@agfpd/iapeer 0.2.38 → 0.2.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.38",
+  "version": "0.2.40",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/index.ts

@@ -1339,6 +1339,15 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           return 1
         }
         out(`${r.woke ? 'woke + ' : ''}attaching ${r.identity}…\n`)
+        // Attach-window observability (killer-hunt 11.06: «была ли смерть под
+        // attach» was answerable only INDIRECTLY via wake cause=attach — i.e. only
+        // when the session was dead at attach time). Bracket the operator's client
+        // window in lifecycle.log: ev=attach at entry, ev=attach-end (with the tmux
+        // client's exit code) when the operator detaches or the server dies under
+        // the client. A death timestamp inside an attach…attach-end window now
+        // reads directly off the log.
+        const attachCfg = loadLifecycleConfig(env)
+        appendLifecycleEvent(attachCfg.eventLogDir, { ev: 'attach', identity: r.identity, woke: String(r.woke) }, { env })
         // Drop the operator into the session. `env -u TMUX` so a nested attach from
         // inside tmux does not error ("sessions should be nested with care").
         const attachEnv = { ...env }
@@ -1347,6 +1356,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           stdio: 'inherit',
           env: attachEnv as Record<string, string>,
         })
+        appendLifecycleEvent(attachCfg.eventLogDir, { ev: 'attach-end', identity: r.identity, rc: a.status ?? -1 }, { env })
         return a.status ?? 0
       }
       default: {

package/src/launch/cmdlog.test.ts

@@ -0,0 +1,94 @@
+// tmux command-log (cmdlog.ts) — the killer-hunt socket-command layer.
+//
+// The live suite encodes boris's acceptance criterion directly: a kill-session
+// issued by an EXTERNAL client must land in the -v server log WITH client
+// attribution (`message: client-<pid> command: …`), file modes never wider than
+// 0600, and the cap keeps volume bounded without losing the tail.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, existsSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { spawnSync } from 'child_process'
+import {
+  CMDLOG_KEEP_BYTES,
+  capCmdLogs,
+  cmdLogDirFor,
+  hardenCmdLogDir,
+  prepareCmdLogDir,
+} from './cmdlog.ts'
+
+const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
+
+let root: string
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), 'cmdlog-'))
+})
+afterAll(() => {
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('prepareCmdLogDir / hardenCmdLogDir / capCmdLogs (hermetic)', () => {
+  test('prepare WIPES the previous generation and recreates 0700', () => {
+    const dir = prepareCmdLogDir(root, 'claude-x')
+    expect(dir).toBe(cmdLogDirFor(root, 'claude-x'))
+    writeFileSync(join(dir!, 'tmux-server-1.log'), 'old generation')
