@llblab/pi-telegram 0.56.0 → 0.56.1

package/lib/bus-leader.ts

@@ -23,6 +23,7 @@ import {
   TELEGRAM_BUS_CAPABILITY_DIRECTORY_DISPLAY_FORMAT,
   TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION,
   TELEGRAM_BUS_CAPABILITY_QUEUE_HANDOFF,
+  TELEGRAM_BUS_CAPABILITY_CONNECT_RECOVERY,
   hasTelegramBusSteerQueueHandoffCapability,
   TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
   TELEGRAM_BUS_CAPABILITY_SESSION_REPLACEMENT_INTENT,
@@ -1529,7 +1530,7 @@ export function createTelegramBusFollowerTargetProvisioner(
   deps: TelegramBusFollowerTargetProvisionerDeps,
 ): (
   registration: TelegramBusInstanceRegistration,
-  options?: { existingWorkspaceBindingOnly?: boolean },
+  options?: { existingWorkspaceBindingOnly?: boolean; recoverConnection?: boolean },
 ) => Promise<
   (TelegramTarget & { slot?: string; threadName?: string }) | undefined
 > {
@@ -1548,6 +1549,16 @@ export function createTelegramBusFollowerTargetProvisioner(
     const chatId = deps.getAllowedUserId();
     if (typeof chatId !== "number") return registration.target;
     await deps.topicTargetStore.load();
+    if (options?.recoverConnection && !options.existingWorkspaceBindingOnly) {
+      const epoch = deps.getCurrentLeaderEpoch?.();
+      await Threads.resetTelegramConnectionProvisioning({
+        store: deps.topicTargetStore, owner: "manual-follower", instanceId: registration.instanceId,
+        profileKey: registration.profileKey ?? `manual:${registration.instanceId}`,
+        isCurrent: () => !deps.getCurrentLeaderEpoch ||
+          (epoch !== undefined && deps.getCurrentLeaderEpoch() === epoch),
+        recordEvent: deps.recordRuntimeEvent,
+      });
+    }
     let restoredPredecessor: Threads.TelegramTopicTargetRecord | undefined;
     if (options?.existingWorkspaceBindingOnly && registration.cwd && registration.sessionId &&
         !registration.previousInstanceId && deps.getLiveFollowers && deps.isFollowerProcessAlive) {
@@ -1580,6 +1591,7 @@ export function createTelegramBusFollowerTargetProvisioner(
           {
             existingBindingOnly: options?.existingWorkspaceBindingOnly === true,
             sessionId: registration.sessionId,
+            provisionProfileKey: registration.profileKey ?? `manual:${registration.instanceId}`,
             onCapacityUnavailable() {
               capacityUnavailable = true;
             },
@@ -1842,12 +1854,6 @@ export function createTelegramBusFollowerTargetProvisioner(
         };
       }
       const probeRequiredRecord = reconnectRecord?.status === "probe-required";
-      const exactSessionHandoff =
-        crossSessionReuse &&
-        !!requestedTarget &&
-        registration.previousInstanceId === reconnectRecord?.instanceId &&
-        requestedTarget.chatId === reconnectRecord.target.chatId &&
-        requestedTarget.threadId === reconnectRecord.target.threadId;
       const requiresVisibilityProbe =
         crossSessionReuse ||
         probeRequiredRecord ||
@@ -1869,19 +1875,14 @@ export function createTelegramBusFollowerTargetProvisioner(
         try {
           assertRestoreRegistration();
           await deps.callApi(
-            exactSessionHandoff ? "sendChatAction" : "sendMessage",
-            exactSessionHandoff
-              ? {
-                  chat_id: connectedAnnouncement.target.chatId,
-                  message_thread_id: connectedAnnouncement.target.threadId,
-                  action: "typing",
-                }
-              : {
-                  chat_id: connectedAnnouncement.target.chatId,
-                  message_thread_id: connectedAnnouncement.target.threadId,
-                  text: connectedAnnouncement.text,
-                  parse_mode: connectedAnnouncement.parseMode,
-                },
+            // Typing is presence, not evidence that a retained Thread still accepts messages.
+            "sendMessage",
+            {
+              chat_id: connectedAnnouncement.target.chatId,
+              message_thread_id: connectedAnnouncement.target.threadId,
+              text: connectedAnnouncement.text,
+              parse_mode: connectedAnnouncement.parseMode,
+            },
           );
           assertRestoreRegistration();
           if (recoverableTarget || probeRequiredRecord) {
@@ -2944,7 +2945,7 @@ export interface TelegramBusLeaderEnvelopeHandlerDeps {
   ) => Promise<unknown> | unknown;
   provisionFollowerTarget?: (
     registration: TelegramBusInstanceRegistration,
-    options?: { existingWorkspaceBindingOnly?: boolean },
+    options?: { existingWorkspaceBindingOnly?: boolean; recoverConnection?: boolean },
   ) =>
     | Promise<
         (TelegramTarget & { slot?: string; threadName?: string }) | undefined
@@ -3453,6 +3454,9 @@ export function createTelegramBusLeaderEnvelopeHandler(
             ));
         const restoringWorkspace =
           envelope.kind === "follower.restoreWorkspace";
+        const recoverConnection = envelope.kind === "follower.register" && envelope.recoverConnection === true;
+        const supportsConnectionRecovery = [deps.protocolIdentity, envelope.registration.protocol]
+          .every(identity => hasTelegramBusCapability(identity, TELEGRAM_BUS_CAPABILITY_CONNECT_RECOVERY));
         const supportsWorkspaceAutoConnect =
           hasTelegramBusCapability(
             deps.protocolIdentity,
@@ -3468,7 +3472,8 @@ export function createTelegramBusLeaderEnvelopeHandler(
           !readerCompatible() ||
           (envelope.registration.cwd !== undefined &&
             envelope.registration.sessionId === undefined) ||
-          (restoringWorkspace && !supportsWorkspaceAutoConnect)
+          (restoringWorkspace && !supportsWorkspaceAutoConnect) ||
+          (recoverConnection && !supportsConnectionRecovery)
         ) {
           return {
             kind: "bus.ack" as const,
@@ -3526,7 +3531,7 @@ export function createTelegramBusLeaderEnvelopeHandler(
                 );
               const target = await deps.provisionFollowerTarget?.(
                 envelope.registration,
-                { existingWorkspaceBindingOnly: restoringWorkspace },
+                { existingWorkspaceBindingOnly: restoringWorkspace, ...(recoverConnection ? { recoverConnection: true } : {}) },
               );
               if (restoringWorkspace && !target) {
                 return {

