@llblab/pi-telegram 0.54.4 → 0.55.0

package/dist/lib/threads.js

@@ -73,6 +73,13 @@ export function createTelegramCleanupTargetProtection(store, departingRecord) {
     // optional fields; neither changes the authority represented by a snapshot.
     const sameSnapshot = (left, right) => isDeepStrictEqual(JSON.parse(JSON.stringify(left)), JSON.parse(JSON.stringify(right)));
     return (target, action) => {
+        try {
+            if (store.listProtectedLiveRebindTargets?.().some(candidate => targetMatches(candidate, target)))
+                return true;
+        }
+        catch {
+            return true;
+        }
         // A source-bound temporary tab is removed only by its own Forward/Cancel, never by generic reconciliation.
         if (store.listTemporaryThreadTargets) {
             try {
@@ -1069,6 +1076,8 @@ function isWorkspaceLiveRebindIntent(value) {
             "recipient",
             "phase",
             "cleanup",
+            "inputRelease",
+            "oldTargetProtected",
         ]) ||
         value.kind !== "live-rebind" ||
         !isTelegramWorkspaceRestoreRequest(value.request) ||
@@ -1085,6 +1094,13 @@ function isWorkspaceLiveRebindIntent(value) {
         value.recipient.kind !==
             (value.request.owner.owner?.kind === "leader" ? "leader" : "follower"))
         return false;
+    if (value.inputRelease !== undefined &&
+        (!["held", "issued", "accepted"].includes(value.inputRelease) ||
+            (value.inputRelease !== "held" && !["released", "finished"].includes(value.phase))))
+        return false;
+    if (value.oldTargetProtected !== undefined &&
+        (value.oldTargetProtected !== true || value.inputRelease === undefined || value.phase !== "finished" || value.cleanup !== "not-issued"))
+        return false;
     if (value.phase === "rebound")
         return value.cleanup === undefined;
     if (value.phase === "released")
@@ -1272,11 +1288,33 @@ function conflictsWithWorkspaceRestoreProvision(request, provision) {
             (targetMatches(provision.target, request.binding.target) ||
                 targetMatches(provision.target, request.target))));
 }
+/** Canonical issuance is distinct from cleanup completion, source disposition and peer dispatch readiness. */
+export function isTelegramLiveRebindInputAuthorized(value) {
+    return value.inputRelease === undefined
+        ? value.phase === "released" && value.cleanup === undefined
+        : ["issued", "accepted"].includes(value.inputRelease) &&
+            ["released", "finished"].includes(value.phase) && value.cleanup !== "issued";
+}
+function liveRebindInputPending(value) {
+    return value.inputRelease !== undefined && value.inputRelease !== "accepted";
+}
+function liveRebindActive(value) {
+    return value.phase !== "finished" || liveRebindInputPending(value);
+}
+function liveRebindOldTargetUnknown(value) {
+    return value.phase === "finished" && value.cleanup === "unknown" && value.inputRelease !== undefined;
+}
+function retainLiveRebind(value) {
+    return liveRebindActive(value) || liveRebindOldTargetUnknown(value) || value.oldTargetProtected === true;
+}
+function protectedLiveRebindOldTargets(snapshot) {
+    return (snapshot?.liveRebindings ?? []).filter(value => value.oldTargetProtected === true || liveRebindOldTargetUnknown(value) || value.inputRelease !== undefined && value.cleanup === "issued").map(value => ({ ...value.request.binding.target }));
+}
 function pendingWorkspaceRelocationRequests(snapshot) {
     return [
         ...(snapshot?.operations ?? []).map((value) => value.request),
         ...(snapshot?.liveRebindings ?? [])
-            .filter((value) => value.phase !== "finished")
+            .filter(liveRebindActive)
             .map((value) => value.request),
     ];
 }
@@ -1311,7 +1349,7 @@ function assertWorkspaceRestoreBindingProtection(file) {
         const owners = (file.threads ?? []).filter((value) => value.slot === current.slot ||
             targetMatches(value.target, request.binding.target) ||
             targetMatches(value.target, request.target));
-        const live = file.workspaceRestore?.liveRebindings?.some((value) => value.phase !== "finished" &&
+        const live = file.workspaceRestore?.liveRebindings?.some((value) => liveRebindActive(value) &&
             value.request.operationId === request.operationId);
         if (owners.length > 1 ||
             owners.some((value) => value.slot !== current.slot ||
@@ -1324,6 +1362,13 @@ function assertWorkspaceRestoreBindingProtection(file) {
             throw new Error("Protected Workspace Restore owner target changed.");
         }
     }
+    for (const old of protectedLiveRebindOldTargets(file.workspaceRestore)) {
+        if (file.workspaceBindings?.some(value => targetMatches(value.target, old)) ||
+            file.threads?.some(value => targetMatches(value.target, old) && ["active", "starting", "pending", "probe-required"].includes(value.status)) ||
+            file.pendingProvisions?.some(value => !value.target || targetMatches(value.target, old)) ||
+            file.reservations?.some(value => targetMatches(value.target, old)))
