@llblab/pi-telegram 0.55.0 → 0.55.1

package/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 ## Unreleased
 
+## 0.55.1: Visible Reroute and follower cleanup
+
+- `Reroute visibility`: Temporary Reroute forwards text, voice, files and albums into the selected Thread before local/follower admission, then anchors replies to confirmed copies. Source/recipient/generation fences reach HTTP and IPC write/ACK boundaries; one native grant prevents replay after partial/lost ACKs. Unknown cold All copies stay held with Cancel; real native-source recovery remains supported. Journal originals, receipt/group cleanup protections, Restore and cleanup timing are unchanged.
+- `Reroute cleanup`: A follower ACK no longer strands a resolved Routing tab when recipient queue custody blocks its first cleanup check. Metadata-only rechecks and existing delivery-drain wakes wait for fresh source/receipt protection to clear, including retained completed membership after runtime replacement. New input, live bindings, authority loss and unverifiable evidence remain protective; issued or unknown deletion never repeats.
+
 ## 0.55.0: Native Restore and fenced lifecycles
 
 - `Restore cleanup`: Live Restore binds the new tab and decides old-tab cleanup before native leader/follower inputs run. Protected work defers cleanup; session replacement carries no deletion grant, and unknown deletion never repeats. Follower execution targets the rebound tab without rewriting journal originals or quoting the former tab. Exact donor ACKs seal routing clocks and retire the menu. Reader/execution capabilities, source custody and detached replies stay separate; busy hints coalesce.

package/README.md

@@ -143,7 +143,7 @@ Enable the optional capabilities the bridge needs in the [@BotFather](https://t.
 | Generative Apps | Install or explicitly replace a reviewed `.mjs` application whose generated JSON button view may mix direct `app::method` actions with ordinary model prompts. | Repeated games, controls, tutors, and adapters compile routine interaction without losing selective model interpretation, explanation, or adaptation. |
 | Callback routing | Route known callbacks to the owner extension and unknown callbacks back into Pi. | Companion extensions can build UI without polling Telegram themselves. |
 | Threaded Mode | Run one leader plus visible follower Pi instances through named private-chat threads. | One bot can host a local multi-instance Pi organism without hidden process spawning. |
-| Reroute and restore | Give text, voice, files and albums sent from `All`, plus unknown threads, explicit reroute and replace/restore choices. | Forward removes the temporary tab; restore rebinds it and may remove only the replaced old tab after positive cleanup proofs. Blocked cleanup preserves the relocation and protected work. |
+| Reroute and restore | Give text, voice, files and albums sent from `All`, plus unknown threads, explicit reroute and replace/restore choices. | Reroute from a routing tab forwards the prompt into the selected Thread before agent admission and anchors replies there; cleanup still requires source ACKs. Restore rebinds the tab and may remove only the replaced old tab after positive cleanup proofs. Blocked cleanup preserves the relocation and protected work. |
 | Extension sections | Add menu sections, commands, status rows, settings, callbacks, and delivery helpers from companion extensions. | `pi-telegram` becomes a platform surface for other Pi extensions. |
 | Runtime diagnostics | Use `/telegram-status` and recent runtime events for connection, role, negotiated bus protocol/build/capabilities, separate polling and inbound-worker progress, journal depth, local/foreign queue ownership, automatic retry waits, transport, and failures. | Compatible build skew, foreign semantic authority, a healthy poller, durable backoff and an infrastructure-blocked worker remain distinguishable without hidden logs. |
 | Safety and ownership | Pair one owner, lock transport, scope targets, and reject fake terminal behavior. | Remote access remains explicit, bounded, and understandable. |

package/dist/lib/bus-follower.d.ts

@@ -388,6 +388,7 @@ export declare function createTelegramBusFollowerClientRuntime<TContext, TReacti
             message: TMessage;
             ownership: TelegramBusForwardOwnership;
             ctx: TContext;
+            assertAuthority?: () => void;
         }) => Promise<import("./bus.ts").TelegramBusForeignUpdateSettlement>;
         forwardEditedMessage: (input: {
             message: TMessage;

package/dist/lib/bus.d.ts

@@ -670,6 +670,8 @@ export declare function createTelegramBusForeignOwnedUpdateForwarder<TContext, T
         message: TMessage;
         ownership: TelegramBusForwardOwnership;
         ctx: TContext;
+        /** Process-local source/recipient lifetime; never part of the wire envelope. */
+        assertAuthority?: () => void;
     }) => Promise<TelegramBusForeignUpdateSettlement>;
     forwardEditedMessage: (input: {
         message: TMessage;

package/dist/lib/bus.js

@@ -971,7 +971,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
             sourceReference,
         };
     };
-    const send = async (envelope, ownership) => {
+    const send = async (envelope, ownership, assertAuthority) => {
         if (deps.validateForwardOwnership &&
             !deps.validateForwardOwnership(ownership))
             return reject({
@@ -991,10 +991,15 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
                 socketPath,
                 envelope,
                 timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
-                retry: getTelegramBusTransportRetryPolicy({
+                retry: assertAuthority ? { attempts: 1, delayMs: 0 } : getTelegramBusTransportRetryPolicy({
                     endpoint: socketPath,
                     operation: "operation",
                 }),
+                ...(assertAuthority || deps.validateForwardOwnership ? { assertAuthority() {
+                        assertAuthority?.();
+                        if (deps.validateForwardOwnership && !deps.validateForwardOwnership(ownership))
+                            throw new Error("Telegram follower forwarding ownership changed.");
+                    } } : {}),
             });
         }
         catch (error) {
@@ -1066,7 +1071,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
         return { status: "accepted", delivery: envelope.delivery };
     };
     // A recipient already holding the source reference is only woken; it never receives a second payload copy.
-    const forward = (kind, value, ownership, build) => {
+    const forward = (kind, value, ownership, build, assertAuthority) => {
         const prepared = prepare(kind, value, ownership);
         if ("settlement" in prepared)
             return Promise.resolve(prepared.settlement);
@@ -1078,7 +1083,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
         };
         return send(prepared.sourceReference
             ? { kind: "leader.wakeInputCustody", ...base, sentAtMs: getNowMs() }
-            : build(base, getNowMs()), ownership);
+            : build(base, getNowMs()), ownership, assertAuthority);
     };
     return {
         forwardCallback: ({ query, ownership }) => forward("leader.forwardCallback", query, ownership, (base, sentAtMs) => ({
@@ -1093,7 +1098,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
             reactionUpdate,
             sentAtMs,
         })),
-        forwardMessage: ({ message, ownership }) => forward("leader.forwardMessage", message, ownership, (base, sentAtMs) => {
+        forwardMessage: ({ message, ownership, assertAuthority }) => forward("leader.forwardMessage", message, ownership, (base, sentAtMs) => {
             const forwardCommentBatchPosition = deps.getForwardCommentBatchPosition?.(message);
             return {
                 kind: "leader.forwardMessage",
@@ -1104,7 +1109,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
                     : {}),
                 sentAtMs,
             };
-        }),
+        }, assertAuthority),
         forwardEditedMessage: ({ message, ownership }) => forward("leader.forwardEditedMessage", message, ownership, (base, sentAtMs) => ({
             kind: "leader.forwardEditedMessage",
             ...base,

package/dist/lib/routing.d.ts

@@ -209,7 +209,7 @@ export interface TelegramInboundRouteRuntimeDeps<TMessage extends TelegramRouted
     canUsePreDispatchRebind?: (recipient?: Threads.TelegramWorkspaceRestoreRecipient) => boolean;
     /** Strict complete namespace plus exact current/historical references; only an empty result clears journal protection. */
     inspectTemporaryThreadSources?: (target: Queue.TelegramQueueTarget, requiredJournalBindingKeys: readonly string[], ownInputs?: readonly Threads.TelegramTemporaryThreadInput[]) => readonly number[] | undefined;
-    /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 1000 ms. */
+    /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 0 ms. */
     temporaryThreadCleanupDelayMs?: number;
     /** Live-rebind cleanup attempt pacing; the bounded window ends in `not-issued`, never a time-based deletion. */
     liveRebindCleanupSchedule?: {

