargetRuntime<
         target.replyToMessageId,
         ctx,
         target.threadId,
+        options,
       );
     },
     sendTextReply: async (message, text, options) => {
       const target = getTelegramCommandMessageTarget(message);
-      await deps.sendTextReply(target.chatId, target.replyToMessageId, text, {
-        ...options,
-        target,
-      });
+      const assertAuthority = options?.assertAuthority,
+        send = deps.sendTextReply;
+      const capturedOptions = { ...options, target };
+      assertAuthority?.();
+      await send(target.chatId, target.replyToMessageId, text, capturedOptions);
+      assertAuthority?.();
     },
   };
 }
 
-export interface TelegramCommandOrPromptRuntimeDeps<TMessage, TContext> {
+export interface TelegramCommandOrPromptDispatcherDeps<TMessage, TContext> {
   extractRawText: (messages: TMessage[]) => string;
   shouldIgnoreMessages?: (messages: TMessage[]) => boolean;
   consumeThreadNameInput?: (
@@ -1165,10 +1461,15 @@ export interface TelegramCommandOrPromptRuntimeDeps<TMessage, TContext> {
   assertExecutionCurrent?: (message: TMessage) => void;
 }
 
+interface TelegramCommandEffectWorkPort {
+  beginCommandEffectWork?: () => TelegramActivityPublicationWork;
+}
+
 export interface TelegramCommandRuntimeDeps<
   TMessage extends TelegramCommandRuntimeMessage,
   TContext,
-> extends TelegramRuntimeEventRecorderPort {
+>
+  extends TelegramRuntimeEventRecorderPort, TelegramCommandEffectWorkPort {
   hasAbortHandler: () => boolean;
   clearPendingModelSwitch: () => void;
   hasQueuedTelegramItems: () => boolean;
@@ -1197,6 +1498,18 @@ export interface TelegramCommandRuntimeDeps<
   ) => void;
   stopTypingLoop?: () => void;
   enqueueContinueTurn: (message: TMessage, ctx: TContext) => Promise<void>;
+  heldTurn?: {
+    enqueue(
+      message: TMessage,
+      ctx: TContext,
+      kind: "continue" | "prompt",
+      admission: TelegramHeldTurnAdmission,
+    ): Promise<void>;
+    templates?: {
+      getCommands(): readonly TelegramPromptTemplateCommand[];
+      expand(name: string, args: string): string | undefined;
+    };
+  };
   requestNewSession?: (message: TMessage) => void;
   compact: (
     ctx: TContext,
@@ -1209,30 +1522,61 @@ export interface TelegramCommandRuntimeDeps<
     statusSummary: string,
     execute: (ctx: TContext) => Promise<void>,
   ) => void;
-  showStatus: (message: TMessage, ctx: TContext) => Promise<void>;
+  showStatus: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
+  /** Supplied adapters must forward recipient authority into issuance and recheck it after awaits. */
   handleForumBootstrap?: (
     message: TMessage,
     ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
   ) => Promise<string | undefined>;
-  openModelMenu: (message: TMessage, ctx: TContext) => Promise<void>;
-  openThinkingMenu: (message: TMessage, ctx: TContext) => Promise<void>;
-  openQueueMenu: (message: TMessage, ctx: TContext) => Promise<void>;
-  openSettingsMenu?: (message: TMessage, ctx: TContext) => Promise<void>;
+  openModelMenu: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
+  openThinkingMenu: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
+  openQueueMenu: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
+  openSettingsMenu?: (
+    message: TMessage,
+    ctx: TContext,
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
   validateThreadName?: (threadName: string) => string | undefined;
   renameCurrentThread?: TelegramThreadDisplayNameRenamePort;
   resetCurrentThreadName?: TelegramThreadDisplayNameResetPort;
   openThreadNameDialog?: (
     message: TMessage,
     ctx: TContext,
-  ) => Promise<void>;
+    admission?: {
+      assertSemanticCurrent(): void;
+      assertRecipientCurrent(): void;
+    },
+  ) => Promise<void | { assertPublished(): void }>;
   getAllowedUserId: () => number | undefined;
   persistAllowedUserId: TelegramConfigStore["persistAllowedUserId"];
-  registerBotCommands: () => Promise<void>;
+  registerBotCommands: (
+    options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+  ) => Promise<void>;
   getPromptTemplateCommands?: () => readonly TelegramPromptTemplateMenuCommand[];
   sendTextReply: (
     message: TMessage,
     text: string,
-    options?: { parseMode?: "HTML" },
+    options?: {
+      parseMode?: "HTML";
+      assertAuthority?: TelegramApiCallOptions["assertAuthority"];
+    },
   ) => Promise<void>;
   getActiveTurnReply?: () =>
     | ((text: string, options?: { parseMode?: "HTML" }) => Promise<void>)
@@ -1241,31 +1585,34 @@ export interface TelegramCommandRuntimeDeps<
   assertExecutionCurrent?: (message: TMessage) => void;
 }
 
-export const TELEGRAM_APP_MENU_INTRO_HTML = [
-  "<b>Pi Telegram</b>",
-  "",
-  `${formatTelegramCommandEmojiPrefix("start")}/start — Open menu / Pair bridge`,
-  `${formatTelegramCommandEmojiPrefix("compact")}/compact — Compact current session`,
-  `${formatTelegramCommandEmojiPrefix("new")}/new — Start a new session`,
-  `${formatTelegramCommandEmojiPrefix("continue")}/continue — Queue continue prompt`,
-  `${formatTelegramCommandEmojiPrefix("next")}/next — Force next turn`,
-  `${formatTelegramCommandEmojiPrefix("abort")}/abort — Abort Pi`,
-  `${formatTelegramCommandEmojiPrefix("stop")}/stop — Abort Pi & Clear queue`,
-].join("\n");
-
-function escapeTelegramCommandMenuHtml(text: string): string {
-  return text
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+/** Pure intro: built-in controls with registered extension lines before the abort controls. */
+function formatTelegramAppMenuIntroHtml(
+  extensionLines: readonly string[],
+): string {
+  const line = (name: TelegramCommandEmojiName, label: string) =>
+    `${formatTelegramCommandEmojiPrefix(name)}/${name} — ${label}`;
+  return [
+    "<b>Pi Telegram</b>",
+    "",
+    line("start", "Open menu / Pair bridge"),
+    line("compact", "Compact current session"),
+    line("new", "Start a new session"),
+    line("continue", "Queue continue prompt"),
+    line("next", "Force next turn"),
+    ...extensionLines,
+    line("abort", "Abort Pi"),
+    line("stop", "Abort Pi & Clear queue"),
+  ].join("\n");
 }
 
+export const TELEGRAM_APP_MENU_INTRO_HTML = formatTelegramAppMenuIntroHtml([]);
+
 function buildTelegramPromptTemplateMenuHtml(
   promptTemplates: readonly TelegramPromptTemplateMenuCommand[] = [],
 ): string {
   if (promptTemplates.length === 0) return "";
   return promptTemplates
-    .map((template) => `🧩 /${escapeTelegramCommandMenuHtml(template.command)}`)
+    .map((template) => `🧩 /${escapeHtml(template.command)}`)
     .join("\n");
 }
 
@@ -1273,27 +1620,16 @@ function buildTelegramExtensionCommandMenuLines(): string[] {
   return getTelegramExtensionCommands()
     .filter((command) => command.showInMenu)
     .map((command) => {
-      const prefix = `${escapeTelegramCommandMenuHtml(command.emoji ?? "")} /${escapeTelegramCommandMenuHtml(command.name)}`;
+      const prefix = `${escapeHtml(command.emoji ?? "")} /${escapeHtml(command.name)}`;
       if (!command.description) return prefix;
-      return `${prefix} — ${escapeTelegramCommandMenuHtml(command.description)}`;
+      return `${prefix} — ${escapeHtml(command.description)}`;
     });
 }
 
 function buildTelegramAppMenuIntroHtml(): string {
-  const extensionLines = buildTelegramExtensionCommandMenuLines();
-  if (extensionLines.length === 0) return TELEGRAM_APP_MENU_INTRO_HTML;
-  return [
-    "<b>Pi Telegram</b>",
-    "",
-    `${formatTelegramCommandEmojiPrefix("start")}/start — Open menu / Pair bridge`,
-    `${formatTelegramCommandEmojiPrefix("compact")}/compact — Compact current session`,
-    `${formatTelegramCommandEmojiPrefix("new")}/new — Start a new session`,
-    `${formatTelegramCommandEmojiPrefix("continue")}/continue — Queue continue prompt`,
-    `${formatTelegramCommandEmojiPrefix("next")}/next — Force next turn`,
-    ...extensionLines,
-    `${formatTelegramCommandEmojiPrefix("abort")}/abort — Abort Pi`,
-    `${formatTelegramCommandEmojiPrefix("stop")}/stop — Abort Pi & Clear queue`,
-  ].join("\n");
+  return formatTelegramAppMenuIntroHtml(
+    buildTelegramExtensionCommandMenuLines(),
+  );
 }
 
 export function buildTelegramAppMenuHtml(
@@ -1379,12 +1715,6 @@ export function buildTelegramCommandAction(
   return TELEGRAM_COMMAND_ACTIONS[commandName];
 }
 
-export function getTelegramCommandExecutionMode(
-  action: TelegramCommandAction,
-): TelegramCommandExecutionMode {
-  return action.executionMode;
-}
-
 function formatTelegramQueuedTurnCount(count: number): string {
   return count === 1 ? "1 queued turn" : `${count} queued turns`;
 }
@@ -1541,6 +1871,36 @@ function buildTelegramNewConfirmationReplyMarkup(): TelegramCompactConfirmationR
   };
 }
 
+/** Send one confirmation to an exact copied recipient, with authority checks around the issued request. */
+async function sendTelegramConfirmation(
+  target: TelegramCommandMessageTarget,
+  deps: TelegramCompactConfirmationDeps,
+  html: string,
+  markup: Parameters<
+    TelegramCompactConfirmationDeps["sendInteractiveMessage"]
+  >[3],
+  assertAuthority?: TelegramApiCallOptions["assertAuthority"],
+): Promise<void> {
+  const recipientTarget = {
+    chatId: target.chatId,
+    ...(target.threadId !== undefined ? { threadId: target.threadId } : {}),
+  };
+  const options = assertAuthority
+    ? { target: recipientTarget, assertAuthority }
+    : target.threadId !== undefined
+      ? { target: recipientTarget }
+      : undefined;
+  assertAuthority?.();
+  await deps.sendInteractiveMessage(
+    recipientTarget.chatId,
+    html,
+    "html",
+    markup,
+    options,
+  );
+  assertAuthority?.();
+}
+
 function getTelegramNewConfirmationHtml(): string {
   return "<b>Start a new session?</b>";
 }
@@ -1548,15 +1908,14 @@ function getTelegramNewConfirmationHtml(): string {
 export async function openTelegramNewConfirmation(
   target: TelegramCommandMessageTarget,
   deps: TelegramCompactConfirmationDeps,
+  assertAuthority?: TelegramApiCallOptions["assertAuthority"],
 ): Promise<void> {
-  await deps.sendInteractiveMessage(
-    target.chatId,
+  await sendTelegramConfirmation(
+    target,
+    deps,
     getTelegramNewConfirmationHtml(),
-    "html",
     buildTelegramNewConfirmationReplyMarkup(),
-    target.threadId !== undefined
-      ? { target: { chatId: target.chatId, threadId: target.threadId } }
-      : undefined,
+    assertAuthority,
   );
 }
 
