@llblab/pi-telegram 0.54.4 → 0.55.0

package/dist/lib/routing.js

@@ -210,6 +210,8 @@ function getTelegramAllTabSourceMessageIds(messages, chatId) {
         ? [message.message_id]
         : []);
 }
+/** Failure retains the source for recovery; Threaded Mode never emits a fallback answer into All. */
+const TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR = "All is input-only in Threaded Mode; a routing Thread could not be prepared.";
 /** What a route chooser moves: `<code>/name</code>` for a command, otherwise "this message". */
 function formatTelegramRouteSubject(command) {
     return command ? `<code>/${escapeHtml(command)}</code>` : "this message";
@@ -250,13 +252,6 @@ function formatTelegramRoutingInputPreview(message) {
     const chars = Array.from(label);
     return (escapeHtml(chars.slice(0, 80).join("")) + (chars.length > 80 ? "…" : ""));
 }
-function formatTelegramAllTabMenuChooserText(command) {
-    return [
-        `<b>🚦 Route ${formatTelegramRouteSubject(command)}:</b>`,
-        "",
-        "<i>To restore a Pi instead, send a message in a new tab.</i>",
-    ].join("\n");
-}
 function buildTelegramUnboundRerouteChooserMarkup(rerouteId, records, options) {
     const activeRecords = records.filter((record) => record.status === "active");
     const canRestoreAnyLiveThread = options.canRestore && activeRecords.length > 0;
@@ -380,11 +375,12 @@ export const TELEGRAM_LIVE_REBIND_CLEANUP_SCHEDULE = Object.freeze({
     intervalMs: 60_000,
     windowMs: 15 * 60_000,
 });
-/** One warm live attempt with exact post-release peer donor settlement; no startup recovery, Restore ACK or cleanup. */
+/** One warm live attempt with independent leader input/cleanup grants and exact peer donor settlement; no startup recovery or legacy Restore ACK. */
 export function createTelegramLiveRebindCoordinator(input) {
     const request = structuredClone(input.request), messages = [...input.messages];
     const executor = structuredClone(input.authority.executor), operatorUserId = input.authority.operatorUserId;
     const leader = input.leader && { ...input.leader }, follower = input.follower, followerRun = follower?.run;
+    const beforeCleanup = input.cleanupBeforeRelease;
     const selectedCommand = follower?.selectedCommand && structuredClone(follower.selectedCommand), held = selectedCommand;
     const observedRecipient = input.getRecipient(), recipient = observedRecipient && structuredClone(observedRecipient);
     const sources = messages.map(Updates.inspectTelegramDeferredSource);
@@ -469,7 +465,7 @@ export function createTelegramLiveRebindCoordinator(input) {
         return confirmed && current();
     };
     let preparation;
-    let saved = false, commitIssued = false, applyIssued = false, retitleIssued = false, peerReleaseIssued = false, donorSettlementAttempted = false, continuationIssued = false, released = false, advancing = false;
+    let saved = false, commitIssued = false, applyIssued = false, retitleIssued = false, peerReleaseIssued = false, donorSettlementAttempted = false, continuationIssued = false, cleanupBeforeReleaseIssued = false, cleanupBeforeReleaseDecided = false, released = false, advancing = false;
     let preparedSource;
     const runFollower = async (mode) => {
         if (!input.follower || !recipient || !current())
@@ -517,6 +513,18 @@ export function createTelegramLiveRebindCoordinator(input) {
             generation: recipient.generation,
             bindingKey: recipient.bindingKey,
         });
+    const acceptInput = (expected) => {
+        if (!expected.inputRelease || expected.inputRelease === "accepted")
+            return expected;
+        let accepted;
+        try {
+            accepted = input.restoreStore.advanceLiveRebind(expected, "accept-input", authority);
+        }
+        catch {
+            accepted = retained();
+        }
+        return accepted?.inputRelease === "accepted" && canonical(accepted) ? accepted : undefined;
+    };
     const releaseFollower = async (intent) => {
         if (!held || !peerReleaseIssued) {
             peerReleaseIssued = true;
@@ -539,6 +547,10 @@ export function createTelegramLiveRebindCoordinator(input) {
                 !canonical(intent))
                 return "unknown";
         }
+        const accepted = acceptInput(intent);
+        if (!accepted)
+            return "unknown";
+        intent = accepted;
         donorSettlementAttempted = true;
         if (preparation?.settleTransferred(() => canonical(intent)) !== "settled")
             return "unknown";
@@ -548,19 +560,16 @@ export function createTelegramLiveRebindCoordinator(input) {
     const observeCommandCompletion = () => {
         const intent = retained();
         if (!intent ||
-            intent.phase !== "released" ||
-            intent.cleanup ||
+            !Threads.isTelegramLiveRebindInputAuthorized(intent) ||
             !canonical(intent) ||
             !leader?.isApplied(intent))
             return "unknown";
         const completions = messages.map(Updates.inspectTelegramDeferredSourceCompletion);
-        return completions.every((completion, index) => completion && isDeepStrictEqual(completion, sources[index])) &&
+        const completed = completions.every((completion, index) => completion && isDeepStrictEqual(completion, sources[index])) &&
             current() &&
             canonical(intent) &&
-            leader.isApplied(intent) &&
-            current()
-            ? "released"
-            : "unknown";
+            leader.isApplied(intent) && current();
+        return completed && acceptInput(intent) ? "released" : "unknown";
     };
     return {
         /** Correlation only; a later cleanup attempt rereads and revalidates the canonical row itself. */
@@ -593,8 +602,7 @@ export function createTelegramLiveRebindCoordinator(input) {
                         return observeCommandCompletion();
                     const intent = retained();
                     if (!intent ||
-                        intent.phase !== "released" ||
-                        intent.cleanup ||
+                        !Threads.isTelegramLiveRebindInputAuthorized(intent) ||
                         !canonical(intent) ||
                         !leader?.isApplied(intent) ||
                         !leader.observeAdmission?.() ||
@@ -602,6 +610,8 @@ export function createTelegramLiveRebindCoordinator(input) {
                         !canonical(intent) ||
                         !leader.isApplied(intent))
                         return "unknown";
+                    if (!acceptInput(intent))
+                        return "unknown";
                     released = true;
                     return "released";
                 }
@@ -657,22 +667,22 @@ export function createTelegramLiveRebindCoordinator(input) {
                         instanceId: recipient.instanceId,
                         sessionId: recipient.sessionId,
                         generation: recipient.generation,
-                    }, authority);
+                    }, authority, beforeCleanup ? { holdInput: true } : undefined);
                 }
                 else if (!commitIssued)
                     return "protected";
                 if (!intent ||
                     !sourceSaved() ||
                     !canonical(intent) ||
-                    intent.phase === "finished" ||
-                    intent.cleanup)
+                    (intent.phase === "finished" && !cleanupBeforeReleaseIssued) ||
+                    (intent.cleanup && intent.inputRelease === undefined))
                     return "protected";
                 // A released peer may already have completed its sources; only its retained settlement can reobserve that outcome.
