@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.36

package/test/ai.test.ts

@@ -242,6 +242,42 @@ test('model catalog can read an agent-bound Codex home', async () => {
   }
 })
 
+test('Choose AI lists the agent-bound Codex home instead of only the desktop fallback', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-ai-menu-codex-home-'))
+  const codexHome = await mkdtemp(join(tmpdir(), 'ez-ai-menu-cache-'))
+  try {
+    await writeFile(join(codexHome, 'models_cache.json'), JSON.stringify({ models: [
+      { slug: 'fixture-bound-model', display_name: 'Bound Fixture', visibility: 'list',
+        supported_reasoning_levels: [{ effort: 'medium' }] },
+    ] }))
+    const store = new ControlStore(dir, 1000)
+    await store.aiState(initialPreset('codex'))
+    // Default catalog (no explicit override): the menu must bind it to codexHome,
+    // otherwise an empty process-home cache drops codex and only codex-gui lists.
+    const menu = createAiMenu(store, 'codex', undefined, dir, codexHome,
+      async (cli) => cli === 'codex' || cli === 'codex-gui')
+    const replies: Array<{ text: string; buttons: Array<{ text: string; callback_data: string }> }> = []
+    const context = (data?: string) => ({
+      callbackQuery: data ? { data } : undefined,
+      answerCallbackQuery: async () => ({}),
+      reply: async (text: string, options?: { reply_markup?: { inline_keyboard?: Array<Array<{ text: string; callback_data: string }>> } }) => {
+        replies.push({ text, buttons: options?.reply_markup?.inline_keyboard?.flat() ?? [] })
+        return {} as never
+      },
+    })
+    await menu.list(context() as never)
+    assert.deepEqual(replies.at(-1)!.buttons.map((button) => button.text), [
+      'codex', 'codex-gui (desktop)', 'Refresh available AIs',
+    ])
+    const client = replies.at(-1)!.buttons.find((button) => button.text === 'codex')!
+    await menu.handle(context(client.callback_data) as never)
+    assert.deepEqual(replies.at(-1)!.buttons.map((button) => button.text), ['Bound Fixture', 'Back to clients'])
+  } finally {
+    await rm(dir, { recursive: true, force: true })
+    await rm(codexHome, { recursive: true, force: true })
+  }
+})
+
 test('native executor flags carry the exact model and effort; only structured metadata binds sessions', () => {
   const opts = { workspace: '/tmp/fixture', sessionId: crypto.randomUUID(), isResume: true,
     model: 'fixture-model', effort: 'medium' }

package/test/application-channel.test.ts

@@ -9,12 +9,13 @@ import { randomBytes } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { ApplicationChannel, ApplicationBindings, applicationScope } from '../src/application-channel.js'
-import { ControlStore, ownerId } from '../src/control-state.js'
+import { ControlStore, ownerId, ownerEpoch } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
 import { requireOwnerExecution } from '../src/execution-authority.js'
 import { createRelay } from '../src/index.js'
 import { EXECUTOR_REGISTRY, executorEnvironment } from '../src/executor.js'
+import { serveTestLedger } from './helpers/ledger.js'
 
