@@ -10,6 +10,33 @@ GitHub Releases.
 
 Use this section for changes that are merged but not released yet.
 
+## v1.0.0-rc.1 - 2026-06-25
+
+Release candidate. A second independent review pass closed the last two
+lost-notification gaps in the delivery path; everything else was clean.
+
+### Reliability
+
+- Release and pull-request notification bodies are now budgeted by their
+  **visible** rendered length, not the raw Markdown slice. Rendering can expand
+  the visible text (a Markdown image becomes an `Image:` prefix), so an
+  image-heavy body could previously exceed Telegram's 4096-character limit and
+  be rejected outright — silently losing the notification with no retry. The
+  body is re-rendered to fit, and titles are bounded.
+- Subscriptions are matched to incoming webhooks by the stable
+  `github_repo_id` instead of the repository's full name. A GitHub repo
+  **rename** no longer silently drops every notification for that repo (the hook
+  keeps firing under the same id with a new name); the cached name is refreshed.
+
+### Fixed
+
+- `/start@botname` — the form Telegram delivers in groups — is now recognized,
+  so the "open me in a DM" prompt fires there.
+- A fatal startup error (e.g. the HTTP port already in use) is no longer masked
+  as a clean exit when a shutdown signal arrives at the same instant.
+- A notification job that exhausts its attempts purely through worker
+  lease-expiry is now logged instead of being a silent terminal drop.
+
 ## v1.0.0-alpha.4 - 2026-06-25
 
 A multi-dimension review pass: two delivery-path correctness blockers closed
 
@@ -164,6 +164,15 @@ func run() error {
 	case <-ctx.Done():
 	case runErr = <-errCh:
 	}
+	// If a shutdown signal won the race against a fatal goroutine error (e.g. a
+	// bind failure buffered the same instant a SIGTERM arrived), drain it so the
+	// real failure is still reported instead of a misleading clean exit.
+	if runErr == nil {
+		select {
+		case runErr = <-errCh:
+		default:
+		}
+	}
 
 	// Cancel the signal context so the polling and worker loops observe it,
 	// shut the HTTP server, then wait for every goroutine to return before the
 
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"math/rand"
 	"sort"
 	"strings"
@@ -265,25 +266,41 @@ func (s *Store) GetSubscriptionForUser(ctx context.Context, telegramUserID int64
 	return sub, err
 }
 
-func (s *Store) ListActiveSubscriptionsForRepoEvent(ctx context.Context, repoFullName, event string) ([]Subscription, error) {
+// ListActiveSubscriptionsForRepoEvent matches on the stable github_repo_id, not
+// the repo's full name, so a GitHub repo rename does not silently break delivery
+// (the webhook payload keeps firing under the same id with a new name).
+func (s *Store) ListActiveSubscriptionsForRepoEvent(ctx context.Context, repoID int64, event string) ([]Subscription, error) {
 	rows, err := s.pool.Query(ctx, `
 		SELECT s.id::text, s.telegram_user_id, s.destination_type, s.destination_chat_id,
 		       s.github_repo_id, s.repo_full_name, s.events, s.branch_mode, s.branch_name,
 		       s.branch_names, s.pull_request_actions, s.release_mode,
 		       s.status, s.pause_reason, r.default_branch, r.html_url
 		FROM subscriptions s
 		JOIN repositories r ON r.github_repo_id = s.github_repo_id
-		WHERE s.repo_full_name = $1
+		WHERE s.github_repo_id = $1
 		  AND s.status = 'active'
 		  AND $2 = ANY(s.events)
-	`, repoFullName, event)
+	`, repoID, event)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	return scanSubscriptions(rows)
 }
 
+// ReconcileSubscriptionRepoName refreshes the cached repo_full_name for every
+// subscription on a repo (matched by stable github_repo_id) when GitHub reports
+// a new name — e.g. after a rename — so the bot UI and any name-based paths do
+// not drift. A no-op when nothing changed.
+func (s *Store) ReconcileSubscriptionRepoName(ctx context.Context, repoID int64, fullName string) error {
+	_, err := s.pool.Exec(ctx, `
+		UPDATE subscriptions
+		SET repo_full_name = $2, updated_at = now()
+		WHERE github_repo_id = $1 AND repo_full_name <> $2
+	`, repoID, fullName)
+	return err
+}
+
 func (s *Store) ListActiveEventsForRepo(ctx context.Context, repoFullName string) ([]string, error) {
 	rows, err := s.pool.Query(ctx, `
 		SELECT DISTINCT unnest(events)
@@ -524,6 +541,12 @@ func (s *Store) ClaimPendingNotificationJobs(ctx context.Context, limit int, lea
 				`, row.job.ID, nextAttempts); err != nil {
 					return nil, err
 				}
+				// This terminal transition happens inside the claim tx, so it
+				// never flows through the worker's recordOutcome/logOutcome. Log
+				// it here so an exhausted-by-lease-expiry failure is not a silent
+				// drop.
+				slog.Warn("notification job failed after repeated lease expiry without a result",
+					"job_id", row.job.ID, "attempts", nextAttempts, "subscription_id", row.job.SubscriptionID)
 				continue
 			}
 			if _, err := tx.Exec(ctx, `
 
