@gajae-code/coding-agent 0.12.11 → 0.12.13

package/src/sdk/bus/telegram-daemon.ts

@@ -4,6 +4,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { exactReplacePath, type NativeExactFileIdentity, type NativeExactUnlinkResult } from "@gajae-code/natives";
 import { logger } from "@gajae-code/utils";
 import { withFileLock } from "../../config/file-lock";
 import type { Settings } from "../../config/settings";
@@ -47,6 +48,8 @@ import {
 	buildCompactChoiceGrid,
 	code,
 	markdownToTelegramHtml,
+	SELECTION_MARK_CHECKED,
+	SELECTION_MARK_UNCHECKED,
 	splitTelegramHtml,
 	TELEGRAM_MESSAGE_LIMIT,
 	TELEGRAM_PARSE_MODE,
@@ -107,7 +110,13 @@ import {
 } from "./telegram-reference";
 import { decideThreadedInbound, type InboundAttachment } from "./threaded-inbound";
 import { renderThreadedFrame, supportsTelegramPhotoUpload, type ThreadedSend } from "./threaded-render";
-import { type TopicEndpointBinding, TopicRegistry, type TopicRegistryState } from "./topic-registry";
+import {
+	parseTopicRegistryState,
+	type TopicEndpointBinding,
+	TopicRegistry,
+	type TopicRegistryCasAuthority,
+	type TopicRegistryState,
+} from "./topic-registry";
 
 export type EnsureDaemonResult = "owner_spawned" | "attached" | "disabled" | "blocked";
 /** Detailed result for orchestration that must distinguish a #2028 handoff from a fresh spawn. */
@@ -146,15 +155,27 @@ export interface DaemonState {
 	servingEpoch?: number;
 	stoppedAt?: number;
 }
+interface ExactFileStat {
+	dev: bigint;
+	ino: bigint;
+	nlink: bigint;
+	size: bigint;
+	mtimeNs: bigint;
+	isFile(): boolean;
+}
+
 export interface TelegramDaemonFs {
 	mkdir(path: string, opts?: fs.MakeDirectoryOptions): Promise<void>;
 	readFile(path: string, encoding: BufferEncoding): Promise<string>;
 	writeFile(path: string, data: string, opts?: fs.WriteFileOptions): Promise<void>;
 	rename(oldPath: string, newPath: string): Promise<void>;
 	unlink(path: string): Promise<void>;
-	open(path: string, flags: string, mode?: number): Promise<{ close(): Promise<void> }>;
+	open(path: string, flags: string, mode?: number): Promise<{ sync?: () => Promise<void>; close(): Promise<void> }>;
 	readdir(path: string): Promise<string[]>;
 	chmod(path: string, mode: number): Promise<void>;
+	/** Crash-atomic persistence seams. Implementations without them fail closed. */
+	fsyncFile?(path: string): Promise<void>;
+	fsyncDirectory?(path: string): Promise<void>;
 	stat?(path: string): Promise<{
 		mtimeMs: number;
 		size?: number;
@@ -163,8 +184,9 @@ export interface TelegramDaemonFs {
 		/** Hard-link count; required to prove a staging temp has no second name. */
 		nlink?: number;
 		ctimeMs?: number;
-		isDirectory?: () => boolean;
+		isDirectory?(): boolean;
 	}>;
+	lstat?(path: string, opts: { bigint: true }): Promise<ExactFileStat>;
 	readEndpointFile?(path: string): Promise<NotificationEndpointFile>;
 	exactUnlink?(
 		path: string,
@@ -233,6 +255,22 @@ function negotiateToolActivityCapability(
 
 const nodeFs: TelegramDaemonFs = {
 	...(fs.promises as unknown as TelegramDaemonFs),
+	fsyncFile: async file => {
+		const handle = await fs.promises.open(file, "r+");
+		try {
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+	},
+	fsyncDirectory: async directory => {
+		const handle = await fs.promises.open(directory, "r");
+		try {
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+	},
 	readEndpointFile: readNotificationEndpointFile,
 	exactUnlink: async (file, identity, quarantineName) =>
 		exactUnlinkNotificationFile(
@@ -347,6 +385,10 @@ const BTW_QUESTION_LIMIT_TEXT = "Question must be at most 4096 Unicode scalar va
 type ParsedBtwCommand = { kind: "question"; question: string } | { kind: "ignored" };
 type TelegramFileDownload = { bytes: Buffer } | { failure: "download_failed" | "too_large" };
 class ThreadedModeCapabilityRefusal extends Error {}
+/** Telegram answered `createForumTopic` with an explicit `ok: false` rejection. */
+class TopicCreationRejected extends Error {}
+/** The transport suppressed `createForumTopic` (no response body to classify). */
+class TopicCreationSuppressed extends Error {}
 
 async function prepareTelegramImageAttachment(frame: Record<string, unknown>): Promise<Record<string, unknown>> {
 	if (frame.type !== "image_attachment") return frame;
@@ -386,7 +428,7 @@ function isThreadedModeCapabilityRefusal(response: unknown): boolean {
 	return (
 		ok === false &&
 		typeof description === "string" &&
-		/(?:threaded mode|forum topics? (?:is|are) (?:disabled|not enabled)|(?:not allowed|not permitted|cannot|can't) create forum topics?)/i.test(
+		/(?:threaded mode|forum topics? (?:is|are) (?:disabled|not enabled)|(?:not allowed|not permitted|cannot|can't) create forum topics?|chat is not a forum)/i.test(
 			description,
 		)
 	);
@@ -479,12 +521,15 @@ function endpointGenerationKey(url: string, token: string): string {
 function topicRenameApplied(response: unknown): boolean {
 	return !!response && typeof response === "object" && (response as { ok?: unknown }).ok === true;
 }
-function topicDeleteSettled(response: unknown): boolean {
+function topicArchiveSettled(response: unknown): boolean {
 	if (!response || typeof response !== "object") return false;
-	const result = response as { ok?: unknown; description?: unknown };
-	if (result.ok === true) return true;
-	if (typeof result.description !== "string") return false;
-	return /(?:TOPIC_ID_INVALID|message thread not found)/i.test(result.description);
+	const result = response as { ok?: unknown; result?: unknown; error_code?: unknown; description?: unknown };
+	if (result.ok === true && result.result === true) return true;
+	if (result.ok !== false || result.error_code !== 400 || typeof result.description !== "string") return false;
+	const description = result.description.trim();
+	return /^(?:Bad Request: )?(?:TOPIC_NOT_FOUND|THREAD_NOT_FOUND|topic (?:already|is already) closed|message thread (?:not found|is not modified))$/i.test(
+		description,
+	);
 }
 
 /**
@@ -589,11 +634,428 @@ async function readJson<T>(fsImpl: TelegramDaemonFs, file: string): Promise<T |
 	}
 }
 
-async function writeJsonAtomic(fsImpl: TelegramDaemonFs, file: string, data: unknown): Promise<void> {
+async function writeJsonAtomic(
+	fsImpl: TelegramDaemonFs,
+	file: string,
+	data: unknown,
+	options: { durable?: boolean } = {},
+): Promise<void> {
 	const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-	await fsImpl.writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
-	await fsImpl.chmod(tmp, 0o600).catch(() => undefined);
-	await fsImpl.rename(tmp, file);
+	let renamed = false;
+	try {
+		await fsImpl.writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+		await fsImpl.chmod(tmp, 0o600).catch(() => undefined);
+		if (options.durable) await syncTelegramFile(fsImpl, tmp);
+		await fsImpl.rename(tmp, file);
+		renamed = true;
+		if (options.durable) await syncTelegramDirectory(fsImpl, path.dirname(file));
+	} catch (error) {
+		if (renamed) throw error;
+		let cleanupError: unknown;
+		try {
+			await fsImpl.unlink(tmp);
+		} catch (candidate) {
+			if ((candidate as NodeJS.ErrnoException).code !== "ENOENT") cleanupError = candidate;
+		}
+		if (cleanupError) throw new AggregateError([error, cleanupError], "Atomic JSON write and cleanup failed");
+		throw error;
+	}
+}
+
+async function syncTelegramFile(fsImpl: TelegramDaemonFs, file: string): Promise<void> {
+	const handle = await fsImpl.open(file, "r+");
+	let syncError: unknown;
+	try {
+		if (typeof handle.sync !== "function")
+			throw new Error("Telegram alias durability requires filesystem sync support");
+		await handle.sync();
+	} catch (error) {
+		syncError = error;
+	}
+	let closeError: unknown;
+	try {
+		await handle.close();
+	} catch (error) {
+		closeError = error;
+	}
+	if (syncError && closeError)
+		throw new AggregateError([syncError, closeError], "Telegram alias file sync and close failed");
+	if (syncError) throw syncError;
+	if (closeError) throw closeError;
+}
+
+async function syncTelegramDirectory(fsImpl: TelegramDaemonFs, directory: string): Promise<void> {
+	let handle: Awaited<ReturnType<TelegramDaemonFs["open"]>>;
+	try {
+		handle = await fsImpl.open(directory, "r");
+	} catch (error) {
+		if (process.platform === "win32" && isUnsupportedTelegramDirectoryBarrier(error)) return;
+		throw error;
+	}
+	let syncError: unknown;
+	try {
+		if (typeof handle.sync !== "function")
+			throw new Error("Telegram alias durability requires filesystem sync support");
+		await handle.sync();
+	} catch (error) {
+		if (!(process.platform === "win32" && isUnsupportedTelegramDirectoryBarrier(error))) syncError = error;
+	}
+	let closeError: unknown;
+	try {
+		await handle.close();
+	} catch (error) {
+		closeError = error;
+	}
+	if (syncError && closeError)
+		throw new AggregateError([syncError, closeError], "Telegram alias directory sync and close failed");
+	if (syncError) throw syncError;
+	if (closeError) throw closeError;
+}
+
+function isUnsupportedTelegramDirectoryBarrier(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	return code === "EINVAL" || code === "EISDIR" || code === "ENOTSUP" || code === "EPERM";
+}
+
+export class TopicRegistryDurabilityUnavailableError extends Error {
+	readonly code = "durability_unavailable";
+
+	constructor(cause: unknown) {
+		super("topic registry durability is unavailable", { cause });
+		this.name = "TopicRegistryDurabilityUnavailableError";
+	}
+}
+
+type TopicRegistryExactReplace = (
+	sourcePath: string,
+	destinationPath: string,
+	expectedSource: NativeExactFileIdentity,
+	expectedDestination: NativeExactFileIdentity,
+) => NativeExactUnlinkResult;
+
+function sameExactFileStat(left: ExactFileStat, right: ExactFileStat): boolean {
+	return (
+		left.dev === right.dev &&
+		left.ino === right.ino &&
+		left.nlink === right.nlink &&
+		left.size === right.size &&
+		left.mtimeNs === right.mtimeNs
+	);
+}
+
+async function captureExactFileSnapshot(
+	fsImpl: TelegramDaemonFs,
+	file: string,
+): Promise<{ bytes: string; identity: NativeExactFileIdentity }> {
+	if (!fsImpl.lstat)
+		throw new TopicRegistryDurabilityUnavailableError(
+			new Error("topic registry persistence requires no-follow file identity"),
+		);
+	const before = await fsImpl.lstat(file, { bigint: true });
+	const bytes = await fsImpl.readFile(file, "utf8");
+	const after = await fsImpl.lstat(file, { bigint: true });
+	const parentStat = await fsImpl.lstat(path.dirname(file), { bigint: true });
+	if (!before.isFile() || !after.isFile() || before.nlink !== 1n || !sameExactFileStat(before, after))
+		throw new TopicRegistryDurabilityUnavailableError(
+			new Error("topic registry persistence requires a stable single-link regular file"),
+		);
+	return {
+		bytes,
+		identity: {
+			dev: after.dev,
+			ino: after.ino,
+			nlink: after.nlink,
+			parentDev: parentStat.dev,
+			parentIno: parentStat.ino,
+			size: after.size,
+			mtimeNs: after.mtimeNs,
+			sha256: crypto.createHash("sha256").update(bytes).digest("hex"),
+		},
+	};
+}
+async function captureTopicRegistryDestination(
+	fsImpl: TelegramDaemonFs,
+	file: string,
+	platform: NodeJS.Platform,
+): Promise<NativeExactFileIdentity | undefined> {
+	if (platform !== "win32") return undefined;
+	try {
+		return (await captureExactFileSnapshot(fsImpl, file)).identity;
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		throw error;
+	}
+}
+
+/** Publish topic authority only after its staged bytes and replacement are durable. */
+export async function writeTopicRegistryAtomic(
+	fsImpl: TelegramDaemonFs,
+	file: string,
+	data: unknown,
+	platform: NodeJS.Platform = process.platform,
+	exactReplace: TopicRegistryExactReplace = exactReplacePath,
+	expectedDestination?: NativeExactFileIdentity,
+): Promise<void> {
+	if (!fsImpl.fsyncFile)
+		throw new TopicRegistryDurabilityUnavailableError(
+			new Error("topic registry persistence requires file fsync crash-atomicity"),
+		);
+	if (platform !== "win32" && !fsImpl.fsyncDirectory)
+		throw new TopicRegistryDurabilityUnavailableError(
+			new Error("topic registry persistence requires directory fsync crash-atomicity"),
+		);
+	const parent = path.dirname(file);
+	const serialized = `${JSON.stringify(data, null, 2)}\n`;
+	let destinationExists = true;
+	try {
+		await fsImpl.readFile(file, "utf8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		destinationExists = false;
+	}
+	if (!destinationExists && expectedDestination)
+		throw new TopicRegistryDurabilityUnavailableError(
+			new Error("topic registry destination disappeared after generation validation"),
+		);
+	if (!destinationExists) {
+		try {
+			await fsImpl.writeFile(file, serialized, { mode: 0o600, flag: "wx" });
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "EEXIST")
+				throw new TopicRegistryDurabilityUnavailableError(
+					new Error("topic registry appeared during exclusive creation"),
+				);
+			throw error;
+		}
+		await fsImpl.chmod(file, 0o600).catch(() => undefined);
+		await fsImpl.fsyncFile(file);
+		if (platform !== "win32") await fsImpl.fsyncDirectory!(parent);
+		const written = await fsImpl.readFile(file, "utf8");
+		if (written !== serialized)
+			throw new TopicRegistryDurabilityUnavailableError(
+				new Error("exclusive topic registry creation verification failed"),
+			);
+		return;
+	}
+
+	const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+	try {
+		await fsImpl.writeFile(tmp, serialized, { mode: 0o600, flag: "wx" });
+		await fsImpl.chmod(tmp, 0o600).catch(() => undefined);
+		await fsImpl.fsyncFile(tmp);
+		if (platform === "win32") {
+			if (typeof exactReplace !== "function")
+				throw new TopicRegistryDurabilityUnavailableError(
+					new Error("native Windows exact replacement is unavailable"),
+				);
+			if (!expectedDestination)
+				throw new TopicRegistryDurabilityUnavailableError(
+					new Error("native Windows replacement requires the validated destination identity"),
+				);
+			const expectedSource = (await captureExactFileSnapshot(fsImpl, tmp)).identity;
+			const outcome = exactReplace(tmp, file, expectedSource, expectedDestination);
+			if (!outcome.ok)
+				throw new TopicRegistryDurabilityUnavailableError(
+					new Error(`native Windows topic replacement failed: ${outcome.code ?? "unknown"}`),
+				);
+		} else {
+			await fsImpl.rename(tmp, file);
+			await fsImpl.fsyncDirectory!(parent);
+		}
+		const written = await fsImpl.readFile(file, "utf8");
+		if (written !== serialized)
+			throw new TopicRegistryDurabilityUnavailableError(new Error("topic registry replacement verification failed"));
+	} catch (error) {
+		await fsImpl.unlink(tmp).catch(() => undefined);
+		throw error;
+	}
+}
+/**
+ * Shared-volume topic authority backed by the existing cross-process file lock.
+ * A missing authority is the only valid bootstrap state; malformed and future
+ * snapshots are never interpreted as empty state.
+ */
+export class FilesystemTopicRegistryCasAuthority implements TopicRegistryCasAuthority {
+	private readonly fsImpl: TelegramDaemonFs;
+	private readonly platform: NodeJS.Platform;
+	private readonly exactReplace: TopicRegistryExactReplace;
+	private readonly installationHostId: string;
+
+	constructor(
+		private readonly file: string,
+		input: {
+			installationHostId: string;
+			fs?: TelegramDaemonFs;
+			platform?: NodeJS.Platform;
+			exactReplace?: TopicRegistryExactReplace;
+		},
+	) {
+		if (!input.installationHostId) throw new Error("installationHostId must be non-empty");
+		this.installationHostId = input.installationHostId;
+		this.fsImpl = input.fs ?? nodeFs;
+		this.platform = input.platform ?? process.platform;
+		this.exactReplace = input.exactReplace ?? exactReplacePath;
+	}
+
+	async read(): Promise<TopicRegistryState> {
+		return await withFileLock(this.file, async () => await this.readLocked(), {
+			staleMs: 10_000,
+			ownerHostId: this.installationHostId,
+		});
+	}
+
+	async compareAndSet(expectedGeneration: number, next: TopicRegistryState): Promise<boolean> {
+		if (!Number.isSafeInteger(expectedGeneration) || expectedGeneration < 0)
+			throw new Error("invalid expected topic registry generation");
+		if (
+			next.version !== 2 ||
+			next.registryGeneration !== expectedGeneration + 1 ||
+			parseTopicRegistryState(next) === undefined
+		)
+			throw new Error("invalid next topic registry generation");
+		return await withFileLock(
+			this.file,
+			async () => {
+				const { state: current, legacyRaw, expectedDestination } = await this.#readLockedWithLegacy();
+				if (current.registryGeneration !== expectedGeneration) return false;
+				await ensureDir(this.fsImpl, path.dirname(this.file));
+				if (legacyRaw !== undefined) await this.#quarantineLegacyLocked(legacyRaw);
+				await writeTopicRegistryAtomic(
+					this.fsImpl,
+					this.file,
+					next,
+					this.platform,
+					this.exactReplace,
+					expectedDestination,
+				);
+				return true;
+			},
+			{ staleMs: 10_000, ownerHostId: this.installationHostId },
+		);
+	}
+
+	private async readLocked(): Promise<TopicRegistryState> {
+		return (await this.#readLockedWithLegacy()).state;
+	}
+
+	async #readLockedWithLegacy(): Promise<{
+		state: TopicRegistryState;
+		legacyRaw?: unknown;
+		expectedDestination?: NativeExactFileIdentity;
+	}> {
+		let raw: unknown;
+		let expectedDestination: NativeExactFileIdentity | undefined;
+		try {
+			if (this.platform === "win32") {
+				const snapshot = await captureExactFileSnapshot(this.fsImpl, this.file);
+				raw = JSON.parse(snapshot.bytes);
+				expectedDestination = snapshot.identity;
+			} else {
+				raw = JSON.parse(await this.fsImpl.readFile(this.file, "utf8"));
+			}
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ENOENT")
+				return { state: { version: 2, registryGeneration: 0, topics: {} } };
+			throw new Error("shared topic authority is malformed or unavailable");
+		}
+		const legacyRaw =
+			raw && typeof raw === "object" && !Array.isArray(raw) && !Object.hasOwn(raw as object, "version")
+				? raw
+				: undefined;
+		const state = parseTopicRegistryState(raw);
+		const generation = state?.registryGeneration;
+		if (state?.version !== 2 || generation === undefined || !Number.isSafeInteger(generation) || generation < 0)
+			throw new Error("shared topic authority is malformed or unsupported");
+		return {
+			state: { ...state, registryGeneration: generation },
+			...(legacyRaw === undefined ? {} : { legacyRaw }),
+			...(expectedDestination === undefined ? {} : { expectedDestination }),
+		};
+	}
+
+	async #quarantineLegacyLocked(raw: unknown): Promise<void> {
+		const digest = crypto.createHash("sha256").update(JSON.stringify(raw)).digest("hex");
+		const quarantinePath = `${this.file}.legacy-quarantine.${digest}.json`;
+		try {
+			await this.fsImpl.readFile(quarantinePath, "utf8");
+			return;
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT")
+				throw new Error("shared topic authority is malformed or unavailable");
+		}
+		await writeTopicRegistryAtomic(this.fsImpl, quarantinePath, raw, this.platform, this.exactReplace);
+	}
+}
+
+export interface MachineIdentityDeps {
+	platform?: NodeJS.Platform;
+	readFile?: (file: string) => Promise<string>;
+	runCommand?: (command: string, args: readonly string[]) => { exitCode: number; stdout: Uint8Array };
+}
+
+function normalizedMachineIdentity(value: string, pattern: RegExp): string | undefined {
+	const normalized = value.trim().toLowerCase();
+	if (!pattern.test(normalized) || /^0+$/.test(normalized.replace(/-/g, ""))) return undefined;
+	return normalized;
+}
+
+/** @internal */
+export function parseWindowsMachineGuid(output: string): string | undefined {
+	const match = /^\s*MachineGuid\s+REG_\w+\s+(\S+)\s*$/im.exec(output);
+	return match
+		? normalizedMachineIdentity(match[1], /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/)
+		: undefined;
+}
+
+/** @internal */
+export function parseMacPlatformUuid(output: string): string | undefined {
+	const match = /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(output);
+	return match
+		? normalizedMachineIdentity(match[1], /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/)
+		: undefined;
+}
+
+function hashMachineIdentity(rawId: string): string {
+	return crypto
+		.createHash("sha256")
+		.update("gajae-code:telegram-daemon:machine-identity:v1\0")
+		.update(rawId)
+		.digest("hex");
+}
+
+/** Loads a verified machine-local identity without persisting the underlying machine ID. */
+export async function loadInstallationHostId(deps: MachineIdentityDeps = {}): Promise<string> {
+	const platform = deps.platform ?? process.platform;
+	const readFile = deps.readFile ?? (async (file: string) => await fs.promises.readFile(file, "utf8"));
+	const runCommand =
+		deps.runCommand ??
+		((command: string, args: readonly string[]) =>
+			Bun.spawnSync([command, ...args], { stdout: "pipe", stderr: "ignore" }));
+
+	let rawId: string | undefined;
+	if (platform === "linux") {
+		for (const file of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+			try {
+				const value = normalizedMachineIdentity(await readFile(file), /^[0-9a-f]{32}$/);
+				if (!value) throw new Error("machine-local identity is unavailable or malformed");
+				rawId = value;
+				break;
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+			}
+		}
+	} else if (platform === "win32") {
+		const result = runCommand("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"]);
+		if (result.exitCode === 0) rawId = parseWindowsMachineGuid(new TextDecoder().decode(result.stdout));
+	} else if (platform === "darwin") {
+		const result = runCommand("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+		if (result.exitCode === 0) rawId = parseMacPlatformUuid(new TextDecoder().decode(result.stdout));
+	} else {
+		throw new Error(`machine-local identity is unsupported on ${platform}`);
+	}
+
+	if (!rawId) throw new Error("machine-local identity is unavailable or malformed");
+	return hashMachineIdentity(rawId);
 }
 