package/dist/lib/routing.js

@@ -1331,13 +1331,20 @@ export function createTelegramInboundRouteRuntime(deps) {
             requestDispatchNextQueuedTelegramTurn(ctx);
         },
     });
-    const cloneTelegramMessagesForThread = (messages, threadId) => {
-        return messages.map((message) => Updates.carryTelegramUpdateExecutionFence(message, {
-            ...message,
-            message_id: 0,
-            message_thread_id: threadId,
-            reply_to_message: undefined,
-        }));
+    const cloneTelegramMessagesForThread = (messages, threadId, copies) => {
+        return messages.map((message) => {
+            const ids = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+            const copyId = copies && ids.length === 1 ? copies.get(ids[0]) : undefined;
+            if (copies && (!Number.isSafeInteger(copyId) || copyId <= 0))
+                throw new Error("Reroute destination copy identity is unavailable.");
+            const routed = {
+                ...message,
+                message_id: copyId ?? 0,
+                message_thread_id: threadId,
+                reply_to_message: undefined,
+            };
+            return Updates.carryTelegramUpdateExecutionFence(message, copies ? Turns.withTelegramTurnReplyAnchor(routed) : routed);
+        });
     };
     /** Whether a chooser is still pending in this Thread, ignoring the ones the caller itself owns. */
     const hasPendingRerouteForTarget = (target, own) => [...pendingUnboundReroutes.values()].some((pending) => pending.sourceTarget.chatId === target.chatId &&
@@ -1603,10 +1610,12 @@ export function createTelegramInboundRouteRuntime(deps) {
         return !acceptedWorkClear;
     };
     /** Best-effort, once consumed: All keeps no copy of an input whose routing tab carried it; failure is only recorded. */
-    const deleteAllTabMessages = async (chatId, messageIds) => {
+    const deleteAllTabMessages = async (chatId, messageIds, isCurrent) => {
         if (!deps.deleteMessage)
             return;
         for (const messageId of messageIds) {
+            if (isCurrent?.() === false)
+                return;
             try {
                 await deps.deleteMessage(chatId, messageId);
             }
@@ -1620,13 +1629,14 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
     };
     /** One-shot per chooser: the copies are taken before deletion, so a later consuming path finds none. */
-    const deleteAllTabCopies = (pending) => deleteAllTabMessages(pending.sourceTarget.chatId, pending.allTabCopies?.splice(0) ?? []);
+    const deleteAllTabCopies = (pending, isCurrent) => deleteAllTabMessages(pending.sourceTarget.chatId, pending.allTabCopies?.splice(0) ?? [], isCurrent);
     /**
      * Restore keeps the tab as the Thread, so the input must stay visible there: the All original goes only when the tab
      * holds its forwarded copy. Without one it stays where the operator can still read it.
      */
     const releaseAllTabCopiesIntoSurvivingTab = (pending) => {
-        if (pending.allTabCopiesForwarded)
+        if (pending.allTabCopiesForwarded &&
+            isDeepStrictEqual(pending.allTabCopiesForwarded.target, pending.sourceTarget))
             return deleteAllTabCopies(pending);
         pending.allTabCopies?.splice(0);
         return Promise.resolve();
@@ -1640,39 +1650,109 @@ export function createTelegramInboundRouteRuntime(deps) {
         const messageIds = [...(pending.allTabCopies ?? [])].sort((a, b) => a - b);
         if (messageIds.length === 0 || !deps.callApi || !isCurrent())
             return;
+        const copyTarget = { ...target };
         const route = {
-            chat_id: target.chatId,
-            message_thread_id: target.threadId,
+            chat_id: copyTarget.chatId,
+            message_thread_id: copyTarget.threadId,
             from_chat_id: pending.sourceTarget.chatId,
             disable_notification: true,
         };
+        const options = {
+            maxAttempts: 1,
+            retrySafety: "non-idempotent",
+            assertAuthority() {
+                if (!isCurrent())
+                    throw new Error("Temporary Thread source forwarding authority changed.");
+            },
+        };
         try {
             // An album moves as one album; forwardMessages skips what it cannot forward, so a short reply is not a move.
             const copies = messageIds.length === 1
                 ? [
-                    await deps.callApi("forwardMessage", {
-                        ...route,
-                        message_id: messageIds[0],
-                    }),
+                    await deps.callApi("forwardMessage", { ...route, message_id: messageIds[0] }, options),
                 ]
-                : await deps.callApi("forwardMessages", { ...route, message_ids: messageIds });
+                : await deps.callApi("forwardMessages", { ...route, message_ids: messageIds }, options);
+            if (!isCurrent())
+                return;
             const copyIds = Array.isArray(copies)
                 ? copies.map((copy) => copy?.message_id)
                 : [];
             if (copyIds.length !== messageIds.length ||
-                !copyIds.every((id) => typeof id === "number" && Number.isSafeInteger(id)))
+                !copyIds.every((id) => typeof id === "number" && Number.isSafeInteger(id) && id > 0) ||
+                new Set(copyIds).size !== copyIds.length)
                 return;
-            pending.allTabCopiesForwarded = true;
-            await deleteAllTabCopies(pending);
-            return copyIds[0];
+            pending.allTabCopiesForwarded = {
+                target: copyTarget,
+                sourceMessageIds: messageIds,
+                messageIds: copyIds,
+            };
+            await deleteAllTabCopies(pending, isCurrent);
+            if (!isCurrent())
+                return;
+            return pending.allTabCopiesForwarded.messageIds[0];
         }
         catch (error) {
-            deps.recordRuntimeEvent?.("routing", error, {
-                phase: "temporary-thread-source-forward",
-            });
+            if (isCurrent())
+                deps.recordRuntimeEvent?.("routing", error, {
+                    phase: "temporary-thread-source-forward",
+                });
             return;
         }
     };
+    /** Read original source addresses, not warm target rewrites; unknown copy provenance never grants a Reroute. */
+    const resolvePendingRerouteForwardSource = (pending) => {
+        try {
+            const originals = pending.messages.map((message) => {
+                const snapshot = Updates.inspectTelegramDeferredSourceSnapshot(message);
+                const ids = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+                const original = snapshot?.update.message;
+                if (!snapshot ||
+                    ids.length !== 1 ||
+                    snapshot.source.updateId !== ids[0] ||
+                    snapshot.update.update_id !== ids[0] ||
+                    Object.keys(snapshot.update).some((key) => key !== "update_id" && key !== "message") ||
+                    snapshot.source.journalBindingKey !== deps.getAdmissionJournalBinding?.() ||
+                    !original ||
+                    original.chat?.type !== "private" ||
+                    original.chat.id !== pending.sourceTarget.chatId ||
+                    original.from?.id !== deps.configStore.getAllowedUserId() ||
+                    original.from?.is_bot !== false ||
+                    !Number.isSafeInteger(original.message_id) ||
+                    original.message_id <= 0)
+                    return undefined;
+                return { message: original, updateId: ids[0] };
+            });
+            if (originals.length === 0 || originals.some((source) => !source))
+                return;
+            originals.sort((a, b) => a.message.message_id - b.message.message_id);
+            const sourceMessageIds = originals.map((source) => source.message.message_id);
+            const sourceUpdateIds = originals.map((source) => source.updateId);
+            if (new Set(sourceMessageIds).size !== sourceMessageIds.length ||
+                new Set(sourceUpdateIds).size !== sourceUpdateIds.length)
+                return;
+            const copied = pending.allTabCopiesForwarded;
+            if (copied) {
+                if (!isDeepStrictEqual(copied.target, pending.sourceTarget) ||
+                    !isDeepStrictEqual(copied.sourceMessageIds, sourceMessageIds) ||
+                    copied.messageIds.length !== sourceMessageIds.length ||
+                    !copied.messageIds.every((id) => Number.isSafeInteger(id) && id > 0) ||
+                    new Set(copied.messageIds).size !== copied.messageIds.length)
+                    return;
+                return { chatId: copied.target.chatId, sourceUpdateIds, sourceMessageIds, messageIds: [...copied.messageIds] };
+            }
+            const nativeOriginals = originals.every((source) => typeof pending.sourceTarget.threadId === "number" &&
+                source.message.message_thread_id === pending.sourceTarget.threadId);
+            const retainedAllOriginals = pending.allTabSourceRetained === true &&
+                originals.every((source) => source.message.message_thread_id === undefined) &&
+                isDeepStrictEqual([...(pending.allTabCopies ?? [])].sort((a, b) => a - b), sourceMessageIds);
+            if (nativeOriginals || retainedAllOriginals)
+                return { chatId: pending.sourceTarget.chatId, sourceUpdateIds, sourceMessageIds, messageIds: [...sourceMessageIds] };
+        }
+        catch (error) {
+            deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-source-proof" });
+        }
+        return undefined;
+    };
     const dismissRerouteChooserMessage = async (query, assertExecutionCurrent) => {
         const chatId = query.message?.chat?.id;
         const messageId = query.message?.message_id;
@@ -4076,7 +4156,24 @@ export function createTelegramInboundRouteRuntime(deps) {
             wake(reason);
     };
     const onSessionSettled = (ctx) => wakeLiveRebindCleanup(ctx, "session-settled");
-    const onDeliverySettled = (ctx) => wakeLiveRebindCleanup(ctx, "delivery-drained");
+    const onDeliverySettled = (ctx) => {
+        wakeLiveRebindCleanup(ctx, "delivery-drained");
+        const cap = captureTemporaryThreadAuthority(ctx);
+        if (!cap?.isCurrent())
+            return;
+        try {
+            for (const entry of cap.store.listTemporaryThreads()) {
+                if (!cap.isCurrent())
+                    return;
+                if (entry.phase === "created" && entry.target && !entry.cleanupIssued &&
+                    Threads.isTelegramTemporaryThreadFullyResolved(entry))
+                    scheduleTemporaryThreadCleanup(entry.target, ctx);
+            }
+        }
+        catch (error) {
+            deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-drain" });
+        }
+    };
     const restoreWorkspace = deps.workspaceRestoreRecipient
         ? async (input) => {
             const ports = deps.workspaceRestoreRecipient;
@@ -4532,6 +4629,92 @@ export function createTelegramInboundRouteRuntime(deps) {
             return false;
         }
     };
+    /** Publish display copies under the native one-shot grant; positive output is not input/source settlement. */
+    const publishPendingRerouteCopies = async (pending, record, ctx, assertExecutionCurrent, foreign) => {
+        const source = resolvePendingRerouteForwardSource(pending);
+        const target = { ...record.target };
+        const recordIdentity = (value) => value && ({
+            target: value.target, profileKey: value.profileKey, owner: value.owner,
+            instanceId: value.instanceId, slot: value.slot, createdAtMs: value.createdAtMs,
+        });
+        const bindingIdentity = () => deps.threadStore.listWorkspaceBindings()
+            .filter((value) => isDeepStrictEqual(value.target, target))
+            .map((value) => ({ bindingKey: value.bindingKey, sessionId: value.sessionId, sessionKey: value.sessionKey,
+            cwd: value.cwd, workspaceKey: value.workspaceKey, instanceSlot: value.instanceSlot, slot: value.slot,
+            target: value.target }));
+        const expectedRecord = structuredClone(recordIdentity(record));
+        const expectedBindings = structuredClone(bindingIdentity());
+        const ownership = deps.getTargetOwnership?.(target);
+        if (!source || !deps.callApi || expectedBindings.length > 1 ||
+            (foreign && (!ownership || ownership.instanceId !== record.instanceId ||
+                !ownership.ownerGeneration || !ownership.recipientBindingKey)))
+            return;
+        const expectedOwnership = ownership && structuredClone(ownership);
+        const cap = captureTemporaryThreadAuthority(ctx, () => {
+            try {
+                assertExecutionCurrent();
+                const current = getTelegramRoutableThreadRecords(deps.threadStore.list(), deps.getLiveThreadTargets?.())
+                    .find((value) => isDeepStrictEqual(value.target, target));
+                return isDeepStrictEqual(recordIdentity(current), expectedRecord) &&
+                    isDeepStrictEqual(bindingIdentity(), expectedBindings) &&
+                    (!foreign || Bus.isTelegramBusForwardOwnershipCurrent(expectedOwnership, deps.getTargetOwnership?.(target)));
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!cap?.isCurrent())
+            return;
+        const temporary = pending.temporaryThread ?? findCreatedTemporaryThread(pending.sourceTarget);
+        if (!temporary || !issueTemporaryThreadForward(pending, ctx))
+            return;
+        pending.phase = { kind: "forward-unknown" };
+        const assertRecipientCurrent = () => {
+            assertExecutionCurrent();
+            if (!cap.isCurrent())
+                throw new Error("Reroute publication recipient authority changed.");
+        };
+        const assertPublicationCurrent = () => {
+            assertRecipientCurrent();
+            const entry = cap.store.listTemporaryThreads().find((value) => value.token === temporary.token);
+            const ids = [...source.sourceUpdateIds].sort((a, b) => a - b);
+            if (!entry || entry.phase !== "created" || entry.cleanupIssued ||
+                entry.operatorUserId !== cap.operatorUserId ||
+                !isDeepStrictEqual(entry.executor, cap.authority.executor) ||
+                !isDeepStrictEqual(entry.target, pending.sourceTarget) ||
+                !entry.forwardedInputs?.some((input) => input.journalBindingKey === cap.journalBindingKey &&
+                    isDeepStrictEqual(input.updateIds, ids)) ||
+                !isDeepStrictEqual(resolvePendingRerouteForwardSource(pending), source))
+                throw new Error("Reroute publication source authority changed.");
+        };
+        try {
+            assertPublicationCurrent();
+            // Bot API requires ascending source IDs. Preserve the source-UID association even if copy IDs reorder them.
+            const order = source.messageIds.map((_, index) => index)
+                .sort((a, b) => source.messageIds[a] - source.messageIds[b]);
+            const messageIds = order.map((index) => source.messageIds[index]);
+            const body = { chat_id: target.chatId, message_thread_id: target.threadId,
+                from_chat_id: source.chatId, disable_notification: true };
+            const options = { maxAttempts: 1, retrySafety: "non-idempotent", assertAuthority: assertPublicationCurrent };
+            const copies = messageIds.length === 1
+                ? [await deps.callApi("forwardMessage", { ...body, message_id: messageIds[0] }, options)]
+                : await deps.callApi("forwardMessages", { ...body, message_ids: messageIds }, options);
+            assertPublicationCurrent();
+            const copyIds = Array.isArray(copies) ? copies.map((copy) => copy?.message_id) : [];
+            if (copyIds.length !== messageIds.length ||
+                !copyIds.every((id) => typeof id === "number" && Number.isSafeInteger(id) && id > 0) ||
+                new Set(copyIds).size !== copyIds.length)
+                return;
+            pending.rerouteCopies = { target, bySourceUpdateId: new Map(order.map((index, position) => [source.sourceUpdateIds[index], copyIds[position]])) };
+            pending.phase = { kind: "selected" };
+            return assertRecipientCurrent;
+        }
+        catch (error) {
+            if (cap.isCurrent())
+                deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-destination-forward" });
+            return;
+        }
+    };
     const forwardPendingRerouteMessages = async (pending, instanceId, threadId, ctx, assertExecutionCurrent, recordForwardAcceptance) => {
         assertExecutionCurrent?.();
         const forwardMessage = deps.foreignOwnedUpdateForwarder?.forwardMessage;
@@ -4545,11 +4728,14 @@ export function createTelegramInboundRouteRuntime(deps) {
             !liveOwnership.recipientBindingKey)
             return false;
         const ownership = structuredClone(liveOwnership);
-        const messages = cloneTelegramMessagesForThread(pending.messages, threadId);
+        const copies = pending.rerouteCopies;
+        const published = !!copies && isDeepStrictEqual(copies.target, target);
+        const messages = cloneTelegramMessagesForThread(pending.messages, threadId, published ? copies.bySourceUpdateId : undefined);
         // Issuance is durable before the RPC: an unacknowledged temporary-tab Forward never becomes another dispatch grant,
         // even after restart. Any refusal or publication failure sends nothing and keeps the input held.
         if (!recordForwardAcceptance &&
             isTemporaryReroute(pending) &&
+            !published &&
             !issueTemporaryThreadForward(pending, ctx)) {
             if (isTemporaryThreadForwardIssued(pending))
                 pending.phase = { kind: "forward-unknown" };
@@ -4561,6 +4747,10 @@ export function createTelegramInboundRouteRuntime(deps) {
             message,
             ownership,
             ctx,
+            assertAuthority() {
+                assertExecutionCurrent?.();
+                Updates.assertTelegramUpdateExecutionCurrent(message);
+            },
         })));
         assertExecutionCurrent?.();
         if (!isDeepStrictEqual(deps.getTargetOwnership?.(target), ownership))
@@ -4719,6 +4909,17 @@ export function createTelegramInboundRouteRuntime(deps) {
             if (retry)
                 restoreSettlementTasks.add(task);
             runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+                .then(() => {
+                if (!cap.isCurrent())
+                    return;
+                const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+                // A follower ACK can precede recipient receipt disposal. Reobserve a protected, unissued tab;
+                // elapsed time never grants deletion, and an issued/unknown delete can never enter this path.
+                if (retained?.phase === "created" && !retained.cleanupIssued &&
+                    Threads.isTelegramTemporaryThreadFullyResolved(retained) &&
+                    cap.store.inspectTemporaryThreadTarget(retained, cap.authority)?.kind === "temporary" && cap.isCurrent())
+                    queueTemporaryThreadCleanup(token, cap, 1000, reconcileExpiry, true);
+            })
                 .catch((error) => {
                 deps.recordRuntimeEvent?.("routing", error, {
                     phase: "temporary-thread-cleanup",
@@ -5244,7 +5445,7 @@ export function createTelegramInboundRouteRuntime(deps) {
             for (const [id, pending] of pendingUnboundReroutes) {
                 if (!Updates.collectTelegramAdmissionSourceUpdateIds(pending.messages).includes(source.original.updateId))
                     continue;
-                movedIntoTab ||= pending.allTabCopiesForwarded === true;
+                movedIntoTab ||= pending.allTabCopiesForwarded !== undefined;
                 removePendingReroute(id);
                 if (signal.aborted ||
                     deps.isContextActive?.(ctx) !== true ||
@@ -6047,6 +6248,12 @@ export function createTelegramInboundRouteRuntime(deps) {
                                                     : "Input queued in the rebound Thread; old-Thread cleanup is scheduled, not confirmed", assertExecutionCurrent, true);
             return true;
         }
+        if (!parsed.useNewSlot &&
+            isTemporaryReroute(pending) &&
+            !resolvePendingRerouteForwardSource(pending)) {
+            await deps.answerCallbackQuery(query.id, "Source copy unavailable; not routing");
+            return true;
+        }
         if (!(await selectPendingDestination()))
             return true;
         if (parsed.useNewSlot && sourceTarget && restoreWorkspace) {
@@ -6130,10 +6337,22 @@ export function createTelegramInboundRouteRuntime(deps) {
             await deps.answerCallbackQuery(query.id, delivered ? "Restored" : "Restore unconfirmed; not resending");
             return true;
         }
+        let assertRerouteCurrent = assertExecutionCurrent;
+        if (isTemporaryReroute(pending)) {
+            const confirmed = await publishPendingRerouteCopies(pending, record, ctx, assertExecutionCurrent, !!record.instanceId && record.instanceId !== currentInstanceId && !isCurrentLeaderRecord);
+            if (!confirmed) {
+                await deps.answerCallbackQuery(query.id, pending.phase.kind === "forward-unknown"
+                    ? "Publication unconfirmed; not resending"
+                    : "Publication unavailable; input kept");
+                return true;
+            }
+            assertRerouteCurrent = confirmed;
+        }
+        assertRerouteCurrent();
         if (record.instanceId &&
             record.instanceId !== currentInstanceId &&
             !isCurrentLeaderRecord) {
-            const allForwarded = await forwardPendingRerouteMessages(pending, record.instanceId, parsed.threadId, ctx, assertExecutionCurrent);
+            const allForwarded = await forwardPendingRerouteMessages(pending, record.instanceId, parsed.threadId, ctx, assertRerouteCurrent);
             if (!allForwarded) {
                 await deps.answerCallbackQuery(query.id, pending.phase.kind === "forward-unknown"
                     ? "Delivery unconfirmed; not resending"
@@ -6144,11 +6363,16 @@ export function createTelegramInboundRouteRuntime(deps) {
         }
         // Local handlers and queue admission consume the same one-time group grant as follower forwarding.
         if (isTemporaryReroute(pending) &&
+            !pending.rerouteCopies &&
             !issueTemporaryThreadForward(pending, ctx)) {
             await deps.answerCallbackQuery(query.id, "Delivery unconfirmed; not resending");
             return true;
         }
-        await dispatchPendingRerouteMessages(pending, reroutedMessages, ctx);
+        const localMessages = pending.rerouteCopies
+            ? cloneTelegramMessagesForThread(pending.messages, parsed.threadId, pending.rerouteCopies.bySourceUpdateId)
+            : reroutedMessages;
+        await dispatchPendingRerouteMessages(pending, localMessages, ctx);
+        assertRerouteCurrent();
         pending.messages = [];
         return completeRoutedReroute();
     };
@@ -7325,6 +7549,14 @@ export function createTelegramInboundRouteRuntime(deps) {
         const tabCopyId = openedNow
             ? await moveAllTabSourceIntoTab(pending, target, current)
             : undefined;
+        if (!current()) {
+            removePendingReroute(rerouteId);
+            throw new Error("Temporary Thread source presentation authority changed.");
+        }
+        if (openedNow &&
+            !pending.allTabCopiesForwarded &&
+            pending.allTabCopies.length === held.length)
+            pending.allTabSourceRetained = true;
         try {
             if (!deps.sendInteractiveMessage)
                 throw new Error("Temporary Thread chooser publication is unavailable.");