@@ -10,6 +10,7 @@ import (
 
 type Event struct {
 	Type          string
+	RepoID        int64
 	RepoFullName  string
 	DefaultBranch string
 	Actor         string
@@ -144,7 +145,7 @@ func pullRequestEvent(event Event) string {
 	header := fmt.Sprintf("%s <b>%s</b>\nPull request %s", iconPR, esc(event.RepoFullName), esc(action))
 
 	var meta []string
-	if title := strings.TrimSpace(event.Title); title != "" {
+	if title := truncateText(event.Title, maxTitleRunes); title != "" {
 		label := title
 		if event.Number > 0 {
 			label = fmt.Sprintf("#%d %s", event.Number, title)
@@ -197,20 +198,23 @@ func showsPRBody(action string) bool {
 }
 
 // maxReleaseBodyRunes caps how much of a release's notes we render. Telegram
-// allows 4096 visible characters per message; the body is sliced from the raw
-// Markdown (visible text after rendering is never longer) and wrapped in an
-// expandable blockquote, so a generous cap stays well under the limit even with
-// the header, footer, and "Full release notes" link, while no longer cutting
-// typical release notes off mid-sentence.
+// allows 4096 visible characters per message; bodyBlock holds the rendered body
+// to this many *visible* characters and the header/footer/title are bounded, so
+// the whole message stays under the limit while no longer cutting typical
+// release notes off mid-sentence.
 const maxReleaseBodyRunes = 3500
 
+// maxTitleRunes bounds an attacker-influenced release/PR title in the header so
+// it cannot, together with the body, push the message past Telegram's limit.
+const maxTitleRunes = 200
+
 func releaseEvent(event Event) string {
 	label := "Release"
 	if event.Prerelease {
 		label = "Pre-release"
 	}
 	versionLine := fmt.Sprintf("<b>%s</b>", label)
-	if version := firstNonEmpty(event.Title, event.TagName); version != "" {
+	if version := truncateText(firstNonEmpty(event.Title, event.TagName), maxTitleRunes); version != "" {
 		if link := safeURL(event.URL); link != "" {
 			versionLine += fmt.Sprintf(` · <a href="%s">%s</a>`, escAttr(link), esc(version))
 		} else {
@@ -282,6 +286,15 @@ const (
 // contain them are shown as-is.
 func bodyBlock(raw string, maxRunes int) (string, bool) {
 	rendered, truncated := renderGitHubMarkdown(raw, maxRunes)
+	// Rendering can make the visible text LONGER than the raw slice — a Markdown
+	// image becomes an "Image: " prefix — so a raw-rune cap alone can overshoot
+	// Telegram's 4096 visible-char limit and get the whole message rejected.
+	// Shrink the raw cap and re-render until the visible body fits its budget.
+	for rawCap := maxRunes; rawCap > 64 && visibleRuneCount(rendered) > maxRunes; {
+		rawCap = rawCap * 3 / 4
+		rendered, _ = renderGitHubMarkdown(raw, rawCap)
+		truncated = true
+	}
 	if rendered == "" {
 		return "", false
 	}
 
@@ -132,6 +132,28 @@ func TestGitHubEventTrimsOverlongCommitListToRemainder(t *testing.T) {
 	}
 }
 
+func TestGitHubEventBodyStaysUnderTelegramLimit(t *testing.T) {
+	// Markdown-image bomb: rendering expands each "![](x)" into an "Image: "
+	// prefix, so a raw-rune cap alone would overshoot Telegram's 4096 visible
+	// limit and get the whole message rejected. With an overlong title too, the
+	// full message must still fit.
+	body := strings.Repeat("![](x) ", 800)
+	text := GitHubEvent(Event{
+		Type:         "release",
+		RepoFullName: "acme/repo",
+		Title:        strings.Repeat("T", 500),
+		TagName:      "v1",
+		URL:          "https://github.com/acme/repo/releases/tag/v1",
+		Body:         body,
+	})
+	if got := visibleRuneCount(text); got > 4096 {
+		t.Fatalf("message visible length = %d, exceeds Telegram's 4096-char limit", got)
+	}
+	if !strings.Contains(text, "Full release notes") {
+		t.Fatalf("a body trimmed to fit should still link to the full notes:\n%s", text)
+	}
+}
+
 func TestGitHubEventCollapsesOnlyLongBodies(t *testing.T) {
 	mk := func(body string) string {
 		return GitHubEvent(Event{Type: "release", RepoFullName: "acme/repo", TagName: "v1", URL: "https://github.com/acme/repo/releases/tag/v1", Body: body})
 