                 if (recipient.kind === "follower" && peerReleaseIssued)
-                    return intent.phase === "released"
+                    return Threads.isTelegramLiveRebindInputAuthorized(intent)
                         ? await releaseFollower(intent)
                         : "protected";
-                const mode = applyIssued || intent.phase === "released" ? "inspect" : "apply";
+                const mode = applyIssued || intent.phase === "released" || intent.phase === "finished" ? "inspect" : "apply";
                 applyIssued = true;
                 if (recipient.kind === "leader") {
                     await leader.apply(structuredClone(intent), mode, current);
@@ -715,22 +725,55 @@ export function createTelegramLiveRebindCoordinator(input) {
                     intent = retained();
                 }
                 if (!intent ||
-                    intent.phase !== "released" ||
-                    intent.cleanup ||
+                    (intent.phase !== "released" && !(intent.phase === "finished" && intent.inputRelease === "held")) ||
+                    (intent.cleanup && intent.inputRelease === undefined) ||
                     !canonical(intent))
                     return "protected";
+                if (beforeCleanup) {
+                    if (!cleanupBeforeReleaseIssued) {
+                        cleanupBeforeReleaseIssued = true;
+                        cleanupBeforeReleaseDecided = await beforeCleanup(intent, current);
+                    }
+                    intent = retained();
+                    if (!cleanupBeforeReleaseDecided && intent?.phase !== "finished")
+                        return "unknown";
+                    if (!intent || !canonical(intent) ||
+                        (recipient.kind === "leader" && !leader.isApplied(intent)) ||
+                        intent.inputRelease !== "held" || intent.cleanup === "issued")
+                        return "unknown";
+                    let issued;
+                    try {
+                        issued = input.restoreStore.advanceLiveRebind(intent, "issue-input", authority);
+                    }
+                    catch {
+                        issued = retained();
+                    }
+                    if (!issued || issued.inputRelease !== "issued" || !canonical(issued))
+                        return "unknown";
+                    intent = issued;
+                }
                 if (recipient.kind === "leader") {
                     const expected = intent;
                     if (!preparation?.beginRelease(() => canonical(expected) && leader.isApplied(expected)))
                         return "protected";
                     continuationIssued = true;
-                    const canContinue = () => current() && canonical(expected) && leader.isApplied(expected);
+                    const canContinue = () => {
+                        const observed = expected.inputRelease ? retained() : expected;
+                        return current() && !!observed &&
+                            (!expected.inputRelease || (observed.inputRelease === "issued" || observed.inputRelease === "accepted")) &&
+                            canonical(observed) && leader.isApplied(observed);
+                    };
                     if (leader.complete) {
                         leader.complete([...messages], canContinue);
+                        // The detached native producer has taken this one input grant; its source ACK remains a separate observation.
+                        if (!acceptInput(intent))
+                            return "unknown";
                         return observeCommandCompletion();
                     }
                     if (!(await leader.continue(messages, canContinue)))
                         return "unknown";
+                    if (!acceptInput(intent))
+                        return "unknown";
                 }
                 else
                     return await releaseFollower(intent);
@@ -1594,23 +1637,34 @@ export function createTelegramInboundRouteRuntime(deps) {
      * any failure keeps the original where the operator can still read it.
      */
     const moveAllTabSourceIntoTab = async (pending, target, isCurrent) => {
-        const [messageId] = pending.allTabCopies ?? [];
-        if (messageId === undefined || !deps.callApi || !isCurrent())
+        const messageIds = [...(pending.allTabCopies ?? [])].sort((a, b) => a - b);
+        if (messageIds.length === 0 || !deps.callApi || !isCurrent())
             return;
+        const route = {
+            chat_id: target.chatId,
+            message_thread_id: target.threadId,
+            from_chat_id: pending.sourceTarget.chatId,
+            disable_notification: true,
+        };
         try {
-            const copy = await deps.callApi("forwardMessage", {
-                chat_id: target.chatId,
-                message_thread_id: target.threadId,
-                from_chat_id: pending.sourceTarget.chatId,
-                message_id: messageId,
-                disable_notification: true,
-            });
-            const copyId = copy?.message_id;
-            if (typeof copyId !== "number" || !Number.isSafeInteger(copyId))
+            // An album moves as one album; forwardMessages skips what it cannot forward, so a short reply is not a move.