@@ -1568,7 +1927,7 @@ export async function handleTelegramNewConfirmationCallback<TContext>(
   const chatId = query.message?.chat?.id;
   const messageId = query.message?.message_id;
   if (typeof chatId !== "number" || typeof messageId !== "number") {
-    await deps.answerCallbackQuery(query.id, "⌛ Interactive message expired.");
+    await deps.answerCallbackQuery(query.id, "Interactive message expired");
     return true;
   }
   if (query.data === "new:cancel") {
@@ -1606,15 +1965,14 @@ function getTelegramCompactConfirmationHtml(): string {
 async function openTelegramCompactConfirmation(
   target: TelegramCommandMessageTarget,
   deps: TelegramCompactConfirmationDeps,
+  assertAuthority?: TelegramApiCallOptions["assertAuthority"],
 ): Promise<void> {
-  await deps.sendInteractiveMessage(
-    target.chatId,
+  await sendTelegramConfirmation(
+    target,
+    deps,
     getTelegramCompactConfirmationHtml(),
-    "html",
     buildTelegramCompactConfirmationReplyMarkup(),
-    target.threadId !== undefined
-      ? { target: { chatId: target.chatId, threadId: target.threadId } }
-      : undefined,
+    assertAuthority,
   );
 }
 
@@ -1629,7 +1987,7 @@ export async function handleTelegramCompactConfirmationCallback<TContext>(
   const chatId = callbackMessage?.chat?.id;
   const messageId = callbackMessage?.message_id;
   if (typeof chatId !== "number" || typeof messageId !== "number") {
-    await deps.answerCallbackQuery(query.id, "⌛ Interactive message expired.");
+    await deps.answerCallbackQuery(query.id, "Interactive message expired");
     return true;
   }
   if (query.data === "compact:cancel") {
@@ -1661,13 +2019,8 @@ export async function handleTelegramCompactConfirmationCallback<TContext>(
   return true;
 }
 
-export interface TelegramNewCommandDeps extends TelegramRuntimeEventRecorderPort {
-  isIdle: () => boolean;
-  hasPendingMessages: () => boolean;
-  hasActiveTelegramTurn: () => boolean;
-  hasDispatchPending: () => boolean;
-  hasQueuedTelegramItems: () => boolean;
-  isCompactionInProgress: () => boolean;
+export interface TelegramNewCommandDeps
+  extends TelegramRuntimeEventRecorderPort, TelegramSessionBusyPorts {
   requestNewSession?: () => void;
   sendTextReply: (
     text: string,
@@ -1678,14 +2031,7 @@ export interface TelegramNewCommandDeps extends TelegramRuntimeEventRecorderPort
 export async function handleTelegramNewCommand(
   deps: TelegramNewCommandDeps,
 ): Promise<void> {
-  if (
-    !deps.isIdle() ||
-    deps.hasPendingMessages() ||
-    deps.hasActiveTelegramTurn() ||
-    deps.hasDispatchPending() ||
-    deps.hasQueuedTelegramItems() ||
-    deps.isCompactionInProgress()
-  ) {
+  if (isTelegramSessionBusy(deps)) {
     await deps.sendTextReply(
       formatTelegramInformationHeading(
         "⏳",
@@ -1711,14 +2057,7 @@ export async function handleTelegramNewCommand(
 export async function handleTelegramCompactCommand(
   deps: TelegramCompactCommandDeps,
 ): Promise<void> {
-  if (
-    !deps.isIdle() ||
-    deps.hasPendingMessages() ||
-    deps.hasActiveTelegramTurn() ||
-    deps.hasDispatchPending() ||
-    deps.hasQueuedTelegramItems() ||
-    deps.isCompactionInProgress()
-  ) {
+  if (isTelegramSessionBusy(deps)) {
     await deps.sendTextReply(
       formatTelegramInformationHeading(
         "⏳",
@@ -1778,25 +2117,6 @@ export async function handleTelegramCompactCommand(
   }
 }
 
-function isTelegramStaleContextError(error: unknown): boolean {
-  return (
-    error instanceof Error &&
-    (error.message.includes("stale after session") ||
-      error.message.includes("stale ctx"))
-  );
-}
-
-export async function handleTelegramStatusCommand<TContext>(deps: {
-  ctx: TContext;
-  showStatus: (ctx: TContext) => Promise<void>;
-}): Promise<void> {
-  try {
-    await deps.showStatus(deps.ctx);
-  } catch (error) {
-    if (!isTelegramStaleContextError(error)) throw error;
-  }
-}
-
 export async function handleTelegramModelCommand<TContext>(deps: {
   ctx: TContext;
   openModelMenu: (ctx: TContext) => Promise<void>;
@@ -1804,7 +2124,7 @@ export async function handleTelegramModelCommand<TContext>(deps: {
   try {
     await deps.openModelMenu(deps.ctx);
   } catch (error) {
-    if (!isTelegramStaleContextError(error)) throw error;
+    if (!isPiStaleContextError(error)) throw error;
   }
 }
 
@@ -1886,12 +2206,7 @@ export function createTelegramCommandHandlerTargetRuntime<
   TContext,
 >(
   deps: TelegramCommandHandlerTargetRuntimeDeps<TMessage, TContext>,
-): (
-  commandName: string | undefined,
-  message: TMessage,
-  ctx: TContext,
-  commandArgs?: string,
-) => Promise<boolean> {
+): ReturnType<typeof createTelegramCommandHandler<TMessage, TContext>> {
   const commandTargetRuntime = createTelegramCommandTargetQueueRuntime<
     TMessage,
     TContext
@@ -1911,6 +2226,7 @@ export function createTelegramCommandHandlerTargetRuntime<
     sendTextReply: deps.sendTextReply,
   });
   return createTelegramCommandHandler({
+    assertExecutionCurrent: deps.assertExecutionCurrent,
     hasAbortHandler: deps.hasAbortHandler,
     clearPendingModelSwitch: deps.clearPendingModelSwitch,
     hasQueuedTelegramItems: deps.hasQueuedTelegramItems,
@@ -1925,15 +2241,16 @@ export function createTelegramCommandHandlerTargetRuntime<
     setCompactionInProgress: deps.setCompactionInProgress,
     updateStatus: deps.updateStatus,
     isContextActive: deps.isContextActive,
+    beginCommandEffectWork: deps.beginCommandEffectWork,
     dispatchNextQueuedTelegramTurn: deps.dispatchNextQueuedTelegramTurn,
     requestNextDispatchAnnouncement: deps.requestNextDispatchAnnouncement,
     markActiveTurnNextAbortAnnouncement:
       deps.markActiveTurnNextAbortAnnouncement,
-    cancelNextTransitionAnnouncements:
-      deps.cancelNextTransitionAnnouncements,
+    cancelNextTransitionAnnouncements: deps.cancelNextTransitionAnnouncements,
     startTypingLoop: deps.startTypingLoop,
     stopTypingLoop: deps.stopTypingLoop,
     enqueueContinueTurn: deps.enqueueContinueTurn,
+    heldTurn: deps.heldTurn,
     compact: deps.compact,
     requestNewSession: deps.requestNewSession,
     sendInteractiveMessage: deps.sendInteractiveMessage,
@@ -1958,74 +2275,1423 @@ export function createTelegramCommandHandlerTargetRuntime<
   });
 }
 