+            throw new Error("Unknown live cleanup target remains protected.");
+    }
     const operations = [
         ...(file.workspaceRestore?.operations ?? []),
         ...(file.workspaceRestore?.liveRebindings ?? []),
@@ -1405,11 +1450,11 @@ function parseWorkspaceRestore(value) {
     if (liveOperations.some((operation, index) => liveOperations
         .slice(index + 1)
         .some((other) => operation.request.operationId === other.request.operationId ||
-        (operation.phase !== "finished" &&
-            other.phase !== "finished" &&
+        (liveRebindActive(operation) &&
+            liveRebindActive(other) &&
             workspaceRestoresConflict(operation.request, other.request))) ||
         snapshot.operations.some((other) => operation.request.operationId === other.request.operationId ||
-            (operation.phase !== "finished" &&
+            (liveRebindActive(operation) &&
                 workspaceRestoresConflict(operation.request, other.request)))))
         throw new Error("Conflicting Workspace live rebinding evidence.");
     const entries = snapshot.temporaryThreads ?? [];
@@ -1424,7 +1469,7 @@ function parseWorkspaceRestore(value) {
         entries.some((entry) => !!entry.target &&
             [
                 ...snapshot.operations,
-                ...liveOperations.filter((value) => value.phase !== "finished"),
+                ...liveOperations.filter(liveRebindActive),
             ].some(({ request }) => targetMatches(request.binding.target, entry.target) ||
                 (targetMatches(request.target, entry.target) &&
                     !isTemporaryThreadRestore(entry, [{ request }])))))
@@ -2461,7 +2506,7 @@ export function createTelegramTopicTargetStore(options) {
                         (transition.kind === "relocate"
                             ? !isDeepStrictEqual(transition.restore.operations.slice(0, -1), workspaceRestore?.operations ?? [])
                             : !isDeepStrictEqual(transition.restore.operations, workspaceRestore?.operations ?? []) ||
-                                !isDeepStrictEqual(transition.restore.liveRebindings?.slice(0, -1), (workspaceRestore?.liveRebindings ?? []).filter((value) => value.phase !== "finished"))))
+                                !isDeepStrictEqual(transition.restore.liveRebindings?.slice(0, -1), (workspaceRestore?.liveRebindings ?? []).filter(retainLiveRebind))))
                         return false;
                     file.workspaceRestore = structuredClone(transition.restore);
                     parseWorkspaceRestore(file.workspaceRestore);
@@ -2891,6 +2936,14 @@ export function createTelegramTopicTargetStore(options) {
                 !isDeepStrictEqual(parseTopicTargetFile(readStoreSnapshot(path, false)), file))
                 throw new Error("Workspace live-rebind observation changed.");
         },
+        hasPreDispatchRebindEvidence() {
+            const file = parseTopicTargetFile(readStoreSnapshot(getPath(), false) ?? { version: 1, records: [] });
+            return file.workspaceRestore?.liveRebindings?.some(value => value.inputRelease !== undefined) === true;
+        },
+        listProtectedLiveRebindTargets() {
+            const file = parseTopicTargetFile(readStoreSnapshot(getPath(), false) ?? { version: 1, records: [] });
+            return protectedLiveRebindOldTargets(file.workspaceRestore);
+        },
         isWorkspaceLiveRebindCleanupTargetProtected(input) {
             try {
                 const expected = structuredClone(input), path = getPath(), profile = activeProfile(), revision = mutationRevision;
@@ -2951,8 +3004,8 @@ export function createTelegramTopicTargetStore(options) {
                     targetMatches(other.request.target, old);
                 if (file.workspaceRestore.operations.some(touchesOld) ||
                     file.workspaceRestore.liveRebindings?.some((other) => other.request.operationId !== request.operationId &&
-                        other.phase !== "finished" &&
-                        touchesOld(other)))
+                        (liveRebindActive(other) && touchesOld(other) ||
+                            (liveRebindOldTargetUnknown(other) || other.oldTargetProtected) && targetMatches(other.request.binding.target, old))))
                     return true;
                 for (const claim of workspaceClaims.values()) {
                     const bindings = canonical.filter((binding) => binding.bindingKey === claim.identity.bindingKey);
@@ -3113,12 +3166,14 @@ export function createTelegramTopicTargetStore(options) {
                                 intent.routing !== undefined))
                         return false;
                     const state = read().state;
+                    if (protectedLiveRebindOldTargets(state).some(old => targetMatches(old, intent.request.binding.target) || targetMatches(old, intent.request.target)))
+                        return false;
                     if (pendingWorkspaceRelocationRequests(state).some((request) => workspaceRestoresConflict(request, intent.request)) ||