package/dist/lib/turns.d.ts

@@ -9,6 +9,10 @@ import { type TelegramVoiceReplyMode } from "./voice.ts";
 export declare const TELEGRAM_PREFIX = "[telegram]";
 /** A routed source keeps its unique message/file/group identity, but cannot quote an anchor in its former tab. */
 export declare function withoutTelegramTurnReplyAnchor<TMessage extends object>(message: TMessage): TMessage;
+/** A confirmed same-target copy may replace the former-tab suppression on a warm input projection. */
+export declare function withTelegramTurnReplyAnchor<TMessage extends {
+    message_id: number;
+}>(message: TMessage): TMessage;
 export declare const TELEGRAM_GUEST_TURN_NOTE = "[guest] delivery: answer quickly with one concise, self-contained reply";
 export interface TelegramTurnTarget {
     chatId: number;

package/dist/lib/turns.js

@@ -14,6 +14,12 @@ const REPLY_ANCHOR_SUPPRESSED = Symbol.for("@llblab/pi-telegram:reply-anchor-sup
 export function withoutTelegramTurnReplyAnchor(message) {
     return { ...message, [REPLY_ANCHOR_SUPPRESSED]: true };
 }
+/** A confirmed same-target copy may replace the former-tab suppression on a warm input projection. */
+export function withTelegramTurnReplyAnchor(message) {
+    if (!Number.isSafeInteger(message.message_id) || message.message_id <= 0)
+        throw new Error("Telegram reply anchor requires a positive message ID.");
+    return { ...message, [REPLY_ANCHOR_SUPPRESSED]: false };
+}
 export const TELEGRAM_GUEST_TURN_NOTE = "[guest] delivery: answer quickly with one concise, self-contained reply";
 function getTelegramTurnTarget(message) {
     return Number.isInteger(message.message_thread_id)

package/dist/lib/updates.d.ts

@@ -141,6 +141,8 @@ export interface TelegramForeignOwnedUpdateForwarder<TContext, TReactionUpdate e
         message: TMessage;
         ownership: TelegramTargetOwnershipView;
         ctx: TContext;
+        /** Local issuance/ACK fence; implementations must not serialize it into payloads. */
+        assertAuthority?: () => void;
     }) => Promise<TelegramBusForeignUpdateSettlement> | TelegramBusForeignUpdateSettlement;
     forwardEditedMessage?: (input: {
         message: TMessage;