+            const copies = messageIds.length === 1
+                ? [
+                    await deps.callApi("forwardMessage", {
+                        ...route,
+                        message_id: messageIds[0],
+                    }),
+                ]
+                : await deps.callApi("forwardMessages", { ...route, message_ids: messageIds });
+            const copyIds = Array.isArray(copies)
+                ? copies.map((copy) => copy?.message_id)
+                : [];
+            if (copyIds.length !== messageIds.length ||
+                !copyIds.every((id) => typeof id === "number" && Number.isSafeInteger(id)))
                 return;
             pending.allTabCopiesForwarded = true;
             await deleteAllTabCopies(pending);
-            return copyId;
+            return copyIds[0];
         }
         catch (error) {
             deps.recordRuntimeEvent?.("routing", error, {
@@ -3019,8 +3073,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                 const intent = store
                     .listLiveRebindings()
                     .find((value) => value.request.operationId === request.operationId);
-                if (intent?.phase === "released" &&
-                    !intent.cleanup &&
+                if (intent && Threads.isTelegramLiveRebindInputAuthorized(intent) &&
                     isDeepStrictEqual(intent.request, request) &&
                     intent.operatorUserId === operatorUserId &&
                     isDeepStrictEqual(intent.executor, {
@@ -3289,6 +3342,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             name ||
             confirmation ||
             extension;
+        const preDispatchCleanup = deps.runWorkspaceOperation !== undefined && deps.canUsePreDispatchRebind?.(recipient) === true;
         const createCoordinator = () => createTelegramLiveRebindCoordinator({
             request,
             messages: selection.messages,
@@ -3299,21 +3353,56 @@ export function createTelegramInboundRouteRuntime(deps) {
                 ? async (isCurrent) => {
                     if (!isCurrent())
                         return;
+                    const expected = threads.getWorkspaceBindingByTarget(target, binding.sessionId);
+                    if (!expected || expected.bindingKey !== binding.bindingKey || expected.slot !== binding.slot)
+                        throw new Error("Live-rebind title binding is unavailable.");
+                    const callApi = deps.callApi;
                     const slot = binding.slot ?? "";
-                    await deps.callApi("editForumTopic", {
-                        chat_id: target.chatId,
-                        message_thread_id: target.threadId,
-                        name: deps.getDisplayTitle?.(target) ??
-                            ThreadNaming.getTelegramTopicTitleForThreadName(getRestoredThreadName(request.owner, slot), slot),
-                    });
+                    const resolveTitle = () => deps.getDisplayTitle?.(expected.target) ??
+                        ThreadNaming.getTelegramTopicTitleForThreadName(getRestoredThreadName(request.owner, slot), slot);
+                    const title = resolveTitle();
+                    const bindingCurrent = (frame) => isCurrent() && deps.callApi === callApi &&
+                        isDeepStrictEqual(threads.getWorkspaceBindingByTarget(frame.target, frame.sessionId), frame);
+                    const assertTitle = () => {
+                        if (!bindingCurrent(expected) || resolveTitle() !== title)
+                            throw new Error("Live-rebind title authority changed.");
+                    };
+                    assertTitle();
+                    const renamed = await callApi.call(deps, "editForumTopic", {
+                        chat_id: expected.target.chatId,
+                        message_thread_id: expected.target.threadId,
+                        name: title,
+                    }, { maxAttempts: 1, assertAuthority: assertTitle });
+                    assertTitle();
+                    if (renamed !== true || !threads.setWorkspaceDisplayTitle(expected, title))
+                        throw new Error("Live-rebind title acknowledgement is unconfirmed.");
+                    const acknowledged = { ...expected, displayTitle: title };
+                    await threads.persist(() => bindingCurrent(acknowledged));
+                    if (!bindingCurrent(acknowledged))
+                        throw new Error("Live-rebind title publication authority changed.");
                 }
                 : undefined,
             authority: {
                 executor: { instanceId, leaderEpoch: String(epoch) },
                 operatorUserId,
-                isCurrent: current,
+                isCurrent: () => current() && (!preDispatchCleanup || deps.canUsePreDispatchRebind?.(recipient) === true),
             },
             getRecipient,
+            ...(preDispatchCleanup ? {
+                async cleanupBeforeRelease(intent, isCurrent) {
+                    const delay = deps.liveRebindCleanupSchedule?.delaysMs[0] ?? 1_000;
+                    await new Promise(resolve => { const timer = setTimeout(resolve, delay); timer.unref?.(); });
+                    if (!isCurrent())
+                        return false;
+                    const result = await inspectLiveRebindRecipient(intent, ctx, isLeader ? "issue" : "follower-issue", isCurrent);
+                    if (!isCurrent())
+                        return false;
+                    // A session-replacing producer cannot retain an old-session cleanup grant across its gateway.
+                    if (result?.status === "not-ready" && selection.confirmationCommand?.name === "new")
+                        return !!store.advanceLiveRebind(intent, "protect-old-target", { executor: intent.executor, operatorUserId, isCurrent });
+                    return result?.status === "not-ready" || result?.status === "finished" && result.recorded;
+                },
+            } : {}),
             follower: isLeader
                 ? undefined
                 : {
@@ -3344,9 +3433,9 @@ export function createTelegramInboundRouteRuntime(deps) {
                                     instanceId,
                                     leaderEpoch: String(epoch),
                                 }) &&
-                                !intent.cleanup &&
-                                (intent.phase === "rebound" ||
-                                    intent.phase === "released") &&
+                                (!intent.cleanup || intent.inputRelease !== undefined && intent.cleanup !== "issued") &&
+                                (intent.phase === "rebound" || intent.phase === "released" ||
+                                    intent.phase === "finished" && intent.inputRelease !== undefined) &&
                                 isDeepStrictEqual(intent.recipient, {
                                     kind: recipient.kind,
                                     instanceId: recipient.instanceId,
@@ -3520,7 +3609,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             },
         };
     };
-    async function inspectLiveRebindRecipient(intent, ctx, mode) {
+    async function inspectLiveRebindRecipient(intent, ctx, mode, admittedOrigin) {
         const ports = deps.workspaceRestoreRecipient, threads = deps.threadStore, store = deps.getWorkspaceRestoreStore?.();
         const followerMode = mode === "follower-cleanup" || mode === "follower-issue", cleanupMode = mode !== "work";
         const issueMode = mode === "issue" || mode === "follower-issue", callApi = deps.callApi;
@@ -3532,8 +3621,9 @@ export function createTelegramInboundRouteRuntime(deps) {
             (followerMode ? !peer || !peerRun || !peerJournal : !collector) ||
             !run ||
             (issueMode && !callApi) ||
-            deps.isContextActive?.(ctx) !== true)
+            deps.isContextActive?.(ctx) !== true) {
             return undefined;
+        }
         try {
             const expected = structuredClone(intent), { request, recipient, executor } = expected;