package/lib/bus.ts

@@ -144,6 +144,7 @@ export const TELEGRAM_BUS_CAPABILITY_QUEUE_HANDOFF =
   "queue-handoff-v1" as const;
 /** Unspent Steer lane codec; independent from baseline receipt handoff support. */
 export const TELEGRAM_BUS_CAPABILITY_QUEUE_STEER = "queue-steer-v1" as const;
+export const TELEGRAM_BUS_CAPABILITY_CONNECT_RECOVERY = "explicit-connect-recovery-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE =
   "input-custody-reference-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME =
@@ -184,6 +185,14 @@ export const TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES = [
   TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
 ] as const;
 
+/** Start/help are restricted menu aliases, negotiated separately from the original held-command set. */
+export const TELEGRAM_BUS_CAPABILITY_HELD_MENU_ALIASES = "held-menu-aliases-v1" as const;
+export function getTelegramBusHeldCommandCapabilities(name: string): readonly string[] {
+  return name === "start" || name === "help"
+    ? [...TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES, TELEGRAM_BUS_CAPABILITY_HELD_MENU_ALIASES]
+    : TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES;
+}
+
 export interface TelegramBusSelectedCommandInput {
   name: string;
   target: TelegramTarget & { threadId: number };
@@ -1009,6 +1018,7 @@ export type TelegramBusEnvelope = (
   | {
       kind: "follower.register";
       requestId: string;
+      recoverConnection?: true;
       registration: TelegramBusInstanceRegistration;
     }
   | {
@@ -2539,12 +2549,7 @@ export function createTelegramBusLiveRebindController(deps: {
         : []),
       ...(settling || held ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE] : []),
       ...(observingHeld ? [TELEGRAM_BUS_CAPABILITY_PRE_DISPATCH_REBIND_EXECUTION] : []),
-      ...(held
-        ? [
-            TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET,
-            TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
-          ]
-        : []),
+      ...(held ? getTelegramBusHeldCommandCapabilities(held.name) : []),
     ];
     const follower = deps.getFollower(expected.instanceId),
       secret = deps.getAuthSecret();
@@ -3545,8 +3550,12 @@ function parseRegisterEnvelope(
   requestId: string,
   kind: "follower.register" | "follower.restoreWorkspace",
 ): TelegramBusEnvelope | undefined {
+  if (value.recoverConnection !== undefined &&
+      (kind !== "follower.register" || value.recoverConnection !== true)) return undefined;
   const registration = parseRegistration(value.registration);
-  return registration ? { kind, requestId, registration } : undefined;
+  return registration ? { kind, requestId, registration,
+    ...(kind === "follower.register" && value.recoverConnection === true ? { recoverConnection: true as const } : {}),
+  } : undefined;
 }
 
 function parseFollowerPresenceEnvelope(

package/lib/commands.ts

@@ -53,7 +53,7 @@ import {
 } from "./updates.ts";
 
 export type TelegramHeldCommandName =
-  "status" | "abort" | "stop" | "next" | "continue";
+  "status" | "start" | "help" | "abort" | "stop" | "next" | "continue";
 
 /** Commands-owned no-fold admission over the ordinary recipient queue; source reporting stays separate from removal. */
 export interface TelegramHeldTurnAdmission {
@@ -2773,53 +2773,58 @@ export function createTelegramCommandHandler<
       },
     };
   };
-  const heldPlans: Record<TelegramHeldCommandName, HeldPlan> = {
-    status: {
-      completion: "before-effect",
-      effect: "showStatus",
-      prepare(ctx, effects) {
-        const scopedStatus = effects?.showStatus;
-        const captured = {
-          ...deps,
-          showStatus: scopedStatus
-            ? (
-                message: TMessage,
-                context: TContext,
-                options?: Pick<TelegramApiCallOptions, "assertAuthority">,
-              ) => {
-                const address = getTelegramCommandMessageTarget(message);
-                return scopedStatus.call(
-                  effects,
-                  address.chatId,
-                  address.replyToMessageId,
-                  context,
-                  address.threadId,
-                  options,
-                );
-              }
-            : deps.showStatus,
-        };
-        return {
-          captured,
-          portsCurrent: () => !effects || effects.showStatus === scopedStatus,
-          async run({ message, command, assertRecipient }) {
-            const recipientOptions = { assertAuthority: assertRecipient };
-            return handleTelegramCommandRuntime(
-              command.name,
-              message,
-              ctx,
-              {
-                ...captured,
-                assertExecutionCurrent: assertRecipient,
-                showStatus: (value: TMessage, context: TContext) =>
-                  captured.showStatus(value, context, recipientOptions),
-              },
-              command.args,
-            );
-          },
-        };
-      },
+  // Held followers are already paired and bound. Start/help open the same restricted menu as status;
+  // they cannot pair an operator, bootstrap another Thread or invoke unrestricted Bot API effects.
+  const heldMenuPlan: HeldPlan = {
+    completion: "before-effect",
+    effect: "showStatus",
+    prepare(ctx, effects) {
+      const scopedStatus = effects?.showStatus;
+      const captured = {
+        ...deps,
+        showStatus: scopedStatus
+          ? (
+              message: TMessage,
+              context: TContext,
+              options?: Pick<TelegramApiCallOptions, "assertAuthority">,
+            ) => {
+              const address = getTelegramCommandMessageTarget(message);
+              return scopedStatus.call(
+                effects,
+                address.chatId,
+                address.replyToMessageId,
+                context,
+                address.threadId,
+                options,
+              );
+            }
+          : deps.showStatus,
+      };
+      return {
+        captured,
+        portsCurrent: () => !effects || effects.showStatus === scopedStatus,
+        async run({ message, command, assertRecipient }) {
+          const recipientOptions = { assertAuthority: assertRecipient };
+          return handleTelegramCommandRuntime(
+            "status",
+            message,
+            ctx,
+            {
+              ...captured,
+              assertExecutionCurrent: assertRecipient,
+              showStatus: (value: TMessage, context: TContext) =>
+                captured.showStatus(value, context, recipientOptions),
+            },
+            command.args,
+          );
+        },
+      };
     },
+  };
+  const heldPlans: Record<TelegramHeldCommandName, HeldPlan> = {
+    status: heldMenuPlan,
+    start: heldMenuPlan,
+    help: heldMenuPlan,
     abort: {
       completion: "after-semantics",
       effect: "sendTextReply",