 const token = () => randomBytes(32).toString('base64url')
 const owner = async (dir: string) => {
@@ -31,7 +32,7 @@ test('HTTP auth, idempotency, origin/context isolation, revocation and persisted
   const root=await mkdtemp(join(tmpdir(),'ez-app-channel-'))
   const owned=await owner(root), runs=new RunStore(root), control=new ControlStore(root,1000)
   let wakes=0
-  const channel=new ApplicationChannel({controlDir:root,initial:initialPreset('codex'),wake:()=>{wakes++},cancel:async id=>{await runs.patch(id,{status:'cancelled'})}})
+  const channel=new ApplicationChannel({controlDir:root,initial:initialPreset('codex'),wake:()=>{wakes++},cancel:async id=>{await runs.patch(id,{status:'cancelled'})},createTelegramPairing:async()=>{throw new Error('unavailable')},telegramAvailable:()=>false})
   t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
   const firstToken=token(), secondToken=token()
   const first=(await channel.bindings.register('first',firstToken,owned))!
@@ -124,12 +125,14 @@ if(result.status!==0){console.error(result.stderr);process.exit(1)};
 `)
   EXECUTOR_REGISTRY.codex={...original,command:process.execPath,buildArgs:(options,_file,prompt)=>{prompts.push(prompt);resumeIds.push(options.isResume?options.sessionId:undefined);return ['--import',require.resolve('tsx'),fixture]}}
   const relay=createRelay({controlDir:root,workspace:root,pairingTtlMs:1000,telegramBotToken:'fixture',executorTimeoutMs:0,executorCli:'codex'})
+  // The engine child reaches the relay memory ledger through the delivery socket.
+  const ledger=await serveTestLedger(root)
   let telegramCalls=0
   relay.bot.api.config.use(async()=>{telegramCalls++;return {ok:true,result:{message_id:1}} as never})
   const owned=await owner(root), secret=token()
   const binding=(await relay.applicationChannel.bindings.register('app',secret,owned))!
   const drain=setInterval(()=>void relay.drainOutbox(),10)
-  t.after(async()=>{clearInterval(drain);await relay.stop();EXECUTOR_REGISTRY.codex=original;await rm(root,{recursive:true,force:true})})
+  t.after(async()=>{clearInterval(drain);await relay.stop();EXECUTOR_REGISTRY.codex=original;await ledger.stop();await rm(root,{recursive:true,force:true})})
   const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'one',scope:'program',text:'Hello from the app',context:{secret:'must-stay-out-of-prompt'}})
   await waitFor(async()=> (await new RunStore(root).get(first.id))?.status==='completed')
   const second=await relay.applicationChannel.submit(binding.bindingId,{requestId:'two',scope:'program',text:'Continue'})
@@ -137,8 +140,9 @@ if(result.status!==0){console.error(result.stderr);process.exit(1)};
   assert.deepEqual(resumeIds,[undefined,nativeId])
   assert.equal(telegramCalls,0)
   assert.ok(prompts[0].startsWith('Hello from the app'))
-  assert.ok(prompts[0].includes('[Application channel]'))
+  assert.ok(prompts[0].includes('[application scope "program"]'))
   assert.ok(!prompts[0].includes('must-stay-out-of-prompt'))
+  assert.ok(!prompts[0].includes('delegate'))
   assert.equal((await relay.applicationChannel.snapshot(binding.bindingId,second.id)).messages[0].text,'Fixture engine reply')
 })
 