+/** Released exact-source admission for one selected command: source/recipient lifetimes and one completion report. */
+export interface TelegramSelectedCommandAdmission {
+  assertSourceCurrent(): void;
+  /** Independent exact recipient/target lifetime, including inside captured menu transport adapters. */
+  assertRecipientCurrent(): void;
+  reportCompleted(): boolean;
+}
+
+/**
+ * Captures admission ports now and checks source → execution → recipient; `strict` rechecks the source after the
+ * recipient, for owners whose effects outlive one synchronous step.
+ */
+function createSelectedSemanticGuard(
+  admission: TelegramSelectedCommandAdmission,
+  assertExecution: () => void,
+  strict: boolean,
+): () => void {
+  const assertSourceCurrent = admission.assertSourceCurrent,
+    assertRecipientCurrent = admission.assertRecipientCurrent;
+  return () => {
+    assertSourceCurrent();
+    assertExecution();
+    assertRecipientCurrent();
+    if (!strict) return;
+    assertSourceCurrent();
+    assertExecution();
+  };
+}
+
+/** Wrap one synchronous command effect between semantic checks. */
+function guardSelectedEffect(assertCurrent: () => void) {
+  return <TArgs extends unknown[], TResult>(
+      effect: (...args: TArgs) => TResult,
+    ) =>
+    (...args: TArgs): TResult => {
+      assertCurrent();
+      const result = effect(...args);
+      assertCurrent();
+      return result;
+    };
+}
+
+/** One issuance only: later calls return false without assertions or effects, never replay. */
+function issueSelectedOnce(
+  assertCurrent: () => void,
+  run: () => Promise<boolean>,
+): () => Promise<boolean> {
+  let issued = false;
+  return async () => {
+    if (issued) return false;
+    assertCurrent();
+    issued = true;
+    return run();
+  };
+}
+
+/** Body-free reply anchor: chat, message and Thread only, never the original's admission symbols. */
+function copySelectedReplyAnchor<
+  TMessage extends TelegramCommandRuntimeMessage,
+>(original: TMessage): TMessage {
+  return {
+    chat: { ...original.chat },
+    message_id: original.message_id,
+    message_thread_id: original.message_thread_id,
+  } as TMessage;
+}
+
+function copySelectedMenuCarrier<
+  TMessage extends TelegramCommandRuntimeMessage,
+>(original: TMessage): TMessage {
+  const message = Object.fromEntries(
+    Object.entries(original).filter(
+      ([key]) => key !== "pi_telegram_source_update_id",
+    ),
+  ) as TMessage;
+  message.chat = { ...original.chat };
+  return message;
+}
+
 export function createTelegramCommandHandler<
   TMessage extends TelegramCommandRuntimeMessage,
   TContext,
 >(deps: TelegramCommandRuntimeDeps<TMessage, TContext>) {
-  return async (
+  const handle = async (
     commandName: string | undefined,
     message: TMessage,
     ctx: TContext,
     commandArgs?: string,
   ): Promise<boolean> => {
-    return handleTelegramCommandRuntime(commandName, message, ctx, deps, commandArgs);
+    return handleTelegramCommandRuntime(
+      commandName,
+      message,
+      ctx,
+      deps,
+      commandArgs,
+    );
   };
-}
-
-export function createTelegramCommandOrPromptRuntime<TMessage, TContext>(
-  deps: TelegramCommandOrPromptRuntimeDeps<TMessage, TContext>,
-) {
-  return {
-    dispatchMessages: async (
-      messages: TMessage[],
+  // Shared held-plan core: binds the exact saved carrier once and fences source, completion and owner ports.
+  type HeldExecution = {
+    message: TMessage;
+    carrier?: TMessage;
+    source?: TelegramDeferredSourceEvidence;
+    queue?: TelegramDeferredQueueAdmissionPreparation;
+    command: ParsedTelegramCommand;
+    reportCompleted(): boolean;
+    assertSemantic(): void;
+    assertRecipient: () => void;
+  };
+  type HeldQueueRecord = {
+    ctx: TContext;
+    signal: AbortSignal;
+    receipt: TelegramQueueAdmissionReceiptLike;
+    queue: TelegramDeferredQueueAdmissionPreparation;
+    completionSha256: string;
+    current(): boolean;
+  };
+  const heldQueueReceipts = new Map<string, HeldQueueRecord | null>();
+  const heldQueueOwners = new WeakSet<AbortSignal>();
+  const watchHeldQueueOwner = (signal: AbortSignal) => {
+    if (heldQueueOwners.has(signal)) return;
+    addAbortListener(signal, () => {
+      // Native owner end is irreversible; keep refusal identity, not its context/carrier closures or a fallback grant.
+      for (const [id, record] of heldQueueReceipts)
+        if (record?.signal === signal) heldQueueReceipts.set(id, null);
+    });
+    heldQueueOwners.add(signal);
+  };
+  type HeldPlan = {
+    completion: "before-effect" | "after-semantics" | "queue-receipt";
+    effect?: keyof TelegramHeldCommandEffects<TContext>;
+    template?: true;
+    available?(): boolean;
+    prepare(
       ctx: TContext,
-    ): Promise<void> => {
-      const firstMessage = messages[0];
-      if (!firstMessage) return;
-      if (deps.shouldIgnoreMessages?.(messages)) return;
-      deps.assertExecutionCurrent?.(firstMessage);
-      if (await deps.consumeThreadNameInput?.(messages, ctx)) {
-        deps.assertExecutionCurrent?.(firstMessage);
-        return;
+      effects?: TelegramHeldCommandEffects<TContext>,
+      command?: ParsedTelegramCommand,
+      replyDelivery?: "inline" | "detached",
+    ):
+      | {
+          captured: typeof deps;
+          portsCurrent(): boolean;
+          run(input: HeldExecution): Promise<boolean>;
+          inspectQueuedCompletion?():
+            TelegramDeferredSourceEvidence | undefined;
+        }
+      | undefined;
+  };
+  const prepareHeldSelectedCommand = (
+    name: string,
+    readiness: TelegramLiveSourceCompletionReadiness,
+    admission: TelegramHeldCommandAdmission,
+    captured: typeof deps,
+    portsCurrent: () => boolean,
+    completion: HeldPlan["completion"],
+    run: (input: HeldExecution) => Promise<boolean>,
+    inspectQueuedCompletion?: () => TelegramDeferredSourceEvidence | undefined,
+  ): TelegramPreparedHeldCommand | undefined => {
+    const snapshot = readiness.snapshot,
+      raw = snapshot.update.message,
+      target = { ...admission.target };
+    const bind = readiness.bindCarrier,
+      isCurrent = readiness.isCurrent,
+      assertSource = admission.assertSourceCurrent,
+      assertRecipient = admission.assertRecipientCurrent;
+    if (
+      typeof bind !== "function" ||
+      typeof isCurrent !== "function" ||
+      typeof assertSource !== "function" ||
+      typeof assertRecipient !== "function" ||
+      !isCurrent.call(readiness) ||
+      !raw ||
+      typeof raw !== "object" ||
+      Array.isArray(raw) ||
+      Object.keys(snapshot.update).some(
+        (key) => !["update_id", "message"].includes(key),
+      )
+    )
+      return undefined;
+    const value = raw as Record<string, unknown>,
+      chat = value.chat as TMessage["chat"] | undefined,
+      from = value.from as TMessage["from"] | undefined;
+    if (typeof captured.getAllowedUserId !== "function") return undefined;
+    const command =
+        typeof value.text === "string"
+          ? parseTelegramCommand(value.text)
+          : undefined,
+      operator = captured.getAllowedUserId();
+    if (
+      !command ||
+      !chat ||
+      !from ||
+      !isTelegramSelectedHeldOriginal(snapshot.update, target, operator, name)
+    )
+      return undefined;
+    const source = { ...snapshot.source },
+      preparedCommand = { ...command };
+    const message = {
+      ...structuredClone(value),
+      chat: { ...chat },
+      message_thread_id: target.threadId,
+    } as TMessage;
+    delete message.pi_telegram_source_update_id;
+    let bound:
+        | {
+            carrier: unknown;
+            completion: TelegramDeferredSourceCompletionPreparation;
+            ports: Pick<
+              TelegramDeferredSourceCompletionPreparation,
+              "isCurrent" | "reportCompleted" | "inspectCompletion"
+            >;
+          }
+        | undefined,
+      issued = false;
+    const ownerCurrent = () =>
+      portsCurrent() &&
+      readiness.bindCarrier === bind &&
+      readiness.isCurrent === isCurrent &&
+      isCurrent.call(readiness) &&
+      captured.getAllowedUserId() === operator;
+    const completionCurrent = () =>
+      !!bound &&
+      Object.entries(bound.ports).every(
+        ([key, port]) => Reflect.get(bound!.completion, key) === port,
+      ) &&
+      bound.ports.isCurrent.call(bound.completion);
+    const assertSourceCurrent = () => {
+      assertSource.call(admission);
+      if (!ownerCurrent() || !completionCurrent() || !bound)
+        throw new Error(`Held ${name} source owner is unavailable.`);
+      captured.assertExecutionCurrent?.(bound.carrier as TMessage);
+      const current = inspectTelegramDeferredSource(bound.carrier);
+      if (
+        !current ||
+        current.updateId !== source.updateId ||
+        current.journalBindingKey !== source.journalBindingKey ||
+        current.sourceSha256 !== source.sourceSha256 ||
+        !ownerCurrent() ||
+        !completionCurrent()
+      )
+        throw new Error(`Held ${name} original changed.`);
+    };
+    return {
+      get source() {
+        return { ...source };
+      },
+      get command() {
+        return { ...preparedCommand };
+      },
+      bindCarrier(value) {
+        if (!ownerCurrent()) return false;
+        if (bound) return value === bound.carrier && completionCurrent();
+        const completion = bind.call(readiness, value);
+        if (
+          !completion ||
+          completion.source.updateId !== source.updateId ||
+          completion.source.journalBindingKey !== source.journalBindingKey ||
+          completion.source.sourceSha256 !== source.sourceSha256 ||
+          !ownerCurrent()
+        )
+          return false;
+        const ports = {
+          isCurrent: completion.isCurrent,
+          reportCompleted: completion.reportCompleted,
+          inspectCompletion: completion.inspectCompletion,
+        };
+        if (Object.values(ports).some((port) => typeof port !== "function"))
+          return false;
+        bound = { carrier: value, completion, ports };
+        return completionCurrent();
+      },
+      async execute() {
+        if (issued) return false;
+        assertSourceCurrent();
+        assertRecipient.call(admission);
+        assertSourceCurrent();
+        issued = true;
+        if (
+          completion === "before-effect" &&
+          !bound!.ports.reportCompleted.call(bound!.completion)
+        )
+          return false;
+        return run({
+          message,
+          carrier: bound!.carrier as TMessage,
+          source: { ...source },
+          command: { ...preparedCommand },
+          assertRecipient,
+          reportCompleted: () =>
+            bound!.ports.reportCompleted.call(bound!.completion),
+          assertSemantic() {
+            assertSourceCurrent();
+            assertRecipient.call(admission);
+          },
+        });
+      },
+      inspectCompletion() {
+        return ownerCurrent() && completionCurrent()
+          ? completion === "queue-receipt"
+            ? inspectQueuedCompletion?.()
+            : bound!.ports.inspectCompletion.call(bound!.completion)
+          : undefined;
+      },
+    };
+  };
+  const prepareHeldReplyPlan = (
+    ctx: TContext,
+    effects: TelegramHeldCommandEffects<TContext>,
+    run: (
+      captured: typeof deps,
+      semantic: ReturnType<typeof guardSelectedEffect>,
+      complete: () => void,
+      reply: (text: string, options?: { parseMode?: "HTML" }) => Promise<void>,
+    ) => Promise<void>,
+    replyDelivery: "inline" | "detached" = "detached",
+  ) => {
+    const send = effects.sendTextReply!,
+      captured = { ...deps };
+    return {
+      captured,
+      portsCurrent: () => effects.sendTextReply === send,
+      async run(input: HeldExecution) {
+        const semantic = guardSelectedEffect(input.assertSemantic);
+        const complete = () => {
+          input.assertSemantic();
+          if (!input.reportCompleted())
+            throw new Error(
+              `Held ${input.command.name} source completion refused.`,
+            );
+          input.assertRecipient();
+        };
+        await run(captured, semantic, complete, async (text, options) => {
+          complete();
+          const deliver = async () => {
+            input.assertRecipient();
+            await send.call(
+              effects,
+              input.message.chat.id,
+              input.message.message_id,
+              text,
+              {
+                ...options,
+                target: {
+                  chatId: input.message.chat.id,
+                  threadId: input.message.message_thread_id!,
+                },
+                assertAuthority: input.assertRecipient,
+              },
+            );
+            input.assertRecipient();
+          };
+          // Transport waiting never changes the already reported semantic completion or licenses another effect.
+          if (replyDelivery === "inline") await deliver();
+          else
+            scheduleTelegramCommandEffect(
+              ctx,
+              input.command.name,
+              "selected-reply",
+              captured,
+              deliver,
+              input.assertRecipient,
+            );
+        });
+        return true;
+      },
+    };
+  };
+  const prepareHeldQueuePlan = (
+    ctx: TContext,
+    template?: {
+      command: ParsedTelegramCommand;
+      expanded: string;
+      isCurrent(): boolean;
+    },
+  ) => {
+    const captured = { ...deps },
+      owner = captured.heldTurn!,
+      enqueue = owner.enqueue;
+    let retained: HeldQueueRecord | undefined;
+    const portsCurrent = () =>
+      deps.heldTurn === owner &&
+      owner.enqueue === enqueue &&
+      (!template || template.isCurrent()) &&
+      deps.heldTurn === owner &&
+      owner.enqueue === enqueue;
+    return {
+      captured,
+      portsCurrent,
+      async run(input: HeldExecution) {
+        input.assertSemantic();
+        if (template && !isDeepStrictEqual(input.command, template.command))
+          return false;
+        const { carrier, source } = input;
+        if (!carrier || !source) return false;
+        const signal = getTelegramUpdateExecutionFence(carrier)?.signal;
+        if (!signal || signal.aborted) return false;
+        const queue =
+          input.queue ?? prepareTelegramDeferredQueueAdmission(carrier);
+        if (!queue || !queue.isCurrent()) return false;
+        const ports = {
+          isCurrent: queue.isCurrent,
+          prepareCompletionScope: queue.prepareCompletionScope,
+          inspectCompletion: queue.inspectCompletion,
+        };
+        if (Object.values(ports).some((port) => typeof port !== "function"))
+          return false;
+        const current = () => {
+          if (
+            !portsCurrent() ||
+            !Object.entries(ports).every(
+              ([key, value]) => Reflect.get(queue, key) === value,
+            ) ||
+            !ports.isCurrent.call(queue)
+          )
+            return false;
+          try {
+            input.assertRecipient();
+            return portsCurrent() && ports.isCurrent.call(queue);
+          } catch {
+            return false;
+          }
+        };
+        const sameTarget =
+          carrier.message_thread_id === input.message.message_thread_id;
+        const message = carryTelegramUpdateExecutionFence(carrier, {
+          ...carrier,
+          ...input.message,
+          pi_telegram_source_update_id: source.updateId,
+          ...(template ? { text: template.expanded, caption: undefined } : {}),
+          ...(sameTarget ? {} : { message_id: 0, reply_to_message: undefined }),
+        } as TMessage);
+        const completionSha256 = createHash("sha256")
+          .update(
+            JSON.stringify([
+              "held-command-v1",
+              randomUUID(),
+              source,
+              input.command,
+              getTelegramCommandMessageTarget(message),
+            ]),
+          )
+          .digest("hex");
+        const admission: TelegramHeldTurnAdmission = {
+          assertCurrent: input.assertSemantic,
+          report(receipts) {
+            input.assertSemantic();
+            const receipt = receipts[0];
+            if (
+              retained ||
+              receipts.length !== 1 ||
+              !receipt ||
+              receipt.queueKind !== "prompt" ||
+              receipt.journalBindingKey !== source.journalBindingKey ||
+              receipt.sourceUpdateIds.length !== 1 ||
+              receipt.sourceUpdateIds[0] !== source.updateId ||
+              heldQueueReceipts.has(receipt.receiptId) ||
+              !current()
+            )
+              throw new Error(
+                "Held command needs one exact original queue receipt.",
+              );
+            const expected = structuredClone(receipt);
+            retained = {
+              ctx,
+              signal,
+              receipt,
+              queue,
+              completionSha256,
+              current: () => current() && isDeepStrictEqual(receipt, expected),
+            };
+            watchHeldQueueOwner(signal);
+            heldQueueReceipts.set(
+              receipt.receiptId,
+              signal.aborted ? null : retained,
+            );
+            if (!reportTelegramQueueAdmission([carrier], [receipt]))
+              throw new Error("Held command queue admission refused.");
+          },
+        };
+        if (template)
+          await enqueue.call(owner, message, ctx, "prompt", admission);
+        else
+          await handleTelegramContinueCommand(message, ctx, {
+            enqueueContinueTurn: (value, context) =>
+              enqueue.call(owner, value, context, "continue", admission),
+          });
+        return !!retained && current();
+      },
+      inspectQueuedCompletion() {
+        if (!retained || !retained.current()) return undefined;
+        const proof = retained.queue.inspectCompletion(retained.receipt);
+        if (proof && retained.current()) {
+          heldQueueReceipts.delete(retained.receipt.receiptId);
+          return { ...proof };
+        }
+        return undefined;
+      },
+    };
+  };
+  const heldPlans: Record<TelegramHeldCommandName, HeldPlan> = {
+    status: {
+      completion: "before-effect",
+      effect: "showStatus",
+      prepare(ctx, effects) {
+        const scopedStatus = effects?.showStatus;
+        const captured = {
+          ...deps,
+          showStatus: scopedStatus
+            ? (
+                message: TMessage,
+                context: TContext,
+                options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+              ) => {
+                const address = getTelegramCommandMessageTarget(message);
+                return scopedStatus.call(
+                  effects,
+                  address.chatId,
+                  address.replyToMessageId,
+                  context,
+                  address.threadId,
+                  options,
+                );
+              }
+            : deps.showStatus,
+        };
+        return {
+          captured,
+          portsCurrent: () => !effects || effects.showStatus === scopedStatus,
+          async run({ message, command, assertRecipient }) {
+            const recipientOptions = { assertAuthority: assertRecipient };
+            return handleTelegramCommandRuntime(
+              command.name,
+              message,
+              ctx,
+              {
+                ...captured,
+                assertExecutionCurrent: assertRecipient,
+                showStatus: (value: TMessage, context: TContext) =>
+                  captured.showStatus(value, context, recipientOptions),
+              },
+              command.args,
+            );
+          },
+        };
+      },
+    },
+    abort: {
+      completion: "after-semantics",
+      effect: "sendTextReply",
+      prepare(ctx, effects, _command, delivery) {
+        return prepareHeldReplyPlan(
+          ctx,
+          effects!,
+          async (captured, semantic, _complete, reply) => {
+            await handleTelegramAbortCommand({
+              hasAbortHandler: semantic(captured.hasAbortHandler),
+              hasActiveTelegramTurn: semantic(captured.hasActiveTelegramTurn),
+              clearPendingModelSwitch: semantic(
+                captured.clearPendingModelSwitch,
+              ),
+              cancelNextTransitionAnnouncements:
+                captured.cancelNextTransitionAnnouncements &&
+                semantic(captured.cancelNextTransitionAnnouncements),
+              abortCurrentTurn: semantic(captured.abortCurrentTurn),
+              setFoldQueuedPromptsIntoHistory: semantic(
+                captured.setFoldQueuedPromptsIntoHistory,
+              ),
+              updateStatus: semantic(() => captured.updateStatus(ctx)),
+              sendTextReply: reply,
+            });
+          },
+          delivery,
+        );
+      },
+    },
+    stop: {
+      completion: "after-semantics",
+      effect: "sendTextReply",
+      available: () =>
+        typeof deps.cancelNextTransitionAnnouncements === "function" &&
+        typeof deps.clearQueuedTelegramItems === "function",
+      prepare(ctx, effects, _command, delivery) {
+        return prepareHeldReplyPlan(
+          ctx,
+          effects!,
+          async (captured, semantic, _complete, reply) => {
+            await handleTelegramStopCommand({
+              hasAbortHandler: semantic(captured.hasAbortHandler),
+              clearPendingModelSwitch: semantic(
+                captured.clearPendingModelSwitch,
+              ),
+              cancelNextTransitionAnnouncements: semantic(
+                captured.cancelNextTransitionAnnouncements!,
+              ),
+              clearQueuedTelegramItems: semantic(() =>
+                captured.clearQueuedTelegramItems(ctx),
+              ),
+              setFoldQueuedPromptsIntoHistory: semantic(
+                captured.setFoldQueuedPromptsIntoHistory,
+              ),
+              abortCurrentTurn: semantic(captured.abortCurrentTurn),
+              updateStatus: semantic(() => captured.updateStatus(ctx)),
+              sendTextReply: reply,
+            });
+          },
+          delivery,
+        );
+      },
+    },
+    next: {
+      completion: "after-semantics",
+      effect: "sendTextReply",
+      available: () =>
+        typeof deps.requestNextDispatchAnnouncement === "function" &&
+        typeof deps.markActiveTurnNextAbortAnnouncement === "function",
+      prepare(ctx, effects, _command, delivery) {
+        return prepareHeldReplyPlan(
+          ctx,
+          effects!,
+          async (captured, semantic, complete, reply) => {
+            await handleTelegramNextCommand({
+              hasAbortHandler: semantic(captured.hasAbortHandler),
+              isIdle: semantic(() => captured.isIdle(ctx)),
+              hasQueuedItems: semantic(captured.hasQueuedTelegramItems),
+              clearPendingModelSwitch: semantic(
+                captured.clearPendingModelSwitch,
+              ),
+              abortCurrentTurn: semantic(captured.abortCurrentTurn),
+              dispatchNextQueuedTurn: semantic(() =>
+                captured.dispatchNextQueuedTelegramTurn(ctx),
+              ),
+              requestNextDispatchAnnouncement: semantic(
+                captured.requestNextDispatchAnnouncement!,
+              ),
+              markActiveTurnNextAbortAnnouncement: semantic(
+                captured.markActiveTurnNextAbortAnnouncement!,
+              ),
+              clearFoldForDispatch: semantic(() =>
+                captured.setFoldQueuedPromptsIntoHistory(false),
+              ),
+              updateStatus() {
+                semantic(() => captured.updateStatus(ctx))();
+                complete();
+              },
+              sendTextReply: reply,
+            });
+          },
+          delivery,
+        );
+      },
+    },
+    continue: {
+      completion: "queue-receipt",
+      available: () => typeof deps.heldTurn?.enqueue === "function",
+      prepare(ctx) {
+        return prepareHeldQueuePlan(ctx);
+      },
+    },
+  };
+  const getHeldTemplatePlan = (name: string): HeldPlan | undefined => {
+    const owner = deps.heldTurn,
+      templates = owner?.templates,
+      get = templates?.getCommands,
+      expand = templates?.expand;
+    if (
+      !owner ||
+      !templates ||
+      typeof owner.enqueue !== "function" ||
+      typeof get !== "function" ||
+      typeof expand !== "function" ||
+      getTelegramReservedCommandNames().includes(name) ||
+      findTelegramExtensionCommand(name)
+    )
+      return undefined;
+    const getIdentity = () => {
+      const matching = get
+        .call(templates)
+        .filter((value) => value.command === name);
+      const selected = matching[0];
+      return matching.length === 1 &&
+        selected &&
+        typeof selected.path === "string" &&
+        selected.path.trim()
+        ? { command: selected.command, path: selected.path }
+        : undefined;
+    };
+    let identity: ReturnType<typeof getIdentity>;
+    try {
+      identity = getIdentity();
+    } catch {
+      return undefined;
+    }
+    if (!identity) return undefined;
+    const current = () => {
+      if (
+        deps.heldTurn !== owner ||
+        owner.templates !== templates ||
+        templates.getCommands !== get ||
+        templates.expand !== expand ||
+        findTelegramExtensionCommand(name)
+      )
+        return false;
+      try {
+        return (
+          isDeepStrictEqual(getIdentity(), identity) &&
+          deps.heldTurn === owner &&
+          owner.templates === templates &&
+          templates.getCommands === get &&
+          templates.expand === expand &&
+          !findTelegramExtensionCommand(name)
+        );
+      } catch {
+        return false;
       }
-      const command = parseTelegramCommand(deps.extractRawText(messages));
-      const handled = await deps.handleCommand(
-        command?.name,
-        firstMessage,
-        ctx,
-        command?.args,
+    };
+    if (!current()) return undefined;
+    return {
+      completion: "queue-receipt",
+      template: true,
+      prepare(ctx, _effects, command) {
+        if (!command || command.name !== name || !current()) return undefined;
+        const captured = { ...command };
+        let expanded: string | undefined;
+        try {
+          expanded = expand.call(templates, captured.name, captured.args);
+        } catch {
+          return undefined;
+        }
+        if (typeof expanded !== "string" || !current()) return undefined;
+        return prepareHeldQueuePlan(ctx, {
+          command: captured,
+          expanded,
+          isCurrent() {
+            if (!current()) return false;
+            try {
+              return (
+                expand.call(templates, captured.name, captured.args) ===