package/lib/extension.ts

@@ -65,6 +65,8 @@ const telegramBusProtocolIdentity =
     Bus.TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION,
     Bus.TELEGRAM_BUS_CAPABILITY_QUEUE_HANDOFF,
     Bus.TELEGRAM_BUS_CAPABILITY_QUEUE_STEER,
+    Bus.TELEGRAM_BUS_CAPABILITY_CONNECT_RECOVERY,
+    Bus.TELEGRAM_BUS_CAPABILITY_HELD_MENU_ALIASES,
     Bus.TELEGRAM_BUS_CAPABILITY_WORKSPACE_FOLLOWER_AUTO_CONNECT,
     Bus.TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME,
     Bus.TELEGRAM_BUS_CAPABILITY_THREAD_DISPLAY_MODE,
@@ -1238,7 +1240,7 @@ export default function (pi: Pi.ExtensionAPI) {
           follower.protocol,
           [
             ...Bus.TELEGRAM_BUS_LIVE_REBIND_CAPABILITIES,
-            ...Bus.TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES,
+            ...Bus.getTelegramBusHeldCommandCapabilities(name),
           ],
         ) &&
         typeof selectedMenuDelivery === "function" &&
@@ -1559,6 +1561,7 @@ export default function (pi: Pi.ExtensionAPI) {
     threadStore,
     runWorkspaceOperation: telegramWorkspaceOperationRuntime.run,
     liveRebindCleanupSchedule: Routing.TELEGRAM_LIVE_REBIND_CLEANUP_SCHEDULE,
+    liveRebindCommandCompletionTimeoutMs: 8_000,
     updateStatus,
     isContextActive: telegramSessionContextStore.isCurrent,
     dispatchNextQueuedTelegramTurn,

package/lib/locks.ts

@@ -1981,6 +1981,7 @@ export interface TelegramLockedPollingRuntime<
   registerFollowerWithOwner?: (
     ctx: TContext,
     owner: TelegramLockEntry,
+    options?: { recoverConnection?: boolean },
   ) => boolean | undefined | Promise<boolean | undefined>;
   restoreFollowerWithOwner?: (
     ctx: TContext,
@@ -2008,6 +2009,7 @@ interface TelegramLockedPollingRuntimeDeps<
   registerFollowerWithOwner?: (
     ctx: TContext,
     owner: TelegramLockEntry,
+    options?: { recoverConnection?: boolean },
   ) => boolean | undefined | Promise<boolean | undefined>;
   restoreFollowerWithOwner?: (
     ctx: TContext,
@@ -2294,6 +2296,7 @@ export function createTelegramLockedPollingRuntime<
             const registered = await deps.registerFollowerWithOwner(
               ctx,
               acquired.lock,
+              options.forceFreshLeaderThread ? { recoverConnection: true } : undefined,
             );
             if (!isCurrent()) return cancelled;
             if (registered) {
@@ -2518,8 +2521,8 @@ export function createTelegramLockedPollingRuntime<
       sessionAutoStartRun = run;
     },
     registerFollowerWithOwner: deps.registerFollowerWithOwner
-      ? async (ctx, owner) => {
-          const registered = await deps.registerFollowerWithOwner?.(ctx, owner);
+      ? async (ctx, owner, options) => {
+          const registered = await deps.registerFollowerWithOwner?.(ctx, owner, options);
           if (registered) deps.updateStatus(ctx);
           return registered === true;
         }

