@llblab/pi-telegram 0.54.3 → 0.55.0

package/dist/lib/routing.js

@@ -210,6 +210,8 @@ function getTelegramAllTabSourceMessageIds(messages, chatId) {
         ? [message.message_id]
         : []);
 }
+/** Failure retains the source for recovery; Threaded Mode never emits a fallback answer into All. */
+const TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR = "All is input-only in Threaded Mode; a routing Thread could not be prepared.";
 /** What a route chooser moves: `<code>/name</code>` for a command, otherwise "this message". */
 function formatTelegramRouteSubject(command) {
     return command ? `<code>/${escapeHtml(command)}</code>` : "this message";
@@ -250,13 +252,6 @@ function formatTelegramRoutingInputPreview(message) {
     const chars = Array.from(label);
     return (escapeHtml(chars.slice(0, 80).join("")) + (chars.length > 80 ? "…" : ""));
 }
-function formatTelegramAllTabMenuChooserText(command) {
-    return [
-        `<b>🚦 Route ${formatTelegramRouteSubject(command)}:</b>`,
-        "",
-        "<i>To restore a Pi instead, send a message in a new tab.</i>",
-    ].join("\n");
-}
 function buildTelegramUnboundRerouteChooserMarkup(rerouteId, records, options) {
     const activeRecords = records.filter((record) => record.status === "active");
     const canRestoreAnyLiveThread = options.canRestore && activeRecords.length > 0;
@@ -302,7 +297,8 @@ function formatTelegramUnboundRerouteChooserText(command) {
     return `<b>🔀 Reroute ${formatTelegramRouteSubject(command)} to:</b>`;
 }
 function formatTelegramUnboundRerouteRestoreChooserText(command) {
-    return `<b>🔁 Restore into this tab & send ${formatTelegramRouteSubject(command)}:</b>`;
+    const subject = command ? ` for ${formatTelegramRouteSubject(command)}` : "";
+    return `<b>🔁 Restore a Pi into this tab${subject}:</b>`;
 }
 function formatTelegramUnboundTopicGuidance() {
     return [
@@ -370,17 +366,21 @@ function classifyLiveRebindCleanupFailure(error) {
         ? "rejected"
         : "unknown";
 }
-/** Default live-rebind cleanup pacing: quick early attempts, then minutely, within a 15-minute window. */
+/**
+ * Default live-rebind cleanup pacing: quick early attempts, then minutely, within a 15-minute window. The first
+ * delay is not cosmetic: a leader's detached command reply still needs the released, cleanup-free row.
+ */
 export const TELEGRAM_LIVE_REBIND_CLEANUP_SCHEDULE = Object.freeze({
     delaysMs: Object.freeze([1_000, 2_000, 5_000, 10_000, 30_000]),
     intervalMs: 60_000,
     windowMs: 15 * 60_000,
 });
-/** One warm live attempt with exact post-release peer donor settlement; no startup recovery, Restore ACK or cleanup. */
+/** One warm live attempt with independent leader input/cleanup grants and exact peer donor settlement; no startup recovery or legacy Restore ACK. */
 export function createTelegramLiveRebindCoordinator(input) {
     const request = structuredClone(input.request), messages = [...input.messages];
     const executor = structuredClone(input.authority.executor), operatorUserId = input.authority.operatorUserId;
     const leader = input.leader && { ...input.leader }, follower = input.follower, followerRun = follower?.run;
+    const beforeCleanup = input.cleanupBeforeRelease;
     const selectedCommand = follower?.selectedCommand && structuredClone(follower.selectedCommand), held = selectedCommand;
     const observedRecipient = input.getRecipient(), recipient = observedRecipient && structuredClone(observedRecipient);
     const sources = messages.map(Updates.inspectTelegramDeferredSource);
@@ -465,7 +465,7 @@ export function createTelegramLiveRebindCoordinator(input) {
         return confirmed && current();
     };
     let preparation;
-    let saved = false, commitIssued = false, applyIssued = false, peerReleaseIssued = false, donorSettlementAttempted = false, continuationIssued = false, released = false, advancing = false;
+    let saved = false, commitIssued = false, applyIssued = false, retitleIssued = false, peerReleaseIssued = false, donorSettlementAttempted = false, continuationIssued = false, cleanupBeforeReleaseIssued = false, cleanupBeforeReleaseDecided = false, released = false, advancing = false;
     let preparedSource;
     const runFollower = async (mode) => {
         if (!input.follower || !recipient || !current())
@@ -513,6 +513,18 @@ export function createTelegramLiveRebindCoordinator(input) {
             generation: recipient.generation,
             bindingKey: recipient.bindingKey,
         });
+    const acceptInput = (expected) => {
+        if (!expected.inputRelease || expected.inputRelease === "accepted")
+            return expected;
+        let accepted;
+        try {
+            accepted = input.restoreStore.advanceLiveRebind(expected, "accept-input", authority);
+        }
+        catch {
+            accepted = retained();
+        }
+        return accepted?.inputRelease === "accepted" && canonical(accepted) ? accepted : undefined;
+    };
     const releaseFollower = async (intent) => {
         if (!held || !peerReleaseIssued) {
             peerReleaseIssued = true;
@@ -535,6 +547,10 @@ export function createTelegramLiveRebindCoordinator(input) {
                 !canonical(intent))
                 return "unknown";
         }
+        const accepted = acceptInput(intent);
+        if (!accepted)
+            return "unknown";
+        intent = accepted;
         donorSettlementAttempted = true;
         if (preparation?.settleTransferred(() => canonical(intent)) !== "settled")
             return "unknown";
@@ -544,19 +560,16 @@ export function createTelegramLiveRebindCoordinator(input) {
     const observeCommandCompletion = () => {
         const intent = retained();
         if (!intent ||
-            intent.phase !== "released" ||
-            intent.cleanup ||
+            !Threads.isTelegramLiveRebindInputAuthorized(intent) ||
             !canonical(intent) ||
             !leader?.isApplied(intent))
             return "unknown";
         const completions = messages.map(Updates.inspectTelegramDeferredSourceCompletion);
-        return completions.every((completion, index) => completion && isDeepStrictEqual(completion, sources[index])) &&
+        const completed = completions.every((completion, index) => completion && isDeepStrictEqual(completion, sources[index])) &&
             current() &&
             canonical(intent) &&
-            leader.isApplied(intent) &&
-            current()
-            ? "released"
-            : "unknown";
+            leader.isApplied(intent) && current();
+        return completed && acceptInput(intent) ? "released" : "unknown";
     };
     return {
         /** Correlation only; a later cleanup attempt rereads and revalidates the canonical row itself. */
@@ -589,8 +602,7 @@ export function createTelegramLiveRebindCoordinator(input) {
                         return observeCommandCompletion();
                     const intent = retained();
                     if (!intent ||
-                        intent.phase !== "released" ||
-                        intent.cleanup ||
+                        !Threads.isTelegramLiveRebindInputAuthorized(intent) ||
                         !canonical(intent) ||
                         !leader?.isApplied(intent) ||
                         !leader.observeAdmission?.() ||
@@ -598,6 +610,8 @@ export function createTelegramLiveRebindCoordinator(input) {
                         !canonical(intent) ||
                         !leader.isApplied(intent))
                         return "unknown";
+                    if (!acceptInput(intent))
+                        return "unknown";
                     released = true;
                     return "released";
                 }
@@ -653,22 +667,22 @@ export function createTelegramLiveRebindCoordinator(input) {
                         instanceId: recipient.instanceId,
                         sessionId: recipient.sessionId,
                         generation: recipient.generation,
-                    }, authority);
+                    }, authority, beforeCleanup ? { holdInput: true } : undefined);
                 }
                 else if (!commitIssued)
                     return "protected";
                 if (!intent ||
                     !sourceSaved() ||
                     !canonical(intent) ||
-                    intent.phase === "finished" ||
-                    intent.cleanup)
+                    (intent.phase === "finished" && !cleanupBeforeReleaseIssued) ||
+                    (intent.cleanup && intent.inputRelease === undefined))
                     return "protected";
                 // A released peer may already have completed its sources; only its retained settlement can reobserve that outcome.