             const instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.(), generation = deps.getSessionGeneration?.();
@@ -3623,7 +3713,8 @@ export function createTelegramInboundRouteRuntime(deps) {
                     peerJournal.call(peer, live) === recipientJournalKey &&
                     isDeepStrictEqual(findReference(), reference));
             };
-            const current = () => deps.hasWorkspaceLiveRebindAuthority?.() === true &&
+            const current = () => (!admittedOrigin || admittedOrigin()) &&
+                deps.hasWorkspaceLiveRebindAuthority?.() === true &&
                 deps.isContextActive?.(ctx) === true &&
                 deps.workspaceRestoreRecipient === ports &&
                 (followerMode || ports.observeLeaderWork === collector) &&
@@ -3668,8 +3759,11 @@ export function createTelegramInboundRouteRuntime(deps) {
             };
             const sample = async () => {
                 assertCanonical();
-                if (cleanupMode && protection.call(threads, expected) !== false)
-                    return undefined;
+                if (cleanupMode) {
+                    const protectedTarget = protection.call(threads, expected);
+                    if (protectedTarget !== false)
+                        return undefined;
+                }
                 const target = { ...request.binding.target };
                 let value;
                 if (followerMode) {
@@ -3678,7 +3772,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                         instanceId: recipient.instanceId,
                         sessionId: recipient.sessionId,
                         recipientBindingKey: recipientJournalKey,
-                        mode: "observe",
+                        mode: expected.inputRelease === "held" ? "observe-held" : "observe",
                         sourceUpdateIds: [...request.source.updateIds],
                         slot: request.binding.slot,
                         target: { ...request.target },
@@ -3720,12 +3814,13 @@ export function createTelegramInboundRouteRuntime(deps) {
                     throw new Error("Live-rebind work sample is unavailable or changed target.");
                 assertCanonical();
                 if (cleanupMode) {
+                    const targetProtected = protection.call(threads, expected);
                     const prepared = ThreadReconciler.prepareLiveRebindThreadCleanup({
                         operationId: request.operationId,
                         oldTarget: request.binding.target,
                         recipientTarget: request.target,
                         leaderEpoch: executor.leaderEpoch,
-                        targetProtected: protection.call(threads, expected),
+                        targetProtected,
                         work,
                     });
                     assertCanonical();
@@ -3749,32 +3844,27 @@ export function createTelegramInboundRouteRuntime(deps) {
                 return undefined;
             if (issueMode) {
                 // One admission spans the fresh sample, durable issue marker, single deletion and terminal record.
-                return await run({
-                    operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
-                    operationKind: "workspace.live-rebind-cleanup",
-                    scopes: [{ kind: "profile" }],
-                }, async () => {
+                const execute = async () => {
                     const prepared = await sample();
                     if (!prepared ||
                         prepared.status !== "prepared" ||
                         !current() ||
-                        protection.call(threads, expected) !== false)
+                        protection.call(threads, expected) !== false) {
                         return { status: "not-ready" };
+                    }
                     const authority = {
                         executor: structuredClone(executor),
                         operatorUserId: expected.operatorUserId,
                         isCurrent: current,
                     };
                     const grant = store.advanceLiveRebind(expected, "issue-cleanup", authority);
-                    if (!grant)
+                    if (!grant) {
                         return undefined;
+                    }
                     const assertGranted = () => assertCanonical(grant);
                     const cleanup = await ThreadReconciler.issueLiveRebindThreadCleanup(prepared, {
                         assertCurrent: assertGranted,
-                        deleteTopic: (target) => callApi("deleteForumTopic", {
-                            chat_id: target.chatId,
-                            message_thread_id: target.threadId,
-                        }, { maxAttempts: 1, assertAuthority: assertGranted }),
+                        deleteTopic: (target) => callApi("deleteForumTopic", { chat_id: target.chatId, message_thread_id: target.threadId }, { maxAttempts: 1, assertAuthority: assertGranted }),
                         classifyFailure: classifyLiveRebindCleanupFailure,
                     });
                     let recorded = false;
@@ -3792,7 +3882,12 @@ export function createTelegramInboundRouteRuntime(deps) {
                         cleanup,
                         recorded,
                     };
-                });
+                };
+                // Pre-dispatch calls are private to the chooser callback already holding the same profile admission/gate.
+                return admittedOrigin ? await execute() : await run({
+                    operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
+                    operationKind: "workspace.live-rebind-cleanup", scopes: [{ kind: "profile" }],
+                }, execute);
             }
             const observation = await run({
                 operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
@@ -3826,8 +3921,26 @@ export function createTelegramInboundRouteRuntime(deps) {
     const issueLiveRebindFollowerCleanup = (intent, ctx) => inspectLiveRebindRecipient(intent, ctx, "follower-issue");
     // One pacing chain per operation: a waiting timer or a running attempt; repeated choices never start another.
     const liveRebindCleanupChains = new Map();
-    // A leader retry waiting out its delay; a settled session wakes it at once, since its own busy run is the usual wait.
+    // One hint slot per existing leader chain; a running attempt retains at most one coalesced recheck.
     const liveRebindCleanupWakers = new Map();
+    const captureLiveRebindCleanupScope = (ctx) => {
+        try {
+            const generation = deps.getSessionGeneration?.(), instanceId = deps.getCurrentInstanceId?.(), epoch = deps.getCurrentLeaderEpoch?.(), store = deps.getWorkspaceRestoreStore?.(), operator = deps.configStore.getAllowedUserId();
+            return () => {
+                try {
+                    return deps.isContextActive?.(ctx) === true && deps.getSessionGeneration?.() === generation &&
+                        deps.getCurrentInstanceId?.() === instanceId && deps.getCurrentLeaderEpoch?.() === epoch &&
+                        deps.getWorkspaceRestoreStore?.() === store && deps.configStore.getAllowedUserId() === operator;
+                }
+                catch {
+                    return false;
+                }
+            };
+        }
+        catch {
+            return () => false;
+        }
+    };
     /** End an unissued attempt honestly under fresh admission and current operator authority; no executor grant is borrowed. */
     const terminalizeUnissuedLiveRebindCleanup = async (operationId, ctx) => {
         const run = deps.runWorkspaceOperation, store = deps.getWorkspaceRestoreStore?.();
@@ -3868,24 +3981,53 @@ export function createTelegramInboundRouteRuntime(deps) {
      * a finished outcome or an inactive session stops, and the window ends in `not-issued` so no released row becomes a
      * permanent rebinding blocker. Waiting timers never join settlement; only a running attempt does.