 function validDaemonPid(pid: unknown): pid is number {
@@ -2184,7 +2646,8 @@ export function isCurrentCompatibleOwner(input: {
 			state?.ownershipPhase === "ready" &&
 			typeof state.acquisitionId === "string" &&
 			state.acquisitionId.length > 0 &&
-			(state.servingEpoch === undefined ? 1 : state.servingEpoch) >= SERVING_EPOCH,
+			state.generation === DAEMON_GENERATION &&
+			state.servingEpoch === SERVING_EPOCH,
 	);
 }
 
@@ -3122,6 +3585,8 @@ export interface TelegramSpawnOwnerInput {
 	roots?: string[];
 	tokenFingerprint: string;
 	chatId: string;
+	/** Ephemeral outbound-only validation destination for this owner launch. */
+	validationTestSupergroupChatId?: string;
 }
 
 export interface TelegramSpawnAcquisition {
@@ -3149,7 +3614,12 @@ export type TelegramSpawnOwnerResult =
  * Source mode prepends the entry script so the respawn loads edited source;
  * a compiled binary self-spawns its own subcommand directly.
  */
-export function buildTelegramDaemonSpawnArgs(input: { execPath?: string; ownerId: string; agentDir: string }): {
+export function buildTelegramDaemonSpawnArgs(input: {
+	execPath?: string;
+	ownerId: string;
+	agentDir: string;
+	validationTestSupergroupChatId?: string;
+}): {
 	command: string;
 	args: string[];
 	runtime: DaemonRuntimeInfo;
@@ -3163,6 +3633,9 @@ export function buildTelegramDaemonSpawnArgs(input: { execPath?: string; ownerId
 		input.ownerId,
 		"--agent-dir",
 		input.agentDir,
+		...(input.validationTestSupergroupChatId !== undefined
+			? ["--validation-test-supergroup-chat-id", input.validationTestSupergroupChatId]
+			: []),
 	];
 	const runtime: DaemonRuntimeInfo = {
 		mode: rt.mode,
@@ -3238,6 +3711,7 @@ export async function spawnTelegramDaemonOwner(
 		execPath,
 		ownerId: provisionalAcquisition.ownerId,
 		agentDir,
+		validationTestSupergroupChatId: input.validationTestSupergroupChatId,
 	});
 	const spawnImpl = deps.spawn ?? defaultDaemonSpawn;
 	const child = spawnImpl(command, args, {
@@ -3419,13 +3893,17 @@ async function ensureTelegramDaemonRunningDetailedOnce(
 	// unproven cooperative handoff into destructive cleanup or a replacement spawn.
 	if ((deps.platform ?? process.platform) === "win32") {
 		const parentState: unknown = await readDaemonState(input.settings, deps.fs);
-		if (isParentDaemonState(parentState) && (deps.pidAlive ?? defaultPidAlive)(parentState.pid))
+		if (
+			isParentDaemonState(parentState) &&
+			(deps.pidAlive ?? defaultPidAlive)(parentState.pid) &&
+			(!hasSafeDaemonStateShape(parentState) || ownerProvenanceMatches(parentState, deps.pidIncarnation))
+		)
 			return "blocked_identity";
 	}
 	// Windows can retain dead launcher metadata without an ownership lock; reclaim
 	// its dead discovery records before the replacement can publish a new owner.
 	if ((deps.platform ?? process.platform) === "win32" && !deps.fs) {
-		const preflight = await reclaimDeadDaemonOwner({
+		let preflight = await reclaimDeadDaemonOwner({
 			settings: input.settings,
 			endpointDir: path.join(root, "sdk"),
 			fs: deps.fs,
@@ -3433,6 +3911,28 @@ async function ensureTelegramDaemonRunningDetailedOnce(
 			pidAlive: deps.pidAlive,
 			pidIncarnation: deps.pidIncarnation,
 		});
+		// A just-reused PID can be reported alive for the first probe. Recheck once
+		// before acquisition only when stale discovery records need fenced cleanup.
+		// reclaimDeadDaemonOwner still requires exact state, lock, incarnation,
+		// transition-lock, and endpoint-identity proofs before deleting anything.
+		const endpointNames =
+			preflight.reason === "not-confirmed-dead"
+				? await (deps.fs ?? nodeFs).readdir(path.join(root, "sdk")).catch(() => undefined)
+				: undefined;
+		if (
+			!preflight.recovered &&
+			preflight.reason === "not-confirmed-dead" &&
+			endpointNames?.some(name => name.endsWith(".json"))
+		) {
+			preflight = await reclaimDeadDaemonOwner({
+				settings: input.settings,
+				endpointDir: path.join(root, "sdk"),
+				fs: deps.fs,
+				now: deps.now,
+				pidAlive: deps.pidAlive,
+				pidIncarnation: deps.pidIncarnation,
+			});
+		}
 		if (!preflight.recovered && preflight.reason !== "not-confirmed-dead") {
 			logger.warn(
 				`notifications: startup recovery unsafe (${preflight.reason}); run \`gjc notify recovery\` for diagnostics`,
@@ -3849,7 +4349,7 @@ export class TelegramBotTransport implements BotApi {
 	}
 }
 
-type PairedChatPrivacy = "private" | "non-private" | "indeterminate";
+type PairedChatPrivacy = "private" | "validation-forum" | "non-private" | "indeterminate";
 
 export type TelegramUpdateOutcome = "consumed" | "retry";
 
@@ -4065,6 +4565,12 @@ export interface TelegramDaemonOptions {
 	ownerId: string;
 	botToken: string;
 	chatId: string;
+	/**
+	 * Exact ephemeral forum destination supplied to the daemon-internal validation
+	 * command. Production ownership, pairing, and durable topic authority remain
+	 * bound to `chatId`.
+	 */
+	validationTestSupergroupChatId?: string;
 	apiBase?: string;
 	fetchImpl?: typeof fetch;
 	fs?: TelegramDaemonFs;
@@ -4116,6 +4622,20 @@ export interface TelegramDaemonOptions {
 	 * built-in `{repo}/{branch} - {title}` composition and its fallbacks.
 	 */
 	topics?: { nameTemplate?: string };
+	/**
+	 * Optional compare-and-set store for installations that share topic state
+	 * across hosts. When configured, every publication is fenced by it.
+	 */
+	topicRegistryAuthority?: TopicRegistryCasAuthority;
+	/** Stable host-local identity. Required whenever a shared authority is configured. */
+	installationHostId?: string;
+}
+
+interface StagedCallbackActivation {
+	pending: { sessionId: string; actionId: string };
+	socketLease: { session: SessionSocket; token: number; logicalSessionId: string };
+	topicLease?: TopicAuthorityLease;
+	settled: Promise<boolean>;
 }
 
 interface SessionSocket {
@@ -4226,7 +4746,8 @@ interface PendingThreadedFrame {
 	send: ThreadedSend;
 	msg: Record<string, unknown>;
 	logicalSessionId: string;
-	socketLease: { session: SessionSocket; token: number; logicalSessionId: string };
+	session: SessionSocket;
+	socketLease?: { session: SessionSocket; token: number; logicalSessionId: string };
 	toolActivity?: ToolActivityOwner;
 }
 
@@ -4246,6 +4767,37 @@ interface BotApiCallResult {
 	response: unknown;
 	outcome: BotApiCallOutcome;
 }
+function createBotApiAdapter(
+	call: (
+		method: string,
+		body: unknown,
+		callOpts?: { signal?: AbortSignal; noRetry?: boolean },
+	) => Promise<BotApiCallResult>,
+): BotApi {
+	return {
+		call: async (method, body, callOpts) => (await call(method, body, callOpts)).response,
+	};
+}
+function createBotApiPipeline(
+	rawBotApi: BotApi,
+	callBotApi: (
+		rawBotApi: BotApi,
+		method: string,
+		body: unknown,
+		callOpts?: { signal?: AbortSignal; noRetry?: boolean },
+	) => Promise<BotApiCallResult>,
+): {
+	classified: (
+		method: string,
+		body: unknown,
+		callOpts?: { signal?: AbortSignal; noRetry?: boolean },
+	) => Promise<BotApiCallResult>;
+	api: BotApi;
+} {
+	const classified = (method: string, body: unknown, callOpts?: { signal?: AbortSignal; noRetry?: boolean }) =>
+		callBotApi(rawBotApi, method, body, callOpts);
+	return { classified, api: createBotApiAdapter(classified) };
+}
 
 function classifyBotApiCallOutcome(response: unknown, cooldownSuppressed = false): BotApiCallOutcome {
 	if (cooldownSuppressed) return { kind: "retryable", retryAfterMs: 0 };
@@ -4329,6 +4881,7 @@ interface PendingBtwDelivery {
 
 class TelegramEffectSupervisor {
 	#stopping = false;
+	#admitting = true;
 	readonly #abort = new AbortController();
 	readonly #terminalContext = new AsyncLocalStorage<boolean>();
 	readonly #pending = new Set<Promise<unknown>>();
@@ -4350,6 +4903,16 @@ class TelegramEffectSupervisor {
 		return this.track(api.call(method, body, { ...opts, signal }));
 	}
 
+	admit<T>(effect: () => Promise<T>): Promise<T> {
+		if (!this.#admitting)
+			return Promise.reject(Object.assign(new Error("Daemon is stopping"), { name: "AbortError" }));
+		try {
+			return this.track(effect());
+		} catch (error) {
+			return Promise.reject(error);
+		}
+	}
+
 	track<T>(effect: Promise<T>): Promise<T> {
 		this.#pending.add(effect);
 		void effect.then(
@@ -4363,7 +4926,12 @@ class TelegramEffectSupervisor {
 		return this.#stopping;
 	}
 
+	closeAdmission(): void {
+		this.#admitting = false;
+	}
+
 	beginShutdown(): void {
+		this.closeAdmission();
 		this.#stopping = true;
 		this.#abort.abort("daemon_shutdown");
 	}
@@ -4388,7 +4956,18 @@ class TelegramEffectSupervisor {
 
 export class TelegramNotificationDaemon {
 	readonly aliasTable: AliasTable;
+	/** Callback aliases are routable only by the immutable socket lease that rendered them. */
+	#callbackAliasLeases = new Map<string, { session: SessionSocket; token: number; logicalSessionId: string }>();
+	/** Each active alias is bound to the exact pending ask object that rendered it. */
+	#callbackAliasPending = new Map<string, { sessionId: string; actionId: string }>();
+	/** Active callbacks preserve the exact topic authority under which their keyboard was rendered. */
+	#callbackAliasTopics = new Map<string, TopicAuthorityLease>();
+	/** Exposed aliases wait for their accepted receipt persistence before routing. */
+	#stagedCallbackActivations = new Map<string, StagedCallbackActivation>();
 	readonly messageRoutes = new Map<string | number, CallbackRoute | Omit<CallbackRoute, "answer">>();
+	/** Restart-revoked aliases retained only to terminalize their old keyboards on an authoritative replay. */
+	private readonly reissueBacklog = new Map<string, CallbackRoute>();
+	private aliasPersistenceQueue: Promise<void> = Promise.resolve();
 	/** Telegram message id backing each streamed `${sessionId}:${coalesceKey}`, for in-place edits. */
 	private readonly liveMessages = new Map<string, number>();
 	/** Endpoint-bound ownership for visible or dispatching tool bubbles. */
@@ -4432,6 +5011,8 @@ export class TelegramNotificationDaemon {
 	private readonly botApi: BotApi;
 	private readonly effects = new TelegramEffectSupervisor();
 	private readonly topics = new TopicRegistry();
+	/** Stable host-local identity; never persisted in shared topic authority. */
+	private installationHostId: string;
 	/**
 	 * Telegram may accept createForumTopic while returning an unusable success
 	 * payload. Remember that ambiguity per endpoint so later frames cannot repeat
@@ -4446,6 +5027,11 @@ export class TelegramNotificationDaemon {
 	private recoveryBindingClaimQueue: Promise<void> = Promise.resolve();
 	/** Durable compensation fences retry under supervision until persistence succeeds. */
 	private readonly compensationFenceRetries = new Map<string, Promise<void>>();
+	/** All archive paths for one session share one durable fence and remote dispatch. */
+	private readonly archiveFlights = new Map<
+		string,
+		Promise<"pre_dispatch_cancelled" | "post_dispatch_pending" | "settled">
+	>();
 
 	/** Daemon edit attempts that can race an accepted user service message. */
 	private readonly daemonRenameAttempts = new Map<string, number>();
@@ -4486,8 +5072,10 @@ export class TelegramNotificationDaemon {
 	private threadedFallbackNoticeSent = false;
 	/** Sessions whose identity header was already sent flat (Threaded Mode off). */
 	private readonly flatIdentitySent = new Set<string>();
-	/** Cached result of whether the paired chat is a private chat (flat-fallback gate). */
-	private pairedChatPrivate: boolean | undefined;
+	/** Cached delivery boundary for the private owner chat or validation forum. */
+	private pairedChatPrivacy: PairedChatPrivacy | undefined;
+	/** Latched once Telegram confirms this chat cannot host forum topics. */
+	private topicCapabilityRefused = false;
 	/** Bot username from getMe, cached once at owner startup for group/forum command targeting. */
 	private botUsername: string | undefined;
 	/** Sessions whose agent loop is currently busy (drives the typing indicator). */
@@ -4555,6 +5143,7 @@ export class TelegramNotificationDaemon {
 	 */
 	requestStop(_reason?: "reload" | "stop" | "signal"): void {
 		this.stopRequested = true;
+		this.effects.closeAdmission();
 
 		const toolShutdown = this.beginToolActivityShutdown();
 		void toolShutdown
@@ -4919,7 +5508,8 @@ export class TelegramNotificationDaemon {
 			const outcome = classifyBotApiCallOutcome(undefined, true);
 			return { response: undefined, outcome };
 		}
-		const response = await this.effects.call(rawBotApi, method, body, callOpts);
+		const outboundBody = this.validationTopicDestination(method, body);
+		const response = await this.effects.call(rawBotApi, method, outboundBody, callOpts);
 		const outcome = classifyBotApiCallOutcome(response);
 		if (outcome.kind === "retryable")
 			this.botCooldownUntil = Math.max(
@@ -4928,6 +5518,20 @@ export class TelegramNotificationDaemon {
 			);
 		return { response, outcome };
 	}
+	private validationTopicDestination(method: string, body: unknown): unknown {
+		if (
+			!this.validationMode() ||
+			method === "getChat" ||
+			!body ||
+			typeof body !== "object" ||
+			String((body as { chat_id?: unknown }).chat_id) !== String(this.opts.chatId)
+		)
+			return body;
+		return {
+			...(body as Record<string, unknown>),
+			chat_id: this.opts.validationTestSupergroupChatId!,
+		};
+	}
 
 	private readonly callBotApiClassified: (
 		method: string,
@@ -4948,6 +5552,9 @@ export class TelegramNotificationDaemon {
 	constructor(private readonly opts: TelegramDaemonOptions) {
 		this.fsImpl = opts.fs ?? nodeFs;
 		this.replyStore = new ReplySentStore({ agentDir: opts.settings.getAgentDir(), fs: opts.fs });
+		if (opts.topicRegistryAuthority && !opts.installationHostId)
+			throw new Error("shared topic authority requires a host-local installation identity");
+		this.installationHostId = opts.installationHostId ?? crypto.randomUUID();
 		this.aliasTable = createAliasTable();
 		this.#adoptionIntentTtlMs = opts.adoptionIntentTtlMs ?? DEFAULT_ADOPTION_INTENT_TTL_MS;
 		const adoptionFs: AdoptionIntentFs = {
@@ -4981,10 +5588,9 @@ export class TelegramNotificationDaemon {
 				fetchImpl: opts.fetchImpl,
 				setTimeoutImpl: opts.setTimeoutImpl,
 			});
-		this.callBotApiClassified = (method, body, callOpts) => this.callBotApi(rawBotApi, method, body, callOpts);
-		this.botApi = {
-			call: async (method, body, callOpts) => (await this.callBotApiClassified(method, body, callOpts)).response,
-		};
+		const botApiPipeline = createBotApiPipeline(rawBotApi, this.callBotApi.bind(this));
+		this.callBotApiClassified = botApiPipeline.classified;
+		this.botApi = botApiPipeline.api;
 		this.runtime = new NotificationOperatorRuntime({
 			now: opts.now,
 			setTimeoutImpl: opts.setTimeoutImpl,
@@ -5058,7 +5664,6 @@ export class TelegramNotificationDaemon {
 					if (!socketLease) return;
 					const topicLease = this.topicAuthorityLeaseFromRegistry(logicalSessionId);
 					if (
-						this.topics.get(logicalSessionId)?.authorityState === "delete_pending" ||
 						this.topics.get(logicalSessionId)?.bindingMalformed ||
 						(mode === "recovery" && (!topicLease || msg.sessionId !== logicalSessionId))
 					) {
@@ -5217,40 +5822,49 @@ export class TelegramNotificationDaemon {
 						if (socketLease && !this.#leaseTokenAllows(socketLease)) return;
 