                         state.liveRebindings?.some((value) => value.request.operationId === intent.request.operationId))
                         return false;
                     if (state.revision === Number.MAX_SAFE_INTEGER)
                         throw new Error("Workspace Restore revision exhausted.");
-                    const pendingLive = (state.liveRebindings ?? []).filter((value) => value.phase !== "finished");
+                    const pendingLive = (state.liveRebindings ?? []).filter(retainLiveRebind);
                     if ((live ? pendingLive.length : state.operations.length) >= 26)
                         throw new Error("Workspace Restore operation capacity reached.");
                     const restore = {
@@ -3352,7 +3407,7 @@ export function createTelegramTopicTargetStore(options) {
             return {
                 list: () => structuredClone(storage.read().operations),
                 listLiveRebindings: () => structuredClone(storage.read().liveRebindings ?? []),
-                async commitLiveRebind(requestInput, recipientInput, authority) {
+                async commitLiveRebind(requestInput, recipientInput, authority, options) {
                     const request = structuredClone(requestInput), recipient = structuredClone(recipientInput);
                     const executor = structuredClone(authority.executor), operatorUserId = authority.operatorUserId;
                     const current = () => currentScope() &&
@@ -3370,6 +3425,7 @@ export function createTelegramTopicTargetStore(options) {
                         createdAtMs: at,
                         updatedAtMs: at,
                         phase: "rebound",
+                        ...(options?.holdInput ? { inputRelease: "held" } : {}),
                     };
                     if (!current() || !isWorkspaceLiveRebindIntent(intent))
                         return undefined;
@@ -3383,7 +3439,8 @@ export function createTelegramTopicTargetStore(options) {
                             isDeepStrictEqual(value.request, request) &&
                             isDeepStrictEqual(value.recipient, recipient) &&
                             isDeepStrictEqual(value.executor, executor) &&
-                            value.operatorUserId === operatorUserId
+                            value.operatorUserId === operatorUserId &&
+                            (value.inputRelease !== undefined) === (options?.holdInput === true)
                             ? structuredClone(value)
                             : undefined;
                     };
@@ -3411,14 +3468,24 @@ export function createTelegramTopicTargetStore(options) {
                         if (!entry ||
                             !isDeepStrictEqual(entry, expected) ||
                             entry.operatorUserId !== operator ||
-                            entry.phase === "finished")
+                            (entry.phase === "finished" && step !== "issue-input" && step !== "accept-input"))
                             return undefined;
-                        const issuing = step === "release" || step === "issue-cleanup";
+                        const issuing = step === "release" || step === "issue-cleanup" || step === "issue-input" || step === "accept-input" || step === "protect-old-target";
                         if ((issuing || step === "confirmed") &&
                             !isDeepStrictEqual(entry.executor, executor))
                             return undefined;
                         let next;
-                        if (step === "release") {
+                        if (step === "issue-input" || step === "accept-input") {
+                            if (!["released", "finished"].includes(entry.phase) || entry.cleanup === "issued" || entry.inputRelease !== (step === "issue-input" ? "held" : "issued"))
+                                return undefined;
+                            next = { ...entry, inputRelease: step === "issue-input" ? "issued" : "accepted" };
+                        }
+                        else if (step === "protect-old-target") {
+                            if (entry.phase !== "released" || entry.cleanup !== undefined || entry.inputRelease !== "held")
+                                return undefined;
+                            next = { ...entry, phase: "finished", cleanup: "not-issued", oldTargetProtected: true };
+                        }
+                        else if (step === "release") {
                             if (entry.phase !== "rebound")
                                 return undefined;
                             next = { ...entry, phase: "released" };
@@ -3673,8 +3740,18 @@ export function createTelegramTopicTargetStore(options) {
                     });
                 },
                 listTemporaryThreads: () => structuredClone(storage.read().temporaryThreads ?? []),
-                reserveTemporaryThread(sourceInput, token, authority) {
+                reserveTemporaryThread(sourceInput, token, authority, groupInput) {
                     const source = structuredClone(sourceInput);
+                    const group = groupInput