@@ -302,7 +306,7 @@ test('generic attachments stage after auth, preserve literal comments and reject
   const input={requestId:'image',scope:'chat',followOwner:true,text:'  /goal literal\n comment  ',attachment:{name:'image.png',data:Buffer.from('89504e470d0a1a0a','hex').toString('base64')}}
   assert.equal((await post(input,'bad')).status,401)
   const {readdir,stat}=await import('node:fs/promises')
-  await assert.rejects(readdir(join(root,'inbox')),/ENOENT/)
+  await assert.rejects(readdir(join(root,'attachments')),/ENOENT/)
   for (const [name,bytes] of [['image.png',Buffer.from('89504e470d0a1a0a','hex')],['file.pdf',Buffer.from('%PDF-1.4\nfixture')],['notes.md',Buffer.from('# Fixture')]] as const) {
     const body={...input,requestId:name,attachment:{name,data:bytes.toString('base64')}}
     const response=await post(body);assert.equal(response.status,202)
@@ -311,12 +315,12 @@ test('generic attachments stage after auth, preserve literal comments and reject
     assert.equal(run.ownerId,ownerId(owned))
     assert.equal(run.application?.inputText,input.text)
     assert.ok(run.texts[0].endsWith(`Caption: ${input.text}`))
-    const path=run.texts[0].match(/staged at (inbox\/[^ ]+)/)![1]
-    assert.deepEqual(await readFile(join(root,path)),bytes)
-    assert.equal((await stat(join(root,path))).mode & 0o777,0o600)
-    const before=(await readdir(join(root,'inbox'))).length
+    const path=run.texts[0].match(/staged at (\/[^ ]+)/)![1]
+    assert.deepEqual(await readFile(path),bytes)
+    assert.equal((await stat(path)).mode & 0o777,0o600)
+    const before=(await readdir(join(root,'attachments'))).length
     assert.equal((await post(body)).status,202)
-    assert.equal((await readdir(join(root,'inbox'))).length,before)
+    assert.equal((await readdir(join(root,'attachments'))).length,before)
     assert.equal((await post({...body,text:'changed'})).status,409)
     assert.equal((await post({...body,attachment:{name,data:Buffer.from('changed').toString('base64')}})).status,409)
     assert.equal((await fetch(`http://127.0.0.1:${address.port}/v1/runs/${snapshot.id}`,{headers:{Authorization:`Bearer ${other}`}})).status,404)
@@ -326,12 +330,56 @@ test('generic attachments stage after auth, preserve literal comments and reject
   const invalidActivation=await post({...input,requestId:'invalid-activation',followOwner:false,activateTelegram:true,scope:'new-scope',attachment:{name:'x.exe',data:Buffer.from('text').toString('base64')}})
   assert.equal(invalidActivation.status,400)
   assert.deepEqual((await control.status()).activeSession,priorSession)
-  const before=(await readdir(join(root,'inbox'))).length
+  const before=(await readdir(join(root,'attachments'))).length
   for (const attachment of [{name:'x.exe',data:Buffer.from('text').toString('base64')},{name:'x.txt',data:'%%%invalid'},{name:'x.txt',data:Buffer.alloc(10*1024*1024+1,65).toString('base64')}]) {
     assert.equal((await post({...input,requestId:'bad',attachment})).status,400)
   }
-  assert.equal((await readdir(join(root,'inbox'))).length,before)
+  assert.equal((await readdir(join(root,'attachments'))).length,before)
   await channel.bindings.register('web',null,owned)
   await assert.rejects(channel.submit(binding.bindingId,{...input,requestId:'revoked'}),/revoked/)
-  assert.equal((await readdir(join(root,'inbox'))).length,before)
+  assert.equal((await readdir(join(root,'attachments'))).length,before)
+})
+
+test('shareTelegram bindings list Telegram intake and admit one run with context', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-telegram-'))
+  const control=new ControlStore(root,1000), runs=new RunStore(root)
+  await control.requestPairing(42,42); await control.approveOwner(42)
+  const owned=(await control.status()).owner!
+  const channel=new ApplicationChannel({controlDir:root,initial:initialPreset('codex'),wake:()=>{},cancel:async()=>{},createTelegramPairing:async()=>{throw new Error('unavailable')},telegramAvailable:()=>false})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const sharedToken=token(), plainToken=token()
+  await channel.bindings.register('tg-app',sharedToken,owned,true)
+  await channel.bindings.register('plain',plainToken,owned)
+  const address=await channel.listen(0) as {port:number}
+  const url=`http://127.0.0.1:${address.port}`
+  const get=(bearer:string)=>fetch(url+'/v1/runs',{headers:{Authorization:`Bearer ${bearer}`}})
+  const attach=(id:string,bearer:string,body:unknown)=>fetch(url+`/v1/runs/${id}/application`,{method:'POST',headers:{Authorization:`Bearer ${bearer}`},body:JSON.stringify(body)})
+  const telegram=await runs.create({id:'tg_intake_1',chatId:42,telegramUserId:42,texts:['Attach the session'],ownerId:ownerId(owned),ownerEpoch:ownerEpoch(owned)})
+  assert.equal(telegram.application,undefined)
+  const listed=await (await get(sharedToken)).json() as {runs:{id:string;scope:string}[]}
+  assert.ok(listed.runs.some(run=>run.id==='tg_intake_1' && run.scope==='telegram'))
+  const hidden=await (await get(plainToken)).json() as {runs:{id:string}[]}
+  assert.ok(!hidden.runs.some(run=>run.id==='tg_intake_1'))
+  assert.equal((await attach('tg_intake_1',plainToken,{context:{aifit:{capability:'x'}}})).status,403)
+  assert.equal((await attach('tg_intake_1',sharedToken,{context:'nope'})).status,400)
+  assert.equal((await attach('tg_nope',sharedToken,{context:{}})).status,404)
+  const admitted=await attach('tg_intake_1',sharedToken,{context:{aifit:{capability:'granted'}}})
+  assert.equal(admitted.status