 						const closedBinding = this.#endpointBinding(session);
-						const closeTopicAuthority = this.topics.captureDeleteAuthority(logicalSessionId);
+						const closedBindingMatches = () => {
+							const current = this.closedEndpointKeys.get(session.sessionId);
+							return (
+								current?.chatId === closedBinding.chatId &&
+								current.endpointKey === closedBinding.endpointKey &&
+								current.endpointDigest === closedBinding.endpointDigest &&
+								current.endpointGeneration === closedBinding.endpointGeneration
+							);
+						};
+						const closeTopicAuthority = this.topics.captureArchiveAuthority(logicalSessionId);
 						const previousClosedBinding = this.closedEndpointKeys.get(session.sessionId);
 						await this.#persistTopicMutation(
 							() => {
 								this.closedEndpointKeys.set(session.sessionId, closedBinding);
-								this.topics.beginDelete(logicalSessionId);
+								this.topics.beginArchive(logicalSessionId, this.installationHostId, this.runtime.now());
 							},
 							() => {
-								this.topics.restoreDeleteAuthority(closeTopicAuthority);
+								this.topics.restoreArchiveAuthority(closeTopicAuthority);
 								if (previousClosedBinding === undefined) this.closedEndpointKeys.delete(session.sessionId);
-								else if (this.closedEndpointKeys.get(session.sessionId) === closedBinding)
+								else if (closedBindingMatches())
 									this.closedEndpointKeys.set(session.sessionId, previousClosedBinding);
 							},
 						);
 						if (
-							socketLease &&
-							(this.sessions.get(session.sessionId) !== session ||
-								session.recoveryLease?.token !== socketLease.token ||
-								session.recoveryLease.state !== "authorized" ||
-								this.logicalSessionOwners.get(logicalSessionId) !== session)
+							this.sessions.get(session.sessionId) !== session ||
+							(socketLease &&
+								(session.recoveryLease?.token !== socketLease.token ||
+									session.recoveryLease.state !== "authorized" ||
+									this.logicalSessionOwners.get(logicalSessionId) !== session))
 						) {
 							// A replacement won after the close fence committed. Restore the exact
 							// pre-close authority and remove the predecessor tombstone together.
 							const restoreCloseAuthority = (): Promise<boolean> =>
 								this.#persistTopicMutation(
 									() => {
-										const restored = this.topics.restoreDeleteAuthority(closeTopicAuthority);
-										if (!restored) throw new Error("close authority changed before compensation");
-										this.closedEndpointKeys.delete(session.sessionId);
+										this.topics.restoreArchiveAuthority(closeTopicAuthority);
+										if (closedBindingMatches()) this.closedEndpointKeys.delete(session.sessionId);
 										return true;
 									},
 									() => {
-										this.topics.restoreDeleteFence(closeTopicAuthority);
-										this.closedEndpointKeys.set(session.sessionId, closedBinding);
+										this.topics.restoreArchiveFence(closeTopicAuthority);
+										if (this.sessions.get(session.sessionId) === session)
+											this.closedEndpointKeys.set(session.sessionId, closedBinding);
 									},
 								);
 							try {
@@ -5260,7 +5874,7 @@ export class TelegramNotificationDaemon {
 							}
 							return;
 						}
-						const deleteOutcome = await this.deleteTopic(logicalSessionId, socketLease, true);
+						const deleteOutcome = await this.archiveTopic(logicalSessionId, socketLease, true);
 						if (
 							deleteOutcome === "pre_dispatch_cancelled" &&
 							socketLease &&
@@ -5268,12 +5882,12 @@ export class TelegramNotificationDaemon {
 						) {
 							await this.#persistTopicMutation(
 								() => {
-									if (!this.topics.restoreDeleteAuthority(closeTopicAuthority))
+									if (!this.topics.restoreArchiveAuthority(closeTopicAuthority))
 										throw new Error("close authority changed before compensation");
 									this.closedEndpointKeys.delete(session.sessionId);
 								},
 								() => {
-									this.topics.restoreDeleteFence(closeTopicAuthority);
+									this.topics.restoreArchiveFence(closeTopicAuthority);
 									this.closedEndpointKeys.set(session.sessionId, closedBinding);
 								},
 							);
@@ -5286,17 +5900,40 @@ export class TelegramNotificationDaemon {
 	}
 
 	async loadAliases(): Promise<void> {
+		if (this.validationMode()) return;
 		const raw = await readJson<unknown>(this.fsImpl, daemonPaths(this.opts.settings.getAgentDir()).aliases);
-		if (raw) this.aliasTable.load(raw);
+		if (!raw) return;
+		const persisted = raw as { revokedRoutes?: unknown };
+		const revoked = createAliasTable();
+		revoked.load({ version: 2, next: 1, routes: persisted.revokedRoutes });
+		for (const [alias, route] of revoked.entries()) this.reissueBacklog.set(alias, route);
+		this.aliasTable.load(raw);
+		for (const [alias, route] of this.aliasTable.entries()) this.reissueBacklog.set(alias, route);
+		this.aliasTable.clear();
+		await this.persistAliases();
 	}
 
-	async persistAliases(): Promise<void> {
-		const paths = daemonPaths(this.opts.settings.getAgentDir());
-		await ensureDir(this.fsImpl, paths.dir);
-		await writeJsonAtomic(this.fsImpl, paths.aliases, this.aliasTable.serialize());
+	persistAliases(): Promise<void> {
+		if (this.validationMode()) return Promise.resolve();
+		const pending = this.aliasPersistenceQueue.then(async () => {
+			const paths = daemonPaths(this.opts.settings.getAgentDir());
+			await ensureDir(this.fsImpl, paths.dir);
+			await writeJsonAtomic(
+				this.fsImpl,
+				paths.aliases,
+				{
+					...this.aliasTable.serialize(),
+					revokedRoutes: Object.fromEntries(this.reissueBacklog),
+				},
+				{ durable: true },
+			);
+		});
+		this.aliasPersistenceQueue = pending.catch(() => undefined);
+		return pending;
 	}
 
 	async loadSeenUpdateIds(): Promise<void> {
+		if (this.validationMode()) return;
 		const raw = await readJson<{ updateIds?: unknown }>(
 			this.fsImpl,
 			daemonPaths(this.opts.settings.getAgentDir()).seenUpdates,
@@ -5312,6 +5949,7 @@ export class TelegramNotificationDaemon {
 	}
 
 	async persistSeenUpdateIds(): Promise<void> {
+		if (this.validationMode()) return;
 		const paths = daemonPaths(this.opts.settings.getAgentDir());
 		await ensureDir(this.fsImpl, paths.dir);
 		await writeJsonAtomic(this.fsImpl, paths.seenUpdates, {
@@ -5341,6 +5979,12 @@ export class TelegramNotificationDaemon {
 		}
 	}
 	private async reserveSeenUpdateId(updateId: number): Promise<boolean> {
+		if (this.validationMode()) {
+			if (this.dispatchState.seenUpdateIds.has(updateId)) return false;
+			this.dispatchState.seenUpdateIds.add(updateId);
+			this.pruneSeenUpdateIds();
+			return true;
+		}
 		if (!Number.isSafeInteger(updateId) || updateId < 0) return false;
 		const candidate = new Set(this.dispatchState.seenUpdateIds);
 		candidate.add(updateId);
@@ -5362,6 +6006,10 @@ export class TelegramNotificationDaemon {
 	}
 
 	private async releaseSeenUpdateId(updateId: number): Promise<void> {
+		if (this.validationMode()) {
+			this.dispatchState.seenUpdateIds.delete(updateId);
+			return;
+		}
 		if (!this.dispatchState.seenUpdateIds.has(updateId)) return;
 		const candidate = new Set(this.dispatchState.seenUpdateIds);
 		candidate.delete(updateId);
@@ -5447,28 +6095,31 @@ export class TelegramNotificationDaemon {
 				} catch {}
 			}
 		}
-		if (permanentlyMissingRoots.length > 0) {
+		if (!this.validationMode()) {
+			if (permanentlyMissingRoots.length > 0) {
+				try {
+					await pruneMissingNotificationRoots({
+						settings: this.opts.settings,
+						fs: this.fsImpl,
+						candidates: permanentlyMissingRoots,
+					});
+				} catch (error) {
+					logger.warn(`notifications: dead-root prune failed: ${sanitizeDiagnostic(String(error))}`);
+				}
+			}
+			// Best-effort periodic reap of retained exact-unlink quarantines (#2956).
 			try {
-				await pruneMissingNotificationRoots({
+				await reapStaleNotificationArtifacts({
 					settings: this.opts.settings,
 					fs: this.fsImpl,
-					candidates: permanentlyMissingRoots,
+					now: this.opts.now,
+					pidAlive: this.opts.pidAlive,
 				});
 			} catch (error) {
-				logger.warn(`notifications: dead-root prune failed: ${sanitizeDiagnostic(String(error))}`);
+				logger.warn(`notifications: leak-artifact reap failed: ${sanitizeDiagnostic(String(error))}`);
 			}
 		}
-		// Best-effort periodic reap of retained exact-unlink quarantines (#2956).
-		try {
-			await reapStaleNotificationArtifacts({
-				settings: this.opts.settings,
-				fs: this.fsImpl,
-				now: this.opts.now,
-				pidAlive: this.opts.pidAlive,
-			});
-		} catch (error) {
-			logger.warn(`notifications: leak-artifact reap failed: ${sanitizeDiagnostic(String(error))}`);
-		}
+
 		if (allRootsReadable) {
 			for (const sessionId of this.topics.sessionIds()) {
 				const owner = this.logicalSessionOwners.get(sessionId);
@@ -5521,7 +6172,7 @@ export class TelegramNotificationDaemon {
 			replayQueue: [],
 		};
 		this.sessions.set(sessionId, session);
-		if (this.topics.get(sessionId)) this.preservedInitiatorTopics.add(sessionId);
+		if (this.topics.get(sessionId)?.authorityState === "active") this.preservedInitiatorTopics.add(sessionId);
 
 		// Bidirectional capability advertisement: announce client_ping_pong once the
 		// socket is open. Sent on "open" only — a real WHATWG WebSocket cannot send
@@ -5566,7 +6217,9 @@ export class TelegramNotificationDaemon {
 			void (async () => {
 				if (this.#logicalSessionId(session) !== sessionId) return;
 				const topic = this.topics.get(sessionId);
-				if (!topic || topic.authorityState === "delete_pending" || topic.bindingMalformed) return;
+				if (!topic || topic.bindingMalformed) return;
+				if (topic.authorityState === "disconnect_grace" && !(await this.#renewTopicLease(sessionId))) return;
+				if (topic.authorityState !== "active") return;
 				const topicLease = this.topicAuthorityLeaseFromRegistry(sessionId);
 				if (topicLease?.topicId === topic.topicId) await this.flushPendingThreadedFrames(sessionId, topicLease);
 			})().catch(err =>
@@ -5579,11 +6232,13 @@ export class TelegramNotificationDaemon {
 			// Identity guard: a delayed frame from a superseded socket must not act
 			// through the replacement session.
 			if (this.sessions.get(sessionId) !== session) return;
-			void this.handleSessionMessage(session, JSON.parse(String(ev.data))).catch(err => {
-				// Surface frame-handling failures (e.g. a rejected ask sendMessage) to
-				// the daemon log instead of an invisible unhandled rejection.
-				logger.error("notifications daemon: handleSessionMessage failed", { error: String(err) });
-			});
+			void this.effects
+				.admit(() => this.handleSessionMessage(session, JSON.parse(String(ev.data))))
+				.catch(err => {
+					// Surface frame-handling failures (e.g. a rejected ask sendMessage) to
+					// the daemon log instead of an invisible unhandled rejection.
+					logger.error("notifications daemon: handleSessionMessage failed", { error: String(err) });
+				});
 		});
 		ws.addEventListener("close", () => {
 			this.dropSession(session, "socket_closed");
@@ -5610,6 +6265,11 @@ export class TelegramNotificationDaemon {
 				this.dropSession(session, "liveness_timeout");
 				return;
 			}
+			const logicalSessionId = this.#logicalSessionId(session);
+			if (session.logicalSessionIdTrusted)
+				void this.#renewTopicLease(logicalSessionId).then(renewed => {
+					if (!renewed) this.dropSession(session, "topic_lease_lost");
+				});
 			if (session.ws.readyState === WebSocket.OPEN) {
 				const nonce = `${session.sessionId}:${t}:${Math.random().toString(36).slice(2)}`;
 				session.awaitingNonce = nonce;
@@ -5753,12 +6413,24 @@ export class TelegramNotificationDaemon {
 	}
 
 	private dropSession(session: SessionSocket, reason: string): void {
-		// A dropped socket must lose authority before any teardown-triggered asynchronous
+		// Capture the exact callback lease before revoking recovery authority. A
+		// predecessor transport can remain keyed by its own session id after a
+		// successor becomes the logical owner, so logical-session revocation
+		// would incorrectly delete the successor's freshly accepted aliases.
+		const callbackLease = {
+			session,
+			token: session.recoveryLease?.token ?? 0,
+			logicalSessionId: this.#logicalSessionId(session),
+		};
+		// A dropped socket must lose authority before any teardown-triggered asynchronous
 		// work can observe it. Its immutable lease token remains captured by queued work,
 		// but is no longer usable.
 		if (session.recoveryLease) session.recoveryLease = { ...session.recoveryLease, state: "rejected" };
 		const isCurrentSession = this.sessions.get(session.sessionId) === session;
-		if (isCurrentSession) this.droppedSessions.add(session);
+		if (isCurrentSession) {
+			this.revokeCallbackAliases(callbackLease);
+			this.droppedSessions.add(session);
+		}
 		if (isCurrentSession) this.cancelLegacyToolStartsForSession(session);
 		if (isCurrentSession) this.scheduleVisibleToolTerminalization(session.endpointDigest).catch(() => undefined);
 		const clearIntervalImpl = this.opts.clearIntervalImpl ?? clearInterval;
@@ -5771,6 +6443,7 @@ export class TelegramNotificationDaemon {
 		} else {
 			void this.#terminalizeBtwTurnsForSession(session).catch(() => undefined);
 		}
+		if (isCurrentSession && session.logicalSessionIdTrusted) this.#releaseTopicLease(this.#logicalSessionId(session));
 		if (isCurrentSession || reason === "session_closed") {
 			this.deleteMessageRoutes(session.sessionId);
 		}
@@ -6094,6 +6767,82 @@ export class TelegramNotificationDaemon {
 			}
 		}
 	}
+	#revokeCallbackAlias(alias: string): CallbackRoute | undefined {
+		const route = this.aliasTable.get(alias);
+		if (!route) return undefined;
+		this.reissueBacklog.set(alias, route);
+		this.aliasTable.delete(alias);
+		this.#callbackAliasLeases.delete(alias);
+		this.#callbackAliasPending.delete(alias);
+		this.#callbackAliasTopics.delete(alias);
+		return route;
+	}
+	#stageCallbackActivation(
+		aliases: Iterable<string>,
+		pending: { sessionId: string; actionId: string },
+		socketLease: { session: SessionSocket; token: number; logicalSessionId: string },
+		topicLease: TopicAuthorityLease | undefined,
+	): PromiseWithResolvers<boolean> {
+		const activation = Promise.withResolvers<boolean>();
+		const staged: StagedCallbackActivation = { pending, socketLease, topicLease, settled: activation.promise };
+		for (const alias of aliases) this.#stagedCallbackActivations.set(alias, staged);
+		return activation;
+	}
+
+	revokeCallbackAliases(socketLease: { session: SessionSocket; token: number; logicalSessionId: string }): void {
+		const actions = new Set<string>();
+		for (const [alias, aliasLease] of this.#callbackAliasLeases) {
+			if (
+				aliasLease.session === socketLease.session &&
+				aliasLease.token === socketLease.token &&
+				aliasLease.logicalSessionId === socketLease.logicalSessionId
+			) {
+				const route = this.#revokeCallbackAlias(alias);
+				if (route) actions.add(route.actionId);
+			}
+		}
+		if (actions.size === 0) return;
+		const terminalization = this.effects.track(
+			(async () => {
+				await this.persistAliases();
+				for (const actionId of actions) await this.reissuePendingAction(socketLease.logicalSessionId, actionId);
+			})(),
+		);
+		void terminalization.catch(() => undefined);
+	}
+
+	private async reissuePendingAction(sessionId: string, actionId: string): Promise<void> {
+		const oldEntries = [...this.reissueBacklog.entries()].filter(
+			([, route]) => route.sessionId === sessionId && route.actionId === actionId,
+		);
+		const messageIds = new Set<number>();
+		for (const [, route] of oldEntries) {
+			if (String(route.chatId) === String(this.opts.chatId) && Number.isSafeInteger(route.messageId))
+				messageIds.add(route.messageId!);
+		}
+		const terminalizedMessageIds = new Set<number>();
+		for (const messageId of messageIds) {
+			try {
+				const terminalized = (await this.botApi.call("editMessageReplyMarkup", {
+					chat_id: this.opts.chatId,
+					message_id: messageId,
+					reply_markup: { inline_keyboard: [] },
+				})) as { ok?: unknown } | undefined;
+				if (terminalized?.ok === true) terminalizedMessageIds.add(messageId);
+			} catch {
+				// Retain the durable receipt so a later replay can retry terminalization.
+			}
+		}
+		for (const [alias, route] of oldEntries) {
+			if (
+				String(route.chatId) === String(this.opts.chatId) &&
+				Number.isSafeInteger(route.messageId) &&
+				terminalizedMessageIds.has(route.messageId!)
+			)
+				this.reissueBacklog.delete(alias);
+		}
+		await this.persistAliases();
+	}
 