+                  expanded && current()
+              );
+            } catch {
+              return false;
+            }
+          },
+        });
+      },
+    };
+  };
+  const getHeldPlan = (
+    name: string,
+    effects?: TelegramHeldCommandEffects<TContext>,
+  ): HeldPlan | undefined => {
+    if (!Object.hasOwn(heldPlans, name)) return getHeldTemplatePlan(name);
+    const plan = heldPlans[name as TelegramHeldCommandName];
+    if (plan.available?.() === false) return undefined;
+    if (
+      (plan.effect &&
+        effects !== undefined &&
+        (!effects || typeof effects[plan.effect] !== "function")) ||
+      (plan.effect === "sendTextReply" && !effects) ||
+      (plan.effect === "showStatus" &&
+        effects === undefined &&
+        typeof deps.showStatus !== "function")
+    )
+      return undefined;
+    return plan;
+  };
+  const prepareSelectedPlan = (
+    command: ParsedTelegramCommand,
+    messages: readonly TMessage[],
+    ctx: TContext,
+    admission: TelegramSelectedCommandAdmission,
+  ): (() => Promise<boolean>) | undefined => {
+    const original = messages[0];
+    if (
+      !["status", "abort", "stop", "next"].includes(command.name) ||
+      messages.length !== 1 ||
+      !original ||
+      typeof admission.assertSourceCurrent !== "function" ||
+      typeof admission.assertRecipientCurrent !== "function" ||
+      typeof admission.reportCompleted !== "function"
+    )
+      return undefined;
+    const captured = { ...deps },
+      parsed = { ...command },
+      message =
+        parsed.name === "status"
+          ? copySelectedMenuCarrier(original)
+          : copySelectedReplyAnchor(original);
+    const assertRecipientCurrent = admission.assertRecipientCurrent,
+      report = admission.reportCompleted;
+    const effects: TelegramHeldCommandEffects<TContext> | undefined =
+      parsed.name === "status"
+        ? undefined
+        : {
+            async sendTextReply(_chat, _anchor, text, options) {
+              await captured.sendTextReply(message, text, {
+                parseMode: options.parseMode,
+                assertAuthority: options.assertAuthority,
+              });
+            },
+          };
+    const plan = getHeldPlan(parsed.name, effects);
+    if (
+      !plan ||
+      plan.completion === "queue-receipt" ||
+      (parsed.name !== "status" && typeof captured.sendTextReply !== "function")
+    )
+      return undefined;
+    const prepared = plan.prepare(ctx, effects, parsed, "inline");
+    if (!prepared) return undefined;
+    const semantic = createSelectedSemanticGuard(
+      admission,
+      () => captured.assertExecutionCurrent?.(original),
+      plan.completion === "before-effect",
+    );
+    const assertCurrent = () => {
+      semantic();
+      if (!prepared.portsCurrent())
+        throw new Error(`Selected ${parsed.name} plan owner is unavailable.`);
+    };
+    return issueSelectedOnce(assertCurrent, async () => {
+      if (plan.completion === "before-effect" && !report.call(admission))
+        return false;
+      return prepared.run({
+        message,
+        command: parsed,
+        assertSemantic: assertCurrent,
+        assertRecipient: assertRecipientCurrent,
+        reportCompleted: () => report.call(admission),
+      });
+    });
+  };
+  const prepareSelectedHelp =
+    (name: "start" | "help") =>
+    (
+      command: ParsedTelegramCommand,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramSelectedCommandAdmission,
+    ): (() => Promise<boolean>) | undefined => {
+      const original = messages[0];
+      if (
+        command.name !== name ||
+        messages.length !== 1 ||
+        !original ||
+        !canPairTelegramUserFromCommandMessage(original) ||
+        original.from?.id === undefined ||
+        original.from.is_bot
+      )
+        return undefined;
+      const captured = { ...deps },
+        userId = original.from.id;
+      if (captured.getAllowedUserId() !== userId) return undefined;
+      const message = {
+        ...copySelectedReplyAnchor(original),
+        from: { ...original.from },
+      };
+      const assertRecipientCurrent = admission.assertRecipientCurrent,
+        reportCompleted = admission.reportCompleted;
+      const assertAdmissionCurrent = createSelectedSemanticGuard(
+        admission,
+        () => captured.assertExecutionCurrent?.(original),
+        false,
       );
-      deps.assertExecutionCurrent?.(firstMessage);
-      if (handled) return;
-      if (command && deps.executeExtensionCommand) {
-        const handledByExtension = await deps.executeExtensionCommand(
-          command,
-          messages[0]!,
+      const assertSemanticCurrent = () => {
+        assertAdmissionCurrent();
+        if (captured.getAllowedUserId() !== userId)
+          throw new Error(
+            `Selected ${name} operator authority is unavailable.`,
+          );
+      };
+      return issueSelectedOnce(assertSemanticCurrent, () =>
+        handleTelegramHelpCommand(
+          name,
+          message,
           ctx,
+          {
+            ...captured,
+            persistAllowedUserId: async () => {
+              throw new Error(
+                `Selected ${name} cannot acquire pairing authority.`,
+              );
+            },
+          },
+          { assertSemanticCurrent, assertRecipientCurrent, reportCompleted },
+        ),
+      );
+    };
+  const prepareSelectedConfirmation =
+    (name: "new" | "compact") =>
+    (
+      command: ParsedTelegramCommand,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramSelectedCommandAdmission,
+    ): (() => Promise<boolean>) | undefined => {
+      const original = messages[0],
+        captured = { ...deps };
+      if (
+        command.name !== name ||
+        messages.length !== 1 ||
+        !original ||
+        !captured.sendInteractiveMessage
+      )
+        return undefined;
+      const target = getTelegramCommandMessageTarget(original);
+      const assertRecipientCurrent = admission.assertRecipientCurrent,
+        reportCompleted = admission.reportCompleted;
+      const openConfirmation =
+        name === "new"
+          ? openTelegramNewConfirmation
+          : openTelegramCompactConfirmation;
+      const assertSemanticCurrent = createSelectedSemanticGuard(
+        admission,
+        () => captured.assertExecutionCurrent?.(original),
+        true,
+      );
+      return issueSelectedOnce(assertSemanticCurrent, async () => {
+        if (!reportCompleted()) return false;
+        assertRecipientCurrent();
+        scheduleTelegramCommandEffect(
+          ctx,
+          name,
+          "confirmation-render",
+          captured,
+          () =>
+            openConfirmation(
+              target,
+              { sendInteractiveMessage: captured.sendInteractiveMessage! },
+              assertRecipientCurrent,
+            ),
+          assertRecipientCurrent,
         );
-        deps.assertExecutionCurrent?.(firstMessage);
-        if (handledByExtension) return;
+        return true;
+      });
+    };
+  return Object.assign(handle, {
+    /** Command-only producer execution; Routing must supply the captured plan and released exact-source authority. */
+    prepareSelectedExtensionCommand(
+      prepared: NonNullable<
+        Awaited<ReturnType<typeof prepareTelegramSelectedExtensionCommand>>
+      >,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramSelectedCommandAdmission,
+    ): (() => Promise<void>) | undefined {
+      const original = messages[0],
+        captured = { ...deps },
+        plan = prepared.plan;
+      if (
+        messages.length !== 1 ||
+        !original ||
+        plan.kind !== "command-only" ||
+        typeof captured.sendTextReply !== "function" ||
+        typeof admission.reportCompleted !== "function"
+      )
+        return undefined;
+      const execute = plan.execute,
+        assertRegistrationCurrent = prepared.assertRegistrationCurrent;
+      const assertSourceCurrent = admission.assertSourceCurrent,
+        recipientCurrent = admission.assertRecipientCurrent;
+      const reportCompleted = admission.reportCompleted;
+      // Only a body-free fixed recipient/anchor enters detached delivery, never the original's admission symbols.
+      const message = copySelectedReplyAnchor(original);
+      const assertRecipientCurrent = () => {
+        if (captured.isContextActive?.(ctx) === false)
+          throw new Error("Selected extension context changed.");
+        assertRegistrationCurrent();
+        recipientCurrent();
+        assertRegistrationCurrent();
+        if (captured.isContextActive?.(ctx) === false)
+          throw new Error("Selected extension context changed.");
+      };
+      const assertCurrent = () => {
+        assertSourceCurrent();
+        captured.assertExecutionCurrent?.(original);
+        assertRecipientCurrent();
+        assertSourceCurrent();
+        captured.assertExecutionCurrent?.(original);
+      };
+      try {
+        assertCurrent();
+      } catch {
+        return undefined;
       }
-      if (command?.name && deps.expandPromptTemplateCommand) {
-        const expanded = deps.expandPromptTemplateCommand(
-          command.name,
-          command.args,
-        );
-        if (expanded !== undefined) {
-          deps.assertExecutionCurrent?.(firstMessage);
-          await deps.enqueueTurn(
-            [
-              deps.replaceMessageText(firstMessage, expanded),
-              ...messages.slice(1),
-            ],
+      let issued = false,
+        reportAttempted = false;
+      const execution: SelectedCommandExecution = Object.freeze({
+        assertCurrent,
+        reportCompleted() {
+          if (!issued || reportAttempted) return false;
+          // Lost/refused reports never authorize another completion attempt or producer execution.
+          reportAttempted = true;
+          assertCurrent();
+          return reportCompleted();
+        },
+        reply(text: string) {
+          assertRecipientCurrent();
+          if (typeof text !== "string")
+            throw new Error("Selected extension reply requires text.");
+          scheduleTelegramCommandEffect(
             ctx,
+            "extension",
+            "selected-reply",
+            captured,
+            () =>
+              captured.sendTextReply(message, text, {
+                assertAuthority: assertRecipientCurrent,
+              }),
+            assertRecipientCurrent,
           );
-          return;
+        },
+      });
+      return async () => {
+        if (issued) return;
+        issued = true;
+        assertCurrent();
+        await execute(execution);
+        // Return, rejection and reply delivery are deliberately not semantic completion reports.
+      };
+    },
+    /** Selected help/start require the existing authenticated owner; cold pairing remains ordinary first contact. */
+    prepareSelectedStartCommand: prepareSelectedHelp("start"),
+    prepareSelectedHelpCommand: prepareSelectedHelp("help"),
+    /** Selected new handles only confirmation; the later authenticated callback owns replacement admission. */
+    prepareSelectedNewCommand: prepareSelectedConfirmation("new"),
+    /** Selected compaction handles only confirmation; the later authenticated callback owns actual compaction. */
+    prepareSelectedCompactCommand: prepareSelectedConfirmation("compact"),
+    /** Bare naming completes only after the exact dialog owner confirms current publication, not delivery alone. */
+    prepareSelectedNameDialogCommand(
+      command: ParsedTelegramCommand,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramSelectedCommandAdmission,
+    ): (() => Promise<boolean>) | undefined {
+      const original = messages[0],
+        captured = { ...deps };
+      if (
+        command.name !== "name" ||
+        command.args.trim() ||
+        messages.length !== 1 ||
+        !original ||
+        !captured.openThreadNameDialog
+      )
+        return undefined;
+      const message = copySelectedReplyAnchor(original);
+      const assertSourceCurrent = admission.assertSourceCurrent,
+        assertRecipientCurrent = admission.assertRecipientCurrent;
+      const reportCompleted = admission.reportCompleted;
+      const assertSemanticCurrent = createSelectedSemanticGuard(
+        admission,
+        () => captured.assertExecutionCurrent?.(original),
+        true,
+      );
+      return issueSelectedOnce(assertSemanticCurrent, async () => {
+        const publication = await captured.openThreadNameDialog!(message, ctx, {
+          assertSemanticCurrent,
+          assertRecipientCurrent,
+        });
+        assertSemanticCurrent();
+        const assertPublished = publication?.assertPublished;
+        if (typeof assertPublished !== "function")
+          throw new Error("Selected name dialog publication is unconfirmed.");
+        assertPublished();
+        assertSemanticCurrent();
+        assertPublished();
+        assertSourceCurrent();
+        captured.assertExecutionCurrent?.(original);
+        if (!reportCompleted())
+          throw new Error("Selected name source completion refused.");
+        return true;
+      });
+    },
+    /** Explicit naming retains source authority until its owner result; bare dialogs use their own publication leaf. */
+    prepareSelectedNameCommand(
+      command: ParsedTelegramCommand,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramSelectedCommandAdmission,
+    ): (() => Promise<boolean>) | undefined {
+      const original = messages[0],
+        threadName = command.args.trim(),
+        captured = { ...deps };
+      if (
+        command.name !== "name" ||
+        messages.length !== 1 ||
+        !original ||
+        !threadName ||
+        (/^[A-Z]$/.test(threadName)
+          ? !captured.resetCurrentThreadName
+          : !captured.renameCurrentThread)
+      )
+        return undefined;
+      const message = copySelectedReplyAnchor(original);
+      const assertRecipientCurrent = admission.assertRecipientCurrent,
+        reportCompleted = admission.reportCompleted;
+      const assertSemanticCurrent = createSelectedSemanticGuard(
+        admission,
+        () => captured.assertExecutionCurrent?.(original),
+        true,
+      );
+      return issueSelectedOnce(assertSemanticCurrent, async () => {
+        await handleTelegramNameCommand(message, ctx, threadName, captured, {
+          assertSemanticCurrent,
+          assertRecipientCurrent,
+          reportCompleted,
+        });
+        return true;
+      });
+    },
+    /** Genuine leader originals capture their warm queue owner before release; no hold copy or semantic-completion report. */
+    prepareSelectedQueueCommand(
+      command: ParsedTelegramCommand,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramHeldCommandAdmission,
+    ): Omit<TelegramPreparedHeldCommand, "bindCarrier"> | undefined {
+      const original = messages[0],
+        parsed = { ...command };
+      if (
+        messages.length !== 1 ||
+        !original ||
+        typeof admission.assertSourceCurrent !== "function" ||
+        typeof admission.assertRecipientCurrent !== "function"
+      )
+        return undefined;
+      const raw =
+          Reflect.get(original, "text") ?? Reflect.get(original, "caption"),
+        operator = deps.getAllowedUserId();
+      const actual =
+        typeof raw === "string" ? parseTelegramCommand(raw) : undefined;
+      if (
+        !isDeepStrictEqual(actual, parsed) ||
+        typeof operator !== "number" ||
+        original.chat.type !== "private" ||
+        original.chat.id !== operator ||
+        original.from?.id !== operator ||
+        original.from.is_bot ||
+        admission.target.chatId !== operator ||
+        !Number.isSafeInteger(admission.target.threadId) ||
+        admission.target.threadId < 1
+      )
+        return undefined;
+      const plan = getHeldPlan(parsed.name);
+      if (!plan || plan.completion !== "queue-receipt") return undefined;
+      const source = inspectTelegramDeferredSource(original),
+        queue = prepareTelegramDeferredQueueAdmission(original);
+      if (!source || source.completionSha256 || !queue?.isCurrent())
+        return undefined;
+      const prepared = plan.prepare(ctx, undefined, parsed);
+      if (!prepared) return undefined;
+      const target = { ...admission.target },
+        originalProjection = structuredClone(copySelectedMenuCarrier(original));
+      const message = structuredClone(originalProjection);
+      message.message_thread_id = target.threadId;
+      const assertSource = admission.assertSourceCurrent,
+        assertRecipient = admission.assertRecipientCurrent;
+      const assertCurrent = () => {
+        assertSource.call(admission);
+        prepared.captured.assertExecutionCurrent?.(original);
+        assertRecipient.call(admission);
+        if (
+          deps.getAllowedUserId() !== operator ||
+          !queue.isCurrent() ||
+          !prepared.portsCurrent() ||
+          !isDeepStrictEqual(
+            copySelectedMenuCarrier(original),
+            originalProjection,
+          ) ||
+          !isDeepStrictEqual(inspectTelegramDeferredSource(original), source)
+        )
+          throw new Error("Selected queue command source/owner changed.");
+        assertSource.call(admission);
+        prepared.captured.assertExecutionCurrent?.(original);
+      };
+      const execute = issueSelectedOnce(assertCurrent, async () => {
+        const release = acquireTelegramUpdateRouting(original);
+        try {
+          assertCurrent();
+          return await prepared.run({
+            message,
+            carrier: original,
+            source: { ...source },
+            queue,
+            command: { ...parsed },
+            assertSemantic: assertCurrent,
+            assertRecipient,
+            reportCompleted() {
+              throw new Error(
+                "Queue admission cannot report semantic source removal.",
+              );
+            },
+          });
+        } finally {
+          release();
         }
-      }
-      deps.assertExecutionCurrent?.(firstMessage);
-      await deps.enqueueTurn(messages, ctx);
+      });
+      return {
+        get source() {
+          return { ...source };
+        },
+        get command() {
+          return { ...parsed };
+        },
+        execute,
+        inspectCompletion() {
+          try {
+            assertRecipient.call(admission);
+            if (
+              deps.getAllowedUserId() !== operator ||
+              !queue.isCurrent() ||
+              !prepared.portsCurrent()
+            )
+              return undefined;
+            const proof = prepared.inspectQueuedCompletion?.();
+            assertRecipient.call(admission);
+            return deps.getAllowedUserId() === operator &&
+              queue.isCurrent() &&
+              prepared.portsCurrent()
+              ? proof
+              : undefined;
+          } catch {
+            return undefined;
+          }
+        },
+      };
+    },
+    /** Selected leaders reuse registry semantics; native source/recipient admission and inline transport remain role-owned. */
+    prepareSelectedCommand: prepareSelectedPlan,
+    /** Existing native publication boundary; unrelated/legacy receipts keep their ordinary owner. */
+    prepareHeldQueueReceipt: ((
+      receipt,
+      queueOwner,
+      context,
+      isWorkerCurrent,
+    ) => {
+      const record = heldQueueReceipts.get(receipt.receiptId);
+      if (record === null)
+        throw new Error("Held queue receipt publication authority changed.");
+      if (!record) return undefined;
+      if (
+        context !== record.ctx ||
+        !isWorkerCurrent() ||
+        !record.current() ||
+        !isDeepStrictEqual(record.receipt, receipt)
+      )
+        throw new Error("Held queue receipt publication authority changed.");
+      const scope = record.queue.prepareCompletionScope(
+        record.receipt,
+        queueOwner,
+        record.completionSha256,
+      );
+      if (!scope || !isWorkerCurrent() || !record.current())
+        throw new Error("Held queue receipt original scope is unavailable.");
+      return [scope];
+    }) satisfies NonNullable<
+      TelegramUpdateWorkerRuntimeDeps<TContext>["beforeQueueReceiptPublished"]
+    >,
+    /** Pure registry/effect availability; never reads a source or activates future recipient authority. */
+    canPrepareHeldCommand(
+      name: string,
+      effects?: TelegramHeldCommandEffects<TContext>,
+    ): boolean {
+      return getHeldPlan(name, effects) !== undefined;
     },
+    /** Compile one registry plan from a saved original; no admission, recipient activation or update-handler replay. */
+    prepareHeldCommand(
+      name: string,
+      readiness: TelegramLiveSourceCompletionReadiness,
+      ctx: TContext,
+      admission: TelegramHeldCommandAdmission,
+      effects?: TelegramHeldCommandEffects<TContext>,
+    ): TelegramPreparedHeldCommand | undefined {
+      const plan = getHeldPlan(name, effects);
+      if (!plan) return undefined;
+      const value = plan.template
+        ? readiness.snapshot.update.message
+        : undefined;
+      const command =
+        value &&
+        typeof value === "object" &&
+        typeof Reflect.get(value, "text") === "string"
+          ? parseTelegramCommand(Reflect.get(value, "text"))
+          : undefined;
+      const prepared = plan.prepare(ctx, effects, command);
+      if (!prepared) return undefined;
+      return prepareHeldSelectedCommand(
+        name,
+        readiness,
+        admission,
+        prepared.captured,
+        prepared.portsCurrent,
+        plan.completion,
+        prepared.run,
+        prepared.inspectQueuedCompletion,
+      );
+    },
+    /** Warm menu-only issuance; completion reporting is not a receipt or a durable removal ACK. */
+    prepareSelectedMenuCommand(
+      command: ParsedTelegramCommand,
+      messages: readonly TMessage[],
+      ctx: TContext,
+      admission: TelegramSelectedCommandAdmission,
+    ): (() => Promise<boolean>) | undefined {
+      const action = buildTelegramCommandAction(command.name);
+      if (
+        messages.length !== 1 ||
+        !messages[0] ||
+        !["status", "model", "thinking", "queue", "settings"].includes(
+          action.kind,
+        ) ||
+        (action.kind === "settings" && !deps.openSettingsMenu)
+      )
+        return undefined;
+      if (action.kind === "status")
+        return prepareSelectedPlan(command, messages, ctx, admission);
+      const original = messages[0],
+        name = command.name,
+        args = command.args;
+      if (
+        typeof admission.assertSourceCurrent !== "function" ||
+        typeof admission.assertRecipientCurrent !== "function" ||
+        typeof admission.reportCompleted !== "function"
+      )
+        return undefined;
+      const assertSourceCurrent = admission.assertSourceCurrent,
+        assertRecipientCurrent = admission.assertRecipientCurrent;
+      const reportCompleted = admission.reportCompleted,
+        assertExecutionCurrent = deps.assertExecutionCurrent;
+      const assertIssuanceCurrent = () => {
+        assertSourceCurrent.call(admission);
+        assertExecutionCurrent?.call(deps, original);
+        assertRecipientCurrent();
+        // Recipient observations can revoke the source too; never complete from an earlier source sample.
+        assertSourceCurrent.call(admission);
+        assertExecutionCurrent?.call(deps, original);
+      };
+      // Preparation proves branch availability, not the future released recipient's active authority.
+      // Detached rendering must not inherit the original admission/fence or a mutable target carrier.
+      const message = copySelectedMenuCarrier(original);
+      const menuDeps = { ...deps };
+      const recipientOptions = { assertAuthority: assertRecipientCurrent };
+      const recipientDeps = {
+        ...deps,
+        assertExecutionCurrent: assertRecipientCurrent,
+        showStatus: (value: TMessage, context: TContext) =>
+          menuDeps.showStatus(value, context, recipientOptions),
+        openModelMenu: (value: TMessage, context: TContext) =>
+          menuDeps.openModelMenu(value, context, recipientOptions),
+        openThinkingMenu: (value: TMessage, context: TContext) =>
+          menuDeps.openThinkingMenu(value, context, recipientOptions),
+        openQueueMenu: (value: TMessage, context: TContext) =>
+          menuDeps.openQueueMenu(value, context, recipientOptions),
+        openSettingsMenu:
+          menuDeps.openSettingsMenu &&
+          ((value: TMessage, context: TContext) =>
+            menuDeps.openSettingsMenu!(value, context, recipientOptions)),
+      };
+      return issueSelectedOnce(
+        assertIssuanceCurrent,
+        async () =>
+          reportCompleted.call(admission) &&
+          handleTelegramCommandRuntime(name, message, ctx, recipientDeps, args),
+      );
+    },
+  });
+}
+
+export function createTelegramCommandOrPromptDispatcher<TMessage, TContext>(
+  deps: TelegramCommandOrPromptDispatcherDeps<TMessage, TContext>,
+) {
+  const dispatchPromptTemplate = async (
+    command: ParsedTelegramCommand | undefined,
+    messages: TMessage[],
+    ctx: TContext,
+  ): Promise<boolean> => {
+    const first = messages[0];
+    if (!first) return false;
+    deps.assertExecutionCurrent?.(first);
+    const expanded =
+      command && deps.expandPromptTemplateCommand?.(command.name, command.args);
+    if (expanded === undefined) return false;
+    deps.assertExecutionCurrent?.(first);
+    const replaced = deps.replaceMessageText(first, expanded);
+    deps.assertExecutionCurrent?.(first);
+    await deps.enqueueTurn([replaced, ...messages.slice(1)], ctx);
+    return true;
+  };
+  return async (messages: TMessage[], ctx: TContext): Promise<void> => {
+    const firstMessage = messages[0];
+    if (!firstMessage) return;
+    if (deps.shouldIgnoreMessages?.(messages)) return;
+    deps.assertExecutionCurrent?.(firstMessage);
+    if (await deps.consumeThreadNameInput?.(messages, ctx)) {
+      deps.assertExecutionCurrent?.(firstMessage);
+      return;
+    }
+    const command = parseTelegramCommand(deps.extractRawText(messages));
+    const handled = await deps.handleCommand(
+      command?.name,
+      firstMessage,
+      ctx,
+      command?.args,
+    );
+    deps.assertExecutionCurrent?.(firstMessage);
+    if (handled) return;
+    if (command && deps.executeExtensionCommand) {
+      const handledByExtension = await deps.executeExtensionCommand(
+        command,
+        messages[0]!,
+        ctx,
+      );
+      deps.assertExecutionCurrent?.(firstMessage);
+      if (handledByExtension) return;
+    }
+    if (await dispatchPromptTemplate(command, messages, ctx)) return;
+    deps.assertExecutionCurrent?.(firstMessage);
+    await deps.enqueueTurn(messages, ctx);
   };
 }
 