+    const again = prepareCmdLogDir(root, 'claude-x')
+    expect(readdirSync(again!)).toEqual([]) // old log gone — one generation per dir
+    expect(statSync(again!).mode & 0o777).toBe(0o700)
+  })
+
+  test('harden clamps every file to 0600', () => {
+    const dir = prepareCmdLogDir(root, 'claude-h')!
+    writeFileSync(join(dir, 'tmux-server-2.log'), 'x', { mode: 0o644 })
+    hardenCmdLogDir(dir)
+    expect(statSync(join(dir, 'tmux-server-2.log')).mode & 0o777).toBe(0o600)
+  })
+
+  test('cap tail-keeps an oversized log (KEEP bytes of TAIL survive), leaves small logs alone', () => {
+    const dir = prepareCmdLogDir(root, 'claude-c')!
+    const big = join(dir, 'tmux-server-3.log')
+    const small = join(dir, 'tmux-server-4.log')
+    // 2 MB of filler ending in a recognizable tail — cap to 1 KB keep for the test
+    writeFileSync(big, Buffer.concat([Buffer.alloc(2 * 1024 * 1024, 0x61), Buffer.from('THE-DEATH-TAIL')]))
+    writeFileSync(small, 'tiny')
+    const capped = capCmdLogs(root, 1024 * 1024, 1024)
+    expect(capped).toEqual([big])
+    const after = readFileSync(big)
+    expect(after.length).toBe(1024)
+    expect(after.toString()).toEndWith('THE-DEATH-TAIL') // the tail is what survives
+    expect(readFileSync(small, 'utf8')).toBe('tiny')
+  })
+
+  test('cap on a missing tree is a silent no-op', () => {
+    expect(capCmdLogs(join(root, 'absent'))).toEqual([])
+  })
+
+  test('default keep constant stays under the cap', () => {
+    expect(CMDLOG_KEEP_BYTES).toBeLessThan(8 * 1024 * 1024)
+  })
+})
+
+describe.if(tmuxAvailable)('live -v server log (acceptance criterion)', () => {
+  test('external client kill-session lands in the server log with client attribution; harden → 0600', () => {
+    const dir = prepareCmdLogDir(root, 'claude-live')!
+    const sock = join(root, 'live.sock')
+    // Start the server FROM the cmdlog dir with -v — exactly the launch wiring.
+    const start = spawnSync('tmux', ['-S', sock, '-v', 'new-session', '-d', '-x', '80', '-y', '24', '-s', 'claude-live', 'sleep 60'], {
+      cwd: dir,
+      encoding: 'utf8',
+    })
+    expect(start.status).toBe(0)
+    hardenCmdLogDir(dir)
+    // An EXTERNAL client (separate tmux invocation = separate client pid) kills it.
+    const kill = spawnSync('tmux', ['-S', sock, 'kill-session', '-t', 'claude-live'], { encoding: 'utf8' })
+    expect(kill.status).toBe(0)
+    const serverLog = readdirSync(dir).find(f => f.startsWith('tmux-server-'))
+    expect(serverLog).toBeDefined()
+    expect(statSync(join(dir, serverLog!)).mode & 0o777).toBe(0o600)
+    const text = readFileSync(join(dir, serverLog!), 'utf8')
+    // Attribution line: message: client-<pid> command: kill-session -t claude-live
+    expect(text).toMatch(/message: client-\d+ command: kill-session -t claude-live/)
+    spawnSync('tmux', ['-S', sock, 'kill-server'], { stdio: 'ignore' })
+  })
+})