+                        ? structuredClone(groupInput)
+                        : {
+                            journalBindingKey: source.journalBindingKey,
+                            updateIds: [source.updateId],
+                        };
+                    if (!isTemporaryThreadInput(group) ||
+                        group.journalBindingKey !== source.journalBindingKey ||
+                        Math.min(...group.updateIds) !== source.updateId)
+                        return undefined;
                     let reserved = false;
                     const entry = mutate(authority, (file, executor, operator) => {
                         const entries = file.temporaryThreads ?? [];
@@ -3690,12 +3767,7 @@ export function createTelegramTopicTargetStore(options) {
                             throw new Error("Invalid Workspace Restore clock.");
                         const next = {
                             source,
-                            inputs: [
-                                {
-                                    journalBindingKey: source.journalBindingKey,
-                                    updateIds: [source.updateId],
-                                },
-                            ],
+                            inputs: [group],
                             operatorUserId: operator,
                             executor,
                             token,
@@ -3708,7 +3780,7 @@ export function createTelegramTopicTargetStore(options) {
                         if (!isTemporaryThreadEntry(next) ||
                             entries.some((value) => value.token === token ||
                                 getTelegramTemporaryThreadInputs(value).some((input) => input.journalBindingKey === source.journalBindingKey &&
-                                    input.updateIds.includes(source.updateId))))
+                                    input.updateIds.some((id) => group.updateIds.includes(id)))))
                             return undefined;
                         if (entries.length >= TEMPORARY_THREAD_CAPACITY)
                             throw new Error("Temporary Thread capacity reached.");
@@ -4075,7 +4147,8 @@ export function createTelegramTopicTargetStore(options) {
         },
         reserveThread(reservation) {
             if (pendingWorkspaceRelocationRequests(workspaceRestore).some((request) => conflictsWithWorkspaceRestoreProvision(request, reservation)) ||
-                conflictsWithTemporaryThread(workspaceRestore, reservation.target)) {
+                conflictsWithTemporaryThread(workspaceRestore, reservation.target) ||
+                protectedLiveRebindOldTargets(workspaceRestore).some(old => targetMatches(old, reservation.target))) {
                 throw new Error("Protected Workspace Restore provisioning conflict.");
             }
             const next = { ...reservation };
@@ -4086,7 +4159,8 @@ export function createTelegramTopicTargetStore(options) {
         },
         upsertPendingProvision(provision) {
             if (pendingWorkspaceRelocationRequests(workspaceRestore).some((request) => conflictsWithWorkspaceRestoreProvision(request, provision)) ||
-                conflictsWithTemporaryThread(workspaceRestore, provision.target)) {
+                conflictsWithTemporaryThread(workspaceRestore, provision.target) ||
+                protectedLiveRebindOldTargets(workspaceRestore).some(old => !provision.target || targetMatches(old, provision.target))) {
                 throw new Error("Protected Workspace Restore provisioning conflict.");
             }
             const next = {
@@ -4937,7 +5011,7 @@ export function createTelegramTopicTargetStore(options) {
             const next = normalizeWorkspaceBindingRecord(binding);
             if (next && hasWorkspaceRetirementConflict(next))
                 return undefined;
-            if (!next)
+            if (!next || protectedLiveRebindOldTargets(workspaceRestore).some(old => targetMatches(old, next.target)))
                 return undefined;
             const nextMapKey = getWorkspaceBindingMapKey(next);
             let claim = workspaceClaims.get(nextMapKey);
@@ -4994,16 +5068,19 @@ export function createTelegramTopicTargetStore(options) {
             if (previous?.manualThreadName && !next.manualThreadName) {
                 next.manualThreadName = previous.manualThreadName;
             }
-            if (previous) {
+            if (previous || replacedTargetBinding) {
                 const journalBindingKeys = Array.from(new Set([
-                    ...(previous.journalBindingKeys ?? []),
+                    ...(previous?.journalBindingKeys ?? []),
+                    ...(replacedTargetBinding?.journalBindingKeys ?? []),
                     ...(next.journalBindingKeys ?? []),
                 ]));
-                if (journalBindingKeys.length || previous.journalBindingsComplete)
+                const retainedComplete = (!previous || previous.journalBindingsComplete === true) &&
+                    (!replacedTargetBinding || replacedTargetBinding.journalBindingsComplete === true);
+                if (journalBindingKeys.length || retainedComplete)