                 if (recipient.kind === "follower" && peerReleaseIssued)
-                    return intent.phase === "released"
+                    return Threads.isTelegramLiveRebindInputAuthorized(intent)
                         ? await releaseFollower(intent)
                         : "protected";
-                const mode = applyIssued || intent.phase === "released" ? "inspect" : "apply";
+                const mode = applyIssued || intent.phase === "released" || intent.phase === "finished" ? "inspect" : "apply";
                 applyIssued = true;
                 if (recipient.kind === "leader") {
                     await leader.apply(structuredClone(intent), mode, current);
@@ -687,6 +701,19 @@ export function createTelegramLiveRebindCoordinator(input) {
                 }
                 if (!sourceSaved() || (preparation && !preparation.confirmSaved()))
                     return "protected";
+                if (input.retitle && !retitleIssued) {
+                    retitleIssued = true;
+                    try {
+                        await input.retitle(current);
+                    }
+                    catch (error) {
+                        input.recordRuntimeEvent?.("telegram", error, {
+                            phase: "live-rebind-title",
+                        });
+                    }
+                    if (!current() || !canonical(intent))
+                        return "unknown";
+                }
                 if (intent.phase === "rebound") {
                     const expected = intent;
                     input.restoreStore.advanceLiveRebind(expected, "release", recipient.kind === "leader"
@@ -698,22 +725,55 @@ export function createTelegramLiveRebindCoordinator(input) {
                     intent = retained();
                 }
                 if (!intent ||
-                    intent.phase !== "released" ||
-                    intent.cleanup ||
+                    (intent.phase !== "released" && !(intent.phase === "finished" && intent.inputRelease === "held")) ||
+                    (intent.cleanup && intent.inputRelease === undefined) ||
                     !canonical(intent))
                     return "protected";
+                if (beforeCleanup) {
+                    if (!cleanupBeforeReleaseIssued) {
+                        cleanupBeforeReleaseIssued = true;
+                        cleanupBeforeReleaseDecided = await beforeCleanup(intent, current);
+                    }
+                    intent = retained();
+                    if (!cleanupBeforeReleaseDecided && intent?.phase !== "finished")
+                        return "unknown";
+                    if (!intent || !canonical(intent) ||
+                        (recipient.kind === "leader" && !leader.isApplied(intent)) ||
+                        intent.inputRelease !== "held" || intent.cleanup === "issued")
+                        return "unknown";
+                    let issued;
+                    try {
+                        issued = input.restoreStore.advanceLiveRebind(intent, "issue-input", authority);
+                    }
+                    catch {
+                        issued = retained();
+                    }
+                    if (!issued || issued.inputRelease !== "issued" || !canonical(issued))
+                        return "unknown";
+                    intent = issued;
+                }
                 if (recipient.kind === "leader") {
                     const expected = intent;
                     if (!preparation?.beginRelease(() => canonical(expected) && leader.isApplied(expected)))
                         return "protected";
                     continuationIssued = true;
-                    const canContinue = () => current() && canonical(expected) && leader.isApplied(expected);
+                    const canContinue = () => {
+                        const observed = expected.inputRelease ? retained() : expected;
+                        return current() && !!observed &&
+                            (!expected.inputRelease || (observed.inputRelease === "issued" || observed.inputRelease === "accepted")) &&
+                            canonical(observed) && leader.isApplied(observed);
+                    };
                     if (leader.complete) {
                         leader.complete([...messages], canContinue);
+                        // The detached native producer has taken this one input grant; its source ACK remains a separate observation.
+                        if (!acceptInput(intent))
+                            return "unknown";
                         return observeCommandCompletion();
                     }
                     if (!(await leader.continue(messages, canContinue)))
                         return "unknown";
+                    if (!acceptInput(intent))
+                        return "unknown";
                 }
                 else
                     return await releaseFollower(intent);
@@ -1561,6 +1621,58 @@ export function createTelegramInboundRouteRuntime(deps) {
     };
     /** One-shot per chooser: the copies are taken before deletion, so a later consuming path finds none. */
     const deleteAllTabCopies = (pending) => deleteAllTabMessages(pending.sourceTarget.chatId, pending.allTabCopies?.splice(0) ?? []);
+    /**
+     * Restore keeps the tab as the Thread, so the input must stay visible there: the All original goes only when the tab
+     * holds its forwarded copy. Without one it stays where the operator can still read it.
+     */
+    const releaseAllTabCopiesIntoSurvivingTab = (pending) => {
+        if (pending.allTabCopiesForwarded)
+            return deleteAllTabCopies(pending);
+        pending.allTabCopies?.splice(0);
+        return Promise.resolve();
+    };
+    /**
+     * The Bot API files a threadless All input in All even when a mobile client first draws it in its new tab. One silent
+     * best-effort forward moves it into the routing tab it opened, and only a confirmed copy lets the original leave All;
+     * any failure keeps the original where the operator can still read it.
+     */
+    const moveAllTabSourceIntoTab = async (pending, target, isCurrent) => {
+        const messageIds = [...(pending.allTabCopies ?? [])].sort((a, b) => a - b);
+        if (messageIds.length === 0 || !deps.callApi || !isCurrent())
+            return;
+        const route = {
+            chat_id: target.chatId,
+            message_thread_id: target.threadId,
+            from_chat_id: pending.sourceTarget.chatId,
+            disable_notification: true,
+        };
+        try {
+            // An album moves as one album; forwardMessages skips what it cannot forward, so a short reply is not a move.
+            const copies = messageIds.length === 1
+                ? [
+                    await deps.callApi("forwardMessage", {
+                        ...route,
+                        message_id: messageIds[0],
+                    }),
+                ]
+                : await deps.callApi("forwardMessages", { ...route, message_ids: messageIds });
+            const copyIds = Array.isArray(copies)
+                ? copies.map((copy) => copy?.message_id)
+                : [];
+            if (copyIds.length !== messageIds.length ||
+                !copyIds.every((id) => typeof id === "number" && Number.isSafeInteger(id)))
+                return;
+            pending.allTabCopiesForwarded = true;
+            await deleteAllTabCopies(pending);
+            return copyIds[0];
+        }
+        catch (error) {
+            deps.recordRuntimeEvent?.("routing", error, {
+                phase: "temporary-thread-source-forward",
+            });
+            return;
+        }
+    };
     const dismissRerouteChooserMessage = async (query, assertExecutionCurrent) => {
         const chatId = query.message?.chat?.id;
         const messageId = query.message?.message_id;
@@ -1586,6 +1698,26 @@ export function createTelegramInboundRouteRuntime(deps) {
             return false;
         }
     };
+    /** Choosers are one-shot: a final outcome deletes the menu; only a failed delete leaves an inert, button-free notice. */
+    const retireRerouteChooserMessage = async (chatId, messageId, fallbackText, assertCurrent) => {
+        if (deps.deleteMessage) {
+            try {
+                await deps.deleteMessage(chatId, messageId);
+                return;
+            }
+            catch (error) {
+                deps.recordRuntimeEvent?.("telegram", error, {
+                    phase: "reroute-chooser-delete",
+                    chatId,
+                    messageId,
+                });
+            }
+            assertCurrent?.();
+        }
+        await deps.editInteractiveMessage?.(chatId, messageId, fallbackText, "html", {
+            inline_keyboard: [],
+        });
+    };
     const closeReroutedUnboundTopic = async (target, messageId, assertExecutionCurrent, ownTemporary) => {
         if (!target || !deps.threadStore)
             return true;
@@ -1708,8 +1840,9 @@ export function createTelegramInboundRouteRuntime(deps) {
                     continue;
                 if (!recordCancelledTemporaryThreadInput(pending, ctx, current))
                     continue;
+                // A sibling cancelled by Restore stays visible in the restored tab, like a desktop input typed there.
                 if (await retireCancellationChooser(id, pending, current))
-                    await deleteAllTabCopies(pending);
+                    await releaseAllTabCopiesIntoSurvivingTab(pending);
             }
             catch (error) {
                 deps.recordRuntimeEvent?.("routing", error, {
@@ -2239,12 +2372,28 @@ export function createTelegramInboundRouteRuntime(deps) {
                     if (!intent)
                         continue;
                 }
+                // The chooser follows the success proof, never old-thread cleanup, which may stay protected indefinitely.