      */
-    const scheduleLiveRebindCleanup = (operationId, role, ctx, startedAtMs = Date.now(), attempt = 0) => {
+    const scheduleLiveRebindCleanup = (operationId, role, ctx, startedAtMs = Date.now(), attempt = 0, current = captureLiveRebindCleanupScope(ctx)) => {
         const pacing = deps.liveRebindCleanupSchedule;
         const chain = liveRebindCleanupChains.get(operationId);
         if (!pacing ||
             (attempt === 0 ? chain !== undefined : chain !== "running") ||
-            deps.isContextActive?.(ctx) !== true) {
-            if (attempt > 0 && chain === "running")
+            !current()) {
+            if (attempt > 0 && chain === "running") {
                 liveRebindCleanupChains.delete(operationId);
+                liveRebindCleanupWakers.delete(operationId);
+            }
             return;
         }
+        let pendingWake;
+        const wake = (reason) => {
+            if (!current())
+                return;
+            if (liveRebindCleanupChains.get(operationId) === "running") {
+                pendingWake = reason;
+                return;
+            }
+            if (liveRebindCleanupChains.get(operationId) !== timer)
+                return;
+            if (reason === "delivery-drained") {
+                let idle;
+                try {
+                    idle = deps.isIdle?.(ctx);
+                }
+                catch { /* A missing idle observation is not a reason to hurry cleanup. */ }
+                if (idle !== true) {
+                    // A streamed technical task can drain between deltas while Pi still runs. Keep one hint, not a polling loop.
+                    pendingWake = reason;
+                    return;
+                }
+            }
+            clearTimeout(timer);
+            attemptNow();
+        };
         const attemptNow = () => {
-            liveRebindCleanupWakers.delete(operationId);
             if (liveRebindCleanupChains.get(operationId) !== timer)
                 return;
+            pendingWake = undefined; // This fresh timer/settlement attempt consumes any previously deferred hint.
             liveRebindCleanupChains.set(operationId, "running");
+            if (role === "leader")
+                liveRebindCleanupWakers.set(operationId, wake);
             let continued = false;
             const task = (async () => {
-                if (deps.isContextActive?.(ctx) !== true)
+                if (!current())
                     return;
                 const intent = deps
                     .getWorkspaceRestoreStore?.()
@@ -3897,20 +4039,25 @@ export function createTelegramInboundRouteRuntime(deps) {
                     ? await issueLiveRebindLeaderCleanup(intent, ctx)
                     : await issueLiveRebindFollowerCleanup(intent, ctx);
                 if (result?.status === "finished" ||
-                    deps.isContextActive?.(ctx) !== true)
+                    !current())
                     return;
-                if (Date.now() - startedAtMs >= pacing.windowMs)
+                if (Date.now() - startedAtMs >= pacing.windowMs) {
                     return terminalizeUnissuedLiveRebindCleanup(operationId, ctx);
+                }
                 continued = true;
-                scheduleLiveRebindCleanup(operationId, role, ctx, startedAtMs, attempt + 1);
+                scheduleLiveRebindCleanup(operationId, role, ctx, startedAtMs, attempt + 1, current);
+                if (pendingWake)
+                    liveRebindCleanupWakers.get(operationId)?.(pendingWake);
             })()
                 .catch((error) => deps.recordRuntimeEvent?.("routing", error, {
                 phase: "live-rebind-cleanup-schedule",
             }))
                 .finally(() => {
                 if (!continued &&
-                    liveRebindCleanupChains.get(operationId) === "running")
+                    liveRebindCleanupChains.get(operationId) === "running") {
                     liveRebindCleanupChains.delete(operationId);
+                    liveRebindCleanupWakers.delete(operationId);
+                }
             });
             restoreSettlementTasks.add(task);
             void task.finally(() => restoreSettlementTasks.delete(task));
@@ -3920,20 +4067,16 @@ export function createTelegramInboundRouteRuntime(deps) {
         liveRebindCleanupChains.set(operationId, timer);
         // The first delay stays whole: a detached command reply still needs the released, cleanup-free row.
         if (role === "leader" && attempt > 0)
-            liveRebindCleanupWakers.set(operationId, () => {
-                if (liveRebindCleanupChains.get(operationId) !== timer)
-                    return;
-                clearTimeout(timer);
-                attemptNow();
-            });
+            liveRebindCleanupWakers.set(operationId, wake);
     };
-    /** The agent settled: every gate is re-sampled now, so an old tab goes right after the answer, not at the next tick. */
-    const onSessionSettled = (ctx) => {
+    const wakeLiveRebindCleanup = (ctx, reason) => {
         if (deps.isContextActive?.(ctx) !== true)
             return;
         for (const wake of [...liveRebindCleanupWakers.values()])
-            wake();
+            wake(reason);
     };
+    const onSessionSettled = (ctx) => wakeLiveRebindCleanup(ctx, "session-settled");
+    const onDeliverySettled = (ctx) => wakeLiveRebindCleanup(ctx, "delivery-drained");
     const restoreWorkspace = deps.workspaceRestoreRecipient
         ? async (input) => {
             const ports = deps.workspaceRestoreRecipient;
@@ -5837,19 +5980,21 @@ export function createTelegramInboundRouteRuntime(deps) {
                 pending.liveRebind ??= selection;
                 if (!(await selectPendingDestination()))
                     return true;
+                const operationId = selection.coordinator.operationId;
                 if (current())
                     outcome = await selection.coordinator.advance();
                 // Cleanup readiness follows the canonical released row, not source disposal: a detached command ACK may
                 // still be pending while every attempt samples current work afresh.