 	#logicalSessionId(session: SessionSocket): string {
 		return session.logicalSessionId ?? session.sessionId;
@@ -6123,8 +6872,10 @@ export class TelegramNotificationDaemon {
 			lease.binding.endpointDigest === session.endpointDigest &&
 			lease.binding.endpointGeneration === session.hostGeneration &&
 			(!record ||
-				(record.authorityState !== "delete_pending" &&
+				(record.authorityState === "active" &&
 					!record.bindingMalformed &&
+					record.leaseOwner === this.installationHostId &&
+					(record.leaseExpiresAt ?? 0) > this.runtime.now() &&
 					record.chatId === lease.binding.chatId &&
 					record.endpointKey === lease.binding.endpointKey &&
 					record.endpointDigest === lease.binding.endpointDigest &&
@@ -6208,14 +6959,86 @@ export class TelegramNotificationDaemon {
 				? undefined
 				: { session, token: 0, logicalSessionId };
 	}
+	async #renewTopicLease(sessionId: string): Promise<boolean> {
+		const record = this.topics.get(sessionId);
+		if (!record) return true;
+		const previous = {
+			leaseOwner: record.leaseOwner,
+			leaseHeartbeatAt: record.leaseHeartbeatAt,
+			leaseExpiresAt: record.leaseExpiresAt,
+			authorityState: record.authorityState,
+			orphanedAt: record.orphanedAt,
+			disconnectGraceExpiresAt: record.disconnectGraceExpiresAt,
+		};
+		return this.#persistTopicMutation(
+			() =>
+				this.topics.acquireLease(
+					sessionId,
+					this.installationHostId,
+					this.runtime.now(),
+					HEARTBEAT_TTL_MS,
+					ORPHAN_TOPIC_GRACE_MS,
+				),
+			() => {
+				const current = this.topics.get(sessionId);
+				if (!current) return;
+				Object.assign(current, previous);
+				if (previous.leaseOwner === undefined) delete current.leaseOwner;
+				if (previous.leaseHeartbeatAt === undefined) delete current.leaseHeartbeatAt;
+				if (previous.leaseExpiresAt === undefined) delete current.leaseExpiresAt;
+				if (previous.orphanedAt === undefined) delete current.orphanedAt;
+				if (previous.disconnectGraceExpiresAt === undefined) delete current.disconnectGraceExpiresAt;
+			},
+		);
+	}
+	#releaseTopicLease(sessionId: string): void {
+		const record = this.topics.get(sessionId);
+		if (!record) return;
+		const previous = {
+			leaseHeartbeatAt: record.leaseHeartbeatAt,
+			leaseExpiresAt: record.leaseExpiresAt,
+			authorityState: record.authorityState,
+			orphanedAt: record.orphanedAt,
+			disconnectGraceExpiresAt: record.disconnectGraceExpiresAt,
+		};
+		void this.#persistTopicMutation(
+			() => {
+				const owner = this.logicalSessionOwners.get(sessionId);
+				return owner === undefined
+					? this.topics.releaseLeaseToGrace(
+							sessionId,
+							this.installationHostId,
+							this.runtime.now(),
+							ORPHAN_TOPIC_GRACE_MS,
+						)
+					: false;
+			},
+			() => {
+				const current = this.topics.get(sessionId);
+				if (!current) return;
+				Object.assign(current, previous);
+				if (previous.leaseHeartbeatAt === undefined) delete current.leaseHeartbeatAt;
+				if (previous.leaseExpiresAt === undefined) delete current.leaseExpiresAt;
+				if (previous.orphanedAt === undefined) delete current.orphanedAt;
+				if (previous.disconnectGraceExpiresAt === undefined) delete current.disconnectGraceExpiresAt;
+			},
+		).catch(() => undefined);
+	}
 
 	#authorizeLease(session: SessionSocket, logicalSessionId: string, binding: TopicEndpointBinding): void {
 		const previousSessionId = this.#logicalSessionId(session);
 		if (previousSessionId !== logicalSessionId && this.logicalSessionOwners.get(previousSessionId) === session)
 			this.logicalSessionOwners.delete(previousSessionId);
 		const previousOwner = this.logicalSessionOwners.get(logicalSessionId);
-		if (previousOwner && previousOwner !== session && previousOwner.recoveryLease)
+		if (previousOwner && previousOwner !== session && previousOwner.recoveryLease) {
+			const predecessorLease = {
+				session: previousOwner,
+				token: previousOwner.recoveryLease.token,
+				logicalSessionId,
+			};
 			previousOwner.recoveryLease = { ...previousOwner.recoveryLease, state: "rejected" };
+			this.revokeCallbackAliases(predecessorLease);
+		}
 		this.logicalSessionOwners.set(logicalSessionId, session);
 		this.preservedInitiatorTopics.delete(logicalSessionId);
 		session.logicalSessionId = logicalSessionId;
@@ -6229,8 +7052,18 @@ export class TelegramNotificationDaemon {
 	}
 
 	async #revokeAskAuthority(sessionId: string): Promise<void> {
+		const actionIds = new Set<string>();
 		for (const [alias, route] of this.aliasTable.entries()) {
-			if (route.sessionId === sessionId) this.aliasTable.delete(alias);
+			if (route.sessionId !== sessionId) continue;
+			this.reissueBacklog.set(alias, route);
+			this.aliasTable.delete(alias);
+			this.#callbackAliasLeases.delete(alias);
+			this.#callbackAliasPending.delete(alias);
+			this.#callbackAliasTopics.delete(alias);
+			actionIds.add(route.actionId);
+		}
+		for (const route of this.reissueBacklog.values()) {
+			if (route.sessionId === sessionId) actionIds.add(route.actionId);
 		}
 		for (const session of this.sessions.values()) {
 			if (session.sessionId === sessionId || this.#logicalSessionId(session) === sessionId) {
@@ -6240,6 +7073,7 @@ export class TelegramNotificationDaemon {
 			}
 		}
 		await this.persistAliases();
+		for (const actionId of actionIds) await this.reissuePendingAction(sessionId, actionId);
 	}
 
 	#clearModelChoiceAliasesForSocket(session: SessionSocket): void {
@@ -6378,84 +7212,123 @@ export class TelegramNotificationDaemon {
 		const binding = this.#endpointBinding(session);
 		const pendingToken = this.nextSocketLeaseToken++;
 		session.recoveryLease = { state: "pending", logicalSessionId: candidateSessionId, binding, token: pendingToken };
-		const claim = await this.#withRecoveryBindingClaim(async () => {
-			const existing = this.topics.get(candidateSessionId);
-			const hadDurableTopic = existing !== undefined;
-			const previousBinding = existing
-				? {
-						chatId: existing.chatId,
-						endpointKey: existing.endpointKey,
-						endpointDigest: existing.endpointDigest,
-						endpointGeneration: existing.endpointGeneration,
-						endpointIncarnation: existing.endpointIncarnation,
-					}
-				: undefined;
-			const outcome = await this.#persistTopicMutation(
-				() =>
-					this.topics.get(candidateSessionId)
-						? this.topics.bindEndpoint(
-								candidateSessionId,
-								binding,
-								this.#activeEndpointKeysFor(candidateSessionId, session),
-								allowEndpointRotation,
-							)
-						: "unchanged",
-				() => {
-					if (previousBinding) this.topics.restoreEndpointBinding(candidateSessionId, binding, previousBinding);
-				},
-			).catch(() => "rejected" as const);
-			if (outcome === "rejected") {
-				if (session.recoveryLease?.token === pendingToken)
-					session.recoveryLease = {
-						state: "rejected",
-						logicalSessionId: candidateSessionId,
-						binding,
-						token: pendingToken,
-					};
-				return undefined;
-			}
-			const endpointAuthority = this.#endpointAuthority(binding, session);
-			const identitylessAdmissionAllows =
-				identitylessAdmission === undefined ||
-				(identitylessAdmission === "bootstrap"
-					? (endpointAuthority.state === "none" && !this.topics.get(candidateSessionId)) ||
-						(endpointAuthority.state === "unique" &&
+		let claim: { previousSessionId: string; hadDurableTopic: boolean } | undefined;
+		try {
+			claim = await this.#withRecoveryBindingClaim(async () => {
+				const existing = this.topics.get(candidateSessionId);
+				const hadDurableTopic = existing !== undefined;
+				const previousBinding = existing
+					? {
+							chatId: existing.chatId,
+							endpointKey: existing.endpointKey,
+							endpointDigest: existing.endpointDigest,
+							endpointGeneration: existing.endpointGeneration,
+							endpointIncarnation: existing.endpointIncarnation,
+						}
+					: undefined;
+				let retiredTopicState: TopicRegistryState | undefined;
+				const outcome = await this.#persistTopicMutation(
+					() => {
+						if (allowEndpointRotation && this.topics.get(candidateSessionId)?.authorityState === "inactive") {
+							retiredTopicState = this.topics.serialize();
+							this.topics.retireInactiveEndpointForSuccessor(candidateSessionId, binding);
+						}
+						return this.topics.get(candidateSessionId)
+							? this.topics.bindEndpoint(
+									candidateSessionId,
+									binding,
+									this.#activeEndpointKeysFor(candidateSessionId, session),
+									allowEndpointRotation,
+								)
+							: "unchanged";
+					},
+					() => {
+						if (retiredTopicState) this.topics.replace(retiredTopicState);
+						else if (previousBinding)
+							this.topics.restoreEndpointBinding(candidateSessionId, binding, previousBinding);
+					},
+				).catch(() => "rejected" as const);
+				if (outcome === "rejected") {
+					if (session.recoveryLease?.token === pendingToken)
+						session.recoveryLease = {
+							state: "rejected",
+							logicalSessionId: candidateSessionId,
+							binding,
+							token: pendingToken,
+						};
+					return undefined;
+				}
+				if (!(await this.#renewTopicLease(candidateSessionId))) {
+					if (session.recoveryLease?.token === pendingToken)
+						session.recoveryLease = {
+							state: "rejected",
+							logicalSessionId: candidateSessionId,
+							binding,
+							token: pendingToken,
+						};
+					return undefined;
+				}
+				const endpointAuthority = this.#endpointAuthority(binding, session);
+				const identitylessAdmissionAllows =
+					identitylessAdmission === undefined ||
+					(identitylessAdmission === "bootstrap"
+						? (endpointAuthority.state === "none" && !this.topics.get(candidateSessionId)) ||
+							(endpointAuthority.state === "unique" &&
+								endpointAuthority.sessionId === candidateSessionId &&
+								this.topics.matchesEndpoint(candidateSessionId, binding))
+						: endpointAuthority.state === "unique" &&
 							endpointAuthority.sessionId === candidateSessionId &&
-							this.topics.matchesEndpoint(candidateSessionId, binding))
-					: endpointAuthority.state === "unique" &&
-						endpointAuthority.sessionId === candidateSessionId &&
-						this.topics.matchesEndpoint(candidateSessionId, binding));
-			if (
-				session.recoveryLease?.token !== pendingToken ||
-				session.recoveryLease.state !== "pending" ||
-				!this.#ownsLiveOpenEndpoint(session, binding) ||
-				!identitylessAdmissionAllows
-			) {
-				if (session.recoveryLease?.token === pendingToken)
-					session.recoveryLease = {
-						state: "rejected",
-						logicalSessionId: candidateSessionId,
-						binding,
-						token: pendingToken,
-					};
-				return undefined;
-			}
-			const previousSessionId = this.#logicalSessionId(session);
-			if (previousSessionId !== candidateSessionId) await this.#terminalizeBtwTurnsForSession(session, true);
-			if (!this.#ownsLiveOpenEndpoint(session, binding)) {
-				if (session.recoveryLease?.token === pendingToken)
-					session.recoveryLease = {
-						state: "rejected",
-						logicalSessionId: candidateSessionId,
-						binding,
-						token: pendingToken,
-					};
-				return undefined;
-			}
-			this.#authorizeLease(session, candidateSessionId, binding);
-			return { previousSessionId, hadDurableTopic };
-		});
-		if (!claim) return false;
+							this.topics.matchesEndpoint(candidateSessionId, binding));
+				if (
+					session.recoveryLease?.token !== pendingToken ||
+					session.recoveryLease.state !== "pending" ||
+					!this.#ownsLiveOpenEndpoint(session, binding) ||
+					!identitylessAdmissionAllows
+				) {
+					if (session.recoveryLease?.token === pendingToken)
+						session.recoveryLease = {
+							state: "rejected",
+							logicalSessionId: candidateSessionId,
+							binding,
+							token: pendingToken,
+						};
+					return undefined;
+				}
+				const previousSessionId = this.#logicalSessionId(session);
+				if (previousSessionId !== candidateSessionId) await this.#terminalizeBtwTurnsForSession(session, true);
+				if (!this.#ownsLiveOpenEndpoint(session, binding)) {
+					if (session.recoveryLease?.token === pendingToken)
+						session.recoveryLease = {
+							state: "rejected",
+							logicalSessionId: candidateSessionId,
+							binding,
+							token: pendingToken,
+						};
+					return undefined;
+				}
+				this.#authorizeLease(session, candidateSessionId, binding);
+				return { previousSessionId, hadDurableTopic };
+			});
+		} catch {
+			if (session.recoveryLease?.token === pendingToken)
+				session.recoveryLease = {
+					state: "rejected",
+					logicalSessionId: candidateSessionId,
+					binding,
+					token: pendingToken,
+				};
+			return false;
+		}
+		if (!claim) {
+			if (session.recoveryLease?.token === pendingToken)
+				session.recoveryLease = {
+					state: "rejected",
+					logicalSessionId: candidateSessionId,
+					binding,
+					token: pendingToken,
+				};
+			return false;
+		}
 		const { previousSessionId } = claim;
 		if (preserveTransportTopic && previousSessionId !== candidateSessionId) {
 			this.legacyTopicOwners.set(previousSessionId, session);
@@ -6464,7 +7337,7 @@ export class TelegramNotificationDaemon {
 		if (candidateSessionId === session.sessionId)
 			void (async () => {
 				const topic = this.topics.get(candidateSessionId);
-				if (!topic || topic.authorityState === "delete_pending" || topic.bindingMalformed) return;
+				if (topic?.authorityState !== "active" || topic.bindingMalformed) return;
 				const topicLease = this.topicAuthorityLeaseFromRegistry(candidateSessionId);
 				if (topicLease?.topicId === topic.topicId)
 					await this.flushPendingThreadedFrames(candidateSessionId, topicLease);
@@ -6539,12 +7412,12 @@ export class TelegramNotificationDaemon {
 		const identityKey = this.topicIdentityKey(msg);
 		const remembered = identityKey ? this.topicOwnerByIdentity.get(identityKey) : undefined;
 		const rememberedTopic = remembered ? this.topics.get(remembered) : undefined;
-		if (remembered && rememberedTopic && rememberedTopic.authorityState !== "delete_pending") return remembered;
+		if (remembered && rememberedTopic && rememberedTopic.authorityState === "active") return remembered;
 		if (!identityKey) return undefined;
 		const base = this.topicIdentityBase(msg);
 		for (const sessionId of this.topics.sessionIds()) {
 			const topic = this.topics.get(sessionId);
-			if (topic?.authorityState === "delete_pending") continue;
+			if (topic?.authorityState !== "active") continue;
 			const nameMatchesLegacyIdentity =
 				base !== undefined && (topic?.name === base || topic?.name?.startsWith(`${base} - `));
 			if (topic?.identityKey === identityKey || nameMatchesLegacyIdentity) {
@@ -6823,21 +7696,29 @@ export class TelegramNotificationDaemon {
 	}
 
 	private async topicAuthorityLease(sessionId: string): Promise<TopicAuthorityLease | undefined> {
-		if (!(await this.pairedChatIsPrivate())) return undefined;
+		if (!(await this.pairedChatAllowsTopics())) return undefined;
 		return this.topicAuthorityLeaseFromRegistry(sessionId);
 	}
 
 	private topicAuthorityLeaseFromRegistry(sessionId: string): TopicAuthorityLease | undefined {
 		const topic = this.topics.get(sessionId);
-		if (!topic || !this.topics.isActiveUnambiguous(sessionId) || topic.bindingMalformed) return undefined;
+		if (
+			!topic ||
+			!this.topics.isActiveUnambiguous(sessionId) ||
+			topic.bindingMalformed ||
+			topic.leaseOwner !== this.installationHostId ||
+			(topic.leaseExpiresAt ?? 0) <= this.runtime.now()
+		)
+			return undefined;
 		return { sessionId, topicId: topic.topicId, authorityEpoch: topic.authorityEpoch ?? 0 };
 	}
-
 	private topicLeaseIsCurrent(lease: TopicAuthorityLease): boolean {
 		const topic = this.topics.get(lease.sessionId);
 		return (
 			this.topics.isActiveUnambiguous(lease.sessionId) &&
 			!topic?.bindingMalformed &&
+			topic?.leaseOwner === this.installationHostId &&
+			(topic.leaseExpiresAt ?? 0) > this.runtime.now() &&
 			topic?.topicId === lease.topicId &&
 			(topic.authorityEpoch ?? 0) === lease.authorityEpoch
 		);
@@ -6884,7 +7765,7 @@ export class TelegramNotificationDaemon {
 	): void {
 		const logicalSessionId = this.#logicalSessionId(session);
 		const socketLease = this.#socketLease(session, logicalSessionId);
-		if (!socketLease) {
+		if (!socketLease && !session.logicalSessionIdTrusted) {
 			this.failLegacyToolStart(toolActivity);
 			return;
 		}
@@ -6898,6 +7779,7 @@ export class TelegramNotificationDaemon {
 			send,
 			msg,
 			logicalSessionId,
+			session,
 			socketLease,
 			...(toolActivity ? { toolActivity } : {}),
 		});
@@ -6913,15 +7795,17 @@ export class TelegramNotificationDaemon {
 		if (!frames || frames.length === 0) return;
 		this.pendingThreadedFrames.delete(sessionId);
 		for (const frame of frames) {
+			const socketLease = frame.socketLease ?? this.#socketLease(frame.session, sessionId);
 			if (
 				frame.logicalSessionId !== sessionId ||
-				!this.#leaseTokenAllows(frame.socketLease) ||
+				!socketLease ||
+				!this.#leaseTokenAllows(socketLease) ||
 				(frame.msg.type === "tool_activity" && this.opts.toolActivity?.enabled !== true)
 			) {
 				this.failLegacyToolStart(frame.toolActivity);
 				continue;
 			}
-			await this.submitThreadedFrame(sessionId, frame.send, topicLease, frame.toolActivity, frame.socketLease);
+			await this.submitThreadedFrame(sessionId, frame.send, topicLease, frame.toolActivity, socketLease);
 		}
 	}
 