@@ -2033,20 +3699,31 @@ function scheduleTelegramCommandEffect<TContext>(
   ctx: TContext,
   command: string,
   phase: string,
-  deps: TelegramRuntimeEventRecorderPort & {
-    isContextActive?: (ctx: TContext) => boolean;
-  },
+  deps: TelegramRuntimeEventRecorderPort &
+    TelegramCommandEffectWorkPort & {
+      isContextActive?: (ctx: TContext) => boolean;
+    },
   effect: () => Promise<void>,
   assertExecutionCurrent?: () => void,
 ): void {
+  const work = deps.beginCommandEffectWork?.();
+  let started = false,
+    outcome: "settled" | "unconfirmed" = "settled";
   void Promise.resolve()
     .then(async () => {
       if (deps.isContextActive?.(ctx) === false) return;
       assertExecutionCurrent?.();
+      started = true;
       await effect();
       assertExecutionCurrent?.();
     })
     .catch((error) => {
+      // A failed started effect cannot prove non-issuance; never turn its uncertainty into known idle.
+      if (
+        started &&
+        !(error instanceof TelegramApiAuthorityError && !error.requestIssued)
+      )
+        outcome = "unconfirmed";
       try {
         deps.recordRuntimeEvent?.("telegram-command", error, {
           command,
@@ -2055,7 +3732,201 @@ function scheduleTelegramCommandEffect<TContext>(
       } catch {
         // Effect diagnostics cannot create an unhandled detached Promise.
       }
+    })
+    .finally(() => work?.settle(outcome));
+}
+
+async function handleTelegramHelpCommand<
+  TMessage extends TelegramCommandRuntimeMessage,
+  TContext,
+>(
+  commandName: string,
+  message: TMessage,
+  ctx: TContext,
+  deps: Pick<
+    TelegramCommandRuntimeDeps<TMessage, TContext>,
+    | "assertExecutionCurrent"
+    | "getAllowedUserId"
+    | "persistAllowedUserId"
+    | "updateStatus"
+    | "isContextActive"
+    | "handleForumBootstrap"
+    | "sendTextReply"
+    | "showStatus"
+    | "registerBotCommands"
+    | "recordRuntimeEvent"
+    | "beginCommandEffectWork"
+  >,
+  admission?: {
+    assertSemanticCurrent(): void;
+    assertRecipientCurrent(): void;
+    reportCompleted(): boolean;
+  },
+): Promise<boolean> {
+  const assertSemanticCurrent =
+    admission?.assertSemanticCurrent ??
+    (() => deps.assertExecutionCurrent?.(message));
+  admission?.assertSemanticCurrent();
+  if (
+    message.from?.id !== undefined &&
+    canPairTelegramUserFromCommandMessage(message)
+  ) {
+    const allowed = await pairTelegramUserIfNeeded(message.from.id, {
+      allowedUserId: deps.getAllowedUserId(),
+      ctx: undefined,
+      persistAllowedUserId: deps.persistAllowedUserId,
+      updateStatus: () => deps.updateStatus(ctx),
+      assertExecutionCurrent: assertSemanticCurrent,
     });
+    if (!allowed) return false;
+  }
+  if (admission) {
+    assertSemanticCurrent();
+    if (!admission.reportCompleted()) return false;
+    admission.assertRecipientCurrent();
+  }
+  const assertEffectCurrent =
+    admission?.assertRecipientCurrent ??
+    (() => deps.assertExecutionCurrent?.(message));
+  const options = admission && {
+    assertAuthority: admission.assertRecipientCurrent,
+  };
+  const isContextActive = () => deps.isContextActive?.(ctx) !== false;
+  scheduleTelegramCommandEffect(
+    ctx,
+    commandName,
+    "menu-render",
+    deps,
+    async () => {
+      let forumBootstrapMessage: string | undefined;
+      if (commandName === "start" && deps.handleForumBootstrap) {
+        forumBootstrapMessage = await deps.handleForumBootstrap(
+          message,
+          ctx,
+          options,
+        );
+      }
+      if (!isContextActive()) return;
+      assertEffectCurrent();
+      if (forumBootstrapMessage) {
+        await deps.sendTextReply(message, forumBootstrapMessage, options);
+        assertEffectCurrent();
+      }
+      if (!isContextActive()) return;
+      assertEffectCurrent();
+      await deps.showStatus(message, ctx, options);
+    },
+    assertEffectCurrent,
+  );
+  scheduleTelegramCommandEffect(
+    ctx,
+    commandName,
+    "bot-command-sync",
+    deps,
+    () => deps.registerBotCommands(options),
+    assertEffectCurrent,
+  );
+  return true;
+}
+
+async function handleTelegramNameCommand<
+  TMessage extends TelegramCommandRuntimeMessage,
+  TContext,
+>(
+  message: TMessage,
+  ctx: TContext,
+  requestedName: string,
+  deps: TelegramCommandRuntimeDeps<TMessage, TContext>,
+  admission?: {
+    assertSemanticCurrent(): void;
+    assertRecipientCurrent(): void;
+    reportCompleted(): boolean;
+  },
+): Promise<void> {
+  const threadName = requestedName.trim();
+  const reply = async (text: string) => {
+    if (admission) {
+      admission.assertSemanticCurrent();
+      if (!admission.reportCompleted())
+        throw new Error("Selected name source completion refused.");
+      admission.assertRecipientCurrent();
+      await deps.sendTextReply(message, text, {
+        parseMode: "HTML",
+        assertAuthority: admission.assertRecipientCurrent,
+      });
+      admission.assertRecipientCurrent();
+    } else {
+      deps.assertExecutionCurrent?.(message);
+      await deps.sendTextReply(message, text, { parseMode: "HTML" });
+      deps.assertExecutionCurrent?.(message);
+    }
+  };
+  if (!threadName) {
+    if (deps.openThreadNameDialog)
+      await deps.openThreadNameDialog(message, ctx);
+    else
+      await reply(
+        formatTelegramInformationHeading("🏷️", "Usage: /name Navigator"),
+      );
+    return;
+  }
+  if (/^[A-Z]$/.test(threadName) && deps.resetCurrentThreadName) {
+    admission?.assertSemanticCurrent();
+    const target = getTelegramCommandMessageTarget(message);
+    const result = admission
+      ? await deps.resetCurrentThreadName(target, {
+          assertAuthority: admission.assertSemanticCurrent,
+        })
+      : await deps.resetCurrentThreadName(target);
+    admission?.assertSemanticCurrent();
+    await reply(
+      result.ok && !result.message
+        ? formatTelegramAutomaticThreadDisplayNameRestoredHeading(
+            result.threadName ?? threadName,
+          )
+        : formatTelegramInformationHeading(
+            result.ok ? "✅" : "⚠️",
+            result.message ?? "Thread display name reset failed.",
+          ),
+    );
+    return;
+  }
+  admission?.assertSemanticCurrent();
+  const validationError = deps.validateThreadName?.(threadName);
+  admission?.assertSemanticCurrent();
+  if (validationError) {
+    await reply(formatTelegramInvalidInstanceName(validationError));
+    return;
+  }
+  if (!deps.renameCurrentThread) {
+    await reply(
+      formatTelegramInformationHeading(
+        "🚫",
+        "Thread display naming is unavailable.",
+      ),
+    );
+    return;
+  }
+  if (admission) admission.assertSemanticCurrent();
+  else deps.assertExecutionCurrent?.(message);
+  const target = getTelegramCommandMessageTarget(message);
+  const result = admission
+    ? await deps.renameCurrentThread(target, threadName, {
+        assertAuthority: admission.assertSemanticCurrent,
+      })
+    : await deps.renameCurrentThread(target, threadName);
+  if (admission) admission.assertSemanticCurrent();
+  else deps.assertExecutionCurrent?.(message);
+  await reply(
+    result.ok && !result.message
+      ? formatTelegramThreadDisplayNameSavedHeading(
+          result.threadName ?? threadName,
+        )
+      : formatTelegramInformationHeading(
+          result.ok ? "✅" : "⚠️",
+          result.message ?? "Thread display name update failed.",
+        ),
+  );
 }
 