-                const operationId = selection.coordinator.operationId;
                 const row = outcome === "protected"
                     ? undefined
                     : deps
                         .getWorkspaceRestoreStore?.()
                         ?.listLiveRebindings()
                         .find((value) => value.request.operationId === operationId);
-                if (row?.phase === "released" && row.cleanup === undefined)
+                if (row?.phase === "released" && row.cleanup === undefined &&
+                    (row.inputRelease === undefined || row.inputRelease === "accepted")) {
                     scheduleLiveRebindCleanup(operationId, selection.record.owner?.kind === "leader" ? "leader" : "follower", ctx);
+                }
                 if (outcome === "released")
                     await releaseAllTabCopiesIntoSurvivingTab(pending);
             }
@@ -5866,28 +6011,40 @@ export function createTelegramInboundRouteRuntime(deps) {
                 await deps.answerCallbackQuery(query.id, "Live rebind is unconfirmed; this choice never replays issued input");
                 return true;
             }
+            const cleanupRow = deps.getWorkspaceRestoreStore?.()?.listLiveRebindings().find(value => value.request.operationId === selection.coordinator?.operationId);
+            const cleanupResult = cleanupRow?.inputRelease && cleanupRow.cleanup !== undefined
+                ? cleanupRow.cleanup === "confirmed" ? "old-Thread removal confirmed"
+                    : cleanupRow.cleanup === "unknown" || cleanupRow.cleanup === "issued" ? "old-Thread removal unconfirmed; deletion will not repeat"
+                        : cleanupRow.cleanup === "failed" ? "old-Thread removal failed" : "old-Thread removal was not issued"
+                : undefined;
+            const commandDisposed = !!(selection.extensionCommand && selection.extensionKind !== "generated-prompt" || selection.nameCommand ||
+                selection.confirmationCommand || selection.helpCommand || selection.stopCommand || selection.nextCommand ||
+                selection.menuCommand || selection.abortCommand || selection.coordinator?.selectedCommandReference());
             // The tab now belongs to the rebound thread; only the one-shot chooser message goes.
-            await finalizePendingReroute(parsed.rerouteId, pending, query, selection.extensionKind === "generated-prompt"
-                ? "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed"
-                : selection.extensionCommand
-                    ? "Command source disposal confirmed; reply delivery and old-Thread cleanup are not confirmed"
-                    : selection.nameCommand
-                        ? selection.nameCommand.args.trim()
-                            ? "Command source disposal confirmed; title/reply delivery and old-Thread cleanup are not confirmed"
-                            : "Command source disposal confirmed; name-dialog publication was handled, not title change or old-Thread cleanup"
-                        : selection.confirmationCommand
-                            ? `Command source disposal confirmed; confirmation delivery and actual ${selection.confirmationCommand.name === "new" ? "session replacement" : "compaction"} or old-Thread cleanup are not confirmed`
-                            : selection.helpCommand
-                                ? "Command source disposal confirmed; menu/sync delivery and old-Thread cleanup are not confirmed"
-                                : selection.stopCommand
-                                    ? "Command source disposal confirmed; abort settlement, reply delivery and old-Thread cleanup are not confirmed"
-                                    : selection.nextCommand
-                                        ? "Command source disposal confirmed; queue dispatch, transition notices and old-Thread cleanup are not confirmed"
-                                        : selection.menuCommand || selection.abortCommand
-                                            ? `Command source disposal confirmed; ${selection.menuCommand ? "menu" : "reply"} delivery and old-Thread cleanup are not confirmed`
-                                            : selection.coordinator?.selectedCommandReference()
-                                                ? "Command source disposal confirmed; recipient command effects and old-Thread cleanup are not confirmed"
-                                                : "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed", assertExecutionCurrent, true);
+            await finalizePendingReroute(parsed.rerouteId, pending, query, cleanupResult
+                ? commandDisposed ? `Command source disposal confirmed; ${cleanupResult}; delivery and follow-on effects remain independent`
+                    : `Input queued in the rebound Thread; ${cleanupResult}`
+                : selection.extensionKind === "generated-prompt"
+                    ? "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed"
+                    : selection.extensionCommand
+                        ? "Command source disposal confirmed; reply delivery and old-Thread cleanup are not confirmed"
+                        : selection.nameCommand
+                            ? selection.nameCommand.args.trim()
+                                ? "Command source disposal confirmed; title/reply delivery and old-Thread cleanup are not confirmed"
+                                : "Command source disposal confirmed; name-dialog publication was handled, not title change or old-Thread cleanup"
+                            : selection.confirmationCommand
+                                ? `Command source disposal confirmed; confirmation delivery and actual ${selection.confirmationCommand.name === "new" ? "session replacement" : "compaction"} or old-Thread cleanup are not confirmed`
+                                : selection.helpCommand
+                                    ? "Command source disposal confirmed; menu/sync delivery and old-Thread cleanup are not confirmed"
+                                    : selection.stopCommand
+                                        ? "Command source disposal confirmed; abort settlement, reply delivery and old-Thread cleanup are not confirmed"
+                                        : selection.nextCommand
+                                            ? "Command source disposal confirmed; queue dispatch, transition notices and old-Thread cleanup are not confirmed"
+                                            : selection.menuCommand || selection.abortCommand
+                                                ? `Command source disposal confirmed; ${selection.menuCommand ? "menu" : "reply"} delivery and old-Thread cleanup are not confirmed`
+                                                : selection.coordinator?.selectedCommandReference()
+                                                    ? "Command source disposal confirmed; recipient command effects and old-Thread cleanup are not confirmed"
+                                                    : "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed", assertExecutionCurrent, true);
             return true;
         }
         if (!(await selectPendingDestination()))
@@ -7023,23 +7180,34 @@ export function createTelegramInboundRouteRuntime(deps) {
      * An All input gets one source-bound tab. The original stays deferred in All until explicit routing,
      * and an existing entry is reused on replay, so restart never creates a second tab or retries an unknown one.