package/lib/polling.ts

@@ -757,6 +757,7 @@ export interface TelegramThreadAwarePollingPorts<TContext, TOwner> {
   registerFollowerWithOwner: (
     ctx: TContext,
     owner: TOwner,
+    options?: { recoverConnection?: boolean },
   ) => Promise<boolean | undefined>;
   restoreFollowerWithOwner: (
     ctx: TContext,
@@ -776,6 +777,7 @@ export interface TelegramThreadAwarePollingControls<TContext, TOwner> {
   registerFollowerWithLeader: (
     ctx: TContext,
     owner: TOwner,
+    options?: { recoverConnection?: boolean },
   ) => Promise<boolean | undefined>;
   restoreFollowerWithLeader?: (
     ctx: TContext,
@@ -1180,9 +1182,10 @@ export function createTelegramThreadAwarePollingPorts<TContext, TOwner>(
   const registerFollowerWithOwner = async (
     ctx: TContext,
     owner: TOwner,
+    options?: { recoverConnection?: boolean },
   ): Promise<boolean | undefined> => {
     if (!(await refreshFollowerState())) return undefined;
-    return deps.registerFollowerWithLeader(ctx, owner);
+    return deps.registerFollowerWithLeader(ctx, owner, options);
   };
   const restoreFollowerWithOwner = async (
     ctx: TContext,