package/src/launch/cmdlog.ts

@@ -0,0 +1,130 @@
+// tmux command-log — the SOCKET-COMMAND observability layer of the killer hunt.
+//
+// Why (death class 11.06, boris's session-deaths track): a tmux server killed by a
+// CLIENT COMMAND (`kill-server` / `kill-session` over the unix socket) dies with
+// zero signals — structurally invisible to ALL THREE existing layers: the eslogger
+// trap (no kill(2) anywhere; kernel-originated SIGHUP to the panes is also proven
+// invisible), the pane-died hook (kill-session destroys the pane without retention)
+// and the server-death canary (sees only "server gone"). The tmux server's OWN
+// verbose log is the only witness of that layer: started with `-v`, the server
+// appends `message: client-<pid> command: <verb> <args>` for every client command —
+// the attribution (client pid + exact command + timestamp) that decides the class
+// binarily: "killed by client X" vs "no command ⇒ internal exit".
+//
+// Sensitivity (boris's requirement): the -v log carries FULL send-keys payloads
+// (every delivered envelope, plaintext) — tmux has no commands-only level and the
+// server writes the file itself (name tmux-server-<pid>.log in the STARTING
+// client's cwd — no FIFO/pipe interposition possible). Containment instead:
+//   • the per-identity dir is 0700 (others cannot traverse — same protection class
+//     as the transcripts that already hold the same texts);
+//   • files are chmod'ed 0600 right after the server starts (hardenCmdLogDir);
+//   • volume is capped: ~7 KB/s under a 10 fps TUI redraw (measured) — the
+//     supervise tick tail-keeps each log over CAP_BYTES down to KEEP_BYTES.
+//     tmux writes with O_APPEND (proven live: external truncation is safe, the
+//     server keeps appending at the new EOF), and a killer's command is by nature
+//     the LAST thing in the log — the death tail always survives capping.
+//   • scope: agent-runtime (warm) sessions only — always-on infra sessions relaunch
+//     rarely (no rotation point) and are not the dying class.
+// Rotation: prepareCmdLogDir WIPES the identity dir on every launch — one server
+// generation per dir, no unbounded accumulation across relaunches.
+//
+// Best-effort BY CONSTRUCTION: observability must never fail a launch or a
+// supervise tick — every export swallows FS errors.
+
+import { chmodSync, mkdirSync, openSync, closeSync, readSync, readdirSync, rmSync, statSync, writeFileSync, fstatSync } from 'fs'
+import { join } from 'path'
+
+/** Tail-keep cap: a log over CAP_BYTES is cut down to its last KEEP_BYTES. */
+export const CMDLOG_CAP_BYTES = 8 * 1024 * 1024
+export const CMDLOG_KEEP_BYTES = 1024 * 1024
+
+const CMDLOG_SUBDIR = 'tmux-cmdlog'
+
+/** The per-identity command-log dir: <eventLogDir>/tmux-cmdlog/<identity>. The
+ *  session-creating tmux client runs FROM this dir with `-v`, so the server drops
+ *  tmux-server-<pid>.log (and the client its tmux-client-*.log) here. */
+export function cmdLogDirFor(eventLogDir: string, identity: string): string {
+  return join(eventLogDir, CMDLOG_SUBDIR, identity)
+}
+
+/** Wipe + recreate the identity's command-log dir (0700) for a fresh server
+ *  generation. Returns the dir, or undefined when the FS refuses (the caller then
+ *  launches WITHOUT -v — observability is never load-bearing). */
+export function prepareCmdLogDir(eventLogDir: string, identity: string): string | undefined {
+  try {
+    const dir = cmdLogDirFor(eventLogDir, identity)
+    rmSync(dir, { recursive: true, force: true })
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    return dir
+  } catch {
+    return undefined
+  }
+}
+
+/** Clamp every file the freshly-started server/client dropped into the dir to
+ *  0600 (the dir's 0700 already blocks traversal; this is the belt to that
+ *  suspender — boris's acceptance criterion: no file wider than 0600). */
+export function hardenCmdLogDir(dir: string): void {
+  try {
+    for (const name of readdirSync(dir)) {
+      try {
+        chmodSync(join(dir, name), 0o600)
+      } catch {
+        /* per-file best-effort */
+      }
+    }
+  } catch {
+    /* dir gone — nothing to harden */
+  }
+}
+
+/** Tail-keep cap over every command log under <eventLogDir>/tmux-cmdlog/<identity>.
+ *  A file over capBytes is rewritten as its last keepBytes. Safe against the
+ *  live writer: tmux logs with O_APPEND, so the server's next write lands at
+ *  the new EOF (proven by live truncation test). Lines appended between the
+ *  tail-read and the rewrite are lost — acceptable mid-life noise; the death
+ *  tail is never here because the peer is alive while being capped. */
+export function capCmdLogs(
+  eventLogDir: string,
+  capBytes: number = CMDLOG_CAP_BYTES,
+  keepBytes: number = CMDLOG_KEEP_BYTES,
+): string[] {
+  const capped: string[] = []
+  let identities: string[]
+  try {
+    identities = readdirSync(join(eventLogDir, CMDLOG_SUBDIR))
+  } catch {
+    return capped
+  }
+  for (const identity of identities) {
+    const dir = join(eventLogDir, CMDLOG_SUBDIR, identity)
+    let files: string[]
+    try {
+      files = readdirSync(dir)
+    } catch {
+      continue
+    }
+    for (const name of files) {
+      if (!name.endsWith('.log')) continue
+      const path = join(dir, name)
+      try {
+        if (statSync(path).size <= capBytes) continue
+        const fd = openSync(path, 'r')
+        let tail: Buffer
+        try {
+          const size = fstatSync(fd).size
+          const start = Math.max(0, size - keepBytes)
+          tail = Buffer.alloc(Math.min(keepBytes, size))
+          readSync(fd, tail, 0, tail.length, start)
+        } finally {
+          closeSync(fd)
+        }
+        writeFileSync(path, tail, { mode: 0o600 })
+        capped.push(path)
+      } catch {
+        /* per-file best-effort */
+      }
+    }
+  }
+  return capped
+}