      */
-    const sendAllTabTemporaryInputChooser = async (command, commandText, message, ctx) => {
-        const [updateId] = Updates.collectTelegramAdmissionSourceUpdateIds([
-            message,
-        ]);
+    /**
+     * Opens (or adopts) the routing tab for input sent from All. One text message may carry a command; anything else,
+     * a voice note, a file or a coalesced album, is held untouched as one prompt.
+     */
+    const sendAllTabTemporaryInputChooser = async (command, commandText, messages, ctx) => {
+        const message = messages[0];
+        if (!message)
+            return false;
+        const updateIds = Updates.collectTelegramAdmissionSourceUpdateIds([
+            ...messages,
+        ]).sort((a, b) => a - b);
+        const updateId = updateIds[0];
+        const group = { journalBindingKey: "", updateIds };
         const execution = Updates.getTelegramUpdateExecutionFence(message);
         const cap = captureTemporaryThreadAuthority(ctx, () => execution?.isCurrent() === true);
         if (!cap ||
             !deps.runWorkspaceOperation ||
             !deps.callApi ||
             updateId === undefined ||
-            message.chat.type !== "private" ||
-            message.chat.id !== cap.operatorUserId ||
-            message.from?.id !== cap.operatorUserId ||
+            updateIds.length !== messages.length ||
+            messages.some((held) => held.chat.type !== "private" ||
+                held.chat.id !== cap.operatorUserId ||
+                held.from?.id !== cap.operatorUserId) ||
             !cap.isCurrent())
             return false;
         const { store, operatorUserId, journalBindingKey, epoch, authority } = cap, current = cap.isCurrent;
         const source = { journalBindingKey, updateId };
+        group.journalBindingKey = journalBindingKey;
         const find = () => store
             .listTemporaryThreads()
             .find((entry) => entry.source.journalBindingKey === journalBindingKey &&
@@ -7065,7 +7233,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             // the input itself to All: adopt that tab rather than leaving it behind next to a second one.
             const native = findImplicitCreationForAllInput(message, updateId, cap, ctx);
             if (native) {
-                const adopted = store.registerImplicitTemporaryThread({ journalBindingKey, updateIds: [updateId] }, native.implicit.target, randomBytes(16).toString("hex"), {
+                const adopted = store.registerImplicitTemporaryThread(group, native.implicit.target, randomBytes(16).toString("hex"), {
                     ...authority,
                     isCurrent: () => current() &&
                         implicitThreadCreations.get(native.key) === native.implicit,
@@ -7090,7 +7258,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                     return;
                 }
             }
-            const reservation = store.reserveTemporaryThread(source, randomBytes(16).toString("hex"), authority);
+            const reservation = store.reserveTemporaryThread(source, randomBytes(16).toString("hex"), authority, group);
             entry = reservation?.entry;
             if (!reservation?.reserved || !current())
                 return;
@@ -7120,26 +7288,33 @@ export function createTelegramInboundRouteRuntime(deps) {
         });
         if (!current() || !entry)
             throw new Error("Temporary Thread authority changed; the input remains retryable.");
-        const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
-            ...message,
-            text: commandText,
-            caption: undefined,
-        });
+        // Only a lone text message is rewritten for command detection; media keeps its caption and payload.
+        const held = messages.length === 1 && typeof message.text === "string"
+            ? [
+                Updates.carryTelegramUpdateExecutionFence(message, {
+                    ...message,
+                    text: commandText,
+                    caption: undefined,
+                }),
+            ]
+            : [...messages];
         if (entry.phase !== "created" || !entry.target) {
-            Updates.reportTelegramUpdateDeferred(commandMessage);
-            await deps.sendTextReply(message.chat.id, message.message_id, "<b>⚠️ The routing tab for this command could not be confirmed.</b> It stays held and was not sent to Pi.", { parseMode: "HTML" });
+            for (const input of held)
+                Updates.reportTelegramUpdateDeferred(input);
+            deps.recordRuntimeEvent?.("routing", new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR), { phase: "temporary-thread-unconfirmed" });
             return true;
         }
         const target = entry.target;
         const records = getTelegramRoutableThreadRecords(deps.threadStore?.list() ?? [], deps.getLiveThreadTargets?.());
-        const rerouteId = storePendingUnboundReroute([commandMessage], command ? "command" : "prompt", target);
+        const rerouteId = storePendingUnboundReroute(held, command ? "command" : "prompt", target);
         const pending = pendingUnboundReroutes.get(rerouteId);
         pending.temporaryThread = entry;
-        pending.allTabCopies = getTelegramAllTabSourceMessageIds([message], target.chatId);
-        Updates.reportTelegramUpdateDeferred(commandMessage);
+        pending.allTabCopies = getTelegramAllTabSourceMessageIds(messages, target.chatId);
+        for (const input of held)
+            Updates.reportTelegramUpdateDeferred(input);
         // Cancel is offered only when the exact source can still be abandoned; the tab removal needs that retention first.