 async function handleTelegramCommandRuntime<
@@ -2068,6 +3939,7 @@ async function handleTelegramCommandRuntime<
   deps: TelegramCommandRuntimeDeps<TMessage, TContext>,
   commandArgs = "",
 ): Promise<boolean> {
+  deps.assertExecutionCurrent?.(message);
   const assertExecutionCurrentFor = (nextMessage: TMessage) => (): void =>
     deps.assertExecutionCurrent?.(nextMessage);
   const sendReplyFor =
@@ -2098,69 +3970,8 @@ async function handleTelegramCommandRuntime<
           sendTextReply: sendReplyFor(nextMessage),
         });
       },
-      handleName: async (nextMessage, _commandCtx, requestedName) => {
-        const threadName = requestedName.trim();
-        if (!threadName) {
-          if (deps.openThreadNameDialog) {
-            await deps.openThreadNameDialog(nextMessage, _commandCtx);
-          } else {
-            await sendReplyFor(nextMessage)(
-              formatTelegramInformationHeading("🏷️", "Usage: /name Navigator"),
-              { parseMode: "HTML" },
-            );
-          }
-          return;
-        }
-        if (/^[A-Z]$/.test(threadName) && deps.resetCurrentThreadName) {
-          const result = await deps.resetCurrentThreadName(
-            getTelegramCommandMessageTarget(nextMessage),
-          );
-          await sendReplyFor(nextMessage)(
-            result.ok && !result.message
-              ? formatTelegramAutomaticThreadDisplayNameRestoredHeading(
-                result.threadName ?? threadName,
-              )
-              : formatTelegramInformationHeading(
-                result.ok ? "✅" : "⚠️",
-                result.message ?? "Thread display name reset failed.",
-              ),
-            { parseMode: "HTML" },
-          );
-          return;
-        }
-        const validationError = deps.validateThreadName?.(threadName);
-        if (validationError) {
-          await sendReplyFor(nextMessage)(
-            formatTelegramInvalidInstanceName(validationError),
-            { parseMode: "HTML" },
-          );
-          return;
-        }
-        if (!deps.renameCurrentThread) {
-          await sendReplyFor(nextMessage)(
-            formatTelegramInformationHeading("🚫", "Thread display naming is unavailable."),
-            { parseMode: "HTML" },
-          );
-          return;
-        }
-        deps.assertExecutionCurrent?.(nextMessage);
-        const result = await deps.renameCurrentThread(
-          getTelegramCommandMessageTarget(nextMessage),
-          threadName,
-        );
-        deps.assertExecutionCurrent?.(nextMessage);
-        await sendReplyFor(nextMessage)(
-          result.ok && !result.message
-            ? formatTelegramThreadDisplayNameSavedHeading(
-              result.threadName ?? threadName,
-            )
-            : formatTelegramInformationHeading(
-              result.ok ? "✅" : "⚠️",
-              result.message ?? "Thread display name update failed.",
-            ),
-          { parseMode: "HTML" },
-        );
-      },
+      handleName: (nextMessage, commandCtx, requestedName) =>
+        handleTelegramNameCommand(nextMessage, commandCtx, requestedName, deps),
       handleAbort: async (nextMessage, commandCtx) => {
         await handleTelegramAbortCommand({
           hasAbortHandler: deps.hasAbortHandler,
@@ -2316,50 +4127,11 @@ async function handleTelegramCommandRuntime<
           }
         : undefined,
       handleHelp: async (nextMessage, nextCommandName, commandCtx) => {
-        if (
-          nextMessage.from?.id !== undefined &&
-          canPairTelegramUserFromCommandMessage(nextMessage)
-        ) {
-          const allowed = await pairTelegramUserIfNeeded(nextMessage.from.id, {
-            allowedUserId: deps.getAllowedUserId(),
-            ctx: undefined,
-            persistAllowedUserId: deps.persistAllowedUserId,
-            updateStatus: updateStatusFor(commandCtx),
-            assertExecutionCurrent: assertExecutionCurrentFor(nextMessage),
-          });
-          if (!allowed) return;
-        }
-        const isContextActive = () =>
-          deps.isContextActive?.(commandCtx) !== false;
-        scheduleTelegramCommandEffect(
-          commandCtx,
+        await handleTelegramHelpCommand(
           nextCommandName,
-          "menu-render",
-          deps,
-          async () => {
-            let forumBootstrapMessage: string | undefined;
-            if (nextCommandName === "start" && deps.handleForumBootstrap) {
-              forumBootstrapMessage = await deps.handleForumBootstrap(
-                nextMessage,
-                commandCtx,
-              );
-            }
-            if (!isContextActive()) return;
-            if (forumBootstrapMessage) {
-              await deps.sendTextReply(nextMessage, forumBootstrapMessage);
-            }
-            if (!isContextActive()) return;
-            await deps.showStatus(nextMessage, commandCtx);
-          },
-          assertExecutionCurrentFor(nextMessage),
-        );
-        scheduleTelegramCommandEffect(
+          nextMessage,
           commandCtx,
-          nextCommandName,
-          "bot-command-sync",
           deps,
-          deps.registerBotCommands,
-          assertExecutionCurrentFor(nextMessage),
         );
       },
     },
@@ -2395,8 +4167,9 @@ export interface TelegramSessionActionRuntimeDeps {
 export interface TelegramSessionReplacementSettlementDeps {
   getIntent: () => Promise<TelegramSessionReplacementIntent | undefined>;
   hasSuccessorContinuity: (intent: TelegramSessionReplacementIntent) => boolean;
-  editSuccess: (intent: TelegramSessionReplacementIntent) =>
-    Promise<{ ok: boolean; retryable?: boolean; message?: string }>;
+  editSuccess: (
+    intent: TelegramSessionReplacementIntent,
+  ) => Promise<{ ok: boolean; retryable?: boolean; message?: string }>;
   clearIntent: (intent: TelegramSessionReplacementIntent) => Promise<boolean>;
   profileName: string | undefined;
   cwd: string;
@@ -2410,18 +4183,20 @@ export async function settleTelegramSessionReplacement(
   deps: TelegramSessionReplacementSettlementDeps,
 ): Promise<"none" | "settled" | "expired" | "failed" | "stale"> {
   const now = deps.now ?? Date.now;
-  const sleep = deps.sleep ?? ((delayMs) =>
-    new Promise<void>((resolve) => setTimeout(resolve, delayMs)));
+  const sleep =
+    deps.sleep ??
+    ((delayMs) => new Promise<void>((resolve) => setTimeout(resolve, delayMs)));
   while (deps.isCurrent?.() !== false) {
     const intent = await deps.getIntent();
     if (!intent || intent.sourceSessionId === deps.sessionId) return "none";
-    if (intent.profileName !== deps.profileName || intent.cwd !== deps.cwd) return "stale";
+    if (intent.profileName !== deps.profileName || intent.cwd !== deps.cwd)
+      return "stale";
     if (now() >= intent.expiresAtMs) return "expired";
     if (!deps.hasSuccessorContinuity(intent)) {
       await sleep(100);
       continue;
     }
-    if (!await deps.clearIntent(intent)) return "failed";
+    if (!(await deps.clearIntent(intent))) return "failed";
     do {
       const delivered = await deps.editSuccess(intent);
       if (delivered.ok) return "settled";
@@ -2434,8 +4209,12 @@ export async function settleTelegramSessionReplacement(
 }
 