                     next.journalBindingKeys = journalBindingKeys;
                 else
                     delete next.journalBindingKeys;
-                if (previous.journalBindingsComplete)
+                if (retainedComplete)
                     next.journalBindingsComplete = true;
                 else
                     delete next.journalBindingsComplete;

package/dist/lib/turns.d.ts

@@ -7,6 +7,8 @@ import { type DownloadedTelegramMessageFile, type DownloadTelegramMessageFilesDe
 import { truncateTelegramQueueSummary, type PendingTelegramTurn, type TelegramPreparedPromptTurn, type TelegramQueueItem, type TelegramQueueStore } from "./queue.ts";
 import { type TelegramVoiceReplyMode } from "./voice.ts";
 export declare const TELEGRAM_PREFIX = "[telegram]";
+/** A routed source keeps its unique message/file/group identity, but cannot quote an anchor in its former tab. */
+export declare function withoutTelegramTurnReplyAnchor<TMessage extends object>(message: TMessage): TMessage;
 export declare const TELEGRAM_GUEST_TURN_NOTE = "[guest] delivery: answer quickly with one concise, self-contained reply";
 export interface TelegramTurnTarget {
     chatId: number;

package/dist/lib/turns.js

@@ -9,6 +9,11 @@ import { appendTelegramAttachmentSection, appendTelegramListSection, buildTelegr
 import { createTelegramQueueAdmissionReceipt, truncateTelegramQueueSummary, } from "./queue.js";
 import { computeVoicePromptContribution, computeVoiceTurnFlags, getTelegramVoiceReplyMode, } from "./voice.js";
 export const TELEGRAM_PREFIX = "[telegram]";
+const REPLY_ANCHOR_SUPPRESSED = Symbol.for("@llblab/pi-telegram:reply-anchor-suppressed");
+/** A routed source keeps its unique message/file/group identity, but cannot quote an anchor in its former tab. */
+export function withoutTelegramTurnReplyAnchor(message) {
+    return { ...message, [REPLY_ANCHOR_SUPPRESSED]: true };
+}
 export const TELEGRAM_GUEST_TURN_NOTE = "[guest] delivery: answer quickly with one concise, self-contained reply";
 function getTelegramTurnTarget(message) {
     return Number.isInteger(message.message_thread_id)
@@ -456,7 +461,7 @@ function buildPreparedTelegramPromptTurn(options, images) {
         kind: "prompt",
         chatId: firstMessage.chat.id,
         target: getTelegramTurnTarget(firstMessage),
-        replyToMessageId: firstMessage.message_id,
+        replyToMessageId: Reflect.get(firstMessage, REPLY_ANCHOR_SUPPRESSED) === true ? 0 : firstMessage.message_id,
         sourceMessageIds: collectTelegramMessageIds(options.messages),
         queueOrder: options.queueOrder,
         queueLane: "default",

package/dist/lib/updates.d.ts

@@ -229,7 +229,9 @@ interface TelegramUpdateAdmissionBinding {
     inspectSourceSnapshot?: () => TelegramDeferredSourceSnapshot | undefined;
     inspectCompletion?: () => TelegramDeferredSourceEvidence | undefined;
     isSourceUnsettled?: () => boolean;
-    prepareLiveInput?: (sourceUpdateIds: readonly number[], isCurrent: () => boolean) => TelegramLiveDeferredInputPreparation | undefined;
+    prepareLiveInput?: (sourceUpdateIds: readonly number[], isCurrent: () => boolean, onTransferred?: () => void) => TelegramLiveDeferredInputPreparation | undefined;
+    /** Internal notification after the worker's exact donor-removal ACK; never issues completion itself. */
+    acknowledgeTransferred?: () => void;
     prepareQueueAdmission?: () => TelegramDeferredQueueAdmissionPreparation | undefined;
     prepareSourceCompletion?: () => Pick<TelegramDeferredSourceCompletionPreparation, "source" | "isCurrent"> | undefined;
     supportsAbandonment?: (journalBindingKey: string) => boolean;
@@ -241,7 +243,7 @@ interface TelegramUpdateAdmissionBinding {
 export type TelegramQueueAdmissionReceiptLike = TelegramQueueAdmissionReceipt;
 export declare function bindTelegramUpdateAdmissionSource<TUpdate extends TelegramUpdateFlow & {
     update_id: number;
-}>(update: TUpdate, report: TelegramUpdateAdmissionBinding["report"], controls?: Pick<TelegramUpdateAdmissionBinding, "abandon" | "armRoutingInput" | "getRoutingInput" | "acquireRouting" | "inspectSource" | "inspectSourceSnapshot" | "inspectCompletion" | "isSourceUnsettled" | "prepareLiveInput" | "prepareQueueAdmission" | "prepareSourceCompletion" | "supportsAbandonment" | "inspectAbandoning" | "inspectHistorical" | "isHistorical" | "isHistoricalReviewHeld">): TUpdate;
+}>(update: TUpdate, report: TelegramUpdateAdmissionBinding["report"], controls?: Pick<TelegramUpdateAdmissionBinding, "abandon" | "armRoutingInput" | "getRoutingInput" | "acquireRouting" | "inspectSource" | "inspectSourceSnapshot" | "inspectCompletion" | "isSourceUnsettled" | "acknowledgeTransferred" | "prepareLiveInput" | "prepareQueueAdmission" | "prepareSourceCompletion" | "supportsAbandonment" | "inspectAbandoning" | "inspectHistorical" | "isHistorical" | "isHistoricalReviewHeld">): TUpdate;
 /**
  * Conservative read-only census: any retained entry naming this Thread, in any nested Telegram object or state,
  * is unresolved custody, except a lone button tap, which carries no input (the in-flight Cancel itself).