+                const retireRestoreChoosers = async () => {
+                    for (const [id, pending] of pendingUnboundReroutes) {
+                        if (pending.workspaceRestore?.operationId !== operationId)
+                            continue;
+                        pending.phase = { kind: "finalizing", message: "Restored" };
+                        if (pending.chooserMessageId === undefined)
+                            continue;
+                        assertSettlementCurrent();
+                        await retireRerouteChooserMessage(pending.sourceTarget.chatId, pending.chooserMessageId, "<b>✅ Message routed.</b>", assertSettlementCurrent);
+                        assertSettlementCurrent();
+                        if (pendingUnboundReroutes.get(id) === pending)
+                            removePendingReroute(id);
+                    }
+                };
                 if (intent.routing?.cleanup === undefined) {
                     if (!intent.request.source.updateIds.every((id) => intent.routing.settlements.some((value) => value.kind !== "queued" && value.updateIds.includes(id))))
                         continue;
-                    // Positive settlement of every selected source is the success proof; old-thread cleanup may stay protected indefinitely.
+                    // Positive settlement of every selected source is the success proof.
                     await disposeTemporaryThreadSiblingsAfterRestore(intent, ctx, settlementAuthority.isCurrent);
                     assertSettlementCurrent();
+                    await retireRestoreChoosers();
                     if (isRerouteTargetProtected(intent.request.binding.target, intent))
                         continue;
                     const grant = store.issueCleanup(intent, settlementAuthority);
@@ -2265,19 +2414,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                 if (!store.retire(intent, settlementAuthority))
                     continue;
                 retired = true;
-                for (const [id, pending] of pendingUnboundReroutes) {
-                    if (pending.workspaceRestore?.operationId !== operationId)
-                        continue;
-                    pending.phase = { kind: "finalizing", message: "Restored" };
-                    if (!deps.editInteractiveMessage ||
-                        pending.chooserMessageId === undefined)
-                        continue;
-                    assertSettlementCurrent();
-                    await deps.editInteractiveMessage(pending.sourceTarget.chatId, pending.chooserMessageId, "<b>✅ Message routed.</b>", "html", { inline_keyboard: [] });
-                    assertSettlementCurrent();
-                    if (pendingUnboundReroutes.get(id) === pending)
-                        removePendingReroute(id);
-                }
+                await retireRestoreChoosers();
             }
         }))
             .catch((error) => {
@@ -2936,8 +3073,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                 const intent = store
                     .listLiveRebindings()
                     .find((value) => value.request.operationId === request.operationId);
-                if (intent?.phase === "released" &&
-                    !intent.cleanup &&
+                if (intent && Threads.isTelegramLiveRebindInputAuthorized(intent) &&
                     isDeepStrictEqual(intent.request, request) &&
                     intent.operatorUserId === operatorUserId &&
                     isDeepStrictEqual(intent.executor, {
@@ -3206,17 +3342,67 @@ export function createTelegramInboundRouteRuntime(deps) {
             name ||
             confirmation ||
             extension;
+        const preDispatchCleanup = deps.runWorkspaceOperation !== undefined && deps.canUsePreDispatchRebind?.(recipient) === true;
         const createCoordinator = () => createTelegramLiveRebindCoordinator({
             request,
             messages: selection.messages,
             restoreStore: store,
             threadStore: threads,
+            // Same title as Workspace Restore: the display-mode title of the restored binding on its new tab.
+            retitle: deps.callApi
+                ? async (isCurrent) => {
+                    if (!isCurrent())
+                        return;
+                    const expected = threads.getWorkspaceBindingByTarget(target, binding.sessionId);
+                    if (!expected || expected.bindingKey !== binding.bindingKey || expected.slot !== binding.slot)
+                        throw new Error("Live-rebind title binding is unavailable.");
+                    const callApi = deps.callApi;
+                    const slot = binding.slot ?? "";
+                    const resolveTitle = () => deps.getDisplayTitle?.(expected.target) ??
+                        ThreadNaming.getTelegramTopicTitleForThreadName(getRestoredThreadName(request.owner, slot), slot);
+                    const title = resolveTitle();
+                    const bindingCurrent = (frame) => isCurrent() && deps.callApi === callApi &&
+                        isDeepStrictEqual(threads.getWorkspaceBindingByTarget(frame.target, frame.sessionId), frame);
+                    const assertTitle = () => {
+                        if (!bindingCurrent(expected) || resolveTitle() !== title)
+                            throw new Error("Live-rebind title authority changed.");
+                    };
+                    assertTitle();
+                    const renamed = await callApi.call(deps, "editForumTopic", {
+                        chat_id: expected.target.chatId,
+                        message_thread_id: expected.target.threadId,
+                        name: title,
+                    }, { maxAttempts: 1, assertAuthority: assertTitle });
+                    assertTitle();
+                    if (renamed !== true || !threads.setWorkspaceDisplayTitle(expected, title))
+                        throw new Error("Live-rebind title acknowledgement is unconfirmed.");
+                    const acknowledged = { ...expected, displayTitle: title };
+                    await threads.persist(() => bindingCurrent(acknowledged));
+                    if (!bindingCurrent(acknowledged))
+                        throw new Error("Live-rebind title publication authority changed.");
+                }
+                : undefined,
             authority: {
                 executor: { instanceId, leaderEpoch: String(epoch) },
                 operatorUserId,
-                isCurrent: current,
+                isCurrent: () => current() && (!preDispatchCleanup || deps.canUsePreDispatchRebind?.(recipient) === true),
             },
             getRecipient,
+            ...(preDispatchCleanup ? {
+                async cleanupBeforeRelease(intent, isCurrent) {
+                    const delay = deps.liveRebindCleanupSchedule?.delaysMs[0] ?? 1_000;
+                    await new Promise(resolve => { const timer = setTimeout(resolve, delay); timer.unref?.(); });
+                    if (!isCurrent())
+                        return false;
+                    const result = await inspectLiveRebindRecipient(intent, ctx, isLeader ? "issue" : "follower-issue", isCurrent);
+                    if (!isCurrent())
+                        return false;
+                    // A session-replacing producer cannot retain an old-session cleanup grant across its gateway.
+                    if (result?.status === "not-ready" && selection.confirmationCommand?.name === "new")
+                        return !!store.advanceLiveRebind(intent, "protect-old-target", { executor: intent.executor, operatorUserId, isCurrent });
+                    return result?.status === "not-ready" || result?.status === "finished" && result.recorded;
+                },
+            } : {}),
             follower: isLeader
                 ? undefined
                 : {
@@ -3247,9 +3433,9 @@ export function createTelegramInboundRouteRuntime(deps) {
                                     instanceId,
                                     leaderEpoch: String(epoch),
                                 }) &&
-                                !intent.cleanup &&
-                                (intent.phase === "rebound" ||
-                                    intent.phase === "released") &&
+                                (!intent.cleanup || intent.inputRelease !== undefined && intent.cleanup !== "issued") &&
+                                (intent.phase === "rebound" || intent.phase === "released" ||
+                                    intent.phase === "finished" && intent.inputRelease !== undefined) &&
                                 isDeepStrictEqual(intent.recipient, {
                                     kind: recipient.kind,
                                     instanceId: recipient.instanceId,
@@ -3423,7 +3609,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             },
         };
     };
-    async function inspectLiveRebindRecipient(intent, ctx, mode) {
+    async function inspectLiveRebindRecipient(intent, ctx, mode, admittedOrigin) {
         const ports = deps.workspaceRestoreRecipient, threads = deps.threadStore, store = deps.getWorkspaceRestoreStore?.();
         const followerMode = mode === "follower-cleanup" || mode === "follower-issue", cleanupMode = mode !== "work";
         const issueMode = mode === "issue" || mode === "follower-issue", callApi = deps.callApi;
@@ -3435,8 +3621,9 @@ export function createTelegramInboundRouteRuntime(deps) {
             (followerMode ? !peer || !peerRun || !peerJournal : !collector) ||
             !run ||
             (issueMode && !callApi) ||
-            deps.isContextActive?.(ctx) !== true)
+            deps.isContextActive?.(ctx) !== true) {
             return undefined;
+        }
         try {
             const expected = structuredClone(intent), { request, recipient, executor } = expected;
             const instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.(), generation = deps.getSessionGeneration?.();
@@ -3526,7 +3713,8 @@ export function createTelegramInboundRouteRuntime(deps) {
                     peerJournal.call(peer, live) === recipientJournalKey &&
                     isDeepStrictEqual(findReference(), reference));
             };
-            const current = () => deps.hasWorkspaceLiveRebindAuthority?.() === true &&
+            const current = () => (!admittedOrigin || admittedOrigin()) &&
+                deps.hasWorkspaceLiveRebindAuthority?.() === true &&
                 deps.isContextActive?.(ctx) === true &&
                 deps.workspaceRestoreRecipient === ports &&
                 (followerMode || ports.observeLeaderWork === collector) &&
@@ -3571,8 +3759,11 @@ export function createTelegramInboundRouteRuntime(deps) {
             };
             const sample = async () => {
                 assertCanonical();
-                if (cleanupMode && protection.call(threads, expected) !== false)
-                    return undefined;
+                if (cleanupMode) {
+                    const protectedTarget = protection.call(threads, expected);
+                    if (protectedTarget !== false)
+                        return undefined;
+                }
                 const target = { ...request.binding.target };
                 let value;
                 if (followerMode) {
@@ -3581,7 +3772,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                         instanceId: recipient.instanceId,
                         sessionId: recipient.sessionId,
                         recipientBindingKey: recipientJournalKey,
-                        mode: "observe",
+                        mode: expected.inputRelease === "held" ? "observe-held" : "observe",
                         sourceUpdateIds: [...request.source.updateIds],
                         slot: request.binding.slot,
                         target: { ...request.target },
@@ -3623,12 +3814,13 @@ export function createTelegramInboundRouteRuntime(deps) {
                     throw new Error("Live-rebind work sample is unavailable or changed target.");
                 assertCanonical();
                 if (cleanupMode) {
+                    const targetProtected = protection.call(threads, expected);
                     const prepared = ThreadReconciler.prepareLiveRebindThreadCleanup({
                         operationId: request.operationId,
                         oldTarget: request.binding.target,
                         recipientTarget: request.target,
                         leaderEpoch: executor.leaderEpoch,
-                        targetProtected: protection.call(threads, expected),
+                        targetProtected,
                         work,
                     });
                     assertCanonical();
@@ -3652,32 +3844,27 @@ export function createTelegramInboundRouteRuntime(deps) {
                 return undefined;
             if (issueMode) {
                 // One admission spans the fresh sample, durable issue marker, single deletion and terminal record.