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.55.0",
+  "version": "0.55.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/docs/architecture.md

@@ -477,10 +477,12 @@ With confirmed Threaded Mode, live bindings or a retained temporary entry, a kno
 
 #### Temporary Thread Multi-Input Lifecycle (Approved Design)
 
-Every temporary routing tab carries one fixed routing name ([copy](./ui-style.md#route-chooser)), never its first input, because later prompts may join it: the bot creates its own tabs with that name and renames a native tab once, best-effort, when it adopts it. Commands and prompts share the same mode chooser. A command delivered with a Telegram-provided unbound private target uses the same chooser and fresh exact-source Cancel capability in that tab, without renaming it or creating another one. Mobile clients sending from `All` first create an implicitly named native tab and then deliver the input without a thread ID, although the client shows it inside that tab: an `All` input whose text starts with the name of such an observation (mobile names the tab after the input), or whose update immediately follows it (generic names such as desktop's `New Chat`), from the same exact scope and created at most ten seconds earlier, registers that native tab as its temporary tab through `registerImplicitTemporaryThread` instead of creating a second one, and renames it once to the routing name. A received target or successful rename alone never manufactures temporary authority. A fresh owner-authenticated private `forum_topic_created` with literal `is_name_implicit: true` supplies native creation evidence: routing retains a bounded process-local observation tied to the exact context, session generation, admission scope, operator, journal binding and executor. The next live input group in that exact target, of any content kind and either one message or an album, registers it through Threads `registerImplicitTemporaryThread` under profile admission, with that group as the entry's first input (its smallest update ID is the source), without calling or fabricating `createForumTopic` (adoption renames it once, best-effort); the publication CAS refuses any binding, owner record, reservation, provisioning, cleanup or Restore conflict. Normal grouped membership, one-shot Forward, source disposition, last-Cancel quiet period and cleanup issuance then apply identically. Historical creation signals, context/epoch changes, manual names, string flags, foreign creators and missing observations grant nothing. The observation is consumed on registration, never reconstructed from a title or restart. Existing bindings/reservations and acknowledged temporary targets retain their protections. Their root chooser offers Reroute, Restore and eligible Cancel; each mode opens its own submenu of live thread targets without dispatching the held input. A submenu Back returns to the mode chooser with its exact original description, retained on that pending chooser; navigation never substitutes or recomputes the root copy. Copy, emoji and button layout live in [UI Style](./ui-style.md#route-chooser). Cancel appears only at the root. After cancellation, the immediate cleanup remains proof-gated. Private-chat temporary tabs skip the unsupported `closeForumTopic` call and issue only one `deleteForumTopic` attempt; literal positive deletion acknowledgement is still required, and uncertainty never authorizes a retry. Every kind of input sent from All takes this path: a lone text message may carry a command, while a voice note, file or sticker is held untouched as a prompt, and an album first gathers through the shared pending-group machine into one input whose whole update group the tab records as its creating input (`reserveTemporaryThread` with a group starting at the source update). All is input-only: no assistant answer, chooser, fallback guidance, draft or activity is emitted there. A failed routing-tab creation retains the source, including a coalesced album, rather than silently settling it. A stale Thread does not prove Classic Mode. The transport/API fence rejects private output without a valid top-level Thread, including retained aggregate markers; Classic DM and explicit channel/business namespaces remain separate. No historical All-output cleanup is scheduled. The Bot API files every threadless All input in All, a desktop menu-picked command as well as a mobile input its client first draws inside its new native tab. So a tab opened for such an input (bot-created or adopted, never on restart re-entry) first receives one silent best-effort `forwardMessage` of it, its chooser replies to that copy, and only a confirmed copy lets the bot delete the All original at once: the input moves into its tab on every client. A failed forward keeps the original in All; it is then deleted best-effort when the input is consumed by Forward, Cancel or expiry, which remove the tab too, but never by Restore, which keeps the tab as the Thread and must not leave it without its input. Failure is recorded and never retried. Pending-cancellation recovery deletes nothing, and typed All inputs already live in their own tab and leave with it.
+Every temporary routing tab carries one fixed routing name ([copy](./ui-style.md#route-chooser)), never its first input, because later prompts may join it: the bot creates its own tabs with that name and renames a native tab once, best-effort, when it adopts it. Commands and prompts share the same mode chooser. A command delivered with a Telegram-provided unbound private target uses the same chooser and fresh exact-source Cancel capability in that tab, without renaming it or creating another one. Mobile clients sending from `All` first create an implicitly named native tab and then deliver the input without a thread ID, although the client shows it inside that tab: an `All` input whose text starts with the name of such an observation (mobile names the tab after the input), or whose update immediately follows it (generic names such as desktop's `New Chat`), from the same exact scope and created at most ten seconds earlier, registers that native tab as its temporary tab through `registerImplicitTemporaryThread` instead of creating a second one, and renames it once to the routing name. A received target or successful rename alone never manufactures temporary authority. A fresh owner-authenticated private `forum_topic_created` with literal `is_name_implicit: true` supplies native creation evidence: routing retains a bounded process-local observation tied to the exact context, session generation, admission scope, operator, journal binding and executor. The next live input group in that exact target, of any content kind and either one message or an album, registers it through Threads `registerImplicitTemporaryThread` under profile admission, with that group as the entry's first input (its smallest update ID is the source), without calling or fabricating `createForumTopic` (adoption renames it once, best-effort); the publication CAS refuses any binding, owner record, reservation, provisioning, cleanup or Restore conflict. Normal grouped membership, one-shot Forward, source disposition, last-Cancel quiet period and cleanup issuance then apply identically. Historical creation signals, context/epoch changes, manual names, string flags, foreign creators and missing observations grant nothing. The observation is consumed on registration, never reconstructed from a title or restart. Existing bindings/reservations and acknowledged temporary targets retain their protections. Their root chooser offers Reroute, Restore and eligible Cancel; each mode opens its own submenu of live thread targets without dispatching the held input. A submenu Back returns to the mode chooser with its exact original description, retained on that pending chooser; navigation never substitutes or recomputes the root copy. Copy, emoji and button layout live in [UI Style](./ui-style.md#route-chooser). Cancel appears only at the root. After cancellation, the immediate cleanup remains proof-gated. Private-chat temporary tabs skip the unsupported `closeForumTopic` call and issue only one `deleteForumTopic` attempt; literal positive deletion acknowledgement is still required, and uncertainty never authorizes a retry. Every kind of input sent from All takes this path: a lone text message may carry a command, while a voice note, file or sticker is held untouched as a prompt, and an album first gathers through the shared pending-group machine into one input whose whole update group the tab records as its creating input (`reserveTemporaryThread` with a group starting at the source update). All is input-only: no assistant answer, chooser, fallback guidance, draft or activity is emitted there. A failed routing-tab creation retains the source, including a coalesced album, rather than silently settling it. A stale Thread does not prove Classic Mode. The transport/API fence rejects private output without a valid top-level Thread, including retained aggregate markers; Classic DM and explicit channel/business namespaces remain separate. No historical All-output cleanup is scheduled. The Bot API files every threadless All input in All, a desktop menu-picked command as well as a mobile input its client first draws inside its new native tab. So a tab opened for such an input (bot-created or adopted, never on restart re-entry) first receives one silent best-effort `forwardMessage` of it, its chooser replies to that copy, and only a confirmed copy lets the bot delete the All original at once: the input moves into its tab on every client. That opening forward has one unretried, generation-fenced API attempt. Only a complete set of distinct positive safe-integer copy IDs acknowledged under current authority permits removal of the All originals. The live chooser retains the exact target and full source/copy ID mapping as display provenance, not input acceptance or cleanup authority; this warm mapping is not a cold-recovery grant and never rewrites journal originals. Temporary Reroute resolves its forwarding addresses from fresh worker-owned original snapshots before selecting the destination: exact source binding/update, paired sender, bot-chat message namespace and positive unique original IDs must all match. Complete warm copies take precedence; original All IDs may be reused only when this live opening attempt is known not to have removed them. A revived chooser cannot reconstruct that fact from journal IDs or its saved location. Unknown cold All copies, unavailable readers, partial group proof and synthetic zero IDs refuse Reroute before native issuance, leaving the source waiting with its exact Cancel capability; actual native-Thread originals may still be recovered. Warm target projection is not proof of an original message location. Restore retains its separate held-input path. Ended authority stops subsequent original-removal delegation and chooser publication; already issued requests cannot be unsent. A failed forward keeps the original in All; it is then deleted best-effort when the input is consumed by Forward, Cancel or expiry, which remove the tab too, but never by Restore, which keeps the tab as the Thread and must not leave it without its input. Failure is recorded and never retried. Pending-cancellation recovery deletes nothing, and typed All inputs already live in their own tab and leave with it.
 