package/lib/routing.ts

@@ -916,6 +916,16 @@ export function createTelegramLiveRebindCoordinator(input: {
           }
         : undefined;
     },
+    /** Observe only an already-issued leader command; never prepares, relocates or executes input. */
+    observeCommandCompletion(): "unknown" | "released" | undefined {
+      if (!continuationIssued || !leader?.complete) return undefined;
+      if (!current()) return "unknown";
+      try { return observeCommandCompletion(); }
+      catch (error) {
+        input.recordRuntimeEvent?.("telegram", error, { phase: "live-rebind-command-observation" });
+        return "unknown";
+      }
+    },
     async advance(): Promise<"protected" | "unknown" | "released"> {
       if (advancing || !current()) return "protected";
       if (released) return "released";
@@ -1561,6 +1571,8 @@ export interface TelegramInboundRouteRuntimeDeps<
   /** Quiet period after the last cancelled input before one cleanup attempt; defaults to 0 ms. */
   temporaryThreadCleanupDelayMs?: number;
   /** Live-rebind cleanup attempt pacing; the bounded window ends in `not-issued`, never a time-based deletion. */
+  /** Bounded ACK observation inside the original chooser admission, independent from menu/reply delivery. */
+  liveRebindCommandCompletionTimeoutMs?: number;
   liveRebindCleanupSchedule?: {
     delaysMs: readonly number[];
     intervalMs: number;
@@ -1937,6 +1949,7 @@ export function createTelegramInboundRouteRuntime<
       extensionCommand?: Commands.ParsedTelegramCommand;
       extensionKind?: Commands.PreparedSelectedCommand["kind"];
       coordinator?: ReturnType<typeof createTelegramLiveRebindCoordinator>;
+      commandCompletionWaited?: true;
       isCurrent?: () => boolean;
     };
     /** The acknowledged tab presenting an All source; `sourceTarget` is this tab, not the original's location. */
@@ -4870,7 +4883,7 @@ export function createTelegramInboundRouteRuntime<
         Bus.isSameTelegramBusFollowerRegistration(live, follower!) &&
         [
           ...Bus.TELEGRAM_BUS_LIVE_REBIND_CAPABILITIES,
-          ...(heldSelected ? Bus.TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES : []),
+          ...(heldSelected ? Bus.getTelegramBusHeldCommandCapabilities(heldSelected.name) : []),
         ].every((cap) => Bus.hasTelegramBusCapability(live.protocol, cap)) &&
         !!live.target &&
         live.target.chatId === binding.target.chatId &&
@@ -5642,6 +5655,7 @@ export function createTelegramInboundRouteRuntime<
     return {
       operationId: request.operationId,
       selectedCommandReference: () => coordinator?.selectedCommandReference(),
+      observeCommandCompletion: () => coordinator?.observeCommandCompletion(),
       async advance() {
         if (!coordinator) {
           if (!current() || !getRecipient()) return "protected";
@@ -9058,6 +9072,42 @@ export function createTelegramInboundRouteRuntime<
         if (!(await selectPendingDestination())) return true;
         const operationId = selection.coordinator.operationId;
         if (current()) outcome = await selection.coordinator.advance();
+        const completionTimeoutMs = deps.liveRebindCommandCompletionTimeoutMs ?? 0;
+        if (outcome === "unknown" && !selection.commandCompletionWaited && selection.record.owner?.kind === "leader" &&
