@llblab/pi-telegram 0.54.4 → 0.55.1

package/lib/routing.ts

@@ -335,6 +335,10 @@ function getTelegramAllTabSourceMessageIds(
   );
 }
 
+/** Failure retains the source for recovery; Threaded Mode never emits a fallback answer into All. */
+const TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR =
+  "All is input-only in Threaded Mode; a routing Thread could not be prepared.";
+
 /** What a route chooser moves: `<code>/name</code>` for a command, otherwise "this message". */
 function formatTelegramRouteSubject(command?: string): string {
   return command ? `<code>/${escapeHtml(command)}</code>` : "this message";
@@ -387,14 +391,6 @@ function formatTelegramRoutingInputPreview(message: object): string {
   );
 }
 
-function formatTelegramAllTabMenuChooserText(command: string): string {
-  return [
-    `<b>🚦 Route ${formatTelegramRouteSubject(command)}:</b>`,
-    "",
-    "<i>To restore a Pi instead, send a message in a new tab.</i>",
-  ].join("\n");
-}
-
 function buildTelegramUnboundRerouteChooserMarkup(
   rerouteId: string,
   records: readonly Threads.TelegramTopicTargetRecord[],
@@ -603,7 +599,7 @@ type TelegramLiveRebindSelectedCommandReference = {
   selectedCommand: Bus.TelegramBusSelectedCommandInput;
 };
 
-/** One warm live attempt with exact post-release peer donor settlement; no startup recovery, Restore ACK or cleanup. */
+/** One warm live attempt with independent leader input/cleanup grants and exact peer donor settlement; no startup recovery or legacy Restore ACK. */
 export function createTelegramLiveRebindCoordinator(input: {
   request: Threads.TelegramWorkspaceRestoreRequest;
   /** Captures caller source/reference, admission, profile, transport and Pi lifetime. */
@@ -647,6 +643,8 @@ export function createTelegramLiveRebindCoordinator(input: {
     /** Explicit staged singleton command branch; absence preserves ordinary live input behavior. */
     selectedCommand?: Bus.TelegramBusSelectedCommandInput;
   };
+  /** Existing profile admission spans the applied recipient, fresh cleanup decision and one native input grant. */
+  cleanupBeforeRelease?(intent: Threads.TelegramWorkspaceLiveRebindIntent, isCurrent: () => boolean): Promise<boolean>;
   /** Restore moves the tab to its new owner: once applied, show that owner's title (best-effort, never blocking). */
   retitle?: (isCurrent: () => boolean) => Promise<void>;
   recordRuntimeEvent?: (
@@ -662,6 +660,7 @@ export function createTelegramLiveRebindCoordinator(input: {
   const leader = input.leader && { ...input.leader },
     follower = input.follower,
     followerRun = follower?.run;
+  const beforeCleanup = input.cleanupBeforeRelease;
   const selectedCommand =
       follower?.selectedCommand && structuredClone(follower.selectedCommand),
     held = selectedCommand;
@@ -783,6 +782,8 @@ export function createTelegramLiveRebindCoordinator(input: {
     peerReleaseIssued = false,
     donorSettlementAttempted = false,
     continuationIssued = false,
+    cleanupBeforeReleaseIssued = false,
+    cleanupBeforeReleaseDecided = false,
     released = false,
     advancing = false;
   let preparedSource: Bus.TelegramBusPreparedCommandSource | undefined;
@@ -836,6 +837,13 @@ export function createTelegramLiveRebindCoordinator(input: {
       generation: recipient!.generation,
       bindingKey: recipient!.bindingKey,
     });
+  const acceptInput = (expected: Threads.TelegramWorkspaceLiveRebindIntent) => {
+    if (!expected.inputRelease || expected.inputRelease === "accepted") return expected;
+    let accepted: Threads.TelegramWorkspaceLiveRebindIntent | undefined;
+    try { accepted = input.restoreStore.advanceLiveRebind(expected, "accept-input", authority); }
+    catch { accepted = retained(); }
+    return accepted?.inputRelease === "accepted" && canonical(accepted) ? accepted : undefined;
+  };
   const releaseFollower = async (
     intent: Threads.TelegramWorkspaceLiveRebindIntent,
   ): Promise<"unknown" | "released"> => {
@@ -864,6 +872,9 @@ export function createTelegramLiveRebindCoordinator(input: {
       )
         return "unknown";
     }
+    const accepted = acceptInput(intent);
+    if (!accepted) return "unknown";
+    intent = accepted;
     donorSettlementAttempted = true;
     if (preparation?.settleTransferred(() => canonical(intent)) !== "settled")
       return "unknown";
@@ -874,8 +885,7 @@ export function createTelegramLiveRebindCoordinator(input: {
     const intent = retained();
     if (
       !intent ||
-      intent.phase !== "released" ||
-      intent.cleanup ||
+      !Threads.isTelegramLiveRebindInputAuthorized(intent) ||
       !canonical(intent) ||
       !leader?.isApplied(intent)
     )
@@ -883,16 +893,14 @@ export function createTelegramLiveRebindCoordinator(input: {
     const completions = messages.map(
       Updates.inspectTelegramDeferredSourceCompletion,
     );
-    return completions.every(
+    const completed = completions.every(
       (completion, index) =>
         completion && isDeepStrictEqual(completion, sources[index]),
     ) &&
       current() &&
       canonical(intent) &&
-      leader.isApplied(intent) &&
-      current()
-      ? "released"
-      : "unknown";
+      leader.isApplied(intent) && current();
+    return completed && acceptInput(intent) ? "released" : "unknown";
   };
   return {
     /** Correlation only; a later cleanup attempt rereads and revalidates the canonical row itself. */
@@ -926,8 +934,7 @@ export function createTelegramLiveRebindCoordinator(input: {
           const intent = retained();
           if (
             !intent ||
-            intent.phase !== "released" ||
-            intent.cleanup ||
+            !Threads.isTelegramLiveRebindInputAuthorized(intent) ||
             !canonical(intent) ||
             !leader?.isApplied(intent) ||
             !leader.observeAdmission?.() ||
@@ -936,6 +943,7 @@ export function createTelegramLiveRebindCoordinator(input: {
             !leader.isApplied(intent)
           )
             return "unknown";
+          if (!acceptInput(intent)) return "unknown";
           released = true;
           return "released";
         }
@@ -1001,23 +1009,24 @@ export function createTelegramLiveRebindCoordinator(input: {
               generation: recipient!.generation,
             },
             authority,
+            beforeCleanup ? { holdInput: true } : undefined,
           );
         } else if (!commitIssued) return "protected";
         if (
           !intent ||
           !sourceSaved() ||
           !canonical(intent) ||
-          intent.phase === "finished" ||
-          intent.cleanup
+          (intent.phase === "finished" && !cleanupBeforeReleaseIssued) ||
+          (intent.cleanup && intent.inputRelease === undefined)
         )
           return "protected";
         // A released peer may already have completed its sources; only its retained settlement can reobserve that outcome.
         if (recipient!.kind === "follower" && peerReleaseIssued)
-          return intent.phase === "released"
+          return Threads.isTelegramLiveRebindInputAuthorized(intent)
             ? await releaseFollower(intent)
             : "protected";
         const mode =
-          applyIssued || intent.phase === "released" ? "inspect" : "apply";
+          applyIssued || intent.phase === "released" || intent.phase === "finished" ? "inspect" : "apply";
         applyIssued = true;
         if (recipient!.kind === "leader") {
           await leader!.apply(structuredClone(intent), mode, current);
@@ -1064,11 +1073,27 @@ export function createTelegramLiveRebindCoordinator(input: {
         }
         if (
           !intent ||
-          intent.phase !== "released" ||
-          intent.cleanup ||
+          (intent.phase !== "released" && !(intent.phase === "finished" && intent.inputRelease === "held")) ||
+          (intent.cleanup && intent.inputRelease === undefined) ||
           !canonical(intent)
         )
           return "protected";
+        if (beforeCleanup) {
+          if (!cleanupBeforeReleaseIssued) {
+            cleanupBeforeReleaseIssued = true;
+            cleanupBeforeReleaseDecided = await beforeCleanup(intent, current);
+          }
+          intent = retained();
+          if (!cleanupBeforeReleaseDecided && intent?.phase !== "finished") return "unknown";
+          if (!intent || !canonical(intent) ||
+            (recipient!.kind === "leader" && !leader!.isApplied(intent)) ||
+            intent.inputRelease !== "held" || intent.cleanup === "issued") return "unknown";
+          let issued: Threads.TelegramWorkspaceLiveRebindIntent | undefined;
+          try { issued = input.restoreStore.advanceLiveRebind(intent, "issue-input", authority); }
+          catch { issued = retained(); }
+          if (!issued || issued.inputRelease !== "issued" || !canonical(issued)) return "unknown";
+          intent = issued;
+        }
         if (recipient!.kind === "leader") {
           const expected = intent;
           if (
@@ -1078,14 +1103,21 @@ export function createTelegramLiveRebindCoordinator(input: {
           )
             return "protected";
           continuationIssued = true;
-          const canContinue = () =>
-            current() && canonical(expected) && leader!.isApplied(expected);
+          const canContinue = () => {
+            const observed = expected.inputRelease ? retained() : expected;
+            return current() && !!observed &&
+              (!expected.inputRelease || (observed.inputRelease === "issued" || observed.inputRelease === "accepted")) &&
+              canonical(observed) && leader!.isApplied(observed);
+          };
           if (leader!.complete) {
             leader!.complete([...messages], canContinue);
+            // The detached native producer has taken this one input grant; its source ACK remains a separate observation.
+            if (!acceptInput(intent)) return "unknown";
             return observeCommandCompletion();
           }
           if (!(await leader!.continue!(messages, canContinue)))
             return "unknown";
+          if (!acceptInput(intent)) return "unknown";
         } else return await releaseFollower(intent);
         if (!current()) return "unknown";
         released = true;
@@ -1519,13 +1551,14 @@ export interface TelegramInboundRouteRuntimeDeps<
   hasWorkspaceRestoreAuthority?: () => boolean;
   /** Exact live root authority; capability advertisement alone cannot replace owned profile/session/recipient fences. */
   hasWorkspaceLiveRebindAuthority?: () => boolean;
+  canUsePreDispatchRebind?: (recipient?: Threads.TelegramWorkspaceRestoreRecipient) => boolean;
   /** Strict complete namespace plus exact current/historical references; only an empty result clears journal protection. */
   inspectTemporaryThreadSources?: (
     target: Queue.TelegramQueueTarget,
     requiredJournalBindingKeys: readonly string[],
     ownInputs?: readonly Threads.TelegramTemporaryThreadInput[],
   ) => readonly number[] | undefined;
-  /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 1000 ms. */
+  /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 0 ms. */
   temporaryThreadCleanupDelayMs?: number;
   /** Live-rebind cleanup attempt pacing; the bounded window ends in `not-issued`, never a time-based deletion. */
   liveRebindCleanupSchedule?: {
@@ -1819,6 +1852,8 @@ export function createTelegramInboundRouteRuntime<
   >["canPrepareHeldCommand"];
   /** Agent-settled hint: wakes waiting leader cleanup retries early; every readiness gate is still sampled fresh. */
   onSessionSettled(ctx: TContext): void;
+  /** Lifetime-fenced hint from drained publication/activity/delivery/API owners; never a cleanup grant. */
+  onDeliverySettled(ctx: TContext): void;
   /** Fresh body-free recipient observation only; never reconstructs an attempt or grants cleanup. */
   observeLiveRebindLeaderWork(
     intent: Threads.TelegramWorkspaceLiveRebindIntent,
@@ -1908,10 +1943,21 @@ export function createTelegramInboundRouteRuntime<
     temporaryThread?: Threads.TelegramTemporaryThreadEntry;
     /** Source copies left in All (a menu-picked command); deleted once, when the input is consumed. */
     allTabCopies?: number[];
-    /** The tab holds a forwarded copy of the threadless original, which then left All at once. */
-    allTabCopiesForwarded?: true;
+    /** This live opening attempt did not remove its All originals; replay/revival cannot reconstruct that fact. */
+    allTabSourceRetained?: true;
+    /** Complete warm copy identity; journal originals stay unchanged even after their All messages leave. */
+    allTabCopiesForwarded?: {
+      target: { chatId: number; threadId: number };
+      sourceMessageIds: readonly number[];
+      messageIds: readonly number[];
+    };
     /** Acknowledged same-tab membership stays protective when its reader disappears; never a dispatch/cleanup grant. */
     temporaryMembership?: true;
+    /** Confirmed display copies only; the durable Forward fact remains the native one-shot authority. */
+    rerouteCopies?: {
+      target: { chatId: number; threadId: number };
+      bySourceUpdateId: ReadonlyMap<number, number>;
+    };
     /** Re-entrancy lock for one command route in flight; orthogonal to `phase`. */
     dispatching?: boolean;
     abandonment?: {
@@ -2380,15 +2426,22 @@ export function createTelegramInboundRouteRuntime<
   const cloneTelegramMessagesForThread = (
     messages: TMessage[],
     threadId: number,
+    copies?: ReadonlyMap<number, number>,
   ): TMessage[] => {
-    return messages.map((message) =>
-      Updates.carryTelegramUpdateExecutionFence(message, {
+    return messages.map((message) => {
+      const ids = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+      const copyId = copies && ids.length === 1 ? copies.get(ids[0]!) : undefined;
+      if (copies && (!Number.isSafeInteger(copyId) || copyId! <= 0))
+        throw new Error("Reroute destination copy identity is unavailable.");
+      const routed = {
         ...message,
-        message_id: 0,
+        message_id: copyId ?? 0,
         message_thread_id: threadId,
         reply_to_message: undefined,
-      } as TMessage),
-    );
+      } as TMessage;
+      return Updates.carryTelegramUpdateExecutionFence(message,
+        copies ? Turns.withTelegramTurnReplyAnchor(routed) : routed);
+    });
   };
   /** Whether a chooser is still pending in this Thread, ignoring the ones the caller itself owns. */
   const hasPendingRerouteForTarget = (
@@ -2784,9 +2837,11 @@ export function createTelegramInboundRouteRuntime<
   const deleteAllTabMessages = async (
     chatId: number,
     messageIds: readonly number[],
+    isCurrent?: () => boolean,
   ): Promise<void> => {
     if (!deps.deleteMessage) return;
     for (const messageId of messageIds) {
+      if (isCurrent?.() === false) return;
       try {
         await deps.deleteMessage(chatId, messageId);
       } catch (error) {
@@ -2799,10 +2854,14 @@ export function createTelegramInboundRouteRuntime<
     }
   };
   /** One-shot per chooser: the copies are taken before deletion, so a later consuming path finds none. */
-  const deleteAllTabCopies = (pending: PendingUnboundReroute): Promise<void> =>
+  const deleteAllTabCopies = (
+    pending: PendingUnboundReroute,
+    isCurrent?: () => boolean,
+  ): Promise<void> =>
     deleteAllTabMessages(
       pending.sourceTarget.chatId,
       pending.allTabCopies?.splice(0) ?? [],
+      isCurrent,
     );
   /**
    * Restore keeps the tab as the Thread, so the input must stay visible there: the All original goes only when the tab
@@ -2811,7 +2870,11 @@ export function createTelegramInboundRouteRuntime<
   const releaseAllTabCopiesIntoSurvivingTab = (
     pending: PendingUnboundReroute,
   ): Promise<void> => {
-    if (pending.allTabCopiesForwarded) return deleteAllTabCopies(pending);
+    if (
+      pending.allTabCopiesForwarded &&
+      isDeepStrictEqual(pending.allTabCopiesForwarded.target, pending.sourceTarget)
+    )
+      return deleteAllTabCopies(pending);
     pending.allTabCopies?.splice(0);
     return Promise.resolve();
   };
@@ -2825,31 +2888,129 @@ export function createTelegramInboundRouteRuntime<
     target: { chatId: number; threadId: number },
     isCurrent: () => boolean,
   ): Promise<number | undefined> => {
-    const [messageId] = pending.allTabCopies ?? [];
-    if (messageId === undefined || !deps.callApi || !isCurrent()) return;
+    const messageIds = [...(pending.allTabCopies ?? [])].sort((a, b) => a - b);
+    if (messageIds.length === 0 || !deps.callApi || !isCurrent()) return;
+    const copyTarget = { ...target };
+    const route = {
+      chat_id: copyTarget.chatId,
+      message_thread_id: copyTarget.threadId,
+      from_chat_id: pending.sourceTarget.chatId,
+      disable_notification: true,
+    };
+    const options = {
+      maxAttempts: 1,
+      retrySafety: "non-idempotent" as const,
+      assertAuthority() {
+        if (!isCurrent())
+          throw new Error("Temporary Thread source forwarding authority changed.");
+      },
+    };
     try {
-      const copy = await deps.callApi<{ message_id?: unknown }>(
-        "forwardMessage",
-        {
-          chat_id: target.chatId,
-          message_thread_id: target.threadId,
-          from_chat_id: pending.sourceTarget.chatId,
-          message_id: messageId,
-          disable_notification: true,
-        },
-      );
-      const copyId = copy?.message_id;
-      if (typeof copyId !== "number" || !Number.isSafeInteger(copyId)) return;
-      pending.allTabCopiesForwarded = true;
-      await deleteAllTabCopies(pending);
-      return copyId;
+      // An album moves as one album; forwardMessages skips what it cannot forward, so a short reply is not a move.
+      const copies =
+        messageIds.length === 1
+          ? [
+              await deps.callApi<{ message_id?: unknown }>(
+                "forwardMessage",
+                { ...route, message_id: messageIds[0] },
+                options,
+              ),
+            ]
+          : await deps.callApi<Array<{ message_id?: unknown }>>(
+              "forwardMessages",
+              { ...route, message_ids: messageIds },
+              options,
+            );
+      if (!isCurrent()) return;
+      const copyIds = Array.isArray(copies)
+        ? copies.map((copy) => copy?.message_id)
+        : [];
+      if (
+        copyIds.length !== messageIds.length ||
+        !copyIds.every(
+          (id): id is number =>
+            typeof id === "number" && Number.isSafeInteger(id) && id > 0,
+        ) ||
+        new Set(copyIds).size !== copyIds.length
+      )
+        return;
+      pending.allTabCopiesForwarded = {
+        target: copyTarget,
+        sourceMessageIds: messageIds,
+        messageIds: copyIds,
+      };
+      await deleteAllTabCopies(pending, isCurrent);
+      if (!isCurrent()) return;
+      return pending.allTabCopiesForwarded.messageIds[0];
     } catch (error) {
-      deps.recordRuntimeEvent?.("routing", error, {
-        phase: "temporary-thread-source-forward",
-      });
+      if (isCurrent())
+        deps.recordRuntimeEvent?.("routing", error, {
+          phase: "temporary-thread-source-forward",
+        });
       return;
     }
   };
+  /** Read original source addresses, not warm target rewrites; unknown copy provenance never grants a Reroute. */
+  const resolvePendingRerouteForwardSource = (
+    pending: PendingUnboundReroute,
+  ): { chatId: number; sourceUpdateIds: number[]; sourceMessageIds: number[]; messageIds: number[] } | undefined => {
+    try {
+      const originals = pending.messages.map((message) => {
+        const snapshot = Updates.inspectTelegramDeferredSourceSnapshot(message);
+        const ids = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+        const original = snapshot?.update.message as TMessage | undefined;
+        if (
+          !snapshot ||
+          ids.length !== 1 ||
+          snapshot.source.updateId !== ids[0] ||
+          snapshot.update.update_id !== ids[0] ||
+          Object.keys(snapshot.update).some((key) => key !== "update_id" && key !== "message") ||
+          snapshot.source.journalBindingKey !== deps.getAdmissionJournalBinding?.() ||
+          !original ||
+          original.chat?.type !== "private" ||
+          original.chat.id !== pending.sourceTarget.chatId ||
+          original.from?.id !== deps.configStore.getAllowedUserId() ||
+          original.from?.is_bot !== false ||
+          !Number.isSafeInteger(original.message_id) ||
+          original.message_id <= 0
+        )
+          return undefined;
+        return { message: original, updateId: ids[0]! };
+      });
+      if (originals.length === 0 || originals.some((source) => !source)) return;
+      originals.sort((a, b) => a!.message.message_id - b!.message.message_id);
+      const sourceMessageIds = originals.map((source) => source!.message.message_id);
+      const sourceUpdateIds = originals.map((source) => source!.updateId);
+      if (
+        new Set(sourceMessageIds).size !== sourceMessageIds.length ||
+        new Set(sourceUpdateIds).size !== sourceUpdateIds.length
+      )
+        return;
+      const copied = pending.allTabCopiesForwarded;
+      if (copied) {
+        if (
+          !isDeepStrictEqual(copied.target, pending.sourceTarget) ||
+          !isDeepStrictEqual(copied.sourceMessageIds, sourceMessageIds) ||
+          copied.messageIds.length !== sourceMessageIds.length ||
+          !copied.messageIds.every((id) => Number.isSafeInteger(id) && id > 0) ||
+          new Set(copied.messageIds).size !== copied.messageIds.length
+        )
+          return;
+        return { chatId: copied.target.chatId, sourceUpdateIds, sourceMessageIds, messageIds: [...copied.messageIds] };
+      }
+      const nativeOriginals = originals.every((source) =>
+        typeof pending.sourceTarget.threadId === "number" &&
+        source!.message.message_thread_id === pending.sourceTarget.threadId);
+      const retainedAllOriginals = pending.allTabSourceRetained === true &&
+        originals.every((source) => source!.message.message_thread_id === undefined) &&
+        isDeepStrictEqual([...(pending.allTabCopies ?? [])].sort((a, b) => a - b), sourceMessageIds);
+      if (nativeOriginals || retainedAllOriginals)
+        return { chatId: pending.sourceTarget.chatId, sourceUpdateIds, sourceMessageIds, messageIds: [...sourceMessageIds] };
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-source-proof" });
+    }
+    return undefined;
+  };
   const dismissRerouteChooserMessage = async (
     query: TCallbackQuery,
     assertExecutionCurrent?: () => void,
@@ -4774,8 +4935,7 @@ export function createTelegramInboundRouteRuntime<
           .listLiveRebindings()
           .find((value) => value.request.operationId === request.operationId);
         if (
-          intent?.phase === "released" &&
-          !intent.cleanup &&
+          intent && Threads.isTelegramLiveRebindInputAuthorized(intent) &&
           isDeepStrictEqual(intent.request, request) &&
           intent.operatorUserId === operatorUserId &&
           isDeepStrictEqual(intent.executor, {
@@ -5188,6 +5348,8 @@ export function createTelegramInboundRouteRuntime<
       name ||
       confirmation ||
       extension;
+    const preDispatchCleanup =
+      deps.runWorkspaceOperation !== undefined && deps.canUsePreDispatchRebind?.(recipient) === true;
     const createCoordinator = () =>
       createTelegramLiveRebindCoordinator({
         request,
@@ -5198,25 +5360,55 @@ export function createTelegramInboundRouteRuntime<
         retitle: deps.callApi
           ? async (isCurrent) => {
               if (!isCurrent()) return;
+              const expected = threads.getWorkspaceBindingByTarget(target, binding.sessionId);
+              if (!expected || expected.bindingKey !== binding.bindingKey || expected.slot !== binding.slot)
+                throw new Error("Live-rebind title binding is unavailable.");
+              const callApi = deps.callApi!;
               const slot = binding.slot ?? "";
-              await deps.callApi!("editForumTopic", {
-                chat_id: target.chatId,
-                message_thread_id: target.threadId,
-                name:
-                  deps.getDisplayTitle?.(target) ??
-                  ThreadNaming.getTelegramTopicTitleForThreadName(
-                    getRestoredThreadName(request.owner, slot),
-                    slot,
-                  ),
-              });
+              const resolveTitle = () => deps.getDisplayTitle?.(expected.target) ??
+                ThreadNaming.getTelegramTopicTitleForThreadName(getRestoredThreadName(request.owner, slot), slot);
+              const title = resolveTitle();
+              const bindingCurrent = (frame: Threads.TelegramWorkspaceThreadBinding) =>
+                isCurrent() && deps.callApi === callApi &&
+                isDeepStrictEqual(threads.getWorkspaceBindingByTarget(frame.target, frame.sessionId), frame);
+              const assertTitle = () => {
+                if (!bindingCurrent(expected) || resolveTitle() !== title)
+                  throw new Error("Live-rebind title authority changed.");
+              };
+              assertTitle();
+              const renamed = await callApi.call(deps, "editForumTopic", {
+                chat_id: expected.target.chatId,
+                message_thread_id: expected.target.threadId,
+                name: title,
+              }, { maxAttempts: 1, assertAuthority: assertTitle });
+              assertTitle();
+              if (renamed !== true || !threads.setWorkspaceDisplayTitle(expected, title))
+                throw new Error("Live-rebind title acknowledgement is unconfirmed.");
+              const acknowledged = { ...expected, displayTitle: title };
+              await threads.persist(() => bindingCurrent(acknowledged));
+              if (!bindingCurrent(acknowledged))
+                throw new Error("Live-rebind title publication authority changed.");
             }
           : undefined,
         authority: {
           executor: { instanceId, leaderEpoch: String(epoch) },
           operatorUserId,
-          isCurrent: current,
+          isCurrent: () => current() && (!preDispatchCleanup || deps.canUsePreDispatchRebind?.(recipient) === true),
         },
         getRecipient,
+        ...(preDispatchCleanup ? {
+          async cleanupBeforeRelease(intent: Threads.TelegramWorkspaceLiveRebindIntent, isCurrent: () => boolean) {
+            const delay = deps.liveRebindCleanupSchedule?.delaysMs[0] ?? 1_000;
+            await new Promise<void>(resolve => { const timer = setTimeout(resolve, delay); timer.unref?.(); });
+            if (!isCurrent()) return false;
+            const result = await inspectLiveRebindRecipient(intent, ctx, isLeader ? "issue" : "follower-issue", isCurrent);
+            if (!isCurrent()) return false;
+            // A session-replacing producer cannot retain an old-session cleanup grant across its gateway.
+            if (result?.status === "not-ready" && selection.confirmationCommand?.name === "new")
+              return !!store.advanceLiveRebind(intent, "protect-old-target", { executor: intent.executor, operatorUserId, isCurrent });
+            return result?.status === "not-ready" || result?.status === "finished" && result.recorded;
+          },
+        } : {}),
         follower: isLeader
           ? undefined
           : {
@@ -5258,9 +5450,9 @@ export function createTelegramInboundRouteRuntime<
                       instanceId,
                       leaderEpoch: String(epoch),
                     }) &&
-                    !intent.cleanup &&
-                    (intent.phase === "rebound" ||
-                      intent.phase === "released") &&
+                    (!intent.cleanup || intent.inputRelease !== undefined && intent.cleanup !== "issued") &&
+                    (intent.phase === "rebound" || intent.phase === "released" ||
+                      intent.phase === "finished" && intent.inputRelease !== undefined) &&
                     isDeepStrictEqual(intent.recipient, {
                       kind: recipient.kind,
                       instanceId: recipient.instanceId,
@@ -5320,6 +5512,7 @@ export function createTelegramInboundRouteRuntime<
                 });
               },
               isApplied,
+
               ...(completeCommand
                 ? {
                     complete(
@@ -5512,11 +5705,13 @@ export function createTelegramInboundRouteRuntime<
     intent: Threads.TelegramWorkspaceLiveRebindIntent,
     ctx: TContext,
     mode: "issue" | "follower-issue",
+    admittedOrigin?: () => boolean,
   ): Promise<TelegramLiveRebindCleanupIssue | undefined>;
   async function inspectLiveRebindRecipient(
     intent: Threads.TelegramWorkspaceLiveRebindIntent,
     ctx: TContext,
     mode: "work" | "cleanup" | "follower-cleanup" | "issue" | "follower-issue",
+    admittedOrigin?: () => boolean,
   ): Promise<
     | Bus.TelegramBusLiveRebindWorkObservation
     | ThreadReconciler.TelegramLiveRebindCleanupPreparation
@@ -5544,8 +5739,9 @@ export function createTelegramInboundRouteRuntime<
       !run ||
       (issueMode && !callApi) ||
       deps.isContextActive?.(ctx) !== true
-    )
+    ) {
       return undefined;
+    }
     try {
       const expected = structuredClone(intent),
         { request, recipient, executor } = expected;
@@ -5651,6 +5847,7 @@ export function createTelegramInboundRouteRuntime<
         );
       };
       const current = () =>
+        (!admittedOrigin || admittedOrigin()) &&
         deps.hasWorkspaceLiveRebindAuthority?.() === true &&
         deps.isContextActive?.(ctx) === true &&
         deps.workspaceRestoreRecipient === ports &&
@@ -5701,8 +5898,10 @@ export function createTelegramInboundRouteRuntime<
       };
       const sample = async () => {
         assertCanonical();
-        if (cleanupMode && protection.call(threads, expected) !== false)
-          return undefined;
+        if (cleanupMode) {
+          const protectedTarget = protection.call(threads, expected);
+          if (protectedTarget !== false) return undefined;
+        }
         const target = { ...request.binding.target };
         let value: Bus.TelegramBusLiveRebindWorkState | undefined;
         if (followerMode) {
@@ -5711,7 +5910,7 @@ export function createTelegramInboundRouteRuntime<
             instanceId: recipient.instanceId,
             sessionId: recipient.sessionId,
             recipientBindingKey: recipientJournalKey!,
-            mode: "observe",
+            mode: expected.inputRelease === "held" ? "observe-held" : "observe",
             sourceUpdateIds: [...request.source.updateIds],
             slot: request.binding.slot!,
             target: { ...request.target },
@@ -5766,12 +5965,13 @@ export function createTelegramInboundRouteRuntime<
           );
         assertCanonical();
         if (cleanupMode) {
+          const targetProtected = protection.call(threads, expected);
           const prepared = ThreadReconciler.prepareLiveRebindThreadCleanup({
             operationId: request.operationId,
             oldTarget: request.binding.target,
             recipientTarget: request.target,
             leaderEpoch: executor.leaderEpoch,
-            targetProtected: protection.call(threads, expected),
+            targetProtected,
             work,
           });
           assertCanonical();
@@ -5794,21 +5994,16 @@ export function createTelegramInboundRouteRuntime<
       if (!current()) return undefined;
       if (issueMode) {
         // One admission spans the fresh sample, durable issue marker, single deletion and terminal record.
-        return await run(
-          {
-            operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
-            operationKind: "workspace.live-rebind-cleanup",
-            scopes: [{ kind: "profile" }],
-          },
-          async (): Promise<TelegramLiveRebindCleanupIssue | undefined> => {
+        const execute = async (): Promise<TelegramLiveRebindCleanupIssue | undefined> => {
             const prepared = await sample();
             if (
               !prepared ||
               prepared.status !== "prepared" ||
               !current() ||
               protection.call(threads, expected) !== false
-            )
+            ) {
               return { status: "not-ready" };
+            }
             const authority = {
               executor: structuredClone(executor),
               operatorUserId: expected.operatorUserId,
@@ -5819,21 +6014,19 @@ export function createTelegramInboundRouteRuntime<
               "issue-cleanup",
               authority,
             );
-            if (!grant) return undefined;
+            if (!grant) {
+              return undefined;
+            }
             const assertGranted = () => assertCanonical(grant);
             const cleanup = await ThreadReconciler.issueLiveRebindThreadCleanup(
               prepared,
               {
                 assertCurrent: assertGranted,
-                deleteTopic: (target) =>
-                  callApi!(
-                    "deleteForumTopic",
-                    {
-                      chat_id: target.chatId,
-                      message_thread_id: target.threadId,
-                    },
-                    { maxAttempts: 1, assertAuthority: assertGranted },
-                  ),
+                deleteTopic: (target) => callApi!(
+                  "deleteForumTopic",
+                  { chat_id: target.chatId, message_thread_id: target.threadId },
+                  { maxAttempts: 1, assertAuthority: assertGranted },
+                ),
                 classifyFailure: classifyLiveRebindCleanupFailure,
               },
             );
@@ -5851,8 +6044,12 @@ export function createTelegramInboundRouteRuntime<
               cleanup,
               recorded,
             };
-          },
-        );
+        };
+        // Pre-dispatch calls are private to the chooser callback already holding the same profile admission/gate.
+        return admittedOrigin ? await execute() : await run({
+          operationId: `live-${mode}-${randomBytes(16).toString("hex")}`,
+          operationKind: "workspace.live-rebind-cleanup", scopes: [{ kind: "profile" }],
+        }, execute);
       }
       const observation = await run(
         {
@@ -5905,8 +6102,22 @@ export function createTelegramInboundRouteRuntime<
     string,
     ReturnType<typeof setTimeout> | "running"
   >();
-  // A leader retry waiting out its delay; a settled session wakes it at once, since its own busy run is the usual wait.
-  const liveRebindCleanupWakers = new Map<string, () => void>();
+  // One hint slot per existing leader chain; a running attempt retains at most one coalesced recheck.
+  const liveRebindCleanupWakers = new Map<string, (reason: "session-settled" | "delivery-drained") => void>();
+  const captureLiveRebindCleanupScope = (ctx: TContext): (() => boolean) => {
+    try {
+      const generation = deps.getSessionGeneration?.(), instanceId = deps.getCurrentInstanceId?.(),
+        epoch = deps.getCurrentLeaderEpoch?.(), store = deps.getWorkspaceRestoreStore?.(),
+        operator = deps.configStore.getAllowedUserId();
+      return () => {
+        try {
+          return deps.isContextActive?.(ctx) === true && deps.getSessionGeneration?.() === generation &&
+            deps.getCurrentInstanceId?.() === instanceId && deps.getCurrentLeaderEpoch?.() === epoch &&
+            deps.getWorkspaceRestoreStore?.() === store && deps.configStore.getAllowedUserId() === operator;
+        } catch { return false; }
+      };
+    } catch { return () => false; }
+  };
   /** End an unissued attempt honestly under fresh admission and current operator authority; no executor grant is borrowed. */
   const terminalizeUnissuedLiveRebindCleanup = async (
     operationId: string,
@@ -5967,25 +6178,48 @@ export function createTelegramInboundRouteRuntime<
     ctx: TContext,
     startedAtMs = Date.now(),
     attempt = 0,
+    current = captureLiveRebindCleanupScope(ctx),
   ): void => {
     const pacing = deps.liveRebindCleanupSchedule;
     const chain = liveRebindCleanupChains.get(operationId);
     if (
       !pacing ||
       (attempt === 0 ? chain !== undefined : chain !== "running") ||
-      deps.isContextActive?.(ctx) !== true
+      !current()
     ) {
-      if (attempt > 0 && chain === "running")
+      if (attempt > 0 && chain === "running") {
         liveRebindCleanupChains.delete(operationId);
+        liveRebindCleanupWakers.delete(operationId);
+      }
       return;
     }
+    let pendingWake: "session-settled" | "delivery-drained" | undefined;
+    const wake = (reason: "session-settled" | "delivery-drained") => {
+      if (!current()) return;
+      if (liveRebindCleanupChains.get(operationId) === "running") {
+        pendingWake = reason; return;
+      }
+      if (liveRebindCleanupChains.get(operationId) !== timer) return;
+      if (reason === "delivery-drained") {
+        let idle: unknown;
+        try { idle = deps.isIdle?.(ctx); } catch { /* A missing idle observation is not a reason to hurry cleanup. */ }
+        if (idle !== true) {
+          // A streamed technical task can drain between deltas while Pi still runs. Keep one hint, not a polling loop.
+          pendingWake = reason;
+          return;
+        }
+      }
+      clearTimeout(timer);
+      attemptNow();
+    };
     const attemptNow = () => {
-      liveRebindCleanupWakers.delete(operationId);
       if (liveRebindCleanupChains.get(operationId) !== timer) return;
+      pendingWake = undefined; // This fresh timer/settlement attempt consumes any previously deferred hint.
       liveRebindCleanupChains.set(operationId, "running");
+      if (role === "leader") liveRebindCleanupWakers.set(operationId, wake);
       let continued = false;
       const task = (async () => {
-        if (deps.isContextActive?.(ctx) !== true) return;
+        if (!current()) return;
         const intent = deps
           .getWorkspaceRestoreStore?.()
           ?.listLiveRebindings()
@@ -5998,11 +6232,12 @@ export function createTelegramInboundRouteRuntime<
             : await issueLiveRebindFollowerCleanup(intent, ctx);
         if (
           result?.status === "finished" ||
-          deps.isContextActive?.(ctx) !== true
+          !current()
         )
           return;
-        if (Date.now() - startedAtMs >= pacing.windowMs)
+        if (Date.now() - startedAtMs >= pacing.windowMs) {
           return terminalizeUnissuedLiveRebindCleanup(operationId, ctx);
+        }
         continued = true;
         scheduleLiveRebindCleanup(
           operationId,
@@ -6010,7 +6245,9 @@ export function createTelegramInboundRouteRuntime<
           ctx,
           startedAtMs,
           attempt + 1,
+          current,
         );
+        if (pendingWake) liveRebindCleanupWakers.get(operationId)?.(pendingWake);
       })()
         .catch((error) =>
           deps.recordRuntimeEvent?.("routing", error, {
@@ -6021,8 +6258,10 @@ export function createTelegramInboundRouteRuntime<
           if (
             !continued &&
             liveRebindCleanupChains.get(operationId) === "running"
-          )
+          ) {
             liveRebindCleanupChains.delete(operationId);
+            liveRebindCleanupWakers.delete(operationId);
+          }
         });
       restoreSettlementTasks.add(task);
       void task.finally(() => restoreSettlementTasks.delete(task));
@@ -6034,17 +6273,27 @@ export function createTelegramInboundRouteRuntime<
     timer.unref?.();
     liveRebindCleanupChains.set(operationId, timer);
     // The first delay stays whole: a detached command reply still needs the released, cleanup-free row.
-    if (role === "leader" && attempt > 0)
-      liveRebindCleanupWakers.set(operationId, () => {
-        if (liveRebindCleanupChains.get(operationId) !== timer) return;
-        clearTimeout(timer);
-        attemptNow();
-      });
+    if (role === "leader" && attempt > 0) liveRebindCleanupWakers.set(operationId, wake);
   };
-  /** The agent settled: every gate is re-sampled now, so an old tab goes right after the answer, not at the next tick. */
-  const onSessionSettled = (ctx: TContext): void => {
+  const wakeLiveRebindCleanup = (ctx: TContext, reason: "session-settled" | "delivery-drained"): void => {
     if (deps.isContextActive?.(ctx) !== true) return;
-    for (const wake of [...liveRebindCleanupWakers.values()]) wake();
+    for (const wake of [...liveRebindCleanupWakers.values()]) wake(reason);
+  };
+  const onSessionSettled = (ctx: TContext): void => wakeLiveRebindCleanup(ctx, "session-settled");
+  const onDeliverySettled = (ctx: TContext): void => {
+    wakeLiveRebindCleanup(ctx, "delivery-drained");
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!cap?.isCurrent()) return;
+    try {
+      for (const entry of cap.store.listTemporaryThreads()) {
+        if (!cap.isCurrent()) return;
+        if (entry.phase === "created" && entry.target && !entry.cleanupIssued &&
+          Threads.isTelegramTemporaryThreadFullyResolved(entry))
+          scheduleTemporaryThreadCleanup(entry.target, ctx);
+      }
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-drain" });
+    }
   };
   const restoreWorkspace = deps.workspaceRestoreRecipient
     ? async (input: {
@@ -6675,6 +6924,97 @@ export function createTelegramInboundRouteRuntime<
       return false;
     }
   };
+  /** Publish display copies under the native one-shot grant; positive output is not input/source settlement. */
+  const publishPendingRerouteCopies = async (
+    pending: PendingUnboundReroute,
+    record: Threads.TelegramTopicTargetRecord,
+    ctx: TContext,
+    assertExecutionCurrent: () => void,
+    foreign: boolean,
+  ): Promise<(() => void) | undefined> => {
+    const source = resolvePendingRerouteForwardSource(pending);
+    const target = { ...record.target };
+    const recordIdentity = (value: Threads.TelegramTopicTargetRecord | undefined) => value && ({
+      target: value.target, profileKey: value.profileKey, owner: value.owner,
+      instanceId: value.instanceId, slot: value.slot, createdAtMs: value.createdAtMs,
+    });
+    const bindingIdentity = () => deps.threadStore!.listWorkspaceBindings()
+      .filter((value) => isDeepStrictEqual(value.target, target))
+      .map((value) => ({ bindingKey: value.bindingKey, sessionId: value.sessionId, sessionKey: value.sessionKey,
+        cwd: value.cwd, workspaceKey: value.workspaceKey, instanceSlot: value.instanceSlot, slot: value.slot,
+        target: value.target }));
+    const expectedRecord = structuredClone(recordIdentity(record));
+    const expectedBindings = structuredClone(bindingIdentity());
+    const ownership = deps.getTargetOwnership?.(target);
+    if (
+      !source || !deps.callApi || expectedBindings.length > 1 ||
+      (foreign && (!ownership || ownership.instanceId !== record.instanceId ||
+        !ownership.ownerGeneration || !ownership.recipientBindingKey))
+    )
+      return;
+    const expectedOwnership = ownership && structuredClone(ownership);
+    const cap = captureTemporaryThreadAuthority(ctx, () => {
+      try {
+        assertExecutionCurrent();
+        const current = getTelegramRoutableThreadRecords(deps.threadStore!.list(), deps.getLiveThreadTargets?.())
+          .find((value) => isDeepStrictEqual(value.target, target));
+        return isDeepStrictEqual(recordIdentity(current), expectedRecord) &&
+          isDeepStrictEqual(bindingIdentity(), expectedBindings) &&
+          (!foreign || Bus.isTelegramBusForwardOwnershipCurrent(expectedOwnership!, deps.getTargetOwnership?.(target)));
+      } catch { return false; }
+    });
+    if (!cap?.isCurrent()) return;
+    const temporary = pending.temporaryThread ?? findCreatedTemporaryThread(pending.sourceTarget);
+    if (!temporary || !issueTemporaryThreadForward(pending, ctx)) return;
+    pending.phase = { kind: "forward-unknown" };
+    const assertRecipientCurrent = (): void => {
+      assertExecutionCurrent();
+      if (!cap.isCurrent()) throw new Error("Reroute publication recipient authority changed.");
+    };
+    const assertPublicationCurrent = (): void => {
+      assertRecipientCurrent();
+      const entry = cap.store.listTemporaryThreads().find((value) => value.token === temporary.token);
+      const ids = [...source.sourceUpdateIds].sort((a, b) => a - b);
+      if (
+        !entry || entry.phase !== "created" || entry.cleanupIssued ||
+        entry.operatorUserId !== cap.operatorUserId ||
+        !isDeepStrictEqual(entry.executor, cap.authority.executor) ||
+        !isDeepStrictEqual(entry.target, pending.sourceTarget) ||
+        !entry.forwardedInputs?.some((input) => input.journalBindingKey === cap.journalBindingKey &&
+          isDeepStrictEqual(input.updateIds, ids)) ||
+        !isDeepStrictEqual(resolvePendingRerouteForwardSource(pending), source)
+      )
+        throw new Error("Reroute publication source authority changed.");
+    };
+    try {
+      assertPublicationCurrent();
+      // Bot API requires ascending source IDs. Preserve the source-UID association even if copy IDs reorder them.
+      const order = source.messageIds.map((_, index) => index)
+        .sort((a, b) => source.messageIds[a]! - source.messageIds[b]!);
+      const messageIds = order.map((index) => source.messageIds[index]!);
+      const body = { chat_id: target.chatId, message_thread_id: target.threadId,
+        from_chat_id: source.chatId, disable_notification: true };
+      const options = { maxAttempts: 1, retrySafety: "non-idempotent" as const, assertAuthority: assertPublicationCurrent };
+      const copies = messageIds.length === 1
+        ? [await deps.callApi<{ message_id?: unknown }>("forwardMessage", { ...body, message_id: messageIds[0] }, options)]
+        : await deps.callApi<Array<{ message_id?: unknown }>>("forwardMessages", { ...body, message_ids: messageIds }, options);
+      assertPublicationCurrent();
+      const copyIds = Array.isArray(copies) ? copies.map((copy) => copy?.message_id) : [];
+      if (
+        copyIds.length !== messageIds.length ||
+        !copyIds.every((id): id is number => typeof id === "number" && Number.isSafeInteger(id) && id > 0) ||
+        new Set(copyIds).size !== copyIds.length
+      )
+        return;
+      pending.rerouteCopies = { target, bySourceUpdateId: new Map(order.map((index, position) =>
+        [source.sourceUpdateIds[index]!, copyIds[position]!] as const)) };
+      pending.phase = { kind: "selected" };
+      return assertRecipientCurrent;
+    } catch (error) {
+      if (cap.isCurrent()) deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-destination-forward" });
+      return;
+    }
+  };
   const forwardPendingRerouteMessages = async (
     pending: PendingUnboundReroute,
     instanceId: string,
@@ -6700,12 +7040,19 @@ export function createTelegramInboundRouteRuntime<
     )
       return false;
     const ownership = structuredClone(liveOwnership);
-    const messages = cloneTelegramMessagesForThread(pending.messages, threadId);
+    const copies = pending.rerouteCopies;
+    const published = !!copies && isDeepStrictEqual(copies.target, target);
+    const messages = cloneTelegramMessagesForThread(
+      pending.messages,
+      threadId,
+      published ? copies.bySourceUpdateId : undefined,
+    );
     // Issuance is durable before the RPC: an unacknowledged temporary-tab Forward never becomes another dispatch grant,
     // even after restart. Any refusal or publication failure sends nothing and keeps the input held.
     if (
       !recordForwardAcceptance &&
       isTemporaryReroute(pending) &&
+      !published &&
       !issueTemporaryThreadForward(pending, ctx)
     ) {
       if (isTemporaryThreadForwardIssued(pending))
@@ -6720,6 +7067,10 @@ export function createTelegramInboundRouteRuntime<
           message,
           ownership,
           ctx,
+          assertAuthority() {
+            assertExecutionCurrent?.();
+            Updates.assertTelegramUpdateExecutionCurrent(message);
+          },
         }),
       ),
     );
@@ -6946,6 +7297,16 @@ export function createTelegramInboundRouteRuntime<
       temporaryCleanupTimers.delete(token);
       if (retry) restoreSettlementTasks.add(task);
       runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+        .then(() => {
+          if (!cap.isCurrent()) return;
+          const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+          // A follower ACK can precede recipient receipt disposal. Reobserve a protected, unissued tab;
+          // elapsed time never grants deletion, and an issued/unknown delete can never enter this path.
+          if (retained?.phase === "created" && !retained.cleanupIssued &&
+            Threads.isTelegramTemporaryThreadFullyResolved(retained) &&
+            cap.store.inspectTemporaryThreadTarget(retained, cap.authority)?.kind === "temporary" && cap.isCurrent())
+            queueTemporaryThreadCleanup(token, cap, 1000, reconcileExpiry, true);
+        })
         .catch((error) => {
           deps.recordRuntimeEvent?.("routing", error, {
             phase: "temporary-thread-cleanup",
@@ -7672,7 +8033,7 @@ export function createTelegramInboundRouteRuntime<
             ).includes(source.original.updateId)
           )
             continue;
-          movedIntoTab ||= pending.allTabCopiesForwarded === true;
+          movedIntoTab ||= pending.allTabCopiesForwarded !== undefined;
           removePendingReroute(id);
           if (
             signal.aborted ||
@@ -8695,10 +9056,10 @@ export function createTelegramInboundRouteRuntime<
         // Keep the captured plan even if the source owner's issued selection result is lost.
         pending.liveRebind ??= selection;
         if (!(await selectPendingDestination())) return true;
+        const operationId = selection.coordinator.operationId;
         if (current()) outcome = await selection.coordinator.advance();
         // Cleanup readiness follows the canonical released row, not source disposal: a detached command ACK may
         // still be pending while every attempt samples current work afresh.
-        const operationId = selection.coordinator.operationId;
         const row =
           outcome === "protected"
             ? undefined
@@ -8706,12 +9067,14 @@ export function createTelegramInboundRouteRuntime<
                 .getWorkspaceRestoreStore?.()
                 ?.listLiveRebindings()
                 .find((value) => value.request.operationId === operationId);
-        if (row?.phase === "released" && row.cleanup === undefined)
+        if (row?.phase === "released" && row.cleanup === undefined &&
+          (row.inputRelease === undefined || row.inputRelease === "accepted")) {
           scheduleLiveRebindCleanup(
             operationId,
             selection.record.owner?.kind === "leader" ? "leader" : "follower",
             ctx,
           );
+        }
         if (outcome === "released")
           await releaseAllTabCopiesIntoSurvivingTab(pending);
       } catch (error) {
@@ -8729,12 +9092,24 @@ export function createTelegramInboundRouteRuntime<
         );
         return true;
       }
+      const cleanupRow = deps.getWorkspaceRestoreStore?.()?.listLiveRebindings().find(value => value.request.operationId === selection.coordinator?.operationId);
+      const cleanupResult = cleanupRow?.inputRelease && cleanupRow.cleanup !== undefined
+        ? cleanupRow.cleanup === "confirmed" ? "old-Thread removal confirmed"
+          : cleanupRow.cleanup === "unknown" || cleanupRow.cleanup === "issued" ? "old-Thread removal unconfirmed; deletion will not repeat"
+            : cleanupRow.cleanup === "failed" ? "old-Thread removal failed" : "old-Thread removal was not issued"
+        : undefined;
+      const commandDisposed = !!(selection.extensionCommand && selection.extensionKind !== "generated-prompt" || selection.nameCommand ||
+        selection.confirmationCommand || selection.helpCommand || selection.stopCommand || selection.nextCommand ||
+        selection.menuCommand || selection.abortCommand || selection.coordinator?.selectedCommandReference());
       // The tab now belongs to the rebound thread; only the one-shot chooser message goes.
       await finalizePendingReroute(
         parsed.rerouteId,
         pending,
         query,
-        selection.extensionKind === "generated-prompt"
+        cleanupResult
+          ? commandDisposed ? `Command source disposal confirmed; ${cleanupResult}; delivery and follow-on effects remain independent`
+            : `Input queued in the rebound Thread; ${cleanupResult}`
+          : selection.extensionKind === "generated-prompt"
           ? "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed"
           : selection.extensionCommand
             ? "Command source disposal confirmed; reply delivery and old-Thread cleanup are not confirmed"
@@ -8760,6 +9135,14 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
+    if (
+      !parsed.useNewSlot &&
+      isTemporaryReroute(pending) &&
+      !resolvePendingRerouteForwardSource(pending)
+    ) {
+      await deps.answerCallbackQuery(query.id, "Source copy unavailable; not routing");
+      return true;
+    }
     if (!(await selectPendingDestination())) return true;
     if (parsed.useNewSlot && sourceTarget && restoreWorkspace) {
       const selection = (pending.workspaceRestore ??= {
@@ -8865,6 +9248,19 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
+    let assertRerouteCurrent = assertExecutionCurrent;
+    if (isTemporaryReroute(pending)) {
+      const confirmed = await publishPendingRerouteCopies(pending, record, ctx, assertExecutionCurrent,
+        !!record.instanceId && record.instanceId !== currentInstanceId && !isCurrentLeaderRecord);
+      if (!confirmed) {
+        await deps.answerCallbackQuery(query.id, pending.phase.kind === "forward-unknown"
+          ? "Publication unconfirmed; not resending"
+          : "Publication unavailable; input kept");
+        return true;
+      }
+      assertRerouteCurrent = confirmed;
+    }
+    assertRerouteCurrent();
     if (
       record.instanceId &&
       record.instanceId !== currentInstanceId &&
@@ -8875,7 +9271,7 @@ export function createTelegramInboundRouteRuntime<
         record.instanceId,
         parsed.threadId,
         ctx,
-        assertExecutionCurrent,
+        assertRerouteCurrent,
       );
       if (!allForwarded) {
         await deps.answerCallbackQuery(
@@ -8891,6 +9287,7 @@ export function createTelegramInboundRouteRuntime<
     // Local handlers and queue admission consume the same one-time group grant as follower forwarding.
     if (
       isTemporaryReroute(pending) &&
+      !pending.rerouteCopies &&
       !issueTemporaryThreadForward(pending, ctx)
     ) {
       await deps.answerCallbackQuery(
@@ -8899,7 +9296,11 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
-    await dispatchPendingRerouteMessages(pending, reroutedMessages, ctx);
+    const localMessages = pending.rerouteCopies
+      ? cloneTelegramMessagesForThread(pending.messages, parsed.threadId, pending.rerouteCopies.bySourceUpdateId)
+      : reroutedMessages;
+    await dispatchPendingRerouteMessages(pending, localMessages, ctx);
+    assertRerouteCurrent();
     pending.messages = [];
     return completeRoutedReroute();
   };
@@ -10288,15 +10689,23 @@ export function createTelegramInboundRouteRuntime<
    * An All input gets one source-bound tab. The original stays deferred in All until explicit routing,
    * and an existing entry is reused on replay, so restart never creates a second tab or retries an unknown one.
    */
+  /**
+   * Opens (or adopts) the routing tab for input sent from All. One text message may carry a command; anything else,
+   * a voice note, a file or a coalesced album, is held untouched as one prompt.
+   */
   const sendAllTabTemporaryInputChooser = async (
     command: Commands.ParsedTelegramCommand | undefined,
     commandText: string,
-    message: TMessage,
+    messages: readonly TMessage[],
     ctx: TContext,
   ): Promise<boolean> => {
-    const [updateId] = Updates.collectTelegramAdmissionSourceUpdateIds([
-      message,
-    ]);
+    const message = messages[0];
+    if (!message) return false;
+    const updateIds = Updates.collectTelegramAdmissionSourceUpdateIds([
+      ...messages,
+    ]).sort((a, b) => a - b);
+    const updateId = updateIds[0];
+    const group = { journalBindingKey: "", updateIds };
     const execution = Updates.getTelegramUpdateExecutionFence(message);
     const cap = captureTemporaryThreadAuthority(
       ctx,
@@ -10307,15 +10716,20 @@ export function createTelegramInboundRouteRuntime<
       !deps.runWorkspaceOperation ||
       !deps.callApi ||
       updateId === undefined ||
-      message.chat.type !== "private" ||
-      message.chat.id !== cap.operatorUserId ||
-      message.from?.id !== cap.operatorUserId ||
+      updateIds.length !== messages.length ||
+      messages.some(
+        (held) =>
+          held.chat.type !== "private" ||
+          held.chat.id !== cap.operatorUserId ||
+          held.from?.id !== cap.operatorUserId,
+      ) ||
       !cap.isCurrent()
     )
       return false;
     const { store, operatorUserId, journalBindingKey, epoch, authority } = cap,
       current = cap.isCurrent;
     const source = { journalBindingKey, updateId };
+    group.journalBindingKey = journalBindingKey;
     const find = () =>
       store
         .listTemporaryThreads()
@@ -10352,7 +10766,7 @@ export function createTelegramInboundRouteRuntime<
         );
         if (native) {
           const adopted = store.registerImplicitTemporaryThread(
-            { journalBindingKey, updateIds: [updateId] },
+            group,
             native.implicit.target,
             randomBytes(16).toString("hex"),
             {
@@ -10385,6 +10799,7 @@ export function createTelegramInboundRouteRuntime<
           source,
           randomBytes(16).toString("hex"),
           authority,
+          group,
         );
         entry = reservation?.entry;
         if (!reservation?.reserved || !current()) return;
@@ -10425,19 +10840,20 @@ export function createTelegramInboundRouteRuntime<
       throw new Error(
         "Temporary Thread authority changed; the input remains retryable.",
       );
-    const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
-      ...message,
-      text: commandText,
-      caption: undefined,
-    } as TMessage);
+    // Only a lone text message is rewritten for command detection; media keeps its caption and payload.
+    const held: TMessage[] =
+      messages.length === 1 && typeof message.text === "string"
+        ? [
+            Updates.carryTelegramUpdateExecutionFence(message, {
+              ...message,
+              text: commandText,
+              caption: undefined,
+            } as TMessage),
+          ]
+        : [...messages];
     if (entry.phase !== "created" || !entry.target) {
-      Updates.reportTelegramUpdateDeferred(commandMessage);
-      await deps.sendTextReply(
-        message.chat.id,
-        message.message_id,
-        "<b>⚠️ The routing tab for this command could not be confirmed.</b> It stays held and was not sent to Pi.",
-        { parseMode: "HTML" },
-      );
+      for (const input of held) Updates.reportTelegramUpdateDeferred(input);
+      deps.recordRuntimeEvent?.("routing", new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR), { phase: "temporary-thread-unconfirmed" });
       return true;
     }
     const target = entry.target;
@@ -10446,23 +10862,22 @@ export function createTelegramInboundRouteRuntime<
       deps.getLiveThreadTargets?.(),
     );
     const rerouteId = storePendingUnboundReroute(
-      [commandMessage],
+      held,
       command ? "command" : "prompt",
       target,
     );
     const pending = pendingUnboundReroutes.get(rerouteId)!;
     pending.temporaryThread = entry;
     pending.allTabCopies = getTelegramAllTabSourceMessageIds(
-      [message],
+      messages,
       target.chatId,
     );
-    Updates.reportTelegramUpdateDeferred(commandMessage);
+    for (const input of held) Updates.reportTelegramUpdateDeferred(input);
     // Cancel is offered only when the exact source can still be abandoned; the tab removal needs that retention first.
     if (
       deps.editInteractiveMessage &&
-      Updates.supportsTelegramDeferredAbandonment(
-        commandMessage,
-        journalBindingKey,
+      held.every((input) =>
+        Updates.supportsTelegramDeferredAbandonment(input, journalBindingKey),
       )
     ) {
       pending.abandonment = {
@@ -10477,6 +10892,16 @@ export function createTelegramInboundRouteRuntime<
     const tabCopyId = openedNow
       ? await moveAllTabSourceIntoTab(pending, target, current)
       : undefined;
+    if (!current()) {
+      removePendingReroute(rerouteId);
+      throw new Error("Temporary Thread source presentation authority changed.");
+    }
+    if (
+      openedNow &&
+      !pending.allTabCopiesForwarded &&
+      pending.allTabCopies.length === held.length
+    )
+      pending.allTabSourceRetained = true;
     try {
       if (!deps.sendInteractiveMessage)
         throw new Error("Temporary Thread chooser publication is unavailable.");
@@ -10499,96 +10924,14 @@ export function createTelegramInboundRouteRuntime<
     }
     return true;
   };
-  const sendAllTabCommandChooser = async (
-    command: Commands.ParsedTelegramCommand,
-    commandText: string,
-    message: TMessage,
-    options: {
-      replyToSource?: boolean;
-      target?: Queue.TelegramQueueTarget;
-    } = {},
-  ): Promise<boolean> => {
-    if (!deps.threadStore) return false;
-    const records = deps.threadStore.list();
-    const activeRecords = getTelegramRoutableThreadRecords(
-      records,
-      deps.getLiveThreadTargets?.(),
-    );
-    if (activeRecords.length === 0) return false;
-    const commandMessage = Updates.carryTelegramUpdateExecutionFence(message, {
-      ...message,
-      text: commandText,
-      caption: undefined,
-    } as TMessage);
-    const rerouteId = storePendingUnboundReroute([commandMessage], "command");
-    Updates.reportTelegramUpdateDeferred(commandMessage);
-    const text = formatTelegramAllTabMenuChooserText(command.name);
-    pendingUnboundReroutes.get(rerouteId)!.rootChooserText = text;
-    const replyMarkup = buildTelegramUnboundRerouteChooserMarkup(
-      rerouteId,
-      activeRecords,
-      {
-        canRestore: typeof message.message_thread_id === "number",
-        getDisplayTitle: deps.getDisplayTitle,
-      },
-    );
-    let chooserId: number | undefined;
-    try {
-      if (deps.sendInteractiveMessage) {
-        chooserId = await deps.sendInteractiveMessage(
-          message.chat.id,
-          text,
-          "html",
-          replyMarkup,
-          options.target || options.replyToSource
-            ? {
-                ...(options.target ? { target: options.target } : {}),
-                ...(options.replyToSource
-                  ? { replyToMessageId: message.message_id }
-                  : {}),
-              }
-            : undefined,
-        );
-      } else if (deps.callApi) {
-        const chooser = await deps.callApi<{ message_id?: number }>(
-          "sendMessage",
-          {
-            chat_id: message.chat.id,
-            text,
-            parse_mode: "HTML",
-            reply_markup: replyMarkup,
-            ...(typeof options.target?.threadId === "number"
-              ? { message_thread_id: options.target.threadId }
-              : {}),
-            ...(options.replyToSource
-              ? {
-                  reply_parameters: {
-                    message_id: message.message_id,
-                    allow_sending_without_reply: true,
-                  },
-                }
-              : {}),
-          },
-        );
-        chooserId = chooser?.message_id;
-      } else {
-        chooserId = await deps.sendTextReply(
-          message.chat.id,
-          message.message_id,
-          text,
-          {
-            parseMode: "HTML",
-            target: options.target,
-          },
-        );
-      }
-    } catch (error) {
-      removePendingReroute(rerouteId);
-      throw error;
-    }
-    rememberRerouteChooser(rerouteId, chooserId);
-    Updates.reportTelegramUpdateCompleted(commandMessage);
-    return true;
+  /** A coalesced album from All requires one routing tab; failure cannot answer in All or discard its source. */
+  const routeAllTabAlbum = async (
+    messages: TMessage[],
+    ctx: TContext,
+  ): Promise<void> => {
+    if (await sendAllTabTemporaryInputChooser(undefined, "", messages, ctx))
+      return;
+    throw new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR);
   };
   const dispatchCommandOrPrompt =
     Commands.createTelegramCommandOrPromptDispatcher<TMessage, TContext>({
@@ -11164,6 +11507,7 @@ export function createTelegramInboundRouteRuntime<
                 entry.source.journalBindingKey ===
                   deps.getAdmissionJournalBinding?.(),
             ) === true;
+        const needsThread = deps.threadStore.getBotState().threadMode === "enabled" || bindings.length > 0 || presented;
         // Returning before deferral lets the admission worker terminally settle expired replay; a presented tab is not expiry.
         if (
           command &&
@@ -11173,30 +11517,48 @@ export function createTelegramInboundRouteRuntime<
         )
           return;
         if (
-          command?.name !== "thread" &&
-          (bindings.length > 0 || presented) &&
+          needsThread &&
           typeof message.text === "string" &&
           message.text.trim() &&
           (await sendAllTabTemporaryInputChooser(
             command,
             text,
-            message as TMessage,
+            [message as TMessage],
             ctx,
           ))
         )
           return;
-        if (bindings.length > 0 && command && command.name !== "thread") {
-          if (
-            await sendAllTabCommandChooser(command, text, message as TMessage, {
-              replyToSource: true,
-            })
-          ) {
+        // Voice notes, files, stickers and albums from All get the same routing tab as text, whether or not the
+        // client opened a tab for them; an album first gathers into one input so it opens one tab.
+        if (
+          !command &&
+          needsThread &&
+          typeof message.text !== "string" &&
+          Media.hasTelegramMessagesPromptContent([message as TMessage])
+        ) {
+          if (message.media_group_id) {
+            deps.mediaGroupRuntime.queueMessage({
+              message: message as TMessage,
+              context: ctx,
+              dispatchMessages: (messages, queuedCtx) =>
+                routeAllTabAlbum(messages, queuedCtx ?? ctx),
+            });
+            Updates.reportTelegramUpdateDeferred(message as TMessage);
             return;
           }
+          if (
+            await sendAllTabTemporaryInputChooser(
+              undefined,
+              text,
+              [message as TMessage],
+              ctx,
+            )
+          )
+            return;
         }
-        if (bindings.length > 0 && !text.startsWith("/")) {
+        if (needsThread) {
           const probeTarget = bindings[0]?.target;
-          if (probeTarget?.threadId && deps.callApi) {
+          if (!command && !text.startsWith("/") && probeTarget?.threadId && deps.callApi) {
             try {
               await deps.callApi("sendChatAction", {
                 chat_id: probeTarget.chatId,
@@ -11205,8 +11567,7 @@ export function createTelegramInboundRouteRuntime<
               });
             } catch (error) {
               if (
-                Threads.isTelegramTopicModeUnavailableError(error) ||
-                Threads.isTelegramTopicTargetStaleError(error)
+                Threads.isTelegramTopicModeUnavailableError(error)
               ) {
                 deps.threadStore.setBotState({
                   threadMode: "disabled",
@@ -11226,12 +11587,7 @@ export function createTelegramInboundRouteRuntime<
               });
             }
           }
-          await deps.sendTextReply(
-            message.chat.id,
-            message.message_id,
-            "This bot is in threaded multi-instance mode. Send prompts in a bound Pi thread tab so they route to the right instance.",
-          );
-          return;
+          throw new Error(TELEGRAM_THREADED_ROUTING_UNAVAILABLE_ERROR);
         }
       }
       await textDispatch.handleMessage(message as TMessage, ctx);
@@ -11663,6 +12019,7 @@ export function createTelegramInboundRouteRuntime<
     prepareHeldCommand: commandHandler.prepareHeldCommand,
     canPrepareHeldCommand: commandHandler.canPrepareHeldCommand,
     onSessionSettled,
+    onDeliverySettled,
     observeLiveRebindLeaderWork,
     prepareLiveRebindLeaderCleanup,
     prepareLiveRebindFollowerCleanup,