@@ -6937,15 +7821,16 @@ export class TelegramNotificationDaemon {
 		session?: SessionSocket,
 		creationLease?: { session: SessionSocket; token: number; logicalSessionId: string },
 	): Promise<string | undefined> {
-		if (!(await this.pairedChatIsPrivate())) return undefined;
+		if (!(await this.pairedChatAllowsTopics())) return undefined;
 		if (session && sessionId === session.sessionId && this.#logicalSessionId(session) !== sessionId) return undefined;
 		const capturedCreationLease = creationLease ?? (session ? this.#socketLease(session, sessionId) : undefined);
 		if (session?.logicalSessionIdTrusted && !capturedCreationLease) return undefined;
 		const creationEndpointKey = session?.endpointDigest ?? session?.endpointKey ?? "unbound";
-		if (this.#malformedTopicCreateEndpoints.get(sessionId) === creationEndpointKey)
+		const malformedCreateEndpoint = this.#malformedTopicCreateEndpoints.get(sessionId);
+		if (malformedCreateEndpoint === "unbound" || malformedCreateEndpoint === creationEndpointKey)
 			throw new Error("createForumTopic: invalid message_thread_id");
 		const existing = this.topics.get(sessionId);
-		if (existing?.authorityState === "delete_pending" || existing?.bindingMalformed) return undefined;
+		if (existing && (existing.authorityState !== "active" || existing.bindingMalformed)) return undefined;
 		if (existing) return existing.topicId;
 		if (
 			session &&
@@ -6958,9 +7843,7 @@ export class TelegramNotificationDaemon {
 		const creationLeaseEpoch = this.topics.authorityEpoch(sessionId);
 		let acceptedTopicId: string | undefined;
 		let acceptedTopicCompensated = false;
-		let acceptedTopicDeleteAttempted = false;
-		let creationSuppressed = false;
-		/** User-created topicId adopted in this callback, if any (for sidecar reconciliation). */
+		let acceptedTopicArchiveAttempted = false;
 		let adoptedTopicId: number | undefined;
 		const adoptionIntentCandidate = this.#adoptionIntents.bySession(sessionId);
 		try {
@@ -6999,10 +7882,10 @@ export class TelegramNotificationDaemon {
 					const res = (await this.botApi.call("createForumTopic", { chat_id: this.opts.chatId, name })) as
 						| { result?: { message_thread_id?: unknown } }
 						| undefined;
-					if (res === undefined) {
-						creationSuppressed = true;
-						return undefined;
-					}
+					// Classification must travel with the rejection, not through
+					// closure flags: `getOrCreateTopic` shares one in-flight create
+					// promise, so every other awaiter observes only the error.
+					if (res === undefined) throw new TopicCreationSuppressed();
 					if (isThreadedModeCapabilityRefusal(res)) throw new ThreadedModeCapabilityRefusal();
 					const response = res as {
 						ok?: unknown;
@@ -7010,57 +7893,52 @@ export class TelegramNotificationDaemon {
 					};
 					const tid = response.result?.message_thread_id;
 					if (typeof tid !== "number" || !Number.isSafeInteger(tid) || tid <= 0) {
-						if (response.ok === true) this.#malformedTopicCreateEndpoints.set(sessionId, creationEndpointKey);
+						if (response.ok === false) throw new TopicCreationRejected();
+						this.#malformedTopicCreateEndpoints.set(sessionId, creationEndpointKey);
 						throw new Error("createForumTopic: invalid message_thread_id");
 					}
 					acceptedTopicId = String(tid);
 					this.#malformedTopicCreateEndpoints.delete(sessionId);
 					if (capturedCreationLease && !(await this.#awaitCreationLeaseAuthority(capturedCreationLease))) {
-						const fencedCreate = this.topics.fenceAcceptedCreateForLease(
-							sessionId,
-							acceptedTopicId,
-							creationLeaseEpoch,
-							this.opts.now,
-							name,
-							creationBinding,
-						);
-						if (!fencedCreate) throw new Error("topic authority was revoked during creation");
-						// Epoch held when the compensating delete is dispatched below; a
-						// concurrent re-fence must not be settled by this delete's result.
-						const fencedCreateEpoch = fencedCreate.authorityEpoch ?? 0;
+						if (
+							!this.topics.fenceAcceptedCreateForLease(
+								sessionId,
+								acceptedTopicId,
+								creationLeaseEpoch,
+								this.installationHostId,
+								this.opts.now,
+								name,
+								creationBinding,
+								undefined,
+								String(this.opts.chatId),
+							)
+						)
+							throw new Error("topic authority was revoked during creation");
 						try {
 							await this.persistTopics();
-						} finally {
-							acceptedTopicDeleteAttempted = true;
-							const deletion = await this.botApi.call("deleteForumTopic", {
-								chat_id: this.opts.chatId,
-								message_thread_id: tid,
-							});
-							// Remote compensation succeeded, but the transaction is not complete
-							// until the registry clear is durable. `acceptedTopicCompensated` is
-							// what tells outer recovery to stop supervising the fence, so it is
-							// set only after the phase-2 commit: a failed clear persist leaves
-							// the fence supervised instead of stranding a cleared memory state
-							// against a `delete_pending` disk state.
-							if (topicDeleteSettled(deletion)) {
-								const settled = this.topics.settleDelete(sessionId, acceptedTopicId, fencedCreateEpoch);
-								if (!settled) {
-									this.#superviseCompensationFence(sessionId);
-									await this.#persistTopicsWithRetry().catch(() => undefined);
-								} else
-									try {
-										await this.persistTopics();
-										this.topics.commitSettledDelete(settled);
-										acceptedTopicCompensated = true;
-									} catch {
-										this.topics.rollbackSettledDelete(settled);
-										this.#superviseCompensationFence(sessionId);
-										await this.#persistTopicsWithRetry().catch(() => undefined);
-									}
-							} else {
-								this.#superviseCompensationFence(sessionId);
-								await this.#persistTopicsWithRetry().catch(() => undefined);
+						} catch (error) {
+							this.topics.scheduleArchiveRetry(
+								sessionId,
+								this.runtime.now(),
+								"archive fence persistence failed",
+							);
+							try {
+								await this.#persistTopicsWithRetry();
+							} catch {
+								await this.#superviseCompensationFence(sessionId);
 							}
+							throw error;
+						}
+						if (
+							this.#acceptedCreateArchiveFenceAllows(
+								sessionId,
+								acceptedTopicId,
+								creationLeaseEpoch,
+								creationBinding,
+							)
+						) {
+							acceptedTopicArchiveAttempted = true;
+							acceptedTopicCompensated = (await this.archiveTopic(sessionId, undefined, true)) === "settled";
 						}
 						throw new Error("topic authority was revoked during creation");
 					}
@@ -7073,9 +7951,8 @@ export class TelegramNotificationDaemon {
 				session,
 				adoptionIntentCandidate ? "user_created" : undefined,
 			);
-			// Adoption commit success: remove the durable sidecar. A cleanup failure
-			// cannot roll back the committed record; topic success is retained and the
-			// stale sidecar is left for startup reconciliation to remove safely.
+			// Adoption commit success removes only the sidecar. The committed
+			// user-created topic remains retained even when sidecar cleanup fails.
 			if (adoptedTopicId !== undefined) {
 				if (adoptionIntentCandidate)
 					logger.info(
@@ -7090,6 +7967,10 @@ export class TelegramNotificationDaemon {
 					);
 				}
 			}
+			// Publish the durable host lease before rechecking the captured socket
+			// lease. The recheck consults the registry once a record exists, so the
+			// newly-created record must already authorize this host.
+			if (!(await this.#renewTopicLease(sessionId))) return undefined;
 			// getOrCreateTopic deduplicates callers, so an accepted create can be
 			// observed by a successor after its initiating socket was revoked. Check
 			// the immutable lease again before exposing that record to frame delivery.
@@ -7111,78 +7992,105 @@ export class TelegramNotificationDaemon {
 						sessionId,
 						rec.topicId,
 						creationLeaseEpoch,
+						this.installationHostId,
 						this.opts.now,
 						name,
 						creationBinding,
+						undefined,
+						String(this.opts.chatId),
 					)
-				)
-					await this.deleteTopic(sessionId, undefined, true);
+				) {
+					try {
+						await this.persistTopics();
+					} catch {
+						this.#superviseCompensationFence(sessionId);
+						return undefined;
+					}
+					if (this.#acceptedCreateArchiveFenceAllows(sessionId, rec.topicId, creationLeaseEpoch, creationBinding))
+						await this.archiveTopic(sessionId, undefined, true);
+				}
 				return undefined;
 			}
 			return rec.topicId;
 		} catch (err) {
-			if (creationSuppressed || err instanceof ThreadedModeCapabilityRefusal) return undefined;
-			// Adoption commit failure: release the in-memory claim so a retry can
-			// re-claim, and retain the durable sidecar (never delete the user topic).
-			if (adoptedTopicId !== undefined) {
-				this.#adoptionIntents.releaseClaim(adoptedTopicId, sessionId);
+			if (adoptedTopicId !== undefined) this.#adoptionIntents.releaseClaim(adoptedTopicId, sessionId);
+			if (adoptionIntentCandidate) this.topics.abandonCreateClaim(sessionId, creationLeaseEpoch);
+			if (
+				err instanceof TopicCreationSuppressed ||
+				err instanceof TopicCreationRejected ||
+				err instanceof ThreadedModeCapabilityRefusal
+			) {
+				if (err instanceof ThreadedModeCapabilityRefusal) this.topicCapabilityRefused = true;
+				if (this.topics.abandonCreateClaim(sessionId, creationLeaseEpoch)) await this.persistTopics();
+				return undefined;
+			}
+			const revokedAcceptedRecord = acceptedTopicId ? this.topics.get(sessionId) : undefined;
+			if (
+				revokedAcceptedRecord !== undefined &&
+				revokedAcceptedRecord.topicId === acceptedTopicId &&
+				revokedAcceptedRecord.authorityState === "archive_pending" &&
+				!this.topics.archiveAuthorityAllows(
+					sessionId,
+					this.installationHostId,
+					this.opts.chatId,
+					this.runtime.now(),
+				)
+			) {
+				if (
+					revokedAcceptedRecord.chatId === undefined &&
+					revokedAcceptedRecord.endpointKey === undefined &&
+					revokedAcceptedRecord.endpointDigest === undefined
+				)
+					revokedAcceptedRecord.chatId = String(this.opts.chatId);
+				this.topics.beginArchive(sessionId, this.installationHostId, this.runtime.now());
+				await this.persistTopics();
 			}
 			if (
 				acceptedTopicId &&
 				!acceptedTopicCompensated &&
-				!acceptedTopicDeleteAttempted &&
-				this.topics.get(sessionId)?.authorityState !== "delete_pending"
+				!acceptedTopicArchiveAttempted &&
+				this.topics.get(sessionId)?.authorityState !== "archive_pending"
 			) {
 				// A failed initial commit must never make compensation conditional on
 				// successfully publishing its fence.
-				const fencedCompensation = this.topics.fenceAcceptedCreateForLease(
-					sessionId,
-					acceptedTopicId,
-					creationLeaseEpoch,
-					this.opts.now,
-					name,
-					creationBinding,
-				);
-				if (fencedCompensation) {
-					// Epoch held when the compensating delete is dispatched below; a
-					// concurrent re-fence must not be settled by this delete's result.
-					const fencedCompensationEpoch = fencedCompensation.authorityEpoch ?? 0;
+				if (
+					this.topics.fenceAcceptedCreateForLease(
+						sessionId,
+						acceptedTopicId,
+						creationLeaseEpoch,
+						this.installationHostId,
+						this.opts.now,
+						name,
+						creationBinding,
+						undefined,
+						String(this.opts.chatId),
+					)
+				) {
 					try {
 						await this.#persistTopicsWithRetry();
 					} catch {
-						this.#superviseCompensationFence(sessionId);
+						await this.#superviseCompensationFence(sessionId);
 					}
 
-					try {
-						const deletion = await this.botApi.call("deleteForumTopic", {
-							chat_id: this.opts.chatId,
-							message_thread_id: Number(acceptedTopicId),
-						});
-						if (topicDeleteSettled(deletion)) {
-							const settled = this.topics.settleDelete(sessionId, acceptedTopicId, fencedCompensationEpoch);
-							if (!settled) {
-								this.#superviseCompensationFence(sessionId);
-								await this.#persistTopicsWithRetry().catch(() => undefined);
-							} else
-								try {
-									await this.persistTopics();
-									this.topics.commitSettledDelete(settled);
-								} catch {
-									this.topics.rollbackSettledDelete(settled);
-									this.#superviseCompensationFence(sessionId);
-									await this.#persistTopicsWithRetry().catch(() => undefined);
-								}
-						} else {
+					if (
+						this.#acceptedCreateArchiveFenceAllows(
+							sessionId,
+							acceptedTopicId,
+							creationLeaseEpoch,
+							creationBinding,
+						)
+					) {
+						try {
+							acceptedTopicArchiveAttempted = true;
+							acceptedTopicCompensated = (await this.archiveTopic(sessionId, undefined, true)) === "settled";
+						} catch {
 							this.#superviseCompensationFence(sessionId);
 							await this.#persistTopicsWithRetry().catch(() => undefined);
 						}
-					} catch {
-						this.#superviseCompensationFence(sessionId);
-						await this.#persistTopicsWithRetry().catch(() => undefined);
 					}
 				}
 			}
-			if (acceptedTopicId && !acceptedTopicCompensated && acceptedTopicDeleteAttempted) {
+			if (acceptedTopicId && !acceptedTopicCompensated && acceptedTopicArchiveAttempted) {
 				this.#superviseCompensationFence(sessionId);
 				await this.#persistTopicsWithRetry().catch(() => undefined);
 			}
@@ -7211,24 +8119,75 @@ export class TelegramNotificationDaemon {
 			if (!this.topicPastOrphanGrace(sessionId)) return;
 			const currentOwner = this.logicalSessionOwners.get(sessionId);
 			if (currentOwner && this.#leaseAllows(currentOwner, sessionId)) return;
-			await this.deleteTopic(sessionId);
+			await this.archiveTopic(sessionId);
 		});
 	}
 
 	/** Best-effort delete of a session topic once its local notification endpoint shuts down. */
-	private async deleteTopic(
+	/** Join all close, compensation, orphan, and restart callers for one session. */
+	private archiveTopic(
+		sessionId: string,
+		socketLease?: { session: SessionSocket; token: number; logicalSessionId: string },
+		archiveFenceAlreadyPublished = false,
+	): Promise<"pre_dispatch_cancelled" | "post_dispatch_pending" | "settled"> {
+		const active = this.archiveFlights.get(sessionId);
+		if (active) return active;
+		const flight = this.#archiveTopicOnce(sessionId, socketLease, archiveFenceAlreadyPublished);
+		this.archiveFlights.set(sessionId, flight);
+		void flight.then(
+			() => {
+				if (this.archiveFlights.get(sessionId) === flight) this.archiveFlights.delete(sessionId);
+			},
+			() => {
+				if (this.archiveFlights.get(sessionId) === flight) this.archiveFlights.delete(sessionId);
+			},
+		);
+		return flight;
+	}
+
+	/** One durable archive fence and at most one remote close dispatch per flight. */
+	async #archiveTopicOnce(
 		sessionId: string,
 		socketLease?: { session: SessionSocket; token: number; logicalSessionId: string },
-		deleteFenceAlreadyPublished = false,
+		archiveFenceAlreadyPublished = false,
 	): Promise<"pre_dispatch_cancelled" | "post_dispatch_pending" | "settled"> {
-		let record = deleteFenceAlreadyPublished ? this.topics.get(sessionId) : this.topics.beginDelete(sessionId);
-		// Authority epoch held for this delete. Captured before any dispatch so a
-		// concurrent scan/close re-fence of the same session cannot be settled by
-		// this delete's definite result.
-		const dispatchedAuthorityEpoch = this.topics.authorityEpoch(sessionId);
+		if (!(await this.pairedChatAllowsTopics())) return "pre_dispatch_cancelled";
+		const existing = this.topics.get(sessionId);
+		// A completed archive retains an inactive record as historical evidence.
+		// Re-archiving it would duplicate the irreversible remote close request.
+		if (existing?.authorityState === "inactive") return "settled";
+		if (existing?.topicOrigin === "user_created") {
+			if (existing.authorityState === "archive_pending") {
+				const archiveSnapshot = this.topics.captureArchiveAuthority(sessionId);
+				const authorityEpoch = existing.authorityEpoch ?? Number.MAX_SAFE_INTEGER;
+				if (!this.topics.settleArchive(sessionId, existing.topicId, authorityEpoch)) return "post_dispatch_pending";
+				try {
+					await this.persistTopics();
+				} catch {
+					this.topics.restoreArchiveFence(archiveSnapshot);
+					await this.#persistTopicsWithRetry().catch(() => undefined);
+					return "post_dispatch_pending";
+				}
+			}
+			return "settled";
+		}
+		const archiveSnapshot = this.topics.captureArchiveAuthority(sessionId);
+		let record = archiveFenceAlreadyPublished
+			? existing
+			: this.topics.beginArchive(sessionId, this.installationHostId, this.runtime.now());
 		if (socketLease && !this.#deleteLeaseAllows(socketLease)) return "pre_dispatch_cancelled";
-		await this.persistTopics();
+		if (
+			record &&
+			!this.topics.archiveAuthorityAllows(sessionId, this.installationHostId, this.opts.chatId, this.runtime.now())
+		)
+			return "pre_dispatch_cancelled";
+		if (!archiveFenceAlreadyPublished) await this.persistTopics();
 		if (socketLease && !this.#deleteLeaseAllows(socketLease)) return "pre_dispatch_cancelled";
+		if (
+			record &&
+			!this.topics.archiveAuthorityAllows(sessionId, this.installationHostId, this.opts.chatId, this.runtime.now())
+		)
+			return "pre_dispatch_cancelled";
 		await this.#revokeAskAuthority(sessionId);
 		this.deleteMessageRoutes(sessionId);
 		this.#clearModelChoiceAliases(sessionId);
@@ -7237,7 +8196,17 @@ export class TelegramNotificationDaemon {
 			record = this.topics.get(sessionId);
 			await this.persistTopics();
 			if (!record) return "settled";
+			if (
+				!this.topics.archiveAuthorityAllows(
+					sessionId,
+					this.installationHostId,
+					this.opts.chatId,
+					this.runtime.now(),
+				)
+			)
+				return "pre_dispatch_cancelled";
 		}
+		const dispatchedAuthorityEpoch = record.authorityEpoch ?? Number.MAX_SAFE_INTEGER;
 		const removed = this.pool.removeWhere(item => item.sessionId === sessionId);
 		for (const item of removed) {
 			if (item.payload.selectedAck)
@@ -7247,43 +8216,26 @@ export class TelegramNotificationDaemon {
 		try {
 			await this.flushPool();
 			if (socketLease && !this.#deleteLeaseAllows(socketLease)) return "pre_dispatch_cancelled";
-			if (record.topicOrigin === "user_created") {
-				// Phase 1: drop the record but keep the topic id quarantined. Routes are
-				// only republished by `commitSettledDelete` once the clear is durable.
-				const settled = this.topics.settleDelete(sessionId, record.topicId, dispatchedAuthorityEpoch);
-				if (!settled) {
-					await this.#persistTopicsWithRetry().catch(() => undefined);
-					return "post_dispatch_pending";
-				}
-				for (const k of [...this.liveMessages.keys()])
-					if (k.startsWith(`${sessionId}:`)) {
-						this.liveMessages.delete(k);
-						this.toolActivityOwners.delete(k);
-					}
-				this.topicOwnerByIdentity.forEach((ownerSessionId, identityKey) => {
-					if (ownerSessionId === sessionId) this.topicOwnerByIdentity.delete(identityKey);
-				});
-				this.pendingThreadedFrames.delete(sessionId);
-				try {
-					await this.persistTopics();
-					this.topics.commitSettledDelete(settled);
-					return "settled";
-				} catch {
-					this.topics.rollbackSettledDelete(settled);
-					await this.#persistTopicsWithRetry().catch(() => undefined);
-					return "post_dispatch_pending";
-				}
-			}
-			const res = (await this.botApi.call("deleteForumTopic", {
+			if (
+				!this.topics.archiveAuthorityAllows(
+					sessionId,
+					this.installationHostId,
+					this.opts.chatId,
+					this.runtime.now(),
+				)
+			)
+				return "pre_dispatch_cancelled";
+			const res = (await this.botApi.call("closeForumTopic", {
 				chat_id: this.opts.chatId,
 				message_thread_id: Number(record.topicId),
 			})) as { ok?: boolean };
-			if (!topicDeleteSettled(res)) return "post_dispatch_pending";
-			const settled = this.topics.settleDelete(sessionId, record.topicId, dispatchedAuthorityEpoch);
-			if (!settled) {
-				await this.#persistTopicsWithRetry().catch(() => undefined);
+			if (!topicArchiveSettled(res)) {
+				this.topics.scheduleArchiveRetry(sessionId, this.runtime.now(), "archive result was not definitive");
+				await this.persistTopics();
 				return "post_dispatch_pending";
 			}
+			if (!this.topics.settleArchive(sessionId, record.topicId, dispatchedAuthorityEpoch))
+				return "post_dispatch_pending";
 			for (const k of [...this.liveMessages.keys()])
 				if (k.startsWith(`${sessionId}:`)) {
 					this.liveMessages.delete(k);
@@ -7295,32 +8247,89 @@ export class TelegramNotificationDaemon {
 			this.pendingThreadedFrames.delete(sessionId);
 			try {
 				await this.persistTopics();
-				this.topics.commitSettledDelete(settled);
 				return "settled";
 			} catch {
-				this.topics.rollbackSettledDelete(settled);
+				this.topics.restoreArchiveFence(archiveSnapshot);
 				await this.#persistTopicsWithRetry().catch(() => undefined);
 				return "post_dispatch_pending";
 			}
 		} catch {
-			// Once Telegram dispatch starts, retain the persisted deletion fence: the
+			// Once Telegram dispatch starts, retain the persisted archive fence: the
 			// remote result is ambiguous and may not restore stale routing authority.
+			this.topics.scheduleArchiveRetry(sessionId, this.runtime.now(), "archive transport failed");
+			await this.persistTopics().catch(() => undefined);
 			return "post_dispatch_pending";
 		}
 	}
 