+          (selection.helpCommand || selection.menuCommand || selection.abortCommand || selection.nextCommand || selection.stopCommand) &&
+          Number.isFinite(completionTimeoutMs) && completionTimeoutMs > 0 &&
+          selection.coordinator.observeCommandCompletion() !== undefined) {
+          selection.commandCompletionWaited = true;
+          const coordinator = selection.coordinator;
+          const signal = Updates.getTelegramUpdateExecutionFence(query)?.signal;
+          outcome = await new Promise<"unknown" | "released">((resolve) => {
+            let settled = false;
+            const subscriptions: (() => void)[] = [];
+            const finish = (result: "unknown" | "released") => {
+              if (settled) return;
+              settled = true;
+              clearTimeout(timer);
+              for (const unsubscribe of subscriptions) unsubscribe();
+              signal?.removeEventListener("abort", abort);
+              resolve(result);
+            };
+            const abort = () => finish("unknown");
+            const observe = () => {
+              if (settled) return;
+              if (!current()) { finish("unknown"); return; }
+              if (coordinator.observeCommandCompletion() === "released") finish("released");
+            };
+            const timer = setTimeout(abort, completionTimeoutMs);
+            timer.unref?.();
+            for (const message of selection.messages) {
+              const unsubscribe = Updates.subscribeTelegramDeferredSourceCompletion(message, observe);
+              if (unsubscribe) subscriptions.push(unsubscribe);
+            }
+            signal?.addEventListener("abort", abort, { once: true });
+            if (signal?.aborted || !current()) abort();
+            else if (coordinator.observeCommandCompletion() === "released") finish("released");
+          });
+        }
         // Cleanup readiness follows the canonical released row, not source disposal: a detached command ACK may
         // still be pending while every attempt samples current work afresh.
         const row =

package/lib/sync.ts

@@ -18,6 +18,7 @@ import {
   isSameTelegramProcessInstance,
   isTelegramTopicTargetStaleError,
   provisionOwnBusTopic,
+  resetTelegramConnectionProvisioning,
   type TelegramOwnTopicProvisionResult,
   type TelegramTopicTargetStore,
   type TelegramWorkspaceDisplayBinding,
@@ -826,6 +827,15 @@ export async function ensureTelegramLeaderThreadBinding(
     ...(deps.telegramProfile ? { telegramProfile: deps.telegramProfile } : {}),
   };
   const leaderProfileKey = getTelegramThreadOwnerKey(leaderOwner);
+  if (deps.forceFreshUnnamed) {
+    await resetTelegramConnectionProvisioning({
+      store: deps.topicTargetStore, owner: "leader", instanceId: deps.instanceId,
+      profileKey: leaderProfileKey, isCurrent: () => {
+        assertLeaderEpoch("connect-recovery");
+        return true;
+      }, recordEvent: deps.recordEvent,
+    });
+  }
   const legacyLeaderRecord =
     deps.topicTargetStore.getByProfileKey(leaderProfileKey);
   let capacityUnavailable = false;
@@ -836,6 +846,7 @@ export async function ensureTelegramLeaderThreadBinding(
         legacyLeaderRecord?.instanceId,
         {
           sessionId: deps.sessionId,
+          provisionProfileKey: leaderProfileKey,
           onCapacityUnavailable() {
             capacityUnavailable = true;
           },