-                return await run({
-                    operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
-                    operationKind: "workspace.live-rebind-cleanup",
-                    scopes: [{ kind: "profile" }],
-                }, async () => {
+                const execute = async () => {
                     const prepared = await sample();
                     if (!prepared ||
                         prepared.status !== "prepared" ||
                         !current() ||
-                        protection.call(threads, expected) !== false)
+                        protection.call(threads, expected) !== false) {
                         return { status: "not-ready" };
+                    }
                     const authority = {
                         executor: structuredClone(executor),
                         operatorUserId: expected.operatorUserId,
                         isCurrent: current,
                     };
                     const grant = store.advanceLiveRebind(expected, "issue-cleanup", authority);
-                    if (!grant)
+                    if (!grant) {
                         return undefined;
+                    }
                     const assertGranted = () => assertCanonical(grant);
                     const cleanup = await ThreadReconciler.issueLiveRebindThreadCleanup(prepared, {
                         assertCurrent: assertGranted,
-                        deleteTopic: (target) => callApi("deleteForumTopic", {
-                            chat_id: target.chatId,
-                            message_thread_id: target.threadId,
-                        }, { maxAttempts: 1, assertAuthority: assertGranted }),
+                        deleteTopic: (target) => callApi("deleteForumTopic", { chat_id: target.chatId, message_thread_id: target.threadId }, { maxAttempts: 1, assertAuthority: assertGranted }),
                         classifyFailure: classifyLiveRebindCleanupFailure,
                     });
                     let recorded = false;
@@ -3695,7 +3882,12 @@ export function createTelegramInboundRouteRuntime(deps) {
                         cleanup,
                         recorded,
                     };
-                });
+                };
+                // Pre-dispatch calls are private to the chooser callback already holding the same profile admission/gate.
+                return admittedOrigin ? await execute() : await run({
+                    operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
+                    operationKind: "workspace.live-rebind-cleanup", scopes: [{ kind: "profile" }],
+                }, execute);
             }
             const observation = await run({
                 operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
@@ -3729,6 +3921,26 @@ export function createTelegramInboundRouteRuntime(deps) {
     const issueLiveRebindFollowerCleanup = (intent, ctx) => inspectLiveRebindRecipient(intent, ctx, "follower-issue");
     // One pacing chain per operation: a waiting timer or a running attempt; repeated choices never start another.
     const liveRebindCleanupChains = new Map();
+    // One hint slot per existing leader chain; a running attempt retains at most one coalesced recheck.
+    const liveRebindCleanupWakers = new Map();
+    const captureLiveRebindCleanupScope = (ctx) => {
+        try {
+            const generation = deps.getSessionGeneration?.(), instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.(), store = deps.getWorkspaceRestoreStore?.(), operator = deps.configStore.getAllowedUserId();
+            return () => {
+                try {
+                    return deps.isContextActive?.(ctx) === true && deps.getSessionGeneration?.() === generation &&
+                        deps.getCurrentInstanceId?.() === instanceId && deps.getCurrentLeaderEpoch?.() === epoch &&
+                        deps.getWorkspaceRestoreStore?.() === store && deps.configStore.getAllowedUserId() === operator;
+                }
+                catch {
+                    return false;
+                }
+            };
+        }
+        catch {
+            return () => false;
+        }
+    };
     /** End an unissued attempt honestly under fresh admission and current operator authority; no executor grant is borrowed. */
     const terminalizeUnissuedLiveRebindCleanup = async (operationId, ctx) => {
         const run = deps.runWorkspaceOperation, store = deps.getWorkspaceRestoreStore?.();
@@ -3769,23 +3981,53 @@ export function createTelegramInboundRouteRuntime(deps) {
      * a finished outcome or an inactive session stops, and the window ends in `not-issued` so no released row becomes a
      * permanent rebinding blocker. Waiting timers never join settlement; only a running attempt does.
      */
-    const scheduleLiveRebindCleanup = (operationId, role, ctx, startedAtMs = Date.now(), attempt = 0) => {
+    const scheduleLiveRebindCleanup = (operationId, role, ctx, startedAtMs = Date.now(), attempt = 0, current = captureLiveRebindCleanupScope(ctx)) => {
         const pacing = deps.liveRebindCleanupSchedule;
         const chain = liveRebindCleanupChains.get(operationId);
         if (!pacing ||
             (attempt === 0 ? chain !== undefined : chain !== "running") ||
-            deps.isContextActive?.(ctx) !== true) {
-            if (attempt > 0 && chain === "running")
+            !current()) {
+            if (attempt > 0 && chain === "running") {
                 liveRebindCleanupChains.delete(operationId);
+                liveRebindCleanupWakers.delete(operationId);
+            }
             return;
         }
-        const timer = setTimeout(() => {
+        let pendingWake;
+        const wake = (reason) => {
+            if (!current())
+                return;
+            if (liveRebindCleanupChains.get(operationId) === "running") {
+                pendingWake = reason;
+                return;
+            }
             if (liveRebindCleanupChains.get(operationId) !== timer)
                 return;
+            if (reason === "delivery-drained") {
+                let idle;
+                try {
+                    idle = deps.isIdle?.(ctx);
+                }
+                catch { /* A missing idle observation is not a reason to hurry cleanup. */ }
+                if (idle !== true) {
+                    // A streamed technical task can drain between deltas while Pi still runs. Keep one hint, not a polling loop.