@@ -197,11 +197,21 @@ func (b *Bot) handleUpdate(ctx context.Context, update Update) error {
 	return nil
 }
 
+// isStartCommand reports whether text is the /start command, tolerating the
+// /start@botname form Telegram delivers in groups and any trailing arguments.
+func isStartCommand(text string) bool {
+	text = strings.TrimSpace(text)
+	if i := strings.IndexAny(text, " @"); i >= 0 {
+		text = text[:i]
+	}
+	return text == "/start"
+}
+
 func (b *Bot) handleMessage(ctx context.Context, msg Message) error {
 	if err := b.upsertUser(ctx, msg.From); err != nil {
 		return err
 	}
-	if msg.Text == "/start" {
+	if isStartCommand(msg.Text) {
 		if msg.Chat.Type != "private" {
 			var markup *InlineKeyboardMarkup
 			if username := b.botUsername(ctx); username != "" {
 
@@ -107,6 +107,7 @@ func parsePush(body []byte) (notify.Event, bool, error) {
 		Compare    string `json:"compare"`
 		Deleted    bool   `json:"deleted"`
 		Repository struct {
+			ID            int64  `json:"id"`
 			FullName      string `json:"full_name"`
 			DefaultBranch string `json:"default_branch"`
 			HTMLURL       string `json:"html_url"`
@@ -154,6 +155,7 @@ func parsePush(body []byte) (notify.Event, bool, error) {
 	}
 	return notify.Event{
 		Type:          "push",
+		RepoID:        payload.Repository.ID,
 		RepoFullName:  payload.Repository.FullName,
 		DefaultBranch: payload.Repository.DefaultBranch,
 		Actor:         actor,
@@ -188,6 +190,7 @@ func parsePullRequest(body []byte) (notify.Event, bool, error) {
 	}
 	return notify.Event{
 		Type:          "pull_request",
+		RepoID:        payload.Repository.ID,
 		RepoFullName:  payload.Repository.FullName,
 		DefaultBranch: payload.Repository.DefaultBranch,
 		Actor:         payload.Sender.Login,
@@ -225,6 +228,7 @@ func parseRelease(body []byte) (notify.Event, bool, error) {
 	title := firstNonEmpty(payload.Release.Name, payload.Release.TagName)
 	return notify.Event{
 		Type:          "release",
+		RepoID:        payload.Repository.ID,
 		RepoFullName:  payload.Repository.FullName,
 		DefaultBranch: payload.Repository.DefaultBranch,
 		Actor:         payload.Sender.Login,
@@ -240,6 +244,7 @@ func parseRelease(body []byte) (notify.Event, bool, error) {
 }
 
 type repo struct {
+	ID            int64  `json:"id"`
 	FullName      string `json:"full_name"`
 	DefaultBranch string `json:"default_branch"`
 	HTMLURL       string `json:"html_url"`
 
@@ -23,7 +23,10 @@ type Store interface {
 	// transaction, returning (enqueued, duplicate, error). A true duplicate means
 	// the delivery was already fully processed.
 	EnqueueNotificationJobs(ctx context.Context, deliveryID, event, repoFullName string, jobs []db.NotificationJobInsert, maxAttempts int) (int, bool, error)
-	ListActiveSubscriptionsForRepoEvent(ctx context.Context, repoFullName, event string) ([]db.Subscription, error)
+	// ListActiveSubscriptionsForRepoEvent matches by stable github_repo_id so a
+	// repo rename does not break delivery.
+	ListActiveSubscriptionsForRepoEvent(ctx context.Context, repoID int64, event string) ([]db.Subscription, error)
+	ReconcileSubscriptionRepoName(ctx context.Context, repoID int64, fullName string) error
 }
 