 	/** Serialize a mutation and its durable snapshot so rollback precedes later writers. */
 	#persistTopicMutation<T>(mutation: () => T, rollback: () => void): Promise<T> {
+		if (this.validationMode()) return Promise.resolve().then(mutation);
 		const pending = this.topicsPersistQueue.then(async () => {
-			const result = mutation();
+			let result = mutation();
+			const authority = this.opts.topicRegistryAuthority;
+			let sharedCommitted = false;
+			let latestWinner: TopicRegistryState | undefined;
 			try {
 				const snapshot = this.#topicStateForPersistence();
-				const paths = daemonPaths(this.opts.settings.getAgentDir());
-				await ensureDir(this.fsImpl, paths.dir);
-				await writeJsonAtomic(this.fsImpl, path.join(paths.dir, "telegram-topics.json"), snapshot);
+				if (authority) {
+					for (let attempt = 0; attempt < 3; attempt++) {
+						const expectedGeneration = this.topics.registryVersion();
+						const snapshot = this.#topicStateForPersistence();
+						const nextGeneration = expectedGeneration + 1;
+						snapshot.registryGeneration = nextGeneration;
+						let accepted = false;
+						try {
+							accepted = await authority.compareAndSet(expectedGeneration, snapshot);
+						} catch {
+							throw new Error("shared topic authority unavailable");
+						}
+						if (accepted) {
+							this.topics.markRegistryPublished(nextGeneration);
+							sharedCommitted = true;
+							break;
+						}
+						const winner = parseTopicRegistryState(await authority.read().catch(() => undefined));
+						if (!winner) throw new Error("shared topic authority conflict");
+						latestWinner = winner;
+						this.#replaceTopicAuthority(winner);
+						if (attempt === 2) throw new Error("shared topic authority conflict");
+						result = mutation();
+					}
+				}
+				if (!authority) {
+					const paths = daemonPaths(this.opts.settings.getAgentDir());
+					await ensureDir(this.fsImpl, paths.dir);
+					const expectedDestination = await captureTopicRegistryDestination(
+						this.fsImpl,
+						path.join(paths.dir, "telegram-topics.json"),
+						process.platform,
+					);
+					await writeTopicRegistryAtomic(
+						this.fsImpl,
+						path.join(paths.dir, "telegram-topics.json"),
+						snapshot,
+						process.platform,
+						exactReplacePath,
+						expectedDestination,
+					);
+				}
 				return result;
 			} catch (error) {
-				rollback();
+				if (sharedCommitted && authority) {
+					const committed = await authority.read().catch(() => undefined);
+					const state = parseTopicRegistryState(committed);
+					if (state) {
+						this.topics.replace(state);
+						this.closedEndpointKeys.clear();
+						for (const [sessionId, binding] of Object.entries(state.closedEndpoints ?? {}))
+							if (binding) this.closedEndpointKeys.set(sessionId, binding);
+					}
+				} else if (latestWinner) {
+					this.#replaceTopicAuthority(latestWinner);
+				} else {
+					rollback();
+				}
 				throw error;
 			}
 		});
@@ -7339,8 +8348,9 @@ export class TelegramNotificationDaemon {
 		}
 	}
 
-	#superviseCompensationFence(sessionId: string): void {
-		if (this.compensationFenceRetries.has(sessionId)) return;
+	async #superviseCompensationFence(sessionId: string): Promise<void> {
+		const existing = this.compensationFenceRetries.get(sessionId);
+		if (existing) return await existing;
 		const retry = this.effects.track(
 			(async () => {
 				for (;;) {
@@ -7354,35 +8364,143 @@ export class TelegramNotificationDaemon {
 			})(),
 		);
 		this.compensationFenceRetries.set(sessionId, retry);
-		void retry.finally(() => this.compensationFenceRetries.delete(sessionId));
+		try {
+			await retry;
+		} finally {
+			if (this.compensationFenceRetries.get(sessionId) === retry) this.compensationFenceRetries.delete(sessionId);
+		}
 	}
 
 	private persistTopics(): Promise<void> {
+		if (this.validationMode()) return Promise.resolve();
 		const pending = this.topicsPersistQueue.then(async () => {
 			// Resolve implicit snapshots inside the serialization queue. Callers that
 			// mutate the registry before waiting cannot overwrite a newer authority
 			// binding with an invocation-time snapshot.
 			const snapshot = this.#topicStateForPersistence();
-			const paths = daemonPaths(this.opts.settings.getAgentDir());
-			await ensureDir(this.fsImpl, paths.dir);
-			await writeJsonAtomic(this.fsImpl, path.join(paths.dir, "telegram-topics.json"), snapshot);
+			const authority = this.opts.topicRegistryAuthority;
+			if (authority) {
+				const expectedGeneration = this.topics.registryVersion();
+				const nextGeneration = expectedGeneration + 1;
+				snapshot.registryGeneration = nextGeneration;
+				let accepted = false;
+				try {
+					accepted = await authority.compareAndSet(expectedGeneration, snapshot);
+				} catch {
+					throw new Error("shared topic authority unavailable");
+				}
+				if (!accepted) {
+					let winner: TopicRegistryState | undefined;
+					try {
+						winner = parseTopicRegistryState(await authority.read());
+					} catch {
+						throw new Error("shared topic authority unavailable");
+					}
+					if (!winner) throw new Error("shared topic authority conflict");
+					this.#replaceTopicAuthority(winner);
+					throw new Error("shared topic authority conflict");
+				}
+				this.topics.markRegistryPublished(nextGeneration);
+			}
+			if (!authority) {
+				const paths = daemonPaths(this.opts.settings.getAgentDir());
+				await ensureDir(this.fsImpl, paths.dir);
+				const topicPath = path.join(paths.dir, "telegram-topics.json");
+				const expectedDestination = await captureTopicRegistryDestination(this.fsImpl, topicPath, process.platform);
+				await writeTopicRegistryAtomic(
+					this.fsImpl,
+					topicPath,
+					snapshot,
+					process.platform,
+					exactReplacePath,
+					expectedDestination,
+				);
+			}
 		});
 		this.topicsPersistQueue = pending.catch(() => undefined);
 		return pending;
 	}
 
+	#acceptedCreateArchiveFenceAllows(
+		sessionId: string,
+		topicId: string,
+		creationLeaseEpoch: number,
+		binding: TopicEndpointBinding | undefined,
+	): boolean {
+		const record = this.topics.get(sessionId);
+		const bindingMatches = binding
+			? record?.chatId === binding.chatId &&
+				record.endpointKey === binding.endpointKey &&
+				record.endpointDigest === binding.endpointDigest &&
+				record.endpointGeneration === binding.endpointGeneration
+			: record?.chatId === String(this.opts.chatId) &&
+				record.endpointKey === undefined &&
+				record.endpointDigest === undefined;
+		return (
+			record?.topicId === topicId &&
+			record.creationLeaseEpoch === creationLeaseEpoch &&
+			bindingMatches &&
+			this.topics.archiveAuthorityAllows(sessionId, this.installationHostId, this.opts.chatId, this.runtime.now())
+		);
+	}
+
+	#replaceTopicAuthority(state: TopicRegistryState): void {
+		this.topics.replace(state);
+		this.closedEndpointKeys.clear();
+		for (const [sessionId, binding] of Object.entries(state.closedEndpoints ?? {}))
+			if (binding) this.closedEndpointKeys.set(sessionId, binding);
+	}
+
 	#topicStateForPersistence(): TopicRegistryState {
-		return { ...this.topics.serialize(), closedEndpoints: Object.fromEntries(this.closedEndpointKeys) };
+		return {
+			...this.topics.serialize(),
+			closedEndpoints: Object.fromEntries(this.closedEndpointKeys),
+			...(this.opts.topicRegistryAuthority ? {} : { installationHostId: this.installationHostId }),
+		};
 	}
 
 	async loadTopics(): Promise<void> {
+		if (this.validationMode()) return;
 		const paths = daemonPaths(this.opts.settings.getAgentDir());
-		const raw = await readJson<TopicRegistryState>(this.fsImpl, path.join(paths.dir, "telegram-topics.json"));
+		const topicPath = path.join(paths.dir, "telegram-topics.json");
+		let raw = await readJson<unknown>(this.fsImpl, topicPath);
+		if (this.opts.topicRegistryAuthority) {
+			try {
+				raw = await this.opts.topicRegistryAuthority.read();
+			} catch {
+				throw new Error("shared topic authority unavailable");
+			}
+			if (!raw) throw new Error("shared topic authority unavailable");
+		}
+		const legacySnapshot =
+			!!raw && typeof raw === "object" && !Array.isArray(raw) && !Object.hasOwn(raw as object, "version");
+		if (legacySnapshot && raw !== undefined) {
+			const legacyDigest = crypto.createHash("sha256").update(JSON.stringify(raw)).digest("hex");
+			const quarantinePath = path.join(paths.dir, `telegram-topics.legacy-quarantine.${legacyDigest}.json`);
+			if ((await readJson<unknown>(this.fsImpl, quarantinePath)) === undefined) {
+				await ensureDir(this.fsImpl, paths.dir);
+				await writeTopicRegistryAtomic(this.fsImpl, quarantinePath, raw);
+			}
+		}
+		const state = parseTopicRegistryState(raw);
 		// Restore the full serialized registry (topicId + identitySent + name) so a
 		// fresh daemon after reload does not resend identity headers or lose renames.
-		if (raw && typeof raw === "object") {
-			this.topics.load(raw);
-			for (const [sessionId, binding] of Object.entries(raw.closedEndpoints ?? {})) {
+		if (state) {
+			const missingHostId =
+				!this.opts.topicRegistryAuthority &&
+				(typeof state.installationHostId !== "string" || state.installationHostId.length === 0);
+			const missingSessionUuid = Object.values(state.topics).some(
+				record => !!record && typeof record === "object" && typeof record.sessionUuid !== "string",
+			);
+			this.topics.load(state);
+			if (!this.opts.topicRegistryAuthority && typeof state.installationHostId === "string")
+				this.installationHostId = state.installationHostId;
+			let reconciledCreateClaim = false;
+			for (const claim of this.topics.pendingCreateClaims()) {
+				const topic = this.topics.get(claim.sessionId);
+				reconciledCreateClaim = this.topics.reconcileCreateClaim(claim.sessionId, topic) || reconciledCreateClaim;
+			}
+			for (const [sessionId, binding] of Object.entries(state.closedEndpoints ?? {})) {
 				if (
 					binding &&
 					typeof binding.chatId === "string" &&
@@ -7393,14 +8511,14 @@ export class TelegramNotificationDaemon {
 				)
 					this.closedEndpointKeys.set(sessionId, binding);
 			}
+			if (legacySnapshot || missingHostId || missingSessionUuid || reconciledCreateClaim) await this.persistTopics();
 		}
 	}
 
 	/**
-	 * Rehydrate durable adoption intents after restart, then reconcile: a
-	 * non-expired sidecar whose target session already has a committed topic
-	 * record is a stale leftover (commit succeeded but sidecar cleanup failed)
-	 * and is removed safely without touching the user topic.
+	 * Rehydrate durable adoption intents after restart. A sidecar whose topic
+	 * already committed is stale evidence and can be removed without touching
+	 * the retained user-created topic.
 	 */
 	async loadAdoptionIntents(): Promise<void> {
 		await this.#adoptionIntents.rehydrate();
@@ -7423,7 +8541,6 @@ export class TelegramNotificationDaemon {
 		}
 	}
 
-	/** Periodic sweep of expired adoption-intent sidecars (files only; no Telegram API). */
 	private startAdoptionSweepTimer(): void {
 		const setIntervalImpl = this.opts.setIntervalImpl ?? setInterval;
 		this.#adoptionSweepTimer = setIntervalImpl(() => {
@@ -7446,9 +8563,10 @@ export class TelegramNotificationDaemon {
 		}
 	}
 
-	/** Retry crash-interrupted topic deletes; only a definite Telegram result clears the durable fence. */
+	/** Retry crash-interrupted topic archives only when the durable backoff permits it. */
 	private async reconcilePendingTopicDeletes(): Promise<void> {
-		for (const sessionId of this.topics.deletePendingSessionIds()) await this.deleteTopic(sessionId);
+		for (const sessionId of this.topics.archivePendingSessionIds(this.runtime.now()))
+			await this.archiveTopic(sessionId);
 	}
 
 	/** Download one Telegram file with the Bot API's 20 MiB ceiling and one end-to-end deadline. */
@@ -7892,7 +9010,7 @@ export class TelegramNotificationDaemon {
 				continue;
 			}
 			const topicId = topicLease?.topicId;
-			if (topicId && !(await this.pairedChatIsPrivate())) {
+			if (topicId && !(await this.pairedChatAllowsTopics())) {
 				this.pool.settle(item.itemId!, "rejected");
 				this.failLegacyToolStart(toolActivity);
 				continue;
@@ -8055,7 +9173,7 @@ export class TelegramNotificationDaemon {
 						);
 						// Index the sent rich message so an inbound reply to it can restore
 						// the original markdown as context (Telegram does not echo it back).
-						if (richMessageId !== undefined) {
+						if (richMessageId !== undefined && !this.validationMode()) {
 							await this.replyStore.record({
 								chatId: this.opts.chatId,
 								messageId: richMessageId,
@@ -8362,29 +9480,41 @@ export class TelegramNotificationDaemon {
 	}
 
 	/**
-	 * Resolve (and cache definitive resolution of) whether the paired `chatId` is
-	 * a private chat. Topic and flat delivery are only safe in a private DM; an
-	 * indeterminate `getChat` result fails closed for this attempt and is retried
-	 * later.
+	 * Resolve and cache the outbound delivery boundary. The validation forum is
+	 * explicit and topic-only; all inbound and flat paths remain private-only.
 	 */
+	private validationMode(): boolean {
+		return this.opts.validationTestSupergroupChatId !== undefined;
+	}
+
 	private async resolvePairedChatPrivacy(): Promise<PairedChatPrivacy> {
-		if (this.pairedChatPrivate !== undefined) return this.pairedChatPrivate ? "private" : "non-private";
+		if (this.pairedChatPrivacy !== undefined) return this.pairedChatPrivacy;
+		const chatId = this.opts.validationTestSupergroupChatId ?? this.opts.chatId;
 		try {
-			const res = (await this.botApi.call("getChat", { chat_id: this.opts.chatId })) as {
+			const res = (await this.botApi.call("getChat", { chat_id: chatId })) as {
 				ok?: unknown;
-				result?: { type?: unknown };
+				result?: { id?: unknown; type?: unknown; is_forum?: unknown };
 			};
 			if (res === undefined) return "indeterminate";
 			if (res?.ok !== true) {
 				logger.warn("notifications: getChat privacy check indeterminate (non-success response)");
 				return "indeterminate";
 			}
-			if (res.result?.type === "private") {
-				this.pairedChatPrivate = true;
+			if (
+				this.validationMode() &&
+				String(res.result?.id) === this.opts.validationTestSupergroupChatId &&
+				res.result?.type === "supergroup" &&
+				res.result.is_forum === true
+			) {
+				this.pairedChatPrivacy = "validation-forum";
+				return "validation-forum";
+			}
+			if (!this.validationMode() && res.result?.type === "private") {
+				this.pairedChatPrivacy = "private";
 				return "private";
 			}
 			if (res.result?.type === "group" || res.result?.type === "supergroup" || res.result?.type === "channel") {
-				this.pairedChatPrivate = false;
+				this.pairedChatPrivacy = "non-private";
 				return "non-private";
 			}
 			logger.warn("notifications: getChat privacy check indeterminate (missing or invalid chat type)");
@@ -8395,7 +9525,13 @@ export class TelegramNotificationDaemon {
 		}
 	}
 
-	/** Keep existing outbound callers fail-closed for indeterminate privacy. */
+	private async pairedChatAllowsTopics(): Promise<boolean> {
+		if (this.topicCapabilityRefused) return false;
+		const privacy = await this.resolvePairedChatPrivacy();
+		return privacy === "private" || privacy === "validation-forum";
+	}
+
+	/** Keep all flat delivery and inbound control paths private-only. */
 	private async pairedChatIsPrivate(): Promise<boolean> {
 		return (await this.resolvePairedChatPrivacy()) === "private";
 	}
@@ -8432,7 +9568,11 @@ export class TelegramNotificationDaemon {
 	private startFlushTimer(): void {
 		this.runtime.startInterval("telegram-flush", RATE_LIMIT_FLUSH_INTERVAL_MS, () => {
 			if (!this.running || this.pool.pending === 0) return;
-			void this.flushPool();
+			// `flushPool` only swallows failures for the shared chain; the promise it
+			// returns still rejects, and an unhandled rejection here exits the daemon.
+			void this.flushPool().catch(error => {
+				logger.warn(`notifications: queue flush failed: ${sanitizeDiagnostic(String(error), this.opts.botToken)}`);
+			});
 		});
 	}
 
@@ -8472,11 +9612,27 @@ export class TelegramNotificationDaemon {
 		this.runtime.stopInterval("telegram-owner-heartbeat");
 	}
 