package/src/launch/index.ts

@@ -20,6 +20,7 @@ import { spawnSync } from 'child_process'
 import { CODEX_BEARER_ENV_VAR, CODEX_DUMMY_BEARER, type Runtime } from '../core/constants.ts'
 import { readLaunchEnv } from '../storage/index.ts'
 import { canaryChannel, dismissCanary, ensureServerCanary, exitLogPath, signalCanaryClean } from './canary.ts'
+import { hardenCmdLogDir, prepareCmdLogDir } from './cmdlog.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
@@ -262,14 +263,31 @@ export const launch: LaunchFn = async (
     PEER_IDENTITY: identity,
     PATH: env.PATH ?? `${homedir()}/.bun/bin:${homedir()}/.local/bin:/opt/homebrew/bin:/usr/bin:/bin`,
   }
+  // (2.4) tmux command-log (killer-hunt socket-command layer, cmdlog.ts): WARM
+  //       agent sessions start their server with `-v` so every client command —
+  //       incl. a killer's `kill-server`/`kill-session`, invisible to signal
+  //       forensics — lands in tmux-server-<pid>.log with client attribution
+  //       (`message: client-<pid> command: …`). The starting client runs FROM the
+  //       per-identity 0700 cmdlog dir (that is where tmux drops the logs; the
+  //       pane's cwd is still `-c cwd`). Gated like the other observability layers
+  //       on cfg.exitLogDir; skipped for always-on infra (rare relaunch = no
+  //       rotation point, and not the dying class). Best-effort: a failed dir
+  //       prepare just launches without -v.
+  const cmdLogDir = !cfg.alwaysOn && cfg.exitLogDir ? prepareCmdLogDir(cfg.exitLogDir, identity) : undefined
   const start = spawnSync(
     'tmux',
-    ['-S', sock, 'new-session', '-d', '-s', identity, '-x', '220', '-y', '50', '-c', cwd, runtimeCmd],
-    { env: childEnv as Record<string, string>, encoding: 'utf8' },
+    [
+      '-S', sock,
+      ...(cmdLogDir ? ['-v'] : []),
+      'new-session', '-d', '-s', identity, '-x', '220', '-y', '50', '-c', cwd, runtimeCmd,
+    ],
+    { env: childEnv as Record<string, string>, encoding: 'utf8', ...(cmdLogDir ? { cwd: cmdLogDir } : {}) },
   )
   if (start.status !== 0) {
     return fail(identity, `tmux new-session failed: ${(start.stderr ?? '').trim() || 'exit ' + start.status}`)
   }
+  // The server/client logs exist once new-session returns — clamp them to 0600.
+  if (cmdLogDir) hardenCmdLogDir(cmdLogDir)
 
   // (2.5) Exit-cause observability: a `pane-died` hook that records WHY this
   //       session's process dies (status/signal) at the moment of death into

package/src/lifecycle/index.ts

@@ -26,6 +26,7 @@ import {
 } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { err, ok, type Result } from '../core/errors.ts'
+import { capCmdLogs } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { readPeerProfile, resolveIdentity } from '../identity/index.ts'
 import {
@@ -1071,6 +1072,11 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const env = deps.env ?? process.env
   const nowMs = deps.nowMs ?? Date.now()
   const verbose = superviseLogVerbose(env)
+  // tmux command-log volume cap (killer-hunt socket-command layer, launch/cmdlog.ts):
+  // a -v server log under a busy TUI grows ~7 KB/s, so each tick tail-keeps any log
+  // over the cap. Best-effort by construction; the killer's command is the LAST
+  // line of a dying log, so capping a LIVE peer's log never costs the death tail.
+  capCmdLogs(cfg.eventLogDir)
   // Durable decision trace (eventlog.ts): every reap/death/eager-fresh gets a line
   // so a postmortem can answer "when & how did peer X's prior session end" even
   // after the .idle-reaped / .deaths markers are consumed. alive / skipped-launchd

package/src/transport/index.ts

@@ -487,6 +487,46 @@ function validateAttachments(value: readonly string[] = []): Result<string[]> {
   return ok(out)
 }
 