 type Handler struct {
@@ -109,12 +112,23 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	subs, err := h.store.ListActiveSubscriptionsForRepoEvent(r.Context(), event.RepoFullName, event.Type)
+	subs, err := h.store.ListActiveSubscriptionsForRepoEvent(r.Context(), event.RepoID, event.Type)
 	if err != nil {
 		slog.Error("webhook list subscriptions failed", "delivery_id", deliveryID, "repo", event.RepoFullName, "error", err)
 		http.Error(w, "list subscriptions", http.StatusInternalServerError)
 		return
 	}
+	// If GitHub renamed the repo, the payload carries the new name while our
+	// cached one is stale; refresh it. Delivery itself already matched by the
+	// stable repo id, so this only keeps the displayed name current.
+	for _, sub := range subs {
+		if sub.RepoFullName != event.RepoFullName {
+			if err := h.store.ReconcileSubscriptionRepoName(r.Context(), event.RepoID, event.RepoFullName); err != nil {
+				slog.Warn("reconcile repo name failed", "repo_id", event.RepoID, "error", err)
+			}
+			break
+		}
+	}
 
 	text := notify.GitHubEvent(event)
 	var jobs []db.NotificationJobInsert
 
@@ -206,23 +206,64 @@ func TestHandlerEnqueuesMatchingSubscription(t *testing.T) {
 	}
 }
 
+func TestHandlerReconcilesRenamedRepo(t *testing.T) {
+	// The repo was renamed: the webhook payload carries the new name (acme/repo,
+	// id 12345) while our cached subscription still has the old name. Delivery
+	// must still match (by stable id) and the cached name must be reconciled.
+	body := pushFixture()
+	store := &fakeStore{subs: []db.Subscription{{
+		ID:                "sub-1",
+		DestinationChatID: 123,
+		BranchMode:        "default",
+		DefaultBranch:     "main",
+		RepoFullName:      "acme/old-name",
+	}}}
+	handler := NewHandler("secret", store, 5, Limits{})
+
+	req := httptest.NewRequest(http.MethodPost, "/webhooks/github", strings.NewReader(string(body)))
+	req.Header.Set("X-Hub-Signature-256", SignForTest("secret", body))
+	req.Header.Set("X-GitHub-Event", "push")
+	req.Header.Set("X-GitHub-Delivery", "delivery-1")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	if len(store.jobs) != 1 {
+		t.Fatalf("jobs = %d, want 1 (a rename must not drop delivery)", len(store.jobs))
+	}
+	if store.reconcileCalls != 1 || store.reconciledName != "acme/repo" {
+		t.Fatalf("reconcile = %dx name=%q; want 1, acme/repo", store.reconcileCalls, store.reconciledName)
+	}
+}
+
 type fakeStore struct {
-	duplicate    bool
-	enqueueCalls int
-	listCalls    int
-	deliveryID   string
-	event        string
-	repoFullName string
-	maxAttempts  int
-	jobs         []db.NotificationJobInsert
-	subs         []db.Subscription
+	duplicate      bool
+	enqueueCalls   int
+	listCalls      int
+	reconcileCalls int
+	reconciledName string
+	deliveryID     string
+	event          string
+	repoFullName   string
+	maxAttempts    int
+	jobs           []db.NotificationJobInsert
+	subs           []db.Subscription
 }
 
-func (f *fakeStore) ListActiveSubscriptionsForRepoEvent(context.Context, string, string) ([]db.Subscription, error) {
+func (f *fakeStore) ListActiveSubscriptionsForRepoEvent(context.Context, int64, string) ([]db.Subscription, error) {
 	f.listCalls++
 	return f.subs, nil
 }
 
+func (f *fakeStore) ReconcileSubscriptionRepoName(_ context.Context, _ int64, fullName string) error {
+	f.reconcileCalls++
+	f.reconciledName = fullName
+	return nil
+}
+
 func (f *fakeStore) EnqueueNotificationJobs(_ context.Context, deliveryID, event, repoFullName string, jobs []db.NotificationJobInsert, maxAttempts int) (int, bool, error) {
 	f.enqueueCalls++
 	f.deliveryID = deliveryID
@@ -240,7 +281,7 @@ func pushFixture() []byte {
 	return []byte(`{
 		"ref":"refs/heads/main",
 		"compare":"https://github.com/acme/repo/compare/a...b",
-		"repository":{"full_name":"acme/repo","default_branch":"main","html_url":"https://github.com/acme/repo"},
+		"repository":{"id":12345,"full_name":"acme/repo","default_branch":"main","html_url":"https://github.com/acme/repo"},
 		"pusher":{"name":"octocat"},
 		"sender":{"login":"octocat"},
 		"head_commit":{"message":"ship it","url":"https://github.com/acme/repo/commit/1"},