 function createTelegramSessionReplacementSettlementRuntime<TContext>(deps: {
-  resolve: (ctx: TContext) => TelegramSessionReplacementSettlementDeps | undefined;
-  onResult?: (result: "none" | "settled" | "expired" | "failed" | "stale") => void;
+  resolve: (
+    ctx: TContext,
+  ) => TelegramSessionReplacementSettlementDeps | undefined;
+  onResult?: (
+    result: "none" | "settled" | "expired" | "failed" | "stale",
+  ) => void;
   onError?: (error: unknown) => void;
 }): { onSessionStart: (ctx: TContext) => void } {
   let generation = 0;
@@ -2446,8 +4225,8 @@ function createTelegramSessionReplacementSettlementRuntime<TContext>(deps: {
       if (!resolved) return;
       void settleTelegramSessionReplacement({
         ...resolved,
-        isCurrent: () => currentGeneration === generation &&
-          resolved.isCurrent?.() !== false,
+        isCurrent: () =>
+          currentGeneration === generation && resolved.isCurrent?.() !== false,
       }).then(deps.onResult, deps.onError);
     },
   };
@@ -2462,11 +4241,18 @@ export interface TelegramSessionActionAssemblyDeps {
     getWorkspaceBindingByTarget: (
       target: { chatId: number; threadId?: number },
       sessionId?: string,
-    ) => {
-      cwd: string; sessionId?: string; slot?: string; threadName?: string;
-      manualThreadName?: string; target: { chatId: number; threadId: number };
-    } | undefined;
-    getSessionReplacementIntent: () => TelegramSessionReplacementIntent | undefined;
+    ) =>
+      | {
+          cwd: string;
+          sessionId?: string;
+          slot?: string;
+          threadName?: string;
+          manualThreadName?: string;
+          target: { chatId: number; threadId: number };
+        }
+      | undefined;
+    getSessionReplacementIntent: () =>
+      TelegramSessionReplacementIntent | undefined;
     commitSessionReplacementIntent: (
       intent: TelegramSessionReplacementIntent,
       isCurrent: () => boolean,
@@ -2507,14 +4293,18 @@ export function createTelegramSessionActionAssembly(
   settlement: { onSessionStart: (ctx: Pi.ExtensionContext) => void };
 } {
   const now = deps.now ?? Date.now;
-  const report = (error: unknown): void => deps.recordRuntimeEvent?.("new-session", error);
+  const report = (error: unknown): void =>
+    deps.recordRuntimeEvent?.("new-session", error);
   const sendTerminalResult = async (
     target: { chatId: number; threadId?: number },
     result: "success" | "cancelled" | "failure",
   ): Promise<void> => {
-    const text = result === "success" ? "<b>🆕 New session started.</b>"
-      : result === "cancelled" ? "<b>🚫 New session cancelled.</b>"
-      : "<b>⚠️ New session failed.</b>";
+    const text =
+      result === "success"
+        ? "<b>🆕 New session started.</b>"
+        : result === "cancelled"
+          ? "<b>🚫 New session cancelled.</b>"
+          : "<b>⚠️ New session failed.</b>";
     const deadline = now() + 10_000;
     do {
       const delivery = await deps.sendResult(target, text);
@@ -2527,21 +4317,28 @@ export function createTelegramSessionActionAssembly(
   const action = createTelegramSessionActionRuntime({
     registerCommand: deps.registerCommand,
     sendUserMessage: deps.sendUserMessage,
-    notifyResult(target, result) { return sendTerminalResult(target, result); },
+    notifyResult(target, result) {
+      return sendTerminalResult(target, result);
+    },
     async prepareReplacement(ctx, updateId, target) {
-      const follower = !deps.ownsPersistence() && typeof target.threadId === "number" &&
-          deps.follower?.isRegisteredFor(target)
-        ? deps.follower
-        : undefined;
+      const follower =
+        !deps.ownsPersistence() &&
+        typeof target.threadId === "number" &&
+        deps.follower?.isRegisteredFor(target)
+          ? deps.follower
+          : undefined;
       // Follower memory is not authority; reread the leader-published snapshot.
       if (follower && deps.store.refresh) await deps.store.refresh();
       else await deps.store.load();
       const sessionId = ctx.sessionManager.getSessionId();
-      const binding = typeof target.threadId === "number"
-        ? deps.store.getWorkspaceBindingByTarget(target)
-        : undefined;
-      if (typeof target.threadId === "number" &&
-          (!binding || binding.cwd !== ctx.cwd || binding.sessionId !== sessionId)) {
+      const binding =
+        typeof target.threadId === "number"
+          ? deps.store.getWorkspaceBindingByTarget(target)
+          : undefined;
+      if (
+        typeof target.threadId === "number" &&
+        (!binding || binding.cwd !== ctx.cwd || binding.sessionId !== sessionId)
+      ) {
         throw new Error("Telegram session replacement binding is unavailable.");
       }
       const createdAtMs = now();
@@ -2554,53 +4351,91 @@ export function createTelegramSessionActionAssembly(
         target: binding ? { ...binding.target } : { chatId: target.chatId },
         messageId: target.messageId,
         ...(binding?.slot ? { slot: binding.slot } : {}),
-        ...(binding?.manualThreadName ?? binding?.threadName
-          ? { threadName: binding.manualThreadName ?? binding.threadName } : {}),
+        ...((binding?.manualThreadName ?? binding?.threadName)
+          ? { threadName: binding.manualThreadName ?? binding.threadName }
+          : {}),
         createdAtMs,
         expiresAtMs: createdAtMs + deps.handoffTtlMs,
         ...(follower ? { sourceInstanceId: follower.instanceId } : {}),
       };
-      if (!await (follower
-        ? follower.requestSessionReplacement("publish", intent)
-        : deps.store.commitSessionReplacementIntent(intent, deps.ownsPersistence))) {
-        throw new Error("Telegram session replacement intent was not persisted.");
+      if (
+        !(await (follower
+          ? follower.requestSessionReplacement("publish", intent)
+          : deps.store.commitSessionReplacementIntent(
+              intent,
+              deps.ownsPersistence,
+            )))
+      ) {
+        throw new Error(
+          "Telegram session replacement intent was not persisted.",
+        );
       }
     },
     recordRuntimeEvent: deps.recordRuntimeEvent,
   });
-  const settlement = createTelegramSessionReplacementSettlementRuntime<Pi.ExtensionContext>({
-    resolve(ctx) {
-      const sessionId = ctx.sessionManager?.getSessionId?.();
-      if (!sessionId) return undefined;
-      return {
-        async getIntent() { await deps.store.refresh?.(); return deps.store.getSessionReplacementIntent(); },
-        hasSuccessorContinuity(intent) {
-          if (intent.continuity === "classic-chat") return true;
-          if (deps.store.getWorkspaceBindingByTarget(intent.target, sessionId)?.cwd !==
-              intent.cwd) return false;
-          // A follower successor claims only after its own re-registration is live.
-          return intent.sourceInstanceId === undefined || deps.ownsPersistence() ||
-            deps.follower?.isRegisteredFor(intent.target) === true;
-        },
-        editSuccess(intent) { return deps.sendResult(intent.target, "<b>🆕 New session started.</b>"); },
-        async clearIntent(intent) {
-          if (intent.sourceInstanceId === undefined || deps.ownsPersistence()) {
-            return deps.store.removeSessionReplacementIntent(intent, deps.ownsPersistence);
-          }
-          return await deps.follower?.requestSessionReplacement("settle", intent) ?? false;
-        },
-        profileName: deps.getProfileName() ?? "default",
-        cwd: ctx.cwd,
-        sessionId,
-      };
-    },
-    onResult(result) {
-      if (result === "expired" || result === "failed") {
-        report(new Error(`Telegram session replacement successor settlement ${result}.`));
-      }
-    },
-    onError: report,
-  });
+  const settlement =
+    createTelegramSessionReplacementSettlementRuntime<Pi.ExtensionContext>({
+      resolve(ctx) {
+        const sessionId = ctx.sessionManager?.getSessionId?.();
+        if (!sessionId) return undefined;
+        return {
+          async getIntent() {
+            await deps.store.refresh?.();
+            return deps.store.getSessionReplacementIntent();
+          },
+          hasSuccessorContinuity(intent) {
+            if (intent.continuity === "classic-chat") return true;
+            if (
+              deps.store.getWorkspaceBindingByTarget(intent.target, sessionId)
+                ?.cwd !== intent.cwd
+            )
+              return false;
+            // A follower successor claims only after its own re-registration is live.
+            return (
+              intent.sourceInstanceId === undefined ||
+              deps.ownsPersistence() ||
+              deps.follower?.isRegisteredFor(intent.target) === true
+            );
+          },
+          editSuccess(intent) {
+            return deps.sendResult(
+              intent.target,
+              "<b>🆕 New session started.</b>",
+            );
+          },
+          async clearIntent(intent) {
+            if (
+              intent.sourceInstanceId === undefined ||
+              deps.ownsPersistence()
+            ) {
+              return deps.store.removeSessionReplacementIntent(
+                intent,
+                deps.ownsPersistence,
+              );
+            }
+            return (
+              (await deps.follower?.requestSessionReplacement(
+                "settle",
+                intent,
+              )) ?? false
+            );
+          },
+          profileName: deps.getProfileName() ?? "default",
+          cwd: ctx.cwd,
+          sessionId,
+        };
+      },
+      onResult(result) {
+        if (result === "expired" || result === "failed") {
+          report(
+            new Error(
+              `Telegram session replacement successor settlement ${result}.`,
+            ),
+          );
+        }
+      },
+      onError: report,
+    });
   return { action, settlement };
 }
 