 This multi-input lifecycle is implemented in the local candidate, not authority for live deletion. It supersedes unconditional per-chooser tab removal. The reject-only guard prevents cleanup/retirement while another known same-tab chooser remains, including unresolved cleanup-only work. `temporaryThreads.inputs` now records bounded append-only journal source groups through the unbound producer before chooser publication; duplicates are read-only, partial/foreign/overlapping groups refuse, and faults retain the source without a new chooser. Cold reads preserve this protection without process-local chooser memory. A group has no readiness or disposition flag, and an absent legacy field does not prove complete coverage. `cancelledInputs` records exact whole known donor groups after either same-journal/operator retained-cancellation evidence or the separate body-free expiry tombstone. Expiry recording may clear a group's unknown Forward issuance or its expired Restore intent, but never mutates a canonical binding, recipient queue or immutable scoped settlement proof. If Restore already bound the tab, expiry releases the temporary frame without deletion. Otherwise fully resolved groups enter the existing one-second quiet-period cleanup. A partially acknowledged known cohort may finish donor disposition when every member is absent from that exact source journal and at least one member has same-operator expiry proof; this is not recipient completion or non-delivery proof. Fresh strict namespace/protection evidence still gates deletion; independent work and bound Threads remain protected. Store publication and returned/retained acknowledgement recheck that proof and operator/executor authority; a lost reply reconciles the exact fact read-only, while missing/foreign/corrupt proof stays protective. The producer composes this into explicit Cancel before temporary cleanup or chooser retirement. Cancelled groups cannot Restore; independent sources remain untouched. More than one known group still blocks cleanup and raw retirement, including all-cancelled membership: these facts grant no deletion. Each successful Cancel retires only its own chooser. If durable membership is fully resolved by exact cancellation/completion facts and no chooser remains, a process-local cleanup is queued with no grace delay (it still waits behind the resolving operation's Workspace admission, which Cancel releases right after its notice, answering the toast and deleting any All copy alongside the cleanup; new input in the tab before it runs cancels it). Its single attempt, under profile admission, rechecks authority, whole-group cancellation/expiry evidence, exact entry CAS, a strict per-Thread journal census (every namespace source must read strictly; any retained update naming the Thread in any state, any of its own groups, and any custody-bearing, failed or non-plain entry anywhere still protect; only an unrelated waiting plain message, edit, callback or reaction elsewhere is exempt, so a chooser held in another tab cannot pin every temporary tab, and so is a plain button tap in this tab, since it carries no input and the in-flight Cancel itself may outlast the quiet period), absence of choosers and the normal reconciler protections. `issueTemporaryThreadCleanup` publishes canonical `cleanupIssued: true` only for an exact fully resolved entry with strict unbound canonical evidence checked inside the publication transaction; the normal target/source guards precede issuance and run again at API boundaries. The reconciler requires that exact retained issued frame and limits its plan to this tab; unrelated expired-provision cleanup never borrows the grant. Close/delete calls disable retries and transport fallback and require a positive acknowledgement. Confirmed current deletion alone permits entry retirement; skip, negative/lost reply, authority loss or post-rename publication interruption retains the marker. Cold reads classify already-issued entries as unknown, new membership refuses, and executor adoption never renews the grant. Missing evidence only refuses; an unpublished grant issues no API call and may still receive its first grant. The quiet period remains process-local, but issued uncertainty survives restart. The census cannot see updates in transit before journal append. Restore from a multi-input tab is allowed only when each other known group is durably cancelled, Forward-completed or a live unselected chooser that supports private abandonment. A previously completed Forward never supplies a new selection or cancellation grant. After positive settlement of every selected source, such siblings are abandoned with cancellation facts and their controls edited to cancelled, then `retireTemporaryThread(expected, authority, completed)` releases the entry (one newly completed selected group, all others durably cancelled or previously Forward-completed). Missing authority/proof or an unproven Restore leaves siblings pending and protected. On startup, a retained journal input recorded in a created temporary tab whose target a Workspace binding now owns is held as historical, never rerouted; an exact saved chooser clock may expire its unclaimed donor attempt without affecting the binding. Live pending sources and due retry-wait sources (including startup retries) use the same fresh membership/binding predicate through `shouldHoldPendingInput` before execution, with source/context/binding/transport checks after classification awaits. The hold grants neither cancellation nor delivery and does not block unrelated inputs. Recipient custody never uses this direct-source classifier. A native production witness admits a recorded command after the worker has already processed an unrelated command, proving it cannot fall through to ordinary bound dispatch. A production retry witness keeps recorded failure metadata intact without command execution, cancellation or deletion. Claimed retries cannot schedule repeated due-time wakes; independent due and future retries remain executable. Real-IPC Forward/Restore sibling witnesses now include recipient journal drain through the real worker and follower router: only the selected message executes, source disposal is observed, and repeated controls do not replay the command. Existing message-ownership composition keeps a locally published chooser's callbacks at its leader publisher after follower rebinding; the native fixture now records publication ownership rather than relying only on target ownership. Four native delivery-reply-loss witnesses cover both routing actions (Forward/Restore), before recipient execution and after worker disposal: the leader source remains unresolved without ACK, independent sibling Cancel preserves the selected group/tab, and a late reply or repeated issued Restore click cannot settle/replay it. Explicit Forward retry after a lost ACK reproduced command duplication when the recipient worker had already disposed its journal record; stable delivery identity alone was not terminal deduplication. The follower's bounded process-local delivery window now acknowledges such a retry without re-execution while it retains that delivery. Ordinary Forward from a temporary tab first publishes a durable per-group `forwardedInputs` issuance fact in the canonical Threads owner under current authority, before either local command handling/prompt preparation/queue admission or follower RPC. Only positively unpublished issuance may receive its first grant; a published fact (even if its reply is ambiguous) is never retried, including after reload, restart or leader replacement. Local repeated selection refuses the retained grant before handler or queue re-entry. Captured All-tab provenance and acknowledged typed-input membership remain protective if the metadata reader disappears; unavailable evidence never falls back to unguarded generic dispatch. Restore retains its separate canonical routing grant. Native local fixtures interrupt source completion before/after commit, prompt preparation and issuance publication/authority; issued sources stay nonterminal, independent siblings remain cancellable and cold restart never manufactures completion or another attempt. A process-local `forward-unknown` chooser phase gates the live chooser. An issued group is refused by repeat Forward, explicit Cancel and Restore (the store also rejects them); before its fixed chooser deadline it keeps sibling accounting protective, while body-free donor expiry or positive `completedInputs` may resolve it; independent siblings remain operable and a restarted chooser cannot resend. Issuance is not proof of delivery, and recipient-side deduplication is limited to the bounded process-local delivery window; the chooser deadline supplies a loss-accepting exit for unclaimed unknown issued groups; generic journal forwarding and non-chooser retry policy are unchanged. Canonical Restore keeps its existing durable grants. Mixed native witnesses prove that a completed Forward allows Restore of another group without replay/recancellation, while an unknown Forward prevents sibling Restore before an intent is created. Prompt Restore leaves a command sibling pending at queue admission, then privately cancels it only after exact scoped worker receipt disposition. Independently Forwarded queued input is neither unassigned nor cancellation-capable: either receipt may dispose first, the other retains custody, and only both positive dispositions release temporary membership while keeping the bound tab/slot. An ordinary queued ACK emits the existing source-completion hint only after whole acknowledged removal and fresh context, owner, generation and originating journal-binding checks; it creates no immutable Restore marker. A published independent Forward group fact wakes pure inspection of already settled Restore only after its Workspace admission releases. The store refuses both Forward facts and cancellation for any source overlapping a retained Restore grant, regardless of target; malformed partial selected groups stay protective. Native ordinary prompt Forward plus sibling Cancel also delays deletion until receipt disposition and fresh all-resolved cleanup. Pi handoff is supplied by the fixture, not observed model/task completion. The retained All-command fixture registers 84 scenarios across creation, Forward, Cancel, cleanup/membership and Restore, including full slots, publication faults, sibling protection, native Unix IPC and recipient worker drain through the real non-reentrant Workspace gate. Full-slot follower cases hold a real Unix response before apply, after apply, and after read-only inspection until client timeout. Fresh same-session registration/context generations reconcile only through inspection; late replies never publish readiness, repeat apply or dispatch, cancel siblings, release independent queued recipient work or delete the tab. Successful continuation retains exact scoped source-disposition proof. A separate cold-successor witness loads fresh stores and a journal binding after an issued command lost acceptance authority, then starts a fresh context/generation/epoch under supplied same-session owner publication. Original command and sibling stay pending, spent routing/canonical facts remain unchanged, and stale Restore/Forward/Cancel controls cannot replay or dispose them. No chooser is reconstructed: the protective hold is proven, not a usable cold recovery surface. Pi effects and startup registration remain supplied adapters/preconditions; actual Pi startup and live behavior were accepted in the operator's 0.52.0 live smoke. Forward completes only its own input: no Forward removes the tab, the worker's completion ACK records a durable `completedInputs` group (process-local accumulation across the group's sources), and when every known group is cancelled or completed the delayed, fully rechecked cleanup removes the tab once. Cancelled and completed groups are disjoint, cannot Restore, and a completed Forward queued prompt holds the tab until its receipt completes. The tab chooser discloses removal only when no other input remains; a failed removal no longer edits the original chooser. Source-only prompt Cancel remains unchanged. The candidate's temporary-tab chooser is the default under the owned leader epoch, not a configurable feature flag. Upgrade all prospective canonical readers/writers before live activation; the metadata (including `forwardProtocol`, `forwardedInputs` and `cleanupIssued`) is not downgrade-safe through older snapshot writers, which could drop issuance facts.
 
+Temporary Reroute publishes the prompt in its selected destination before local queue/command admission or follower IPC. The existing exact whole-group `forwardedInputs` grant precedes this one unretried Bot API request as well as native dispatch; complete distinct positive returned IDs provide display/reply anchors, never source acceptance or settlement. `forwardMessages` preserves albums and requires ascending source IDs, so the warm map correlates each destination ID with its immutable original source update ID rather than a routed zero ID or array position. Acknowledged routing copies are preferred; a proven still-retained All original or real native-Thread original may supply the source instead. Before issuance and after awaits, guards recheck source/executor/operator/context/generation/profile, exact issued group, live recipient record and Workspace session binding; followers also retain their exact registration/protocol ownership. API and IPC callbacks stay local. Reroute passes recipient/session authority plus each original execution fence to the existing socket connect/write/ACK checks, with one guarded transport attempt; a stale post-write ACK cannot settle donor custody or undo accepted recipient work. The input's warm projection uses the confirmed copy ID and clears former-tab reply suppression before carrying the original execution fence; donor journal originals remain untouched. A partial/malformed/lost API reply or revoked authority keeps the issued group nonterminal with no output or native retry, even after restart. A lost native IPC ACK similarly retains donor authority and cannot replay an already accepted recipient input or its display copies. Local receipt disposal and exact whole-group foreign source-removal ACKs still own temporary cleanup; neither a visible copy nor model completion grants deletion. A follower donor ACK may precede recipient receipt disposal, so a fully resolved but protected, unissued tab retains one metadata-only one-second recheck and accepts existing session-delivery drain wakes. Every attempt reacquires profile admission and fresh namespace/binding/source/authority proof; time is not a deletion grant. A fresh runtime drain can reobserve retained completed membership without replaying its input. Issued or unknown deletion never repeats. Restore's held-input sequencing and cleanup schedules are unchanged.
+
 - `Membership`: A positively source-linked disposable temporary Thread owns no Pi binding or A–Z slot and may contain multiple independent unassigned inputs, each with its own routing controls. Track exact journal source/group membership, including additional inputs, rather than treating the first chooser or a process-local count as the whole Thread. Serialize admission, selection, cancellation, Restore and cleanup through the existing Workspace admission and mutation owners; unreadable, incomplete, selected, accepted, running or unknown-issued evidence blocks deletion.
 - `Per-input Cancel`: Privately retain the exact original and positively commit source-only cancellation before acknowledging `Routing cancelled` and deleting its one-shot chooser message. Other unassigned inputs retain their choosers and custody; cancelling one input neither delivers nor cancels siblings. No separate Cancel-and-delete action or extra confirmation dialog is required, but the chooser must disclose the conditional whole-tab deletion consequence.
 - `Last-resolution cleanup`: Only an explicit Cancel or positive completion of an explicitly issued Forward that resolves the final known group may schedule deletion of the entire still-temporary Telegram tab, including all its messages. The operator-approved grace is now zero, superseding the earlier 1-second and 2–3-second designs: deletion is attempted right after the chooser is deleted. For Last Cancel, scheduling follows positively recorded whole-group cancellation and successful retirement of the final chooser, not the initial button tap. The timer establishes earliest eligibility for one proof-gated cleanup attempt, not an exact deletion time: Workspace admission, fresh protection checks and Bot API latency may delay or refuse it. Actual client timing was accepted in the operator's 0.52.0 live smoke. Mirrored native witnesses use shortened injected delays, not a production-default or Telegram-client timing measurement. This grace is presentation timing, not proof of emptiness or non-delivery. New input or a changed binding/authority cancels the scheduled cleanup. Immediately before issuance, reacquire current Workspace admission, recheck exact operator/profile/session/leader/source/target authority, positive disposable-tab provenance, complete source dispositions and all Thread protection, then publish the canonical one-shot temporary cleanup grant. A restored/bound Thread or any unresolved/unverifiable work remains protected. TTL, startup, silence and a zero chooser count do not manufacture this last-Cancel grant. Failed/unknown deletion cannot undo cancellation or cause automatic repeat issuance.