-	/** Run a root scan, guarding against overlapping scans from the timer + loop. */
+	/**
+	 * Run a root scan, guarding against overlapping scans from the timer + loop.
+	 *
+	 * A reconciliation pass is retried every scan interval, so a failed one must
+	 * never tear the owner down. Both callers are fatal boundaries: the timer
+	 * fires and forgets, and the run loop awaits without a handler. A rejection
+	 * escaping either one (a shared topic authority whose lock or compare-and-set
+	 * is momentarily unavailable is the observed case) reaches the process-level
+	 * handler, which exits the daemon: every session topic is then left as an
+	 * unarchived shell that answers nothing, and the sessions that were still
+	 * live lose notifications too. Report the failure and let the next scan
+	 * retry instead.
+	 */
 	private async runScan(): Promise<void> {
-		await this.runtime.runExclusive("telegram-scan", async () => {
-			await this.scanRoots();
-		});
+		try {
+			await this.runtime.runExclusive("telegram-scan", async () => {
+				await this.scanRoots();
+			});
+		} catch (error) {
+			logger.warn(`notifications: session scan failed: ${sanitizeDiagnostic(String(error), this.opts.botToken)}`);
+		}
 	}
 
 	private startScanTimer(): void {
@@ -8594,14 +9750,18 @@ export class TelegramNotificationDaemon {
 		);
 		if (!this.#leaseTokenAllows(socketLease) || !this.topicLeaseIsCurrent(topicLease)) return false;
 		try {
-			const response = await this.botApi.call("sendMessage", {
-				chat_id: this.opts.chatId,
-				message_thread_id: Number(topicId),
-				text: rendered.text,
-				parse_mode: TELEGRAM_PARSE_MODE,
-				reply_markup: { inline_keyboard },
-				...(telegramDisableNotification(this.opts.sound, "ask") === true ? { disable_notification: true } : {}),
-			});
+			const response = await this.botApi.call(
+				"sendMessage",
+				{
+					chat_id: this.opts.chatId,
+					message_thread_id: Number(topicId),
+					text: rendered.text,
+					parse_mode: TELEGRAM_PARSE_MODE,
+					reply_markup: { inline_keyboard },
+					...(telegramDisableNotification(this.opts.sound, "ask") === true ? { disable_notification: true } : {}),
+				},
+				{ noRetry: true },
+			);
 			if (!response || typeof response !== "object" || (response as { ok?: unknown }).ok !== true) {
 				for (const alias of aliases) this.#modelChoiceAliases.delete(alias);
 				logger.warn("notifications: failed to send model selection keyboard");
@@ -8689,10 +9849,13 @@ export class TelegramNotificationDaemon {
 				endpointAuthority.sessionId === session.sessionId &&
 				ownsLiveOpenEndpoint &&
 				this.topics.matchesEndpoint(session.sessionId, endpointBinding);
+			const inactiveSuccessor =
+				this.topics.get(session.sessionId)?.authorityState === "inactive" &&
+				this.topics.get(session.sessionId)?.endpointDigest !== endpointBinding.endpointDigest;
 			const canBootstrapTransport =
-				endpointAuthority.state === "none" &&
+				(endpointAuthority.state === "none" || inactiveSuccessor) &&
 				ownsLiveOpenEndpoint &&
-				!this.topics.get(session.sessionId) &&
+				(!this.topics.get(session.sessionId) || inactiveSuccessor) &&
 				!this.preservedInitiatorTopics.has(session.sessionId);
 			const replayCandidateSessionId =
 				replayIdentitySessionId ?? (canResumeTransport || canBootstrapTransport ? session.sessionId : undefined);
@@ -8704,6 +9867,7 @@ export class TelegramNotificationDaemon {
 				true,
 				replayIdentitySessionId ? undefined : canBootstrapTransport ? "bootstrap" : "resume",
 			);
+			if (this.sessions.get(session.sessionId) !== session) return;
 			if (!recovered) {
 				if (session.hostGeneration === msg.generation && session.recoveryLease?.state !== "pending")
 					this.dropSession(session, "recovery_rejected");
@@ -9116,10 +10280,8 @@ export class TelegramNotificationDaemon {
 				abandonStaleToolStart();
 				return;
 			}
-			if (
-				this.topics.get(logicalSessionId)?.authorityState === "delete_pending" ||
-				this.topics.get(logicalSessionId)?.bindingMalformed
-			) {
+			const topicRecord = this.topics.get(logicalSessionId);
+			if (topicRecord && (topicRecord.authorityState !== "active" || topicRecord.bindingMalformed)) {
 				this.failLegacyToolStart(toolActivity);
 				return;
 			}
@@ -9132,10 +10294,8 @@ export class TelegramNotificationDaemon {
 				(await this.ensureTopic(logicalSessionId, this.topicNameFor(logicalSessionId, msg), session));
 			const topicLease = await this.topicAuthorityLease(logicalSessionId);
 			if (!topicId || !topicLease || topicLease.topicId !== topicId) {
-				if (
-					this.topics.get(logicalSessionId)?.authorityState === "delete_pending" ||
-					this.topics.get(logicalSessionId)?.bindingMalformed
-				) {
+				const topicRecord = this.topics.get(logicalSessionId);
+				if (topicRecord && (topicRecord.authorityState !== "active" || topicRecord.bindingMalformed)) {
 					this.failLegacyToolStart(toolActivity);
 					return;
 				}
@@ -9195,12 +10355,13 @@ export class TelegramNotificationDaemon {
 			const logicalSessionId = this.#logicalSessionId(session);
 			const socketLease = this.#socketLease(session, logicalSessionId);
 			if (!socketLease) return;
-			if (msg.kind === "ask") session.pending.set(msg.id, { sessionId: logicalSessionId, actionId: msg.id });
-			if (
-				this.topics.get(logicalSessionId)?.authorityState === "delete_pending" ||
-				this.topics.get(logicalSessionId)?.bindingMalformed
-			)
-				return;
+			const pendingAction = msg.kind === "ask" ? { sessionId: logicalSessionId, actionId: msg.id } : undefined;
+			if (pendingAction) {
+				session.pending.set(msg.id, pendingAction);
+				await this.reissuePendingAction(logicalSessionId, msg.id);
+			}
+			const topicRecord = this.topics.get(logicalSessionId);
+			if (topicRecord && (topicRecord.authorityState !== "active" || topicRecord.bindingMalformed)) return;
 			const topicId = await this.ensureTopic(logicalSessionId, this.topicNameFor(logicalSessionId, msg), session);
 			const topicLease = topicId ? this.topicAuthorityLeaseFromRegistry(logicalSessionId) : undefined;
 			if (topicId && (!topicLease || topicLease.topicId !== topicId)) return;
@@ -9247,7 +10408,9 @@ export class TelegramNotificationDaemon {
 					: [],
 			);
 			const displayOptions = options.map((option, index) =>
-				multiSelect ? `${selectedOptionIndices.has(index) ? "☑" : "☐"} ${option}` : option,
+				multiSelect
+					? `${selectedOptionIndices.has(index) ? SELECTION_MARK_CHECKED : SELECTION_MARK_UNCHECKED} ${option}`
+					: option,
 			);
 			const rendered = buildActionMessage({
 				kind: msg.kind ?? "ask",
@@ -9258,81 +10421,245 @@ export class TelegramNotificationDaemon {
 				controls,
 				summary: msg.summary,
 			});
+			const kind = msg.kind === "idle" ? "idle" : "ask";
+			const callbackDispatchAuthorityIsCurrent = (): boolean =>
+				this.#leaseTokenAllows(socketLease) &&
+				(!topicLease || this.topicLeaseIsCurrent(topicLease)) &&
+				(kind !== "ask" || (pendingAction !== undefined && session.pending.get(msg.id) === pendingAction));
+			const createdAliases: Array<[string, CallbackRoute]> = [];
+			const createAlias = (answer: CallbackRoute["answer"]): string => {
+				const alias = this.aliasTable.allocate(candidate => this.reissueBacklog.has(candidate));
+				createdAliases.push([
+					alias,
+					{
+						sessionId: logicalSessionId,
+						actionId: msg.id,
+						answer,
+					},
+				]);
+				return alias;
+			};
 			const inline_keyboard = [
-				...buildCompactChoiceGrid(displayOptions, (i: number) =>
-					this.aliasTable.put({ sessionId: logicalSessionId, actionId: msg.id, answer: i }),
-				),
+				...buildCompactChoiceGrid(displayOptions, (i: number) => createAlias(i)),
 				...controls.map(control => [
 					{
 						text: control.label,
-						callback_data: this.aliasTable.put({
-							sessionId: logicalSessionId,
-							actionId: msg.id,
-							answer: { controlId: control.id },
-						}),
+						callback_data: createAlias({ controlId: control.id }),
 					},
 				]),
 			];
-			const kind = msg.kind === "idle" ? "idle" : "ask";
+			if (createdAliases.length > 0) {
+				for (const [alias, route] of createdAliases) {
+					if (!this.aliasTable.activate(alias, route)) throw new Error("callback alias reservation conflicted");
+				}
+				// Reserve every exposed callback token durably before Telegram can
+				// accept a keyboard. A restart loads these non-receipt routes only
+				// into the non-routable reissue backlog.
+				await this.persistAliases();
+			}
 			// HTML delivery: one sendMessage per chunk, keyboard on the last chunk;
-			// returns the last chunk's message_id (the reply-routable message).
+			// returns the last chunk's authoritative message_id (the reply-routable message).
+			let callbackDelivery: "accepted" | "rejected" | "ambiguous" = "rejected";
 			const sendHtmlChunks = async (): Promise<number | undefined> => {
 				const chunks = splitTelegramHtml(rendered.text);
-				let result: { result?: { message_id?: number } } | undefined;
+				let acceptedMessageId: number | undefined;
 				for (let i = 0; i < chunks.length; i++) {
-					if (!this.#leaseTokenAllows(socketLease) || (topicLease && !this.topicLeaseIsCurrent(topicLease)))
+					const exposesCallbacks = i === chunks.length - 1 && inline_keyboard.length > 0;
+					if (!callbackDispatchAuthorityIsCurrent()) return undefined;
+					let result: { ok?: unknown; result?: { message_id?: unknown } } | undefined;
+					try {
+						result = (await this.botApi.call(
+							"sendMessage",
+							{
+								chat_id: this.opts.chatId,
+								...threadField,
+								text: chunks[i]!,
+								parse_mode: TELEGRAM_PARSE_MODE,
+								...(telegramDisableNotification(this.opts.sound, kind, i === chunks.length - 1) === true
+									? { disable_notification: true }
+									: {}),
+								...(exposesCallbacks ? { reply_markup: { inline_keyboard } } : {}),
+							},
+							{ noRetry: true },
+						)) as { ok?: unknown; result?: { message_id?: unknown } } | undefined;
+					} catch {
+						if (exposesCallbacks) callbackDelivery = "ambiguous";
 						return undefined;
-					result = (await this.botApi.call("sendMessage", {
-						chat_id: this.opts.chatId,
-						...threadField,
-						text: chunks[i]!,
-						parse_mode: TELEGRAM_PARSE_MODE,
-						...(telegramDisableNotification(this.opts.sound, kind, i === chunks.length - 1) === true
-							? { disable_notification: true }
-							: {}),
-						...(i === chunks.length - 1 && inline_keyboard.length ? { reply_markup: { inline_keyboard } } : {}),
-					})) as { result?: { message_id?: number } } | undefined;
-					if (result === undefined) return undefined;
+					}
+					if (result?.ok !== true) {
+						if (exposesCallbacks && result?.ok !== false) callbackDelivery = "ambiguous";
+						return undefined;
+					}
+					const candidate = result.result?.message_id;
+					if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate <= 0) {
+						if (exposesCallbacks) callbackDelivery = "ambiguous";
+						return undefined;
+					}
+					if (exposesCallbacks) callbackDelivery = "accepted";
+					acceptedMessageId = candidate;
 				}
-				return result?.result?.message_id;
+				return acceptedMessageId;
 			};
+			let messageId: number | undefined;
 			if (this.opts.rich?.enabled !== false) {
 				// Rich (default on): promote to sendRichMessage with a top-level
 				// reply_markup (probe-confirmed). Any miss falls back to the HTML loop.
-
-				if (!this.#leaseTokenAllows(socketLease) || (topicLease && !this.topicLeaseIsCurrent(topicLease))) return;
-				const outcome = await deliverRichActionWithFallback(
-					this.botApi,
-					{
-						chat_id: this.opts.chatId,
-						...threadField,
-						...(telegramDisableNotification(this.opts.sound, kind) === true
-							? { disable_notification: true }
-							: {}),
-					},
-					{
-						markdown: buildActionMarkdown({
-							kind,
-							question: msg.question,
-							options: displayOptions,
-							recommendedIndex: msg.recommendedIndex,
-							summary: msg.summary,
-						}),
-						replyMarkup: kind === "ask" && inline_keyboard.length ? { inline_keyboard } : undefined,
-					},
-					AbortSignal.any([this.#deliveryAbort.signal, AbortSignal.timeout(30_000)]),
-					sendHtmlChunks,
-					logger,
-				);
-				// Only asks are reply-routable; idle pings register no route.
-				if (kind === "ask" && outcome.messageId !== undefined)
-					this.messageRoutes.set(String(outcome.messageId), { sessionId: logicalSessionId, actionId: msg.id });
+				if (callbackDispatchAuthorityIsCurrent()) {
+					const outcome = await deliverRichActionWithFallback(
+						this.botApi,
+						{
+							chat_id: this.opts.chatId,
+							...threadField,
+							...(telegramDisableNotification(this.opts.sound, kind) === true
+								? { disable_notification: true }
+								: {}),
+						},
+						{
+							markdown: buildActionMarkdown({
+								kind,
+								question: msg.question,
+								options: displayOptions,
+								recommendedIndex: msg.recommendedIndex,
+								summary: msg.summary,
+							}),
+							replyMarkup: kind === "ask" && inline_keyboard.length ? { inline_keyboard } : undefined,
+						},
+						AbortSignal.any([this.#deliveryAbort.signal, AbortSignal.timeout(30_000)]),
+						sendHtmlChunks,
+						logger,
+					);
+					messageId = outcome.messageId;
+					if (createdAliases.length > 0 && messageId !== undefined) callbackDelivery = "accepted";
+					else if (createdAliases.length > 0 && !outcome.usedFallback) callbackDelivery = "ambiguous";
+				}
 			} else {
 				// Rich disabled: deliver through the HTML chunk path.
-				const messageId = await sendHtmlChunks();
-				// Only asks are reply-routable; idle pings register no route.
-				if (kind === "ask" && messageId !== undefined)
-					this.messageRoutes.set(String(messageId), { sessionId: logicalSessionId, actionId: msg.id });
+				messageId = await sendHtmlChunks();
+			}
+			const pendingActionIsCurrent = pendingAction !== undefined && session.pending.get(msg.id) === pendingAction;
+			const mayActivate =
+				kind === "ask" &&
+				messageId !== undefined &&
+				pendingActionIsCurrent &&
+				this.#leaseTokenAllows(socketLease) &&
+				(!topicLease || this.topicLeaseIsCurrent(topicLease));
+			if (mayActivate) {
+				for (const [alias, route] of createdAliases) {
+					if (
+						!this.aliasTable.update(alias, {
+							...route,
+							chatId: String(this.opts.chatId),
+							messageId,
+							ownerId: this.opts.ownerId,
+							generation: DAEMON_GENERATION,
+						})
+					)
+						throw new Error("callback alias receipt update conflicted");
+				}
+				this.messageRoutes.set(String(messageId), { sessionId: logicalSessionId, actionId: msg.id });
+				const activation = this.#stageCallbackActivation(
+					createdAliases.map(([alias]) => alias),
+					pendingAction,
+					socketLease,
+					topicLease,
+				);
+				try {
+					// A receipt is durable before an alias gets a routable socket lease.
+					await this.persistAliases();
+				} catch {
+					for (const [alias] of createdAliases) {
+						this.#stagedCallbackActivations.delete(alias);
+						this.#revokeCallbackAlias(alias);
+					}
+					this.deleteMessageRoutes(logicalSessionId, msg.id);
+					try {
+						await this.persistAliases();
+					} catch {
+						// The in-memory backlog retains the accepted receipt for shutdown terminalization.
+					}
+					activation.resolve(false);
+					throw new Error("callback alias receipt persistence failed");
+				}
+				if (
+					session.pending.get(msg.id) !== pendingAction ||
+					!this.#leaseTokenAllows(socketLease) ||
+					(topicLease && !this.topicLeaseIsCurrent(topicLease))
+				) {
+					for (const [alias] of createdAliases) {
+						this.#revokeCallbackAlias(alias);
+						this.#stagedCallbackActivations.delete(alias);
+					}
+					this.deleteMessageRoutes(logicalSessionId, msg.id);
+					let revocationPersistenceError: unknown;
+					try {
+						await this.persistAliases();
+					} catch (error) {
+						revocationPersistenceError = error;
+					} finally {
+						activation.resolve(false);
+					}
+					try {
+						await this.botApi.call("editMessageReplyMarkup", {
+							chat_id: this.opts.chatId,
+							message_id: messageId,
+							reply_markup: { inline_keyboard: [] },
+						});
+					} catch {
+						// The accepted receipt remains in memory for shutdown terminalization if persistence failed.
+					}
+					if (revocationPersistenceError !== undefined)
+						throw new Error("callback alias revocation persistence failed", {
+							cause: revocationPersistenceError,
+						});
+					return;
+				}
+				for (const [alias] of createdAliases) {
+					this.#callbackAliasPending.set(alias, pendingAction);
+					this.#callbackAliasLeases.set(alias, socketLease);
+					if (topicLease) this.#callbackAliasTopics.set(alias, topicLease);
+					this.#stagedCallbackActivations.delete(alias);
+				}
+				activation.resolve(true);
+			} else if (kind === "ask" && messageId !== undefined) {
+				// The send may have succeeded after authority ended. Persist every
+				// receipt as revoked before best-effort remote terminalization.
+				for (const [alias, route] of createdAliases) {
+					const receipt = {
+						...route,
+						chatId: String(this.opts.chatId),
+						messageId,
+						ownerId: this.opts.ownerId,
+						generation: DAEMON_GENERATION,
+					};
+					if (this.aliasTable.update(alias, receipt)) {
+						this.#revokeCallbackAlias(alias);
+						continue;
+					}
+					const revoked = this.reissueBacklog.get(alias);
+					if (
+						revoked &&
+						(revoked.sessionId !== route.sessionId ||
+							revoked.actionId !== route.actionId ||
+							revoked.answer !== route.answer)
+					)
+						throw new Error("callback alias revocation update conflicted");
+					this.reissueBacklog.set(alias, receipt);
+				}
+				await this.persistAliases();
+				try {
+					const terminalized = (await this.botApi.call("editMessageReplyMarkup", {
+						chat_id: this.opts.chatId,
+						message_id: messageId,
+						reply_markup: { inline_keyboard: [] },
+					})) as { ok?: unknown } | undefined;
+					if (terminalized?.ok === true) for (const [alias] of createdAliases) this.reissueBacklog.delete(alias);
+				} catch {
+					// The accepted receipt remains durably terminalizable even if its keyboard cannot be removed.
+				}
+			} else if (kind === "ask" && callbackDelivery === "ambiguous") {
+				for (const [alias] of createdAliases) this.#revokeCallbackAlias(alias);
+			} else if (kind === "ask") {
+				for (const [alias] of createdAliases) this.aliasTable.delete(alias);
 			}
 			await this.persistAliases();
 		} else if (msg.type === "action_resolved" && msg.id) {
@@ -9340,8 +10667,9 @@ export class TelegramNotificationDaemon {
 			this.deleteMessageRoutes(this.#logicalSessionId(session), msg.id);
 			for (const [alias, route] of this.aliasTable.entries()) {
 				if (route.sessionId === this.#logicalSessionId(session) && route.actionId === msg.id)
-					this.aliasTable.delete(alias);
+					this.#revokeCallbackAlias(alias);
 			}
+			await this.reissuePendingAction(this.#logicalSessionId(session), msg.id);
 			await this.persistAliases();
 		}
 	}
@@ -9556,14 +10884,18 @@ export class TelegramNotificationDaemon {
 			}),
 		}));
 		try {
-			const response = await this.botApi.call("sendMessage", {
-				chat_id: this.opts.chatId,
-				message_thread_id: threadId,
-				text: "Choose where to start the GJC session:",
-				reply_markup: {
-					inline_keyboard: aliases.map(choice => [{ text: choice.label, callback_data: choice.alias }]),
+			const response = await this.botApi.call(
+				"sendMessage",
+				{
+					chat_id: this.opts.chatId,
+					message_thread_id: threadId,
+					text: "Choose where to start the GJC session:",
+					reply_markup: {
+						inline_keyboard: aliases.map(choice => [{ text: choice.label, callback_data: choice.alias }]),
+					},
 				},
-			});
+				{ noRetry: true },
+			);
 			if (!response || typeof response !== "object" || (response as { ok?: unknown }).ok !== true) {
 				for (const choice of aliases) this.#adoptionPickerAliases.delete(choice.alias);
 				return false;
@@ -9626,12 +10958,16 @@ export class TelegramNotificationDaemon {
 			index => aliases[index]!.alias,
 		);
 		try {
-			const response = await this.botApi.call("sendMessage", {
-				chat_id: this.opts.chatId,
-				message_thread_id: threadId,
-				text: "Pick a recent work folder to start a session here:",
-				reply_markup: { inline_keyboard },
-			});
+			const response = await this.botApi.call(
+				"sendMessage",
+				{
+					chat_id: this.opts.chatId,
+					message_thread_id: threadId,
+					text: "Pick a recent work folder to start a session here:",
+					reply_markup: { inline_keyboard },
+				},
+				{ noRetry: true },
+			);
 			if (!response || typeof response !== "object" || (response as { ok?: unknown }).ok !== true) {
 				for (const a of aliases) this.#adoptionPickerAliases.delete(a.alias);
 				return false;
@@ -10080,6 +11416,7 @@ export class TelegramNotificationDaemon {
 	}
 