package/lib/threads.ts

@@ -783,6 +783,7 @@ export interface TelegramTopicTargetStore {
   ) => { slot?: string; threadName?: string } | undefined;
   listReservations: () => TelegramThreadReservation[];
   listPendingProvisions: () => TelegramThreadPendingProvision[];
+  resetPendingProvisionForConnect: (expected: TelegramThreadPendingProvision, isCurrent: () => boolean) => Promise<boolean>;
   listPendingCleanups: () => TelegramThreadCleanupIntent[];
   listSyncObservations: () => TelegramTopicSyncObservation[];
   reserveThread: (reservation: TelegramThreadReservation) => void;
@@ -902,6 +903,7 @@ export interface TelegramTopicTargetStore {
     options?: {
       existingBindingOnly?: boolean;
       sessionId?: string;
+      provisionProfileKey?: string;
       onCapacityUnavailable?: () => void;
     },
   ) => TelegramWorkspaceBindingIdentity | undefined;
@@ -4168,6 +4170,7 @@ export function createTelegramTopicTargetStore(
         }
     ),
     isCurrentPublication?: () => boolean,
+    resetProvisions?: readonly TelegramThreadPendingProvision[],
   ): Promise<boolean> => {
     const submittedPath = getPath(),
       submittedProfile = activeProfile();
@@ -4367,6 +4370,13 @@ export function createTelegramTopicTargetStore(
                   !!expectedRestore,
               ),
         );
+        if (resetProvisions) {
+          const recoveries = readProvisionRecoveries(path, true);
+          if (mutationRevision !== persistedRevision || resetProvisions.some(expected =>
+            expected.target || Object.hasOwn(recoveries, expected.id) ||
+            !isDeepStrictEqual(disk.pendingProvisions?.find(value => value.id === expected.id), expected)))
+            throw new Error("Telegram connection recovery provisioning evidence changed.");
+        }
         if (!isDeepStrictEqual(disk.workspaceRestore, expectedRestore))
           throw new Error(
             "Workspace Restore evidence changed before publication.",
@@ -4429,7 +4439,7 @@ export function createTelegramTopicTargetStore(
             }
           : {}),
         reservations: reservations.map((reservation) => ({ ...reservation })),
-        pendingProvisions: pendingProvisions.map((provision) => ({
+        pendingProvisions: pendingProvisions.filter(provision => !resetProvisions?.some(expected => expected.id === provision.id)).map((provision) => ({
           ...provision,
           ...(provision.target ? { target: { ...provision.target } } : {}),
         })),
@@ -4636,6 +4646,7 @@ export function createTelegramTopicTargetStore(
         loadedProfile = submittedProfile;
         loaded = true;
         observedWorkspaceSemantic = getTelegramStateSemanticSnapshot(wire);
+        if (resetProvisions) { pendingProvisions = file.pendingProvisions; mutationRevision += 1; }
         if (transition) {
           records = new Map(
             file.threads.map((record) => {
@@ -4808,6 +4819,10 @@ export function createTelegramTopicTargetStore(
       if (isCurrentPublication?.() === false) return false;
       loadedPath = path;
       loaded = true;
+      if (resetProvisions) {
+        if (mutationRevision !== persistedRevision) return false;
+        pendingProvisions = file.pendingProvisions;
+      }
       if (mutationRevision === persistedRevision) dirty = false;
       return true;
     });
@@ -6814,6 +6829,11 @@ export function createTelegramTopicTargetStore(
       current.status = "ambiguous";
       return true;
     },
+    resetPendingProvisionForConnect(expected, isCurrent) {
+      // Stage no in-memory deletion: refusal or a stale publication must keep its protective hold.
+      if (expected.target || !isCurrent()) return Promise.resolve(false);
+      return persistSnapshot(undefined, isCurrent, [structuredClone(expected)]);
+    },
     removePendingProvision(id) {
       const before = pendingProvisions.length;
       pendingProvisions = pendingProvisions.filter(
@@ -7608,8 +7628,14 @@ export function createTelegramTopicTargetStore(
         ) {
           return undefined;
         }
-        const retainedTarget = binding?.target ?? legacyRecord?.target;
-        const retainedSlot = binding?.slot ?? legacyRecord?.slot;
+        const ownedProvisions = pendingProvisions.filter(value =>
+          value.workspaceBindingKey === identity.bindingKey &&
+          (value.instanceId === instanceId || value.instanceId === effectivePreviousInstanceId ||
+            (options?.provisionProfileKey !== undefined && value.profileKey === options.provisionProfileKey)));
+        if (ownedProvisions.length > 1) return undefined;
+        const ownProvision = ownedProvisions[0];
+        const retainedTarget = ownProvision?.target ?? binding?.target ?? legacyRecord?.target;
+        const retainedSlot = ownProvision?.slot ?? binding?.slot ?? legacyRecord?.slot;
         const otherBindings = Array.from(workspaceBindings.values())
           .filter(
             (other) => other.bindingKey !== identity.bindingKey && other.slot,
@@ -7641,7 +7667,7 @@ export function createTelegramTopicTargetStore(
             )
             .map((reservation) => reservation.slot),
           ...pendingProvisions
-            .filter((provision) =>
+            .filter((provision) => provision !== ownProvision &&
               isPendingProvisionLiveOrTargeted(provision, nowMs),
             )
             .map((provision) => provision.slot),
@@ -9661,6 +9687,32 @@ export function createTelegramTopicTargetRenamer(
   };
 }
 