+// ─── Telegram-domain sender policy (defect track 11.06, sanctioned by Артур) ─
+
+/** A SENDER face in the telegram domain: a non-empty interfaces.telegram.bot (the
+ *  bot machine-key) in the peer's registry passport. Deliberately bot-ONLY, not
+ *  bot|user_id — the bridge picks the SENDING bot from the sender's bot key
+ *  (owner fact, telegram-runtime сверка 11.06): a user_id grants a receive/operator
+ *  identity but no ability to send, so a user_id-only sender passing the guard
+ *  would still die at the bridge — a late asynchronous failure where the guard
+ *  exists to give a synchronous one. The guard passes exactly what the bridge can
+ *  deliver. */
+export function hasTelegramPresence(record: PeerRecord): boolean {
+  const tg = record.interfaces?.telegram
+  if (!tg || typeof tg !== 'object' || Array.isArray(tg)) return false
+  const t = tg as Record<string, unknown>
+  return typeof t.bot === 'string' && t.bot.trim() !== ''
+}
+
+/** Sender policy for the telegram domain: a peer with NO declared telegram presence
+ *  must not write into it — the recipient (a human in Telegram) would face a message
+ *  from a peer that has no telegram face (identity confusion: who writes, by what
+ *  right?). Bot channel = declared presence; no presence — no right to the domain.
+ *  Enforced at the ROUTER, not the bridge: the refusal is synchronous and lands in
+ *  the sender's tool result; a bridge-side check would fire AFTER the router's
+ *  ok:true — a false-OK + silent loss, the class this contract forbids. Applied to
+ *  the INTENDED channel (override / target default — before any wake side-effect,
+ *  since a wake delivers the envelope as the boot first-message) AND to the RESOLVED
+ *  channel at both delivery points (the only-live-session fallback can land on
+ *  telegram without either). */
+function telegramSenderGuard(
+  caller: ResolvedCaller,
+  targetRuntime: string,
+  targetPersonality: string,
+): Result<void> {
+  if (targetRuntime !== 'telegram') return ok(undefined)
+  if (hasTelegramPresence(caller.record)) return ok(undefined)
+  return err(
+    `telegram policy: sender "${caller.personality}" has no telegram face (no interfaces.telegram.bot in its passport) — message to "${targetPersonality}" NOT delivered; route via a telegram-faced peer (e.g. boris) or provision a bot for this sender`,
+  )
+}
+
 /**
  * Route a send from a request-resolved caller to a target peer and deliver it.
  *  hit (live)  → build envelope from the CALLER → deliverViaTmux → {woke:false}
@@ -529,6 +569,12 @@ export async function routeSend(
     return err(`peer "${personality}" is not in the iapeer peers index; message NOT delivered`)
   }
 
+  // Telegram sender policy — INTENDED channel (explicit override, or the target's
+  // default). Checked BEFORE any wake side-effect: a wake delivers the envelope as
+  // the boot first-message, past the resolved-target guards further down.
+  const intendedGuard = telegramSenderGuard(caller, runtime ?? peer.runtime, personality)
+  if (!intendedGuard.ok) return intendedGuard
+
   // Built once — it is both the live-delivery payload and, on a miss, the wake
   // first-message (the woken session receives it as its boot task).
   const envelope = buildEnvelope({
@@ -554,6 +600,10 @@ export async function routeSend(
   const target = resolvePeerDeliveryTarget(personality, runtime, peer)
   if (target.ok) {
     if (target.value.address === caller.address) return err('cannot send to self')
+    // Telegram sender policy — RESOLVED channel (the only-live-session fallback can
+    // land on telegram without an override and without telegram being the default).
+    const liveGuard = telegramSenderGuard(caller, target.value.runtime, personality)
+    if (!liveGuard.ok) return liveGuard
     // peer.cwd enables the Ф-B transcript-mtime liveness probe (busy-session case).
     const delivered = deliverViaTmux(target.value, envelope, peer.cwd)
     if (!delivered.ok) return delivered
@@ -581,6 +631,11 @@ export async function routeSend(
     return err(`woke "${personality}" but the session is not live (verify-before-act): ${live.error.message}`)
   }
   if (live.value.address === caller.address) return err('cannot send to self')
+  // Telegram sender policy — post-wake RESOLVED channel (airtight: a wake should
+  // never bring up a telegram session — they are launchd-held — but the policy is
+  // enforced on every delivery point, not on an assumption about the wake).
+  const postWakeGuard = telegramSenderGuard(caller, live.value.runtime, personality)
+  if (!postWakeGuard.ok) return postWakeGuard
   // taskDelivered:false — the wake took the idempotent live-session fast path (a
   // CONCURRENT sender's boot won the wake.lock and delivered only ITS envelope as
   // the boot first-message). OUR envelope was not delivered by anything yet —

package/src/transport/routesend-wake.test.ts

@@ -17,7 +17,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import { spawnSync } from 'child_process'
-import { routeSend, type WakeFn } from './index.ts'
+import { hasTelegramPresence, routeSend, type WakeFn } from './index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
 import type { PeerRecord } from '../registry/index.ts'
 