+                    pendingWake = reason;
+                    return;
+                }
+            }
+            clearTimeout(timer);
+            attemptNow();
+        };
+        const attemptNow = () => {
+            if (liveRebindCleanupChains.get(operationId) !== timer)
+                return;
+            pendingWake = undefined; // This fresh timer/settlement attempt consumes any previously deferred hint.
             liveRebindCleanupChains.set(operationId, "running");
+            if (role === "leader")
+                liveRebindCleanupWakers.set(operationId, wake);
             let continued = false;
             const task = (async () => {
-                if (deps.isContextActive?.(ctx) !== true)
+                if (!current())
                     return;
                 const intent = deps
                     .getWorkspaceRestoreStore?.()
@@ -3797,27 +4039,44 @@ export function createTelegramInboundRouteRuntime(deps) {
                     ? await issueLiveRebindLeaderCleanup(intent, ctx)
                     : await issueLiveRebindFollowerCleanup(intent, ctx);
                 if (result?.status === "finished" ||
-                    deps.isContextActive?.(ctx) !== true)
+                    !current())
                     return;
-                if (Date.now() - startedAtMs >= pacing.windowMs)
+                if (Date.now() - startedAtMs >= pacing.windowMs) {
                     return terminalizeUnissuedLiveRebindCleanup(operationId, ctx);
+                }
                 continued = true;
-                scheduleLiveRebindCleanup(operationId, role, ctx, startedAtMs, attempt + 1);
+                scheduleLiveRebindCleanup(operationId, role, ctx, startedAtMs, attempt + 1, current);
+                if (pendingWake)
+                    liveRebindCleanupWakers.get(operationId)?.(pendingWake);
             })()
                 .catch((error) => deps.recordRuntimeEvent?.("routing", error, {
                 phase: "live-rebind-cleanup-schedule",
             }))
                 .finally(() => {
                 if (!continued &&
-                    liveRebindCleanupChains.get(operationId) === "running")
+                    liveRebindCleanupChains.get(operationId) === "running") {
                     liveRebindCleanupChains.delete(operationId);
+                    liveRebindCleanupWakers.delete(operationId);
+                }
             });
             restoreSettlementTasks.add(task);
             void task.finally(() => restoreSettlementTasks.delete(task));
-        }, pacing.delaysMs[attempt] ?? pacing.intervalMs);
+        };
+        const timer = setTimeout(attemptNow, pacing.delaysMs[attempt] ?? pacing.intervalMs);
         timer.unref?.();
         liveRebindCleanupChains.set(operationId, timer);
+        // The first delay stays whole: a detached command reply still needs the released, cleanup-free row.
+        if (role === "leader" && attempt > 0)
+            liveRebindCleanupWakers.set(operationId, wake);
     };
+    const wakeLiveRebindCleanup = (ctx, reason) => {
+        if (deps.isContextActive?.(ctx) !== true)
+            return;
+        for (const wake of [...liveRebindCleanupWakers.values()])
+            wake(reason);
+    };
+    const onSessionSettled = (ctx) => wakeLiveRebindCleanup(ctx, "session-settled");
+    const onDeliverySettled = (ctx) => wakeLiveRebindCleanup(ctx, "delivery-drained");
     const restoreWorkspace = deps.workspaceRestoreRecipient
         ? async (input) => {
             const ports = deps.workspaceRestoreRecipient;
@@ -4203,17 +4462,25 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         await promptEnqueue(messages, ctx);
     };
-    const finalizePendingReroute = async (rerouteId, pending, query, successMessage, assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query)) => {
+    const finalizePendingReroute = async (rerouteId, pending, query, successMessage, assertExecutionCurrent = Updates.createTelegramUpdateExecutionFenceGuard(query), retainRecord = false) => {
         assertExecutionCurrent();
         const dismissed = await dismissRerouteChooserMessage(query, assertExecutionCurrent);
         assertExecutionCurrent();
         if (dismissed) {
-            removePendingReroute(rerouteId);
+            // A retained record no longer matches any chooser, so a late duplicate tap reads as expired.
+            if (retainRecord)
+                pending.chooserMessageId = undefined;
+            else
+                removePendingReroute(rerouteId);
             await deps.answerCallbackQuery(query.id, successMessage);
             await deleteAllTabCopies(pending);
             return;
         }
-        pending.phase = { kind: "finalizing", message: successMessage };
+        pending.phase = {
+            kind: "finalizing",
+            message: successMessage,
+            ...(retainRecord ? { retainRecord: true } : {}),
+        };
         await deps.answerCallbackQuery(query.id, `${successMessage}; tap again to clear the menu`);
     };
     const isTemporaryReroute = (pending) => !!pending.temporaryThread ||
@@ -4613,10 +4880,10 @@ export function createTelegramInboundRouteRuntime(deps) {
     const retireCancellationChooser = async (id, pending, isCurrent) => {
         if (!isPendingRerouteCancelled(pending) ||
             !isCurrent() ||
-            !deps.editInteractiveMessage ||
+            (!deps.deleteMessage && !deps.editInteractiveMessage) ||
             pending.chooserMessageId === undefined)
             return false;
-        await deps.editInteractiveMessage(pending.sourceTarget.chatId, pending.chooserMessageId, "<b>⛔️ Routing cancelled.</b>", "html", { inline_keyboard: [] });
+        await retireRerouteChooserMessage(pending.sourceTarget.chatId, pending.chooserMessageId, "<b>⛔️ Routing cancelled.</b>");
         if (!isCurrent() || pendingUnboundReroutes.get(id) !== pending)
             return false;
         removePendingReroute(id);
@@ -4973,9 +5240,11 @@ export function createTelegramInboundRouteRuntime(deps) {
             if (!result)
                 return;
             // Expiry revokes the donor carrier; old controls and late ACKs cannot issue another delivery. No body is archived.
+            let movedIntoTab = false;
             for (const [id, pending] of pendingUnboundReroutes) {
                 if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
                     continue;
+                movedIntoTab ||= pending.allTabCopiesForwarded === true;
                 removePendingReroute(id);
                 if (signal.aborted ||
                     deps.isContextActive?.(ctx) !== true ||
@@ -4999,7 +5268,9 @@ export function createTelegramInboundRouteRuntime(deps) {
             // never closes over this source or asks the worker to retain a terminal prompt while metadata publication fails.
             if (temporary?.target && runtimeCurrent()) {
                 scheduleTemporaryThreadCleanup(temporary.target, ctx, true);
-                await deleteAllTabMessages(temporary.target.chatId, getTelegramAllTabSourceMessageIds([message], temporary.target.chatId));
+                // A moved original already left All with its forward; only an unmoved one is deleted here.
+                if (!movedIntoTab)
+                    await deleteAllTabMessages(temporary.target.chatId, getTelegramAllTabSourceMessageIds([message], temporary.target.chatId));
             }
         });
     };
@@ -5448,7 +5719,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             return true;
         }
         if (pending.phase.kind === "finalizing") {
-            await finalizePendingReroute(parsed.rerouteId, pending, query, pending.phase.message, assertExecutionCurrent);
+            await finalizePendingReroute(parsed.rerouteId, pending, query, pending.phase.message, assertExecutionCurrent, pending.phase.retainRecord === true);
             return true;
         }
         if (pending.liveRebind &&
@@ -5709,21 +5980,23 @@ export function createTelegramInboundRouteRuntime(deps) {
                 pending.liveRebind ??= selection;
                 if (!(await selectPendingDestination()))
                     return true;
+                const operationId = selection.coordinator.operationId;
                 if (current())
                     outcome = await selection.coordinator.advance();
                 // Cleanup readiness follows the canonical released row, not source disposal: a detached command ACK may
                 // still be pending while every attempt samples current work afresh.
-                const operationId = selection.coordinator.operationId;
                 const row = outcome === "protected"
                     ? undefined
                     : deps
                         .getWorkspaceRestoreStore?.()
                         ?.listLiveRebindings()
                         .find((value) => value.request.operationId === operationId);
-                if (row?.phase === "released" && row.cleanup === undefined)
+                if (row?.phase === "released" && row.cleanup === undefined &&
+                    (row.inputRelease === undefined || row.inputRelease === "accepted")) {
                     scheduleLiveRebindCleanup(operationId, selection.record.owner?.kind === "leader" ? "leader" : "follower", ctx);
+                }
                 if (outcome === "released")
-                    await deleteAllTabCopies(pending);
+                    await releaseAllTabCopiesIntoSurvivingTab(pending);
             }
             catch (error) {
                 deps.recordRuntimeEvent?.("routing", error, {
@@ -5734,8 +6007,24 @@ export function createTelegramInboundRouteRuntime(deps) {
                 selection.isCurrent = undefined;
             }
             assertExecutionCurrent();
-            await deps.answerCallbackQuery(query.id, outcome === "released"
-                ? selection.extensionKind === "generated-prompt"
+            if (outcome !== "released") {
+                await deps.answerCallbackQuery(query.id, "Live rebind is unconfirmed; this choice never replays issued input");
+                return true;
+            }
+            const cleanupRow = deps.getWorkspaceRestoreStore?.()?.listLiveRebindings().find(value => value.request.operationId === selection.coordinator?.operationId);
+            const cleanupResult = cleanupRow?.inputRelease && cleanupRow.cleanup !== undefined
+                ? cleanupRow.cleanup === "confirmed" ? "old-Thread removal confirmed"
+                    : cleanupRow.cleanup === "unknown" || cleanupRow.cleanup === "issued" ? "old-Thread removal unconfirmed; deletion will not repeat"
+                        : cleanupRow.cleanup === "failed" ? "old-Thread removal failed" : "old-Thread removal was not issued"
+                : undefined;
+            const commandDisposed = !!(selection.extensionCommand && selection.extensionKind !== "generated-prompt" || selection.nameCommand ||
+                selection.confirmationCommand || selection.helpCommand || selection.stopCommand || selection.nextCommand ||
+                selection.menuCommand || selection.abortCommand || selection.coordinator?.selectedCommandReference());
+            // The tab now belongs to the rebound thread; only the one-shot chooser message goes.