@@ -596,7 +598,9 @@ export interface TelegramUpdateExecutionFailureClassification {
 }
 export interface TelegramUpdateWorkerRuntimeDeps<TContext> {
     journal: TelegramUpdateWorkerJournalPort;
-    executeUpdate: (update: TelegramJournaledUpdate, ctx: TContext, signal: AbortSignal) => Promise<TelegramUpdateAdmissionOutcome> | TelegramUpdateAdmissionOutcome;
+    executeUpdate: (update: TelegramJournaledUpdate, ctx: TContext, signal: AbortSignal, target?: TelegramTarget & {
+        threadId: number;
+    }) => Promise<TelegramUpdateAdmissionOutcome> | TelegramUpdateAdmissionOutcome;
     /** Native source-only binding, installed by the admission-worker assembly rather than ordinary dispatch. */
     admitPreparedLiveInput?: (update: TelegramJournaledUpdate, ctx: TContext, signal: AbortSignal) => Promise<{
         outcome: TelegramUpdateAdmissionOutcome;
@@ -660,7 +664,9 @@ export interface TelegramLiveInputPreparation {
     prepareStatusConsumption?(input: TelegramLiveStatusConsumption): boolean;
     /** Native owner availability before recipient append; not admission or future target activation. */
     canPrepareStatusConsumption?(): boolean;
-    release(canRelease: () => boolean): boolean;
+    release(canRelease: () => boolean, target?: TelegramTarget & {
+        threadId: number;
+    }): boolean;
     /** Ends a failed pre-append attempt only when no selected input was saved. */
     cancelEmpty(): boolean;
     /** One fenced removal of this never-dispatched recipient copy; unknown issuance cannot be retried. */
@@ -704,6 +710,7 @@ export interface TelegramUpdateWorkerRuntime<TContext> {
         sourceUpdateIds: readonly number[];
         signal: AbortSignal;
         isCurrent(): boolean;
+        onTransferred?(): void;
     }) => TelegramLiveDeferredInputPreparation | undefined;
     prepareDeferredQueueAdmission?: (input: {
         updateId: number;

package/dist/lib/updates.js

@@ -5,6 +5,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
+import { withoutTelegramTurnReplyAnchor } from "./turns.js";
 import { createTelegramUserPairingRuntime, getTelegramAuthorizationState, } from "./config.js";
 import { TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_FAILURE_CLASS_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_FAILURE_SUMMARY_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_QUEUE_OWNER_ID_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_VERSION, areTelegramUpdateJournalQueueOwnersEqual, createTelegramUpdateJournalEntryDigest, doesTelegramJournalUpdateNameThread, isTelegramJournalLoneCallbackUpdate, getTelegramUpdateJournalBindingPath, isTelegramUpdateJournalLegacyFamilyVersion, isTelegramUpdateJournalQueueOwnerProcess, parseTelegramUpdateJournalQueueOwner, } from "./journal.js";
 import { isPiStaleContextError } from "./pi.js";
@@ -262,19 +263,26 @@ export function prepareTelegramLiveDeferredInput(values, isCurrent) {
         carriers.some((value) => getTelegramUpdateExecutionFence(value)?.signal !== execution.signal ||
             getTelegramUpdateExecutionFence(value)?.isCurrent() !== true))
         return undefined;
-    const unsettled = () => carriers.every((value) => getTelegramUpdateAdmissionBinding(value)?.isSourceUnsettled?.() ===
-        true);
+    const bindings = carriers.map(getTelegramUpdateAdmissionBinding);
+    const acknowledgers = bindings.map(binding => binding?.acknowledgeTransferred);
+    const bindingsCurrent = () => carriers.every((value, index) => getTelegramUpdateAdmissionBinding(value) === bindings[index] && bindings[index]?.acknowledgeTransferred === acknowledgers[index]);
+    const unsettled = () => bindingsCurrent() && bindings.every(binding => binding?.isSourceUnsettled?.() === true);
     if (!unsettled())
         return undefined;
-    const prepared = getTelegramUpdateAdmissionBinding(first)?.prepareLiveInput?.(ids, () => isCurrent() &&
-        carriers.every((value) => getTelegramUpdateExecutionFence(value)?.isCurrent() === true));
+    let transferred = false;
+    const prepared = getTelegramUpdateAdmissionBinding(first)?.prepareLiveInput?.(ids, () => bindingsCurrent() && isCurrent() &&
+        carriers.every((value) => getTelegramUpdateExecutionFence(value)?.isCurrent() === true), () => {
+        transferred = true;
+        for (let index = 0; index < bindings.length; index++)
+            acknowledgers[index]?.call(bindings[index]);
+    });
     return (prepared && {
         ...prepared,
         isCurrent: () => unsettled() && prepared.isCurrent(),
         confirmSaved: () => unsettled() && prepared.confirmSaved(),