+/** Caller holds profile Workspace admission; only an explicit connect grants a fresh creation attempt. */
+export async function resetTelegramConnectionProvisioning(input: {
+  store: TelegramTopicTargetStore;
+  owner: TelegramThreadPendingProvision["owner"];
+  instanceId: string;
+  profileKey: string;
+  isCurrent: () => boolean;
+  recordEvent: (category: string, message: unknown, details?: Record<string, unknown>) => void;
+}): Promise<void> {
+  if (!input.isCurrent()) throw new Error("Telegram connection recovery authority changed.");
+  const removed: TelegramThreadPendingProvision[] = [];
+  for (const pending of input.store.listPendingProvisions()) {
+    if (pending.owner !== input.owner || pending.target ||
+        (pending.profileKey !== input.profileKey && pending.instanceId !== input.instanceId)) continue;
+    if (!input.isCurrent()) throw new Error("Telegram connection recovery authority changed.");
+    if (!await input.store.resetPendingProvisionForConnect(pending, input.isCurrent))
+      throw new Error("Telegram connection recovery lost publication authority.");
+    if (!input.isCurrent()) throw new Error("Telegram connection recovery authority changed.");
+    removed.push(pending);
+  }
+  if (removed.length === 0) return;
+  input.recordEvent("connection", "Explicit connect reset unfinished Thread creation; an unconfirmed Telegram Thread may remain.", {
+    phase: "connect-provision-reset", count: removed.length, owner: input.owner,
+  });
+}
+
 export function createTelegramTopicTargetProvisioner(
   deps: TelegramTopicTargetProvisionerDeps,
 ): (
@@ -9923,7 +9975,7 @@ export function createTelegramTopicTargetProvisioner(
         slot,
       );
     }
-    const pendingId = `provision:${request.instanceId}:${slot}:${nowMs}`;
+    const pendingId = `provision:${request.instanceId}:${slot}:${nowMs}:${randomUUID()}`;
     const pendingOwner =
       request.owner?.kind === "leader" ? "leader" : "manual-follower";
     assertLeaderEpoch("before-pending-intent");