+            await finalizePendingReroute(parsed.rerouteId, pending, query, cleanupResult
+                ? commandDisposed ? `Command source disposal confirmed; ${cleanupResult}; delivery and follow-on effects remain independent`
+                    : `Input queued in the rebound Thread; ${cleanupResult}`
+                : selection.extensionKind === "generated-prompt"
                     ? "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed"
                     : selection.extensionCommand
                         ? "Command source disposal confirmed; reply delivery and old-Thread cleanup are not confirmed"
@@ -5755,8 +6044,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                                                 ? `Command source disposal confirmed; ${selection.menuCommand ? "menu" : "reply"} delivery and old-Thread cleanup are not confirmed`
                                                 : selection.coordinator?.selectedCommandReference()
                                                     ? "Command source disposal confirmed; recipient command effects and old-Thread cleanup are not confirmed"
-                                                    : "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed"
-                : "Live rebind is unconfirmed; this choice never replays issued input");
+                                                    : "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed", assertExecutionCurrent, true);
             return true;
         }
         if (!(await selectPendingDestination()))
@@ -5768,6 +6056,8 @@ export function createTelegramInboundRouteRuntime(deps) {
                 messages: [...pending.messages],
             });
             let active = true;
+            // Delivery proof for the toast only; chooser retirement still waits for the positive settlement that follows.
+            let delivered = false;
             const ownerUserId = deps.configStore.getAllowedUserId();
             const leaderEpoch = deps.getCurrentLeaderEpoch?.();
             const admissionScope = deps.getAdmissionScope?.();
@@ -5818,12 +6108,15 @@ export function createTelegramInboundRouteRuntime(deps) {
                                 : routed;
                             await dispatchPendingRerouteMessages(pending, messages, ctx);
                             assertRecipientCurrent();
-                            await deleteAllTabCopies(pending);
+                            delivered = true;
+                            await releaseAllTabCopiesIntoSurvivingTab(pending);
                             return true;
                         }
                         const forwarded = await forwardPendingRerouteMessages(pending, recipient.instanceId, sourceTarget.threadId, ctx, assertRecipientCurrent, recordForwardAcceptance);
-                        if (forwarded)
-                            await deleteAllTabCopies(pending);
+                        if (forwarded) {
+                            delivered = true;
+                            await releaseAllTabCopiesIntoSurvivingTab(pending);
+                        }
                         return forwarded;
                     },
                 });
@@ -5834,7 +6127,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             assertExecutionCurrent();
             if (!selectionCurrent())
                 return true;
-            await deps.answerCallbackQuery(query.id, "Restore unconfirmed; not resending");
+            await deps.answerCallbackQuery(query.id, delivered ? "Restored" : "Restore unconfirmed; not resending");
             return true;
         }
         if (record.instanceId &&
@@ -6856,13 +7149,16 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         return undefined;
     };
-    /** A fresh implicit native tab whose name the All input starts with, observed just before it in the same exact scope. */
+    /**
+     * A fresh implicit native tab observed just before the All input in the same exact scope: mobile names it after
+     * the input, while other clients may use a generic name, so the immediately preceding creation also qualifies.
+     */
     const findImplicitCreationForAllInput = (message, updateId, cap, ctx) => {
         const text = (message.text ?? message.caption ?? "").trim();
         let match;
         for (const [key, implicit] of implicitThreadCreations) {
-            if (implicit.name &&
-                text.startsWith(implicit.name) &&
+            if (((implicit.name && text.startsWith(implicit.name)) ||
+                implicit.updateId === updateId - 1) &&
                 implicit.updateId < updateId &&
                 implicit.createdAtSec > 0 &&
                 message.date !== undefined &&
@@ -6884,28 +7180,42 @@ export function createTelegramInboundRouteRuntime(deps) {
      * An All input gets one source-bound tab. The original stays deferred in All until explicit routing,
      * and an existing entry is reused on replay, so restart never creates a second tab or retries an unknown one.
      */
-    const sendAllTabTemporaryInputChooser = async (command, commandText, message, ctx) => {
-        const [updateId] = Updates.collectTelegramAdmissionSourceUpdateIds([
-            message,
-        ]);
+    /**
+     * Opens (or adopts) the routing tab for input sent from All. One text message may carry a command; anything else,
+     * a voice note, a file or a coalesced album, is held untouched as one prompt.
+     */
+    const sendAllTabTemporaryInputChooser = async (command, commandText, messages, ctx) => {
+        const message = messages[0];
+        if (!message)
+            return false;
+        const updateIds = Updates.collectTelegramAdmissionSourceUpdateIds([
+            ...messages,
+        ]).sort((a, b) => a - b);
+        const updateId = updateIds[0];
+        const group = { journalBindingKey: "", updateIds };
         const execution = Updates.getTelegramUpdateExecutionFence(message);
         const cap = captureTemporaryThreadAuthority(ctx, () => execution?.isCurrent() === true);
         if (!cap ||
             !deps.runWorkspaceOperation ||
             !deps.callApi ||
             updateId === undefined ||
-            message.chat.type !== "private" ||
-            message.chat.id !== cap.operatorUserId ||
-            message.from?.id !== cap.operatorUserId ||
+            updateIds.length !== messages.length ||
+            messages.some((held) => held.chat.type !== "private" ||
+                held.chat.id !== cap.operatorUserId ||
+                held.from?.id !== cap.operatorUserId) ||
             !cap.isCurrent())
             return false;
         const { store, operatorUserId, journalBindingKey, epoch, authority } = cap, current = cap.isCurrent;
         const source = { journalBindingKey, updateId };
+        group.journalBindingKey = journalBindingKey;
         const find = () => store
             .listTemporaryThreads()
             .find((entry) => entry.source.journalBindingKey === journalBindingKey &&
             entry.source.updateId === updateId);
         let entry;
+        // A tab opened by this call, by the bot or adopted from the client, gets the input's one forwarded copy; re-entry
+        // after a restart finds its tab already prepared and never forwards again.
+        let openedNow = false;
         await deps.runWorkspaceOperation({
             operationId: `temporary-thread-${randomBytes(16).toString("hex")}`,
             operationKind: "workspace.temporary-thread",
@@ -6923,7 +7233,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             // the input itself to All: adopt that tab rather than leaving it behind next to a second one.
             const native = findImplicitCreationForAllInput(message, updateId, cap, ctx);
             if (native) {
-                const adopted = store.registerImplicitTemporaryThread({ journalBindingKey, updateIds: [updateId] }, native.implicit.target, randomBytes(16).toString("hex"), {
+                const adopted = store.registerImplicitTemporaryThread(group, native.implicit.target, randomBytes(16).toString("hex"), {
                     ...authority,
                     isCurrent: () => current() &&
                         implicitThreadCreations.get(native.key) === native.implicit,
@@ -6931,6 +7241,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                 if (adopted && current()) {
                     implicitThreadCreations.delete(native.key);
                     entry = adopted;
+                    openedNow = true;
                     // Adopted native tabs share the routing name; a failed rename never blocks routing.
                     try {
                         await deps.callApi("editForumTopic", {
@@ -6947,7 +7258,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                     return;
                 }
             }
-            const reservation = store.reserveTemporaryThread(source, randomBytes(16).toString("hex"), authority);
+            const reservation = store.reserveTemporaryThread(source, randomBytes(16).toString("hex"), authority, group);
             entry = reservation?.entry;
             if (!reservation?.reserved || !current())
                 return;
@@ -6971,31 +7282,39 @@ export function createTelegramInboundRouteRuntime(deps) {
                 !Number.isSafeInteger(threadId) ||
                 threadId <= 0)
                 return;
-            entry =
-                store.acknowledgeTemporaryThread(reservation.entry, { chatId: operatorUserId, threadId }, authority) ?? entry;
+            const acknowledged = store.acknowledgeTemporaryThread(reservation.entry, { chatId: operatorUserId, threadId }, authority);
+            openedNow = !!acknowledged;
+            entry = acknowledged ?? entry;
         });
         if (!current() || !entry)
             throw new Error("Temporary Thread authority changed; the input remains retryable.");
-        const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
-            ...message,
-            text: commandText,
-            caption: undefined,
-        });
+        // Only a lone text message is rewritten for command detection; media keeps its caption and payload.