         beginRelease: (canRelease) => unsettled() && prepared.beginRelease(() => unsettled() && canRelease()),
         settleTransferred: (canSettle) => unsettled()
-            ? prepared.settleTransferred(() => unsettled() && canSettle())
+            ? prepared.settleTransferred(() => (transferred || unsettled()) && canSettle())
             : "protected",
         cancel: () => unsettled() && prepared.cancel(),
     });
@@ -1714,7 +1722,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         transition("blocked", currentUpdateId, "authority-lost");
         return "blocked";
     };
-    const executeWithinOwner = async (expectedOwner, update, preparedExecute) => {
+    const executeWithinOwner = async (expectedOwner, update, preparedExecute, target) => {
         if (expectedOwner.controller.signal.aborted) {
             return TELEGRAM_UPDATE_WORKER_EXECUTION_ABORTED;
         }
@@ -1723,7 +1731,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             ? preparedExecute(update, expectedOwner.ctx, expectedOwner.controller.signal)
             : deps.executeCustodiedUpdate
                 ? deps.executeCustodiedUpdate(update, expectedOwner.ctx, expectedOwner.controller.signal)
-                : deps.executeUpdate(update, expectedOwner.ctx, expectedOwner.controller.signal));
+                : deps.executeUpdate(update, expectedOwner.ctx, expectedOwner.controller.signal, target));
         const settlement = execution.then((outcome) => custodied
             ? {
                 ok: true,
@@ -2434,7 +2442,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                             throw new Error("Prepared status admission is unconfirmed.");
                         return admitted.outcome;
                     }
-                    : undefined);
+                    : undefined, prepared?.target);
                 if (execution === TELEGRAM_UPDATE_WORKER_EXECUTION_ABORTED) {
                     return "aborted";
                 }
@@ -2490,6 +2498,12 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     snapshotInvalidated = true;
                     break;
                 }
+                if (prepared?.target) {
+                    prepared.ids = new Set([...prepared.ids].filter(id => id !== entry.updateId));
+                    if (!prepared.ids.size && livePreparation === prepared)
+                        livePreparation = undefined;
+                    updateClaimCounts();
+                }
                 const postExecutionAuthority = checkAuthority(expectedOwner, entry.updateId);
                 if (postExecutionAuthority)
                     return postExecutionAuthority;
@@ -2856,7 +2870,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             launchDrain();
         },
         prepareDeferredLiveInput(input) {
-            const expectedOwner = owner, binding = deps.getJournalBindingKey?.(), ids = [...input.sourceUpdateIds];
+            const expectedOwner = owner, binding = deps.getJournalBindingKey?.(), onTransferred = input.onTransferred, ids = [...input.sourceUpdateIds];
             const sources = ids.map((id) => deferredSources.get(id));
             const ownerCurrent = () => !!expectedOwner &&
                 owner === expectedOwner &&
@@ -2867,7 +2881,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 deps.hasAuthority(expectedOwner.ctx) &&
                 deps.isContextCurrent?.(expectedOwner.ctx) !== false &&
                 isQueueOwnerIdentityCurrent(expectedOwner) &&
-                input.isCurrent();
+                input.onTransferred === onTransferred && input.isCurrent();
             const sourcesCurrent = () => ownerCurrent() &&
                 sources.every((source, index) => !!source &&
                     deferredSources.get(ids[index]) === source &&
@@ -2946,10 +2960,11 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     held.discardIssued = true;
                     try {
                         const result = completeExact(ids, expected, undefined, () => current() && canSettle());
-                        if (!current() ||
-                            !canSettle() ||
-                            result.removedUpdateIds.length !== ids.length ||
-                            !ids.every((id) => result.removedUpdateIds.includes(id)))
+                        if (result.removedUpdateIds.length !== ids.length || !ids.every(id => result.removedUpdateIds.includes(id)))
+                            return "unknown";
+                        // A consumed routing clock is expected only after this exact ACK, never after uncertain removal.