package/docs/multi-instance-bus.md

@@ -281,6 +281,8 @@ Negotiated identities remain on the live follower registry and appear in `/teleg
 
 Foreign update forwarding returns an explicit `accepted`, `retryable`, or `terminal-rejected` settlement. Acceptance requires an acknowledgement for the exact request whose receipt contains the expected stable `deliveryId` and source `update_id`; a callback error popup never substitutes for that receipt. Missing or negative acknowledgements, stale registrations, absent follower context, binding rejection, journal admission failure, and missing or mismatched receipts all retain the leader source. Message, edited-message, reaction, and callback paths share this contract. The follower remembers each admitted `deliveryId` in a process-local window (24 hours, at most 4,096 deliveries); a repeated delivery inside it, including after its journal entry completed and was removed, is acknowledged with the same receipt without another append or handler execution. This absorbs a leader retry after a lost acknowledgement; it is bounded at-most-once behavior, not exactly-once across recipient restart or window eviction.
 
+Foreign message forwards may carry one process-local `assertAuthority` callback; it is never serialized into the envelope or recipient journal. Guarded Reroute supplies both its captured source/context/session/recipient authority and each original message's execution fence. The existing local client rechecks them before connecting, immediately before the encoded socket write and after reading the ACK; the forwarder also revalidates exact live ownership at those boundaries. A guarded send has one transport attempt with no reconnect replay, while unguarded generic forwarding retains its established retry policy. Before-write refusal issues nothing; after-write refusal cannot unsend recipient work and retains donor custody without accepting the stale ACK. Wire protocol, stable delivery/source identity and recipient receipt validation are unchanged.
+
 The delivery id excludes the replaceable runtime instance and registration generation: it derives from envelope kind, source `update_id`, and the stable manual-follower binding. Stored message ownership carries that binding and may rebind to the current authenticated registration after follower replacement, preserving one retry identity while still fencing each attempt by the current generation. A lost acknowledgement retries with the same delivery identity and becomes accepted only when the exact durable receipt returns. Journal deduplication covers retained entries, not lifetime completion history: after ordinary receipt completion removes an entry, cursorless admission can accept that source again. Stable delivery IDs therefore do not by themselves establish exactly-once execution. Owned local IPC evidence reproduces the gap: a proxy drops actual ACK bytes; real forwarding, authenticated receiving, paired admission, journals and admission workers leave the leader source in retry-wait after follower completion. The next attempt reaches an injected authorized callback handler twice in total, then both journals settle. A queued-message variant likewise re-admits the source under a fresh acquisition after a real worker receipt handoff. This proves repeated handler/queue-admission invocation in the composed local pipeline, not actual Pi queue dispatch, live Telegram effects or model execution. Delivery custody, including role-dependent local replay, must be reconciled before a consume-once guarantee can be claimed; the [design counterexamples](./architecture.md#busjournal-design-acceptance) rule out treating origin disappearance as proof of a specific handoff.
 
 Transport leadership does not own already-queued semantics. Each queued journal receipt binds the acquiring runtime instance, OS process birth, session generation, and acquisition. A replacement leader or follower process sees another live process's receipt as foreign and cannot replay or settle it; the original process may complete its local Pi queue after transport moves. Startup preserves foreign and legacy unowned receipts. Before a replacement admission worker starts, tri-state pid/process-birth proof: an absent PID or mismatched stable Linux/macOS birth identity permits recovery, while a live matching owner stays `alive` and Windows or inaccessible birth metadata stays `unverifiable`; both non-dead outcomes preserve the receipt may transactionally recover a dead owner's complete receipt to pending, after which replacement replay creates fresh queue authority. Registration publishes the replacement's exact pid/process-birth identity first; a concurrent recovery that observes it returns `owner-alive`, while live or unverifiable owners remain untouched.

package/lib/bus.ts

@@ -1926,6 +1926,8 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
     message: TMessage;
     ownership: TelegramBusForwardOwnership;
     ctx: TContext;
+    /** Process-local source/recipient lifetime; never part of the wire envelope. */
+    assertAuthority?: () => void;
   }) => Promise<TelegramBusForeignUpdateSettlement>;
   forwardEditedMessage: (input: {
     message: TMessage;
@@ -2057,6 +2059,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
   const send = async (
     envelope: TelegramBusDurableForwardEnvelope,
     ownership: TelegramBusForwardOwnership,
+    assertAuthority?: () => void,
   ): Promise<TelegramBusForeignUpdateSettlement> => {
     if (
       deps.validateForwardOwnership &&
@@ -2078,10 +2081,15 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
         socketPath,
         envelope,
         timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
-        retry: getTelegramBusTransportRetryPolicy({
+        retry: assertAuthority ? { attempts: 1, delayMs: 0 } : getTelegramBusTransportRetryPolicy({
           endpoint: socketPath,
           operation: "operation",
         }),
+        ...(assertAuthority || deps.validateForwardOwnership ? { assertAuthority() {
+          assertAuthority?.();
+          if (deps.validateForwardOwnership && !deps.validateForwardOwnership(ownership))
+            throw new Error("Telegram follower forwarding ownership changed.");
+        } } : {}),
       });
     } catch (error) {
       return reject({
@@ -2178,6 +2186,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
       base: ForwardBase,
       sentAtMs: number,
     ) => TelegramBusDurableForwardEnvelope,
+    assertAuthority?: () => void,
   ): Promise<TelegramBusForeignUpdateSettlement> => {
     const prepared = prepare(kind, value, ownership);
     if ("settlement" in prepared) return Promise.resolve(prepared.settlement);
@@ -2192,6 +2201,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
         ? { kind: "leader.wakeInputCustody", ...base, sentAtMs: getNowMs() }
         : build(base, getNowMs()),
       ownership,
+      assertAuthority,
     );
   };
   return {
@@ -2214,7 +2224,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
           sentAtMs,
         }),
       ),
-    forwardMessage: ({ message, ownership }) =>
+    forwardMessage: ({ message, ownership, assertAuthority }) =>
       forward("leader.forwardMessage", message, ownership, (base, sentAtMs) => {
         const forwardCommentBatchPosition =
           deps.getForwardCommentBatchPosition?.(message);
@@ -2227,7 +2237,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
             : {}),
           sentAtMs,
         };
-      }),
+      }, assertAuthority),
     forwardEditedMessage: ({ message, ownership }) =>
       forward(
         "leader.forwardEditedMessage",