+        const held = messages.length === 1 && typeof message.text === "string"
+            ? [
+                Updates.carryTelegramUpdateExecutionFence(message, {
+                    ...message,
+                    text: commandText,
+                    caption: undefined,
+                }),
+            ]
+            : [...messages];
         if (entry.phase !== "created" || !entry.target) {
-            Updates.reportTelegramUpdateDeferred(commandMessage);
-            await deps.sendTextReply(message.chat.id, message.message_id, "<b>⚠️ The routing tab for this command could not be confirmed.</b> It stays held and was not sent to Pi.", { parseMode: "HTML" });
+            for (const input of held)
+                Updates.reportTelegramUpdateDeferred(input);
+            deps.recordRuntimeEvent?.("routing", new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR), { phase: "temporary-thread-unconfirmed" });
             return true;
         }
         const target = entry.target;
         const records = getTelegramRoutableThreadRecords(deps.threadStore?.list() ?? [], deps.getLiveThreadTargets?.());
-        const rerouteId = storePendingUnboundReroute([commandMessage], command ? "command" : "prompt", target);
+        const rerouteId = storePendingUnboundReroute(held, command ? "command" : "prompt", target);
         const pending = pendingUnboundReroutes.get(rerouteId);
         pending.temporaryThread = entry;
-        pending.allTabCopies = getTelegramAllTabSourceMessageIds([message], target.chatId);
-        Updates.reportTelegramUpdateDeferred(commandMessage);
+        pending.allTabCopies = getTelegramAllTabSourceMessageIds(messages, target.chatId);
+        for (const input of held)
+            Updates.reportTelegramUpdateDeferred(input);
         // Cancel is offered only when the exact source can still be abandoned; the tab removal needs that retention first.
         if (deps.editInteractiveMessage &&
-            Updates.supportsTelegramDeferredAbandonment(commandMessage, journalBindingKey)) {
+            held.every((input) => Updates.supportsTelegramDeferredAbandonment(input, journalBindingKey))) {
             pending.abandonment = {
                 ownerUserId: operatorUserId,
                 journalBindingKey,
@@ -7003,6 +7322,9 @@ export function createTelegramInboundRouteRuntime(deps) {
             };
         }
         pending.rootChooserText = formatTelegramTemporaryThreadChooserText(command?.name);
+        const tabCopyId = openedNow
+            ? await moveAllTabSourceIntoTab(pending, target, current)
+            : undefined;
         try {
             if (!deps.sendInteractiveMessage)
                 throw new Error("Temporary Thread chooser publication is unavailable.");
@@ -7010,7 +7332,9 @@ export function createTelegramInboundRouteRuntime(deps) {
                 canRestore: true,
                 canCancel: !!pending.abandonment,
                 getDisplayTitle: deps.getDisplayTitle,
-            }), { target });
+            }), tabCopyId === undefined
+                ? { target }
+                : { target, replyToMessageId: tabCopyId });
             rememberRerouteChooser(rerouteId, chooserId);
         }
         catch (error) {
@@ -7019,72 +7343,11 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         return true;
     };
-    const sendAllTabCommandChooser = async (command, commandText, message, options = {}) => {
-        if (!deps.threadStore)
-            return false;
-        const records = deps.threadStore.list();
-        const activeRecords = getTelegramRoutableThreadRecords(records, deps.getLiveThreadTargets?.());
-        if (activeRecords.length === 0)
-            return false;
-        const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
-            ...message,
-            text: commandText,
-            caption: undefined,
-        });
-        const rerouteId = storePendingUnboundReroute([commandMessage], "command");
-        Updates.reportTelegramUpdateDeferred(commandMessage);
-        const text = formatTelegramAllTabMenuChooserText(command.name);
-        pendingUnboundReroutes.get(rerouteId).rootChooserText = text;
-        const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(rerouteId, activeRecords, {
-            canRestore: typeof message.message_thread_id === "number",
-            getDisplayTitle: deps.getDisplayTitle,
-        });
-        let chooserId;
-        try {
-            if (deps.sendInteractiveMessage) {
-                chooserId = await deps.sendInteractiveMessage(message.chat.id, text, "html", replyMarkup, options.target || options.replyToSource
-                    ? {
-                        ...(options.target ? { target: options.target } : {}),
-                        ...(options.replyToSource
-                            ? { replyToMessageId: message.message_id }
-                            : {}),
-                    }
-                    : undefined);
-            }
-            else if (deps.callApi) {
-                const chooser = await deps.callApi("sendMessage", {
-                    chat_id: message.chat.id,
-                    text,
-                    parse_mode: "HTML",
-                    reply_markup: replyMarkup,
-                    ...(typeof options.target?.threadId === "number"
-                        ? { message_thread_id: options.target.threadId }
-                        : {}),
-                    ...(options.replyToSource
-                        ? {
-                            reply_parameters: {
-                                message_id: message.message_id,
-                                allow_sending_without_reply: true,
-                            },
-                        }
-                        : {}),
-                });
-                chooserId = chooser?.message_id;
-            }
-            else {
-                chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
-                    parseMode: "HTML",
-                    target: options.target,
-                });
-            }
-        }
-        catch (error) {
-            removePendingReroute(rerouteId);
-            throw error;
-        }
-        rememberRerouteChooser(rerouteId, chooserId);
-        Updates.reportTelegramUpdateCompleted(commandMessage);
-        return true;
+    /** A coalesced album from All requires one routing tab; failure cannot answer in All or discard its source. */
+    const routeAllTabAlbum = async (messages, ctx) => {
+        if (await sendAllTabTemporaryInputChooser(undefined, "", messages, ctx))
+            return;
+        throw new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR);
     };
     const dispatchCommandOrPrompt = Commands.createTelegramCommandOrPromptDispatcher({
         extractRawText: Media.extractFirstTelegramMessageText,
@@ -7311,7 +7574,9 @@ export function createTelegramInboundRouteRuntime(deps) {
                     chatId: lifecycle.target.chatId,
                     threadId: lifecycle.target.threadId,
                 },
-                name: "name" in created && typeof created.name === "string" ? created.name : "",
+                name: "name" in created && typeof created.name === "string"
+                    ? created.name
+                    : "",
                 createdAtSec: message.date ?? 0,
             });
         }
@@ -7529,28 +7794,39 @@ export function createTelegramInboundRouteRuntime(deps) {
                         .some((entry) => entry.source.updateId === sourceUpdateId &&
                         entry.source.journalBindingKey ===
                             deps.getAdmissionJournalBinding?.()) === true;
+                const needsThread = deps.threadStore.getBotState().threadMode === "enabled" || bindings.length > 0 || presented;
                 // Returning before deferral lets the admission worker terminally settle expired replay; a presented tab is not expiry.
                 if (command &&
                     command.name !== "thread" &&
                     !presented &&
                     isTelegramAllTabCommandExpired(message))
                     return;
-                if (command?.name !== "thread" &&
-                    (bindings.length > 0 || presented) &&
+                if (needsThread &&
                     typeof message.text === "string" &&
                     message.text.trim() &&
-                    (await sendAllTabTemporaryInputChooser(command, text, message, ctx)))
+                    (await sendAllTabTemporaryInputChooser(command, text, [message], ctx)))
                     return;
-                if (bindings.length > 0 && command && command.name !== "thread") {
-                    if (await sendAllTabCommandChooser(command, text, message, {
-                        replyToSource: true,
-                    })) {
+                // Voice notes, files, stickers and albums from All get the same routing tab as text, whether or not the
+                // client opened a tab for them; an album first gathers into one input so it opens one tab.