@@ -48,6 +48,10 @@ const callerRecord = {
   description: '',
   intelligence: 'artificial',
   cwd: '/tmp/boris',
+  // Telegram sender policy: the target of these suites is a telegram peer, so the
+  // caller must declare a telegram presence (the bot machine-key) — these suites
+  // double as the "bot-faced sender delivers as before" half of the policy criterion.
+  interfaces: { telegram: { bot: 'boris' } },
 } as unknown as PeerRecord
 const caller: ResolvedCaller = {
   personality: 'boris',
@@ -213,3 +217,89 @@ describe.if(tmuxAvailable)('routeSend noteLiveTopic seam (live-delivered topic)'
     killTargetSession()
   })
 })
+
+// ─── Telegram sender policy (defect track 11.06) ─────────────────────────────
+// A sender with NO declared telegram presence (interfaces.telegram.bot|user_id)
+// must get a SYNCHRONOUS refusal when the delivery channel is telegram — the
+// incident class: the bridge silently dropped such envelopes while the router
+// reported ok:true. The bot-faced "delivers as before" half of the criterion is
+// carried by the suites above (their caller declares interfaces.telegram.bot).
+
+const facelessCaller: ResolvedCaller = {
+  personality: 'ghost',
+  runtime: 'claude',
+  address: 'claude-ghost',
+  description: '',
+  intelligence: 'artificial',
+  cwd: '/tmp/ghost',
+  record: {
+    personality: 'ghost',
+    runtime: 'claude',
+    runtimes: ['claude'],
+    description: '',
+    intelligence: 'artificial',
+    cwd: '/tmp/ghost',
+  } as unknown as PeerRecord,
+}
+
+describe('telegram sender policy — hasTelegramPresence', () => {
+  const rec = (tg: unknown): PeerRecord =>
+    ({ personality: 'x', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', cwd: '/tmp/x', ...(tg !== undefined ? { interfaces: { telegram: tg } } : {}) }) as unknown as PeerRecord
+  test('bot machine-key (agent peers) → sender face present', () => {
+    expect(hasTelegramPresence(rec({ bot: 'boris' }))).toBe(true)
+  })
+  test('user_id alone (natural peers — arthur) → NO sender face: the bridge sends FROM the bot key; user_id is a receive/operator identity (owner fact, bot-only predicate)', () => {
+    expect(hasTelegramPresence(rec({ user_id: '409502965' }))).toBe(false)
+    expect(hasTelegramPresence(rec({ user_id: 409502965 }))).toBe(false)
+  })
+  test('no interfaces / no telegram / empty bot → absent', () => {
+    expect(hasTelegramPresence(rec(undefined))).toBe(false)
+    expect(hasTelegramPresence(rec({}))).toBe(false)
+    expect(hasTelegramPresence(rec({ bot: '' }))).toBe(false)
+    expect(hasTelegramPresence(rec({ bot: '  ' }))).toBe(false)
+    expect(hasTelegramPresence(rec({ aliases: { '/alias-new': 'x' } }))).toBe(false)
+  })
+})
+
+describe('telegram sender policy — routeSend refusal', () => {
+  test('INTENDED channel (target default = telegram, peer offline): refused BEFORE the wake — wake never invoked', async () => {
+    let wakeCalled = false
+    const wake: WakeFn = async () => {
+      wakeCalled = true
+      return { status: 'READY', woke: true, runtime: 'telegram', taskDelivered: true }
+    }
+    const r = await routeSend(facelessCaller, { personality: TARGET, message: 'm' }, { wake })
+    expect(r.ok).toBe(false)
+    if (!r.ok) {
+      expect(r.error.message).toContain('telegram policy')
+      expect(r.error.message).toContain('"ghost"')
+      expect(r.error.message).toContain('NOT delivered')
+    }
+    expect(wakeCalled).toBe(false)
+  })
+
+  test('explicit runtime=telegram override: refused with the policy line, not "offline"', async () => {
+    const r = await routeSend(facelessCaller, { personality: TARGET, runtime: 'telegram', message: 'm' })
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('telegram policy')
+  })
+})
+
+describe.if(tmuxAvailable)('telegram sender policy — live telegram session', () => {
+  test('faceless sender + LIVE telegram target → refused, envelope NEVER reaches the pane', async () => {
+    startTargetSession()
+    const r = await routeSend(facelessCaller, { personality: TARGET, message: 'POLICY-MUST-BLOCK' })
+    expect(r.ok).toBe(false)
+    if (!r.ok) expect(r.error.message).toContain('telegram policy')
+    expect(capturePane()).not.toContain('POLICY-MUST-BLOCK')
+    killTargetSession()
+  })
+
+  test('bot-faced sender (boris) + LIVE telegram target → delivered as before', async () => {
+    startTargetSession()
+    const r = await routeSend(caller, { personality: TARGET, message: 'BOT-FACED-OK' })
+    expect(r.ok).toBe(true)
+    expect(capturePane()).toContain('BOT-FACED-OK')
+    killTargetSession()
+  })
+})