package/lib/routing.ts

@@ -1558,7 +1558,7 @@ export interface TelegramInboundRouteRuntimeDeps<
     requiredJournalBindingKeys: readonly string[],
     ownInputs?: readonly Threads.TelegramTemporaryThreadInput[],
   ) => readonly number[] | undefined;
-  /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 1000 ms. */
+  /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 0 ms. */
   temporaryThreadCleanupDelayMs?: number;
   /** Live-rebind cleanup attempt pacing; the bounded window ends in `not-issued`, never a time-based deletion. */
   liveRebindCleanupSchedule?: {
@@ -1943,10 +1943,21 @@ export function createTelegramInboundRouteRuntime<
     temporaryThread?: Threads.TelegramTemporaryThreadEntry;
     /** Source copies left in All (a menu-picked command); deleted once, when the input is consumed. */
     allTabCopies?: number[];
-    /** The tab holds a forwarded copy of the threadless original, which then left All at once. */
-    allTabCopiesForwarded?: true;
+    /** This live opening attempt did not remove its All originals; replay/revival cannot reconstruct that fact. */
+    allTabSourceRetained?: true;
+    /** Complete warm copy identity; journal originals stay unchanged even after their All messages leave. */
+    allTabCopiesForwarded?: {
+      target: { chatId: number; threadId: number };
+      sourceMessageIds: readonly number[];
+      messageIds: readonly number[];
+    };
     /** Acknowledged same-tab membership stays protective when its reader disappears; never a dispatch/cleanup grant. */
     temporaryMembership?: true;
+    /** Confirmed display copies only; the durable Forward fact remains the native one-shot authority. */
+    rerouteCopies?: {
+      target: { chatId: number; threadId: number };
+      bySourceUpdateId: ReadonlyMap<number, number>;
+    };
     /** Re-entrancy lock for one command route in flight; orthogonal to `phase`. */
     dispatching?: boolean;
     abandonment?: {
@@ -2415,15 +2426,22 @@ export function createTelegramInboundRouteRuntime<
   const cloneTelegramMessagesForThread = (
     messages: TMessage[],
     threadId: number,
+    copies?: ReadonlyMap<number, number>,
   ): TMessage[] => {
-    return messages.map((message) =>
-      Updates.carryTelegramUpdateExecutionFence(message, {
+    return messages.map((message) => {
+      const ids = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+      const copyId = copies && ids.length === 1 ? copies.get(ids[0]!) : undefined;
+      if (copies && (!Number.isSafeInteger(copyId) || copyId! <= 0))
+        throw new Error("Reroute destination copy identity is unavailable.");
+      const routed = {
         ...message,
-        message_id: 0,
+        message_id: copyId ?? 0,
         message_thread_id: threadId,
         reply_to_message: undefined,
-      } as TMessage),
-    );
+      } as TMessage;
+      return Updates.carryTelegramUpdateExecutionFence(message,
+        copies ? Turns.withTelegramTurnReplyAnchor(routed) : routed);
+    });
   };
   /** Whether a chooser is still pending in this Thread, ignoring the ones the caller itself owns. */
   const hasPendingRerouteForTarget = (
@@ -2819,9 +2837,11 @@ export function createTelegramInboundRouteRuntime<
   const deleteAllTabMessages = async (
     chatId: number,
     messageIds: readonly number[],
+    isCurrent?: () => boolean,
   ): Promise<void> => {
     if (!deps.deleteMessage) return;
     for (const messageId of messageIds) {
+      if (isCurrent?.() === false) return;
       try {
         await deps.deleteMessage(chatId, messageId);
       } catch (error) {
@@ -2834,10 +2854,14 @@ export function createTelegramInboundRouteRuntime<
     }
   };
   /** One-shot per chooser: the copies are taken before deletion, so a later consuming path finds none. */
-  const deleteAllTabCopies = (pending: PendingUnboundReroute): Promise<void> =>
+  const deleteAllTabCopies = (
+    pending: PendingUnboundReroute,
+    isCurrent?: () => boolean,
+  ): Promise<void> =>
     deleteAllTabMessages(
       pending.sourceTarget.chatId,
       pending.allTabCopies?.splice(0) ?? [],
+      isCurrent,
     );
   /**
    * Restore keeps the tab as the Thread, so the input must stay visible there: the All original goes only when the tab
@@ -2846,7 +2870,11 @@ export function createTelegramInboundRouteRuntime<
   const releaseAllTabCopiesIntoSurvivingTab = (
     pending: PendingUnboundReroute,
   ): Promise<void> => {
-    if (pending.allTabCopiesForwarded) return deleteAllTabCopies(pending);
+    if (
+      pending.allTabCopiesForwarded &&
+      isDeepStrictEqual(pending.allTabCopiesForwarded.target, pending.sourceTarget)
+    )
+      return deleteAllTabCopies(pending);
     pending.allTabCopies?.splice(0);
     return Promise.resolve();
   };
@@ -2862,26 +2890,38 @@ export function createTelegramInboundRouteRuntime<
   ): Promise<number | undefined> => {
     const messageIds = [...(pending.allTabCopies ?? [])].sort((a, b) => a - b);
     if (messageIds.length === 0 || !deps.callApi || !isCurrent()) return;
+    const copyTarget = { ...target };
     const route = {
-      chat_id: target.chatId,
-      message_thread_id: target.threadId,
+      chat_id: copyTarget.chatId,
+      message_thread_id: copyTarget.threadId,
       from_chat_id: pending.sourceTarget.chatId,
       disable_notification: true,
     };
+    const options = {
+      maxAttempts: 1,
+      retrySafety: "non-idempotent" as const,
+      assertAuthority() {
+        if (!isCurrent())
+          throw new Error("Temporary Thread source forwarding authority changed.");
+      },
+    };
     try {
       // An album moves as one album; forwardMessages skips what it cannot forward, so a short reply is not a move.
       const copies =
         messageIds.length === 1
           ? [
-              await deps.callApi<{ message_id?: unknown }>("forwardMessage", {
-                ...route,
-                message_id: messageIds[0],
-              }),
+              await deps.callApi<{ message_id?: unknown }>(
+                "forwardMessage",
+                { ...route, message_id: messageIds[0] },
+                options,
+              ),
             ]
           : await deps.callApi<Array<{ message_id?: unknown }>>(
               "forwardMessages",
               { ...route, message_ids: messageIds },
+              options,
             );
+      if (!isCurrent()) return;
       const copyIds = Array.isArray(copies)
         ? copies.map((copy) => copy?.message_id)
         : [];
@@ -2889,20 +2929,88 @@ export function createTelegramInboundRouteRuntime<
         copyIds.length !== messageIds.length ||
         !copyIds.every(
           (id): id is number =>
-            typeof id === "number" && Number.isSafeInteger(id),
-        )
+            typeof id === "number" && Number.isSafeInteger(id) && id > 0,
+        ) ||
+        new Set(copyIds).size !== copyIds.length
       )
         return;
-      pending.allTabCopiesForwarded = true;
-      await deleteAllTabCopies(pending);
-      return copyIds[0];
+      pending.allTabCopiesForwarded = {
+        target: copyTarget,
+        sourceMessageIds: messageIds,
+        messageIds: copyIds,
+      };
+      await deleteAllTabCopies(pending, isCurrent);
+      if (!isCurrent()) return;
+      return pending.allTabCopiesForwarded.messageIds[0];
     } catch (error) {
-      deps.recordRuntimeEvent?.("routing", error, {
-        phase: "temporary-thread-source-forward",
-      });
+      if (isCurrent())
+        deps.recordRuntimeEvent?.("routing", error, {
+          phase: "temporary-thread-source-forward",
+        });
       return;
     }
   };
+  /** Read original source addresses, not warm target rewrites; unknown copy provenance never grants a Reroute. */
+  const resolvePendingRerouteForwardSource = (
+    pending: PendingUnboundReroute,
+  ): { chatId: number; sourceUpdateIds: number[]; sourceMessageIds: number[]; messageIds: number[] } | undefined => {
+    try {
+      const originals = pending.messages.map((message) => {
+        const snapshot = Updates.inspectTelegramDeferredSourceSnapshot(message);
+        const ids = Updates.collectTelegramAdmissionSourceUpdateIds([message]);
+        const original = snapshot?.update.message as TMessage | undefined;
+        if (
+          !snapshot ||
+          ids.length !== 1 ||
+          snapshot.source.updateId !== ids[0] ||
+          snapshot.update.update_id !== ids[0] ||
+          Object.keys(snapshot.update).some((key) => key !== "update_id" && key !== "message") ||
+          snapshot.source.journalBindingKey !== deps.getAdmissionJournalBinding?.() ||
+          !original ||
+          original.chat?.type !== "private" ||
+          original.chat.id !== pending.sourceTarget.chatId ||
+          original.from?.id !== deps.configStore.getAllowedUserId() ||
+          original.from?.is_bot !== false ||
+          !Number.isSafeInteger(original.message_id) ||
+          original.message_id <= 0
+        )
+          return undefined;
+        return { message: original, updateId: ids[0]! };
+      });
+      if (originals.length === 0 || originals.some((source) => !source)) return;
+      originals.sort((a, b) => a!.message.message_id - b!.message.message_id);
+      const sourceMessageIds = originals.map((source) => source!.message.message_id);
+      const sourceUpdateIds = originals.map((source) => source!.updateId);
+      if (
+        new Set(sourceMessageIds).size !== sourceMessageIds.length ||
+        new Set(sourceUpdateIds).size !== sourceUpdateIds.length
+      )
+        return;
+      const copied = pending.allTabCopiesForwarded;
+      if (copied) {
+        if (
+          !isDeepStrictEqual(copied.target, pending.sourceTarget) ||
+          !isDeepStrictEqual(copied.sourceMessageIds, sourceMessageIds) ||
+          copied.messageIds.length !== sourceMessageIds.length ||
+          !copied.messageIds.every((id) => Number.isSafeInteger(id) && id > 0) ||
+          new Set(copied.messageIds).size !== copied.messageIds.length
+        )
+          return;
+        return { chatId: copied.target.chatId, sourceUpdateIds, sourceMessageIds, messageIds: [...copied.messageIds] };
+      }
+      const nativeOriginals = originals.every((source) =>
+        typeof pending.sourceTarget.threadId === "number" &&
+        source!.message.message_thread_id === pending.sourceTarget.threadId);
+      const retainedAllOriginals = pending.allTabSourceRetained === true &&
+        originals.every((source) => source!.message.message_thread_id === undefined) &&
+        isDeepStrictEqual([...(pending.allTabCopies ?? [])].sort((a, b) => a - b), sourceMessageIds);
+      if (nativeOriginals || retainedAllOriginals)
+        return { chatId: pending.sourceTarget.chatId, sourceUpdateIds, sourceMessageIds, messageIds: [...sourceMessageIds] };
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-source-proof" });
+    }
+    return undefined;
+  };
   const dismissRerouteChooserMessage = async (
     query: TCallbackQuery,
     assertExecutionCurrent?: () => void,
@@ -6172,7 +6280,21 @@ export function createTelegramInboundRouteRuntime<
     for (const wake of [...liveRebindCleanupWakers.values()]) wake(reason);
   };
   const onSessionSettled = (ctx: TContext): void => wakeLiveRebindCleanup(ctx, "session-settled");
-  const onDeliverySettled = (ctx: TContext): void => wakeLiveRebindCleanup(ctx, "delivery-drained");
+  const onDeliverySettled = (ctx: TContext): void => {
+    wakeLiveRebindCleanup(ctx, "delivery-drained");
+    const cap = captureTemporaryThreadAuthority(ctx);
+    if (!cap?.isCurrent()) return;
+    try {
+      for (const entry of cap.store.listTemporaryThreads()) {
+        if (!cap.isCurrent()) return;
+        if (entry.phase === "created" && entry.target && !entry.cleanupIssued &&
+          Threads.isTelegramTemporaryThreadFullyResolved(entry))
+          scheduleTemporaryThreadCleanup(entry.target, ctx);
+      }
+    } catch (error) {
+      deps.recordRuntimeEvent?.("routing", error, { phase: "temporary-thread-cleanup-drain" });
+    }
+  };
   const restoreWorkspace = deps.workspaceRestoreRecipient
     ? async (input: {
         operationId: string;
@@ -6802,6 +6924,97 @@ export function createTelegramInboundRouteRuntime<
       return false;
     }
   };
+  /** Publish display copies under the native one-shot grant; positive output is not input/source settlement. */
+  const publishPendingRerouteCopies = async (
+    pending: PendingUnboundReroute,
+    record: Threads.TelegramTopicTargetRecord,
+    ctx: TContext,
+    assertExecutionCurrent: () => void,
+    foreign: boolean,
+  ): Promise<(() => void) | undefined> => {
+    const source = resolvePendingRerouteForwardSource(pending);
+    const target = { ...record.target };
+    const recordIdentity = (value: Threads.TelegramTopicTargetRecord | undefined) => value && ({
+      target: value.target, profileKey: value.profileKey, owner: value.owner,
+      instanceId: value.instanceId, slot: value.slot, createdAtMs: value.createdAtMs,
+    });
+    const bindingIdentity = () => deps.threadStore!.listWorkspaceBindings()
+      .filter((value) => isDeepStrictEqual(value.target, target))
+      .map((value) => ({ bindingKey: value.bindingKey, sessionId: value.sessionId, sessionKey: value.sessionKey,
+        cwd: value.cwd, workspaceKey: value.workspaceKey, instanceSlot: value.instanceSlot, slot: value.slot,
+        target: value.target }));
+    const expectedRecord = structuredClone(recordIdentity(record));
+    const expectedBindings = structuredClone(bindingIdentity());
+    const ownership = deps.getTargetOwnership?.(target);
+    if (
+      !source || !deps.callApi || expectedBindings.length > 1 ||
+      (foreign && (!ownership || ownership.instanceId !== record.instanceId ||
+        !ownership.ownerGeneration || !ownership.recipientBindingKey))
+    )
+      return;
+    const expectedOwnership = ownership && structuredClone(ownership);
+    const cap = captureTemporaryThreadAuthority(ctx, () => {
+      try {
+        assertExecutionCurrent();
+        const current = getTelegramRoutableThreadRecords(deps.threadStore!.list(), deps.getLiveThreadTargets?.())
+          .find((value) => isDeepStrictEqual(value.target, target));
+        return isDeepStrictEqual(recordIdentity(current), expectedRecord) &&
+          isDeepStrictEqual(bindingIdentity(), expectedBindings) &&
+          (!foreign || Bus.isTelegramBusForwardOwnershipCurrent(expectedOwnership!, deps.getTargetOwnership?.(target)));
+      } catch { return false; }
+    });
+    if (!cap?.isCurrent()) return;
+    const temporary = pending.temporaryThread ?? findCreatedTemporaryThread(pending.sourceTarget);
+    if (!temporary || !issueTemporaryThreadForward(pending, ctx)) return;
+    pending.phase = { kind: "forward-unknown" };
+    const assertRecipientCurrent = (): void => {
+      assertExecutionCurrent();
+      if (!cap.isCurrent()) throw new Error("Reroute publication recipient authority changed.");
+    };
+    const assertPublicationCurrent = (): void => {
+      assertRecipientCurrent();
+      const entry = cap.store.listTemporaryThreads().find((value) => value.token === temporary.token);
+      const ids = [...source.sourceUpdateIds].sort((a, b) => a - b);
+      if (
+        !entry || entry.phase !== "created" || entry.cleanupIssued ||
+        entry.operatorUserId !== cap.operatorUserId ||
+        !isDeepStrictEqual(entry.executor, cap.authority.executor) ||
+        !isDeepStrictEqual(entry.target, pending.sourceTarget) ||
+        !entry.forwardedInputs?.some((input) => input.journalBindingKey === cap.journalBindingKey &&
+          isDeepStrictEqual(input.updateIds, ids)) ||
+        !isDeepStrictEqual(resolvePendingRerouteForwardSource(pending), source)
+      )
+        throw new Error("Reroute publication source authority changed.");
+    };
+    try {
+      assertPublicationCurrent();
+      // Bot API requires ascending source IDs. Preserve the source-UID association even if copy IDs reorder them.
+      const order = source.messageIds.map((_, index) => index)
+        .sort((a, b) => source.messageIds[a]! - source.messageIds[b]!);
+      const messageIds = order.map((index) => source.messageIds[index]!);
+      const body = { chat_id: target.chatId, message_thread_id: target.threadId,
+        from_chat_id: source.chatId, disable_notification: true };
+      const options = { maxAttempts: 1, retrySafety: "non-idempotent" as const, assertAuthority: assertPublicationCurrent };
+      const copies = messageIds.length === 1
+        ? [await deps.callApi<{ message_id?: unknown }>("forwardMessage", { ...body, message_id: messageIds[0] }, options)]
+        : await deps.callApi<Array<{ message_id?: unknown }>>("forwardMessages", { ...body, message_ids: messageIds }, options);
+      assertPublicationCurrent();
+      const copyIds = Array.isArray(copies) ? copies.map((copy) => copy?.message_id) : [];
+      if (
+        copyIds.length !== messageIds.length ||
+        !copyIds.every((id): id is number => typeof id === "number" && Number.isSafeInteger(id) && id > 0) ||
+        new Set(copyIds).size !== copyIds.length
+      )
+        return;
+      pending.rerouteCopies = { target, bySourceUpdateId: new Map(order.map((index, position) =>
+        [source.sourceUpdateIds[index]!, copyIds[position]!] as const)) };
+      pending.phase = { kind: "selected" };
+      return assertRecipientCurrent;
+    } catch (error) {
+      if (cap.isCurrent()) deps.recordRuntimeEvent?.("routing", error, { phase: "reroute-destination-forward" });
+      return;
+    }
+  };
   const forwardPendingRerouteMessages = async (
     pending: PendingUnboundReroute,
     instanceId: string,
@@ -6827,12 +7040,19 @@ export function createTelegramInboundRouteRuntime<
     )
       return false;
     const ownership = structuredClone(liveOwnership);
-    const messages = cloneTelegramMessagesForThread(pending.messages, threadId);
+    const copies = pending.rerouteCopies;
+    const published = !!copies && isDeepStrictEqual(copies.target, target);
+    const messages = cloneTelegramMessagesForThread(
+      pending.messages,
+      threadId,
+      published ? copies.bySourceUpdateId : undefined,
+    );
     // Issuance is durable before the RPC: an unacknowledged temporary-tab Forward never becomes another dispatch grant,
     // even after restart. Any refusal or publication failure sends nothing and keeps the input held.
     if (
       !recordForwardAcceptance &&
       isTemporaryReroute(pending) &&
+      !published &&
       !issueTemporaryThreadForward(pending, ctx)
     ) {
       if (isTemporaryThreadForwardIssued(pending))
@@ -6847,6 +7067,10 @@ export function createTelegramInboundRouteRuntime<
           message,
           ownership,
           ctx,
+          assertAuthority() {
+            assertExecutionCurrent?.();
+            Updates.assertTelegramUpdateExecutionCurrent(message);
+          },
         }),
       ),
     );
@@ -7073,6 +7297,16 @@ export function createTelegramInboundRouteRuntime<
       temporaryCleanupTimers.delete(token);
       if (retry) restoreSettlementTasks.add(task);
       runTemporaryThreadCleanup(token, cap, reconcileExpiry)
+        .then(() => {
+          if (!cap.isCurrent()) return;
+          const retained = cap.store.listTemporaryThreads().find(value => value.token === token);
+          // A follower ACK can precede recipient receipt disposal. Reobserve a protected, unissued tab;
+          // elapsed time never grants deletion, and an issued/unknown delete can never enter this path.
+          if (retained?.phase === "created" && !retained.cleanupIssued &&
+            Threads.isTelegramTemporaryThreadFullyResolved(retained) &&
+            cap.store.inspectTemporaryThreadTarget(retained, cap.authority)?.kind === "temporary" && cap.isCurrent())
+            queueTemporaryThreadCleanup(token, cap, 1000, reconcileExpiry, true);
+        })
         .catch((error) => {
           deps.recordRuntimeEvent?.("routing", error, {
             phase: "temporary-thread-cleanup",
@@ -7799,7 +8033,7 @@ export function createTelegramInboundRouteRuntime<
             ).includes(source.original.updateId)
           )
             continue;
-          movedIntoTab ||= pending.allTabCopiesForwarded === true;
+          movedIntoTab ||= pending.allTabCopiesForwarded !== undefined;
           removePendingReroute(id);
           if (
             signal.aborted ||
@@ -8901,6 +9135,14 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
+    if (
+      !parsed.useNewSlot &&
+      isTemporaryReroute(pending) &&
+      !resolvePendingRerouteForwardSource(pending)
+    ) {
+      await deps.answerCallbackQuery(query.id, "Source copy unavailable; not routing");
+      return true;
+    }
     if (!(await selectPendingDestination())) return true;
     if (parsed.useNewSlot && sourceTarget && restoreWorkspace) {
       const selection = (pending.workspaceRestore ??= {
@@ -9006,6 +9248,19 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
+    let assertRerouteCurrent = assertExecutionCurrent;
+    if (isTemporaryReroute(pending)) {
+      const confirmed = await publishPendingRerouteCopies(pending, record, ctx, assertExecutionCurrent,
+        !!record.instanceId && record.instanceId !== currentInstanceId && !isCurrentLeaderRecord);
+      if (!confirmed) {
+        await deps.answerCallbackQuery(query.id, pending.phase.kind === "forward-unknown"
+          ? "Publication unconfirmed; not resending"
+          : "Publication unavailable; input kept");
+        return true;
+      }
+      assertRerouteCurrent = confirmed;
+    }
+    assertRerouteCurrent();
     if (
       record.instanceId &&
       record.instanceId !== currentInstanceId &&
@@ -9016,7 +9271,7 @@ export function createTelegramInboundRouteRuntime<
         record.instanceId,
         parsed.threadId,
         ctx,
-        assertExecutionCurrent,
+        assertRerouteCurrent,
       );
       if (!allForwarded) {
         await deps.answerCallbackQuery(
@@ -9032,6 +9287,7 @@ export function createTelegramInboundRouteRuntime<
     // Local handlers and queue admission consume the same one-time group grant as follower forwarding.
     if (
       isTemporaryReroute(pending) &&
+      !pending.rerouteCopies &&
       !issueTemporaryThreadForward(pending, ctx)
     ) {
       await deps.answerCallbackQuery(
@@ -9040,7 +9296,11 @@ export function createTelegramInboundRouteRuntime<
       );
       return true;
     }
-    await dispatchPendingRerouteMessages(pending, reroutedMessages, ctx);
+    const localMessages = pending.rerouteCopies
+      ? cloneTelegramMessagesForThread(pending.messages, parsed.threadId, pending.rerouteCopies.bySourceUpdateId)
+      : reroutedMessages;
+    await dispatchPendingRerouteMessages(pending, localMessages, ctx);
+    assertRerouteCurrent();
     pending.messages = [];
     return completeRoutedReroute();
   };
@@ -10632,6 +10892,16 @@ export function createTelegramInboundRouteRuntime<
     const tabCopyId = openedNow
       ? await moveAllTabSourceIntoTab(pending, target, current)
       : undefined;
+    if (!current()) {
+      removePendingReroute(rerouteId);
+      throw new Error("Temporary Thread source presentation authority changed.");
+    }
+    if (
+      openedNow &&
+      !pending.allTabCopiesForwarded &&
+      pending.allTabCopies.length === held.length
+    )
+      pending.allTabSourceRetained = true;
     try {
       if (!deps.sendInteractiveMessage)
         throw new Error("Temporary Thread chooser publication is unavailable.");