+                if (!command &&
+                    needsThread &&
+                    typeof message.text !== "string" &&
+                    Media.hasTelegramMessagesPromptContent([message])) {
+                    if (message.media_group_id) {
+                        deps.mediaGroupRuntime.queueMessage({
+                            message: message,
+                            context: ctx,
+                            dispatchMessages: (messages, queuedCtx) => routeAllTabAlbum(messages, queuedCtx ?? ctx),
+                        });
+                        Updates.reportTelegramUpdateDeferred(message);
                         return;
                     }
+                    if (await sendAllTabTemporaryInputChooser(undefined, text, [message], ctx))
+                        return;
                 }
-                if (bindings.length > 0 && !text.startsWith("/")) {
+                if (needsThread) {
                     const probeTarget = bindings[0]?.target;
-                    if (probeTarget?.threadId && deps.callApi) {
+                    if (!command && !text.startsWith("/") && probeTarget?.threadId && deps.callApi) {
                         try {
                             await deps.callApi("sendChatAction", {
                                 chat_id: probeTarget.chatId,
@@ -7559,8 +7835,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                             });
                         }
                         catch (error) {
-                            if (Threads.isTelegramTopicModeUnavailableError(error) ||
-                                Threads.isTelegramTopicTargetStaleError(error)) {
+                            if (Threads.isTelegramTopicModeUnavailableError(error)) {
                                 deps.threadStore.setBotState({
                                     threadMode: "disabled",
                                     updatedAtMs: Date.now(),
@@ -7578,8 +7853,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                             });
                         }
                     }
-                    await deps.sendTextReply(message.chat.id, message.message_id, "This bot is in threaded multi-instance mode. Send prompts in a bound Pi thread tab so they route to the right instance.");
-                    return;
+                    throw new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR);
                 }
             }
             await textDispatch.handleMessage(message, ctx);
@@ -7623,7 +7897,35 @@ export function createTelegramInboundRouteRuntime(deps) {
                     threadId: target.threadId,
                 };
                 /** Rebinds the leader record to this unbound tab, publishes its identity and handles the message there. */
-                const reclaimUnboundTargetForLeader = async (base, profileKey, slot, threadName, event, details) => {
+                // The leader's own Workspace binding follows a reclaimed tab, keeping its slot and name; without it, the tab
+                // would gain a second slot while Restore, labels and titles still pointed at the deleted target.
+                const leaderWorkspaceCwd = typeof ctx.cwd === "string"
+                    ? ctx.cwd
+                    : undefined;
+                const claimLeaderWorkspaceBinding = () => {
+                    const sessionId = deps.workspaceRestoreRecipient?.getSessionId(ctx);
+                    if (!leaderWorkspaceCwd || !sessionId || !instanceId)
+                        return undefined;
+                    const identity = deps.threadStore.claimWorkspaceIdentity(leaderWorkspaceCwd, instanceId, undefined, { existingBindingOnly: true, sessionId });
+                    const binding = identity
+                        ? deps.threadStore.getWorkspaceBinding(identity.cwd, identity.instanceSlot, identity.sessionId)
+                        : undefined;
+                    if (!binding)
+                        deps.threadStore.releaseWorkspaceClaim(instanceId);
+                    return binding;
+                };
+                const reclaimUnboundTargetForLeader = async (base, profileKey, slot, threadName, event, details, leaderBinding) => {
+                    if (leaderBinding) {
+                        const { inactiveSinceMs: _inactiveSinceMs, displayTitle: _displayTitle, ...moved } = leaderBinding;
+                        const committed = deps.threadStore.upsertWorkspaceBinding({
+                            ...moved,
+                            target: { ...unboundTarget },
+                            updatedAtMs: Date.now(),
+                        }, instanceId);
+                        deps.threadStore.releaseWorkspaceClaim(instanceId);
+                        if (committed)
+                            threadName = committed.threadName ?? threadName;
+                    }
                     deps.threadStore.upsert({
                         ...base,
                         profileKey,
@@ -7654,6 +7956,33 @@ export function createTelegramInboundRouteRuntime(deps) {
                         slot,
                         profileKey,
                     });
+                    if (leaderBinding && deps.callApi) {
+                        const title = deps.getDisplayTitle?.(unboundTarget);
+                        if (title)
+                            try {
+                                await deps.callApi("editForumTopic", {
+                                    chat_id: unboundTarget.chatId,
+                                    message_thread_id: unboundTarget.threadId,
+                                    name: title,
+                                });
+                                const current = deps
+                                    .threadStore.listWorkspaceBindings()
+                                    .find((value) => value.bindingKey === leaderBinding.bindingKey &&
+                                    isDeepStrictEqual(value.target, unboundTarget));
+                                if (current) {
+                                    deps.threadStore.upsertWorkspaceBinding({
+                                        ...current,
+                                        displayTitle: title,
+                                    });
+                                    await deps.threadStore.persist();
+                                }
+                            }
+                            catch (error) {
+                                deps.recordRuntimeEvent?.("bus", error, {
+                                    phase: "leader-topic-reclaim-title",
+                                });
+                            }
+                    }
                     await textDispatch.handleMessage(message, ctx);
                 };
                 const records = deps.threadStore.list();
@@ -7754,7 +8083,10 @@ export function createTelegramInboundRouteRuntime(deps) {
                                 throw error;
                         }
                         if (currentLeaderIsStale) {
-                            const slot = deps.threadStore.allocateSlot(leaderProfileKey);
+                            const leaderBinding = claimLeaderWorkspaceBinding();
+                            const slot = deps.threadStore.allocateSlot(leaderProfileKey, leaderBinding?.slot, leaderBinding?.bindingKey);
+                            if (leaderBinding && leaderBinding.slot !== slot)
+                                deps.threadStore.releaseWorkspaceClaim(instanceId);
                             if (!slot) {
                                 deps.threadStore.markStaleByTarget(currentLeaderRecord.target, "deleted", "Current leader thread is stale during unbound prompt routing.");
                                 await deps.threadStore.persist();
@@ -7767,7 +8099,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                             await reclaimUnboundTargetForLeader(currentLeaderRecord, leaderProfileKey, slot, threadName, "Bus leader reclaimed stale-current unbound thread", {
                                 phase: "leader-topic-unbound-stale-reclaim",
                                 staleThreadId: currentLeaderRecord.target.threadId,
-                            });
+                            }, leaderBinding?.slot === slot ? leaderBinding : undefined);
                             return;
                         }
                     }
@@ -7777,7 +8109,12 @@ export function createTelegramInboundRouteRuntime(deps) {
                     !hasAnyRoutableThread) {
                     const priorLeaderRecord = deps.threadStore.getByProfileKey(leaderProfileKey);
                     const priorLeaderIdentity = deps.threadStore.getIdentityByProfileKey(leaderProfileKey);
-                    const slot = deps.threadStore.allocateSlot(leaderProfileKey, priorLeaderRecord?.slot ?? priorLeaderIdentity?.slot);
+                    const leaderBinding = claimLeaderWorkspaceBinding();
+                    const slot = deps.threadStore.allocateSlot(leaderProfileKey, leaderBinding?.slot ??
+                        priorLeaderRecord?.slot ??
+                        priorLeaderIdentity?.slot, leaderBinding?.bindingKey);
+                    if (leaderBinding && leaderBinding.slot !== slot)
+                        deps.threadStore.releaseWorkspaceClaim(instanceId);
                     if (!slot) {
                         await deps.sendTextReply(target.chatId, message.message_id, TELEGRAM_SLOT_CAPACITY_MESSAGE, { target });
                         return;
@@ -7790,7 +8127,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                         identityThreadName ??
                         ThreadNaming.chooseTelegramThreadName({ slot }) ??
                         "Pi";
-                    await reclaimUnboundTargetForLeader({ createdAtMs: priorLeaderRecord?.createdAtMs ?? Date.now() }, leaderProfileKey, slot, threadName, "Bus leader reclaimed unbound thread", { phase: "leader-topic-reclaim" });
+                    await reclaimUnboundTargetForLeader({ createdAtMs: priorLeaderRecord?.createdAtMs ?? Date.now() }, leaderProfileKey, slot, threadName, "Bus leader reclaimed unbound thread", { phase: "leader-topic-reclaim" }, leaderBinding?.slot === slot ? leaderBinding : undefined);
                     return;
                 }
                 await sendUnboundRerouteChooser(message, ctx);
@@ -7817,6 +8154,8 @@ export function createTelegramInboundRouteRuntime(deps) {
         onUpdateCompleted,
         prepareHeldCommand: commandHandler.prepareHeldCommand,
         canPrepareHeldCommand: commandHandler.canPrepareHeldCommand,
+        onSessionSettled,
+        onDeliverySettled,
         observeLiveRebindLeaderWork,
         prepareLiveRebindLeaderCleanup,
         prepareLiveRebindFollowerCleanup,