         if (deps.editInteractiveMessage &&
-            Updates.supportsTelegramDeferredAbandonment(commandMessage, journalBindingKey)) {
+            held.every((input) => Updates.supportsTelegramDeferredAbandonment(input, journalBindingKey))) {
             pending.abandonment = {
                 ownerUserId: operatorUserId,
                 journalBindingKey,
@@ -7168,72 +7343,11 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         return true;
     };
-    const sendAllTabCommandChooser = async (command, commandText, message, options = {}) => {
-        if (!deps.threadStore)
-            return false;
-        const records = deps.threadStore.list();
-        const activeRecords = getTelegramRoutableThreadRecords(records, deps.getLiveThreadTargets?.());
-        if (activeRecords.length === 0)
-            return false;
-        const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
-            ...message,
-            text: commandText,
-            caption: undefined,
-        });
-        const rerouteId = storePendingUnboundReroute([commandMessage], "command");
-        Updates.reportTelegramUpdateDeferred(commandMessage);
-        const text = formatTelegramAllTabMenuChooserText(command.name);
-        pendingUnboundReroutes.get(rerouteId).rootChooserText = text;
-        const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(rerouteId, activeRecords, {
-            canRestore: typeof message.message_thread_id === "number",
-            getDisplayTitle: deps.getDisplayTitle,
-        });
-        let chooserId;
-        try {
-            if (deps.sendInteractiveMessage) {
-                chooserId = await deps.sendInteractiveMessage(message.chat.id, text, "html", replyMarkup, options.target || options.replyToSource
-                    ? {
-                        ...(options.target ? { target: options.target } : {}),
-                        ...(options.replyToSource
-                            ? { replyToMessageId: message.message_id }
-                            : {}),
-                    }
-                    : undefined);
-            }
-            else if (deps.callApi) {
-                const chooser = await deps.callApi("sendMessage", {
-                    chat_id: message.chat.id,
-                    text,
-                    parse_mode: "HTML",
-                    reply_markup: replyMarkup,
-                    ...(typeof options.target?.threadId === "number"
-                        ? { message_thread_id: options.target.threadId }
-                        : {}),
-                    ...(options.replyToSource
-                        ? {
-                            reply_parameters: {
-                                message_id: message.message_id,
-                                allow_sending_without_reply: true,
-                            },
-                        }
-                        : {}),
-                });
-                chooserId = chooser?.message_id;
-            }
-            else {
-                chooserId = await deps.sendTextReply(message.chat.id, message.message_id, text, {
-                    parseMode: "HTML",
-                    target: options.target,
-                });
-            }
-        }
-        catch (error) {
-            removePendingReroute(rerouteId);
-            throw error;
-        }
-        rememberRerouteChooser(rerouteId, chooserId);
-        Updates.reportTelegramUpdateCompleted(commandMessage);
-        return true;
+    /** A coalesced album from All requires one routing tab; failure cannot answer in All or discard its source. */
+    const routeAllTabAlbum = async (messages, ctx) => {
+        if (await sendAllTabTemporaryInputChooser(undefined, "", messages, ctx))
+            return;
+        throw new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR);
     };
     const dispatchCommandOrPrompt = Commands.createTelegramCommandOrPromptDispatcher({
         extractRawText: Media.extractFirstTelegramMessageText,
@@ -7680,28 +7794,39 @@ export function createTelegramInboundRouteRuntime(deps) {
                         .some((entry) => entry.source.updateId === sourceUpdateId &&
                         entry.source.journalBindingKey ===
                             deps.getAdmissionJournalBinding?.()) === true;
+                const needsThread = deps.threadStore.getBotState().threadMode === "enabled" || bindings.length > 0 || presented;
                 // Returning before deferral lets the admission worker terminally settle expired replay; a presented tab is not expiry.
                 if (command &&
                     command.name !== "thread" &&
                     !presented &&
                     isTelegramAllTabCommandExpired(message))
                     return;
-                if (command?.name !== "thread" &&
-                    (bindings.length > 0 || presented) &&
+                if (needsThread &&
                     typeof message.text === "string" &&
                     message.text.trim() &&
-                    (await sendAllTabTemporaryInputChooser(command, text, message, ctx)))
+                    (await sendAllTabTemporaryInputChooser(command, text, [message], ctx)))
                     return;
-                if (bindings.length > 0 && command && command.name !== "thread") {
-                    if (await sendAllTabCommandChooser(command, text, message, {
-                        replyToSource: true,
-                    })) {
+                // Voice notes, files, stickers and albums from All get the same routing tab as text, whether or not the
+                // client opened a tab for them; an album first gathers into one input so it opens one tab.
+                if (!command &&
+                    needsThread &&
+                    typeof message.text !== "string" &&
+                    Media.hasTelegramMessagesPromptContent([message])) {
+                    if (message.media_group_id) {
+                        deps.mediaGroupRuntime.queueMessage({
+                            message: message,
+                            context: ctx,
+                            dispatchMessages: (messages, queuedCtx) => routeAllTabAlbum(messages, queuedCtx ?? ctx),
+                        });
+                        Updates.reportTelegramUpdateDeferred(message);
                         return;
                     }
+                    if (await sendAllTabTemporaryInputChooser(undefined, text, [message], ctx))
+                        return;
                 }
-                if (bindings.length > 0 && !text.startsWith("/")) {
+                if (needsThread) {
                     const probeTarget = bindings[0]?.target;
-                    if (probeTarget?.threadId && deps.callApi) {
+                    if (!command && !text.startsWith("/") && probeTarget?.threadId && deps.callApi) {
                         try {
                             await deps.callApi("sendChatAction", {
                                 chat_id: probeTarget.chatId,
@@ -7710,8 +7835,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                             });
                         }
                         catch (error) {
-                            if (Threads.isTelegramTopicModeUnavailableError(error) ||
-                                Threads.isTelegramTopicTargetStaleError(error)) {
+                            if (Threads.isTelegramTopicModeUnavailableError(error)) {
                                 deps.threadStore.setBotState({
                                     threadMode: "disabled",
                                     updatedAtMs: Date.now(),
@@ -7729,8 +7853,7 @@ export function createTelegramInboundRouteRuntime(deps) {
                             });
                         }
                     }
-                    await deps.sendTextReply(message.chat.id, message.message_id, "This bot is in threaded multi-instance mode. Send prompts in a bound Pi thread tab so they route to the right instance.");
-                    return;
+                    throw new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR);
                 }
             }
             await textDispatch.handleMessage(message, ctx);
@@ -8032,6 +8155,7 @@ export function createTelegramInboundRouteRuntime(deps) {
         prepareHeldCommand: commandHandler.prepareHeldCommand,
         canPrepareHeldCommand: commandHandler.canPrepareHeldCommand,
         onSessionSettled,
+        onDeliverySettled,
         observeLiveRebindLeaderWork,
         prepareLiveRebindLeaderCleanup,
         prepareLiveRebindFollowerCleanup,