+                        onTransferred?.call(input);
+                        if (!current() || !canSettle())
                             return "unknown";
                     }
                     catch (error) {
@@ -3063,7 +3078,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 }
             };
             const finish = () => {
-                if (!held.released || !held.status)
+                if (!held.released || !held.status && !held.target)
                     livePreparation = undefined;
                 updateClaimCounts();
                 notifyStateChange();
@@ -3180,7 +3195,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     };
                     return held.status.current();
                 },
-                release(canRelease) {
+                release(canRelease, target) {
                     if (!current() ||
                         held.discardIssued ||
                         !held.saved ||
@@ -3193,6 +3208,16 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                         !canRelease() ||
                         !current())
                         return false;
+                    if (target) {
+                        if (!Number.isSafeInteger(target.chatId) || target.chatId === 0 || !Number.isSafeInteger(target.threadId) || target.threadId <= 0 ||
+                            entries.some(entry => {
+                                const message = (entry.update.message ?? entry.update.edited_message);
+                                return message?.chat?.id !== target.chatId;
+                            }))
+                            return false;
+                        if (!held.status)
+                            held.target = { ...target };
+                    }
                     released = true;
                     held.released = true;
                     finish();
@@ -5257,7 +5282,8 @@ function createTelegramUpdateSourceAdmissionHandle(deps, capture) {
                     signal,
                 })
                 : undefined,
-            prepareLiveInput: (sourceUpdateIds, isCurrent) => execution.isCurrent() &&
+            acknowledgeTransferred: () => { settlementReported = true; },
+            prepareLiveInput: (sourceUpdateIds, isCurrent, onTransferred) => execution.isCurrent() &&
                 !immediate &&
                 !settlementReported &&
                 !suspended
@@ -5266,6 +5292,7 @@ function createTelegramUpdateSourceAdmissionHandle(deps, capture) {
                     sourceUpdateIds,
                     signal,
                     isCurrent: () => execution.isCurrent() && isCurrent(),
+                    onTransferred,
                 })
                 : undefined,
             isHistorical: (matchesOriginal) => !signal.aborted &&
@@ -6299,10 +6326,18 @@ export function createTelegramUpdateAdmissionWorkerRuntime(deps) {
                     update, ctx, signal),
             }
             : {}),
-        async executeUpdate(update, ctx, signal) {
+        async executeUpdate(update, ctx, signal, target) {
             const typedUpdate = update;
+            const prepared = deps.prepareUpdateForExecution?.(typedUpdate) ?? typedUpdate;
+            // Journal/source evidence remains the original; only the warm released handler projection changes destination.
+            const routed = target ? { ...prepared,
+                ...(prepared.message ? { message: prepared.message.message_thread_id === target.threadId ? { ...prepared.message }
+                        : withoutTelegramTurnReplyAnchor({ ...prepared.message, message_thread_id: target.threadId, reply_to_message: undefined }) } : {}),
+                ...(prepared.edited_message ? { edited_message: prepared.edited_message.message_thread_id === target.threadId ? { ...prepared.edited_message }
+                        : withoutTelegramTurnReplyAnchor({ ...prepared.edited_message, message_thread_id: target.threadId, reply_to_message: undefined }) } : {}),
+            } : prepared;
             try {
-                return await executeUpdate(deps.prepareUpdateForExecution?.(typedUpdate) ?? typedUpdate, ctx, signal);
+                return await executeUpdate(routed, ctx, signal);
             }
             catch (error) {
                 if (await deps.settleTerminalExecutionFailure?.(error)) {

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.54.4",
+  "version": "0.55.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/docs/activity.md

@@ -222,7 +222,7 @@ Default scope:
 - `telegram` uses `{ kind: "target", target: event.target }`, binding delayed handlers to the immutable originating thread rather than whichever turn happens to be active later.
 - `local`, `autonomous`, and `unknown` use `{ kind: "instance" }`.
 
-Handlers may explicitly choose aggregate or another authorized scope. Context methods delegate to the public delivery runtime on every call; they do not retain Telegram clients, Pi contexts, or transport ownership objects. The Delivery API rechecks authorization when an operation runs, so a captured target that is no longer owned fails closed instead of rerouting.
+Handlers may explicitly choose an authorized scope; aggregate output is available only in Classic Mode, never Threaded Mode's input-only All. Context methods delegate to the public delivery runtime on every call; they do not retain Telegram clients, Pi contexts, or transport ownership objects. The Delivery API rechecks authorization when an operation runs, so a captured target that is no longer owned fails closed instead of rerouting.
 
 A handler may still receive events while no target is currently deliverable. Delivery then returns the normal structured `target-unavailable`, `target-unauthorized`, or `runtime-unavailable` result.