 	private async processTelegramUpdate(update: unknown): Promise<TelegramUpdateOutcome> {
+		if (this.validationMode()) return "consumed";
 		const createdOutcome = await this.handleForumTopicCreatedUpdate(update);
 		if (createdOutcome !== "not-topic") return createdOutcome;
 		const topicOutcome = await this.handleForumTopicEdited(update);
@@ -10088,16 +11425,13 @@ export class TelegramNotificationDaemon {
 			await this.handleTelegramUpdate(update);
 		} catch (err) {
 			logger.error("notifications daemon: handleTelegramUpdate failed", { error: String(err) });
+			return "retry";
 		}
 		return "consumed";
 	}
 
 	async handleTelegramUpdate(update: unknown): Promise<void> {
-		// A user-created forum topic (`forum_topic_created`) is consumed first: it
-		// authenticates the chat/user, shows the folder-source picker, and emits the
-		// "already starting" dedup notice for a topic with a live adoption intent.
-		// This mirrors the poll-loop ordering in processTelegramUpdate so direct
-		// (test/orchestration) callers observe identical created-topic handling.
+		if (this.validationMode()) return;
 		if ((await this.handleForumTopicCreatedUpdate(update)) !== "not-topic") return;
 		if ((await this.handleForumTopicEdited(update)) !== "not-topic") return;
 		// A raw path is accepted only after the explicit direct-entry choice. The exact
@@ -10259,7 +11593,17 @@ export class TelegramNotificationDaemon {
 		// update_id dedupe are all enforced by decideThreadedInbound.
 		const raw = update as {
 			callback_query?: unknown;
-			message?: { text?: unknown; reply_to_message?: { message_id?: unknown } };
+			message?: {
+				text?: unknown;
+				reply_to_message?: { message_id?: unknown };
+				photo?: unknown;
+				document?: unknown;
+				video?: unknown;
+				audio?: unknown;
+				chat?: { id?: unknown };
+				message_thread_id?: unknown;
+				message_id?: unknown;
+			};
 		};
 		// A reply to a known ask message routes to that ask (below). Any OTHER
 		// message in a topic (plain text, or a reply to a non-ask message) is a
@@ -10269,6 +11613,23 @@ export class TelegramNotificationDaemon {
 			typeof raw.message?.text === "string" ? parseBtwCommand(raw.message.text, this.botUsername) : undefined;
 		const isAskReply =
 			replyTo !== undefined && (this.messageRoutes.has(String(replyTo)) || this.messageRoutes.has(Number(replyTo)));
+		if (
+			reservedBtw?.kind === "question" &&
+			(raw.message?.photo || raw.message?.document || raw.message?.video || raw.message?.audio) &&
+			typeof raw.message?.message_thread_id === "number" &&
+			typeof raw.message.message_id === "number" &&
+			String(raw.message.chat?.id) === this.opts.chatId &&
+			(await this.pairedChatIsPrivate())
+		) {
+			if (!(await this.reserveSeenUpdateId((update as { update_id?: number }).update_id!))) return;
+			await this.#sendBtwMessage({
+				threadId: String(raw.message.message_thread_id),
+				messageId: raw.message.message_id,
+				text: BTW_USAGE_TEXT,
+				isAuthoritative: () => true,
+			});
+			return;
+		}
 		const directControl =
 			typeof raw.message?.text === "string"
 				? parseTelegramControlCommand(raw.message.text, this.botUsername)
@@ -10302,11 +11663,17 @@ export class TelegramNotificationDaemon {
 							return undefined;
 						return transportOwner.logicalSessionId;
 					}
+					if (
+						reservedBtw?.kind === "question" &&
+						(raw.message?.photo || raw.message?.document || raw.message?.video || raw.message?.audio)
+					)
+						return topicSessionId;
 					return [...this.sessions.values()].some(
 						session =>
-							session.sessionId === topicSessionId ||
-							this.#logicalSessionId(session) === topicSessionId ||
-							session.recoveryLease?.logicalSessionId === topicSessionId,
+							(session.sessionId === topicSessionId ||
+								this.#logicalSessionId(session) === topicSessionId ||
+								session.recoveryLease?.logicalSessionId === topicSessionId) &&
+							session.ws.readyState !== WebSocket.CLOSED,
 					)
 						? undefined
 						: topicSessionId;
@@ -10319,6 +11686,7 @@ export class TelegramNotificationDaemon {
 				const preliminaryControl = inbound.attachment
 					? { kind: "none" as const }
 					: parseTelegramControlCommand(inbound.text, this.botUsername);
+				const reservedBtw = parseBtwCommand(inbound.text, this.botUsername);
 				if (preliminaryControl.kind === "ignored") return;
 				const session =
 					this.logicalSessionOwners.get(inbound.sessionId) ??
@@ -10348,6 +11716,20 @@ export class TelegramNotificationDaemon {
 					topicLeaseAllows();
 				const routeLeaseAllows = (): boolean =>
 					topicLeaseAllows() && (!session || (!!routeLease && this.#leaseTokenAllows(routeLease)));
+				if (
+					/^\/btw(?:\s|$)/i.test(inbound.text) &&
+					inbound.attachment &&
+					(!session || session.ws.readyState !== WebSocket.OPEN || !routeLease)
+				) {
+					if (!(await this.reserveSeenUpdateId(inbound.updateId))) return;
+					await this.#sendBtwMessage({
+						threadId: inbound.threadId,
+						messageId: inbound.messageId,
+						text: BTW_USAGE_TEXT,
+						isAuthoritative: () => true,
+					});
+					return;
+				}
 				const reserveRouteUpdate = async (): Promise<boolean> => {
 					if (!(await this.reserveSeenUpdateId(inbound.updateId))) return false;
 					if (routeLeaseAllows()) return true;
@@ -10355,9 +11737,18 @@ export class TelegramNotificationDaemon {
 					return false;
 				};
 
-				if (session && !routeLease) return;
-				if (preliminaryControl.kind === "invalid" && session?.ws.readyState !== WebSocket.OPEN) return;
-				if (preliminaryControl.kind === "command" && session?.ws.readyState !== WebSocket.OPEN) {
+				if (session && !routeLease && !(reservedBtw?.kind === "question" && inbound.attachment)) return;
+				if (
+					preliminaryControl.kind === "invalid" &&
+					session?.ws.readyState !== WebSocket.OPEN &&
+					!(reservedBtw?.kind === "question" && inbound.attachment)
+				)
+					return;
+				if (
+					preliminaryControl.kind === "command" &&
+					session?.ws.readyState !== WebSocket.OPEN &&
+					!(reservedBtw?.kind === "question" && inbound.attachment)
+				) {
 					if (await reserveRouteUpdate()) {
 						try {
 							await this.botApi.call("sendMessage", {
@@ -10374,18 +11765,22 @@ export class TelegramNotificationDaemon {
 					}
 					return;
 				}
-				const reservedBtw = parseBtwCommand(inbound.text, this.botUsername);
 				if (reservedBtw?.kind === "ignored") {
 					await this.rememberSeenUpdateId(inbound.updateId);
 					return;
 				}
 				if (reservedBtw?.kind === "question" && (!reservedBtw.question || inbound.attachment)) {
-					if (!(await reserveRouteUpdate())) return;
+					const reserved =
+						session?.ws.readyState === WebSocket.OPEN
+							? await reserveRouteUpdate()
+							: await this.reserveSeenUpdateId(inbound.updateId);
+					if (!reserved) return;
+					if (session?.ws.readyState !== WebSocket.OPEN) await this.flushPool();
 					await this.#sendBtwMessage({
 						threadId: inbound.threadId,
 						messageId: inbound.messageId,
 						text: BTW_USAGE_TEXT,
-						isAuthoritative: routeLeaseAllows,
+						isAuthoritative: session?.ws.readyState === WebSocket.OPEN ? routeLeaseAllows : () => true,
 					});
 					return;
 				}
@@ -10627,19 +12022,102 @@ export class TelegramNotificationDaemon {
 		const callbackId = (update as { callback_query?: { id?: unknown } }).callback_query?.id;
 		if (await this.#handleAdoptionPickerCallback(update, callbackId)) return;
 		if (await this.#handleModelChoiceCallback(update, callbackId)) return;
+		const callbackAlias = (update as { callback_query?: { data?: unknown } }).callback_query?.data;
+		const stagedActivation =
+			typeof callbackAlias === "string" ? this.#stagedCallbackActivations.get(callbackAlias) : undefined;
+		if (stagedActivation && !(await stagedActivation.settled)) {
+			await this.sendStaleGuidance(callbackId);
+			return;
+		}
 		const decision = routeInboundUpdate(update, {
 			aliasTable: this.aliasTable,
 			messageRoutes: this.messageRoutes,
 			pairedChatId: this.opts.chatId,
 		});
 		if (decision.kind === "reply") {
+			const callbackLease =
+				typeof callbackAlias === "string" ? this.#callbackAliasLeases.get(callbackAlias) : undefined;
+			const callbackPending =
+				typeof callbackAlias === "string" ? this.#callbackAliasPending.get(callbackAlias) : undefined;
+			const callbackTopic =
+				typeof callbackAlias === "string" ? this.#callbackAliasTopics.get(callbackAlias) : undefined;
 			const session = this.logicalSessionOwners.get(decision.sessionId) ?? this.sessions.get(decision.sessionId);
+			const pendingAction = session?.pending.get(decision.actionId);
 			if (
+				(typeof callbackAlias === "string" &&
+					(!callbackLease ||
+						!callbackPending ||
+						callbackPending !== pendingAction ||
+						!this.#leaseTokenAllows(callbackLease) ||
+						(callbackTopic
+							? !this.topicLeaseIsCurrent(callbackTopic)
+							: this.topics.get(decision.sessionId) !== undefined))) ||
 				session?.ws.readyState !== WebSocket.OPEN ||
-				!session.pending.has(decision.actionId) ||
-				!this.#leaseAllows(session, decision.sessionId) ||
-				(this.topics.get(decision.sessionId) !== undefined &&
-					!this.topicAuthorityLeaseFromRegistry(decision.sessionId))
+				!pendingAction ||
+				!this.#leaseAllows(session, decision.sessionId)
+			) {
+				if (
+					typeof callbackAlias === "string" &&
+					callbackPending !== undefined &&
+					callbackPending !== pendingAction &&
+					this.#revokeCallbackAlias(callbackAlias)
+				)
+					await this.persistAliases();
+				await this.sendStaleGuidance(callbackId);
+				return;
+			}
+			const consumedAliases: Array<
+				[
+					string,
+					CallbackRoute,
+					{ session: SessionSocket; token: number; logicalSessionId: string } | undefined,
+					{ sessionId: string; actionId: string } | undefined,
+					TopicAuthorityLease | undefined,
+				]
+			> = [];
+			// Consume only controls from this exact rendered ask. Predecessor receipts
+			// remain in the terminalization backlog until their authoritative outcome.
+			for (const [alias, route] of this.aliasTable.entries()) {
+				if (
+					route.sessionId === decision.sessionId &&
+					route.actionId === decision.actionId &&
+					this.#callbackAliasPending.get(alias) === pendingAction
+				) {
+					consumedAliases.push([
+						alias,
+						route,
+						this.#callbackAliasLeases.get(alias),
+						this.#callbackAliasPending.get(alias),
+						this.#callbackAliasTopics.get(alias),
+					]);
+					this.aliasTable.delete(alias);
+					this.#callbackAliasLeases.delete(alias);
+					this.#callbackAliasPending.delete(alias);
+					this.#callbackAliasTopics.delete(alias);
+				}
+			}
+			try {
+				await this.persistAliases();
+			} catch {
+				for (const [alias, route, lease, pending, topic] of consumedAliases) {
+					this.aliasTable.activate(alias, route);
+					if (lease) this.#callbackAliasLeases.set(alias, lease);
+					if (pending) this.#callbackAliasPending.set(alias, pending);
+					if (topic) this.#callbackAliasTopics.set(alias, topic);
+				}
+				throw new Error("callback receipt consumption was not durably persisted");
+			}
+			if (
+				session.ws.readyState !== WebSocket.OPEN ||
+				session.pending.get(decision.actionId) !== pendingAction ||
+				(typeof callbackAlias === "string" &&
+					(!callbackPending ||
+						callbackPending !== pendingAction ||
+						!callbackLease ||
+						!this.#leaseTokenAllows(callbackLease) ||
+						(callbackTopic
+							? !this.topicLeaseIsCurrent(callbackTopic)
+							: this.topics.get(decision.sessionId) !== undefined)))
 			) {
 				await this.sendStaleGuidance(callbackId);
 				return;
@@ -10694,6 +12172,12 @@ export class TelegramNotificationDaemon {
 		// Runtime callers can bypass TypeScript's option type. Without a valid bot
 		// token, there is no authenticated daemon identity or lifecycle authority.
 		if (!validBotToken(this.opts.botToken)) return;
+		if (this.validationMode()) {
+			if (!/^-100\d+$/.test(this.opts.validationTestSupergroupChatId!))
+				throw new Error("validation forum destination must be a negative -100... chat ID");
+			if ((await this.resolvePairedChatPrivacy()) !== "validation-forum")
+				throw new Error("validation forum destination must be the exact supergroup forum returned by getChat");
+		}
 		let ownershipProved = false;
 		try {
 			const renewed = await renewDaemonHeartbeat({
@@ -10713,19 +12197,22 @@ export class TelegramNotificationDaemon {
 			if (!this.running) return;
 			// Self-heal durable notification state before any scan/poll work so
 			// `daemon reload` recovers dead roots + leak artifacts (#2956).
-			try {
-				await healTelegramDaemonNotificationState({
-					settings: this.opts.settings,
-					fs: this.fsImpl,
-					now: this.opts.now,
-				});
-			} catch (error) {
-				logger.warn(`notifications: startup self-heal failed: ${sanitizeDiagnostic(String(error))}`);
+			if (!this.validationMode()) {
+				try {
+					await healTelegramDaemonNotificationState({
+						settings: this.opts.settings,
+						fs: this.fsImpl,
+						now: this.opts.now,
+					});
+				} catch (error) {
+					logger.warn(`notifications: startup self-heal failed: ${sanitizeDiagnostic(String(error))}`);
+				}
 			}
+			await this.loadAliases();
 			// Owner-only: start lifecycle control immediately after ownership proof,
 			// before timers or pre-poll startup work can invalidate this run.
 			// Best-effort; notification delivery remains available on failure.
-			await this.startLifecycleControl();
+			if (!this.validationMode()) await this.startLifecycleControl();
 			// A stop may arrive while lifecycle startup awaits its control endpoint.
 			// Do not re-enable runtime work after that stop; close the partial server.
 			if (!this.running) return;
@@ -10734,14 +12221,19 @@ export class TelegramNotificationDaemon {
 			this.startFlushTimer();
 			this.startScanTimer();
 			this.startTypingTimer();
-			await this.refreshBotIdentity();
-			await this.registerBotCommands();
-			await this.loadAliases();
+			if (!this.validationMode()) {
+				await this.refreshBotIdentity();
+				await this.registerBotCommands();
+			}
 			await this.loadTopics();
-			await this.loadAdoptionIntents();
-			this.startAdoptionSweepTimer();
-			await this.loadSeenUpdateIds();
-			await this.replyStore.load();
+			if (!this.validationMode()) {
+				await this.loadAdoptionIntents();
+				this.startAdoptionSweepTimer();
+			}
+			if (!this.validationMode()) {
+				await this.loadSeenUpdateIds();
+				await this.replyStore.load();
+			}
 			await this.runScan();
 			let idleSince = this.runtime.now();
 			while (this.running) {
@@ -10807,37 +12299,43 @@ export class TelegramNotificationDaemon {
 				}
 				this.effects.beginShutdown();
 				this.#deliveryAbort.abort();
+				this.stopFlushTimer();
+				this.stopScanTimer();
+				this.stopTypingTimer();
+				this.stopAdoptionSweepTimer();
+				this.stopLifecycleControl();
 				let persisted = false;
-				const shutdown = this.effects.allowTerminal(async () => {
-					if (toolShutdownError) throw toolShutdownError;
-					await this.#drainBtwTurns();
-					await this.toolTerminalizationChain;
-					this.stopFlushTimer();
-					this.stopScanTimer();
-					this.stopTypingTimer();
-					this.stopAdoptionSweepTimer();
-					this.stopLifecycleControl();
-					await this.cleanupAllAttachmentDirs();
-					await this.persistAliases();
-					await this.persistTopics();
-					await this.persistSeenUpdateIds();
-					await this.opts.control?.clear?.(this.opts.ownerId);
-					persisted = true;
-				});
-				const deadline = Promise.withResolvers<boolean>();
-				const deadlineTimer = setTimeout(() => deadline.resolve(false), BTW_SHUTDOWN_JOIN_MS);
-				const completed = await Promise.race([
-					shutdown.then(
-						() => true,
-						error => {
-							logger.warn(`notifications: shutdown persistence failed: ${sanitizeDiagnostic(String(error))}`);
-							return false;
-						},
-					),
-					deadline.promise,
-				]);
-				clearTimeout(deadlineTimer);
-				const quiesced = completed && heartbeatJoined && (await this.effects.join(BTW_SHUTDOWN_JOIN_MS));
+				const sessionEffectsQuiesced = await this.effects.join(BTW_SHUTDOWN_JOIN_MS);
+				let completed = false;
+				if (sessionEffectsQuiesced) {
+					const shutdown = this.effects.allowTerminal(async () => {
+						if (toolShutdownError) throw toolShutdownError;
+						await this.#drainBtwTurns();
+						await this.toolTerminalizationChain;
+						await this.cleanupAllAttachmentDirs();
+						if (!this.validationMode()) {
+							await this.persistAliases();
+							await this.persistSeenUpdateIds();
+							await this.opts.control?.clear?.(this.opts.ownerId);
+						}
+						await this.persistTopics();
+						persisted = true;
+					});
+					const deadline = Promise.withResolvers<boolean>();
+					const deadlineTimer = setTimeout(() => deadline.resolve(false), BTW_SHUTDOWN_JOIN_MS);
+					completed = await Promise.race([
+						shutdown.then(
+							() => true,
+							error => {
+								logger.warn(`notifications: shutdown persistence failed: ${sanitizeDiagnostic(String(error))}`);
+								return false;
+							},
+						),
+						deadline.promise,
+					]);
+					clearTimeout(deadlineTimer);
+				}
+				const quiesced = completed && heartbeatJoined && sessionEffectsQuiesced;
 				if (!quiesced || !persisted) {
 					logger.warn("notifications: shutdown was not durably quiesced; retaining daemon ownership");
 				} else {