@@ -2625,11 +4460,13 @@ export function createTelegramSessionActionRuntime(
   deps: TelegramSessionActionRuntimeDeps,
 ): TelegramSessionActionRuntime {
   let pendingUpdateId: number | undefined;
-  let pendingTarget: {
-    chatId: number;
-    threadId?: number;
-    messageId: number;
-  } | undefined;
+  let pendingTarget:
+    | {
+        chatId: number;
+        threadId?: number;
+        messageId: number;
+      }
+    | undefined;
   let pendingAction: TelegramPendingInternalAction | undefined;
   let registered = false;
 
@@ -2657,9 +4494,14 @@ export function createTelegramSessionActionRuntime(
           switch (action.kind) {
             case "replace-session":
               try {
-                await deps.prepareReplacement?.(ctx, action.updateId, action.target);
+                await deps.prepareReplacement?.(
+                  ctx,
+                  action.updateId,
+                  action.target,
+                );
                 const result = await ctx.newSession();
-                if (result.cancelled) await deps.notifyResult(action.target, "cancelled");
+                if (result.cancelled)
+                  await deps.notifyResult(action.target, "cancelled");
               } catch (error) {
                 reportFailure(error);
                 await deps.notifyResult(action.target, "failure");
@@ -2670,7 +4512,8 @@ export function createTelegramSessionActionRuntime(
       });
     },
     scheduleAfterUpdate(updateId, target) {
-      if (pendingUpdateId !== undefined || pendingAction !== undefined) return false;
+      if (pendingUpdateId !== undefined || pendingAction !== undefined)
+        return false;
       pendingUpdateId = updateId;
       pendingTarget = { ...target };
       return true;