package/lib/turns.ts

@@ -51,6 +51,13 @@ export function withoutTelegramTurnReplyAnchor<TMessage extends object>(message:
   return { ...message, [REPLY_ANCHOR_SUPPRESSED]: true };
 }
 
+/** A confirmed same-target copy may replace the former-tab suppression on a warm input projection. */
+export function withTelegramTurnReplyAnchor<TMessage extends { message_id: number }>(message: TMessage): TMessage {
+  if (!Number.isSafeInteger(message.message_id) || message.message_id <= 0)
+    throw new Error("Telegram reply anchor requires a positive message ID.");
+  return { ...message, [REPLY_ANCHOR_SUPPRESSED]: false };
+}
+
 export const TELEGRAM_GUEST_TURN_NOTE =
   "[guest] delivery: answer quickly with one concise, self-contained reply";
 

package/lib/updates.ts

@@ -374,6 +374,8 @@ export interface TelegramForeignOwnedUpdateForwarder<
     message: TMessage;
     ownership: TelegramTargetOwnershipView;
     ctx: TContext;
+    /** Local issuance/ACK fence; implementations must not serialize it into payloads. */
+    assertAuthority?: () => void;
   }) =>
     | Promise<TelegramBusForeignUpdateSettlement>
     | TelegramBusForeignUpdateSettlement;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.55.0",
+  "version": "0.55.1",
   "private": false,
   "publishConfig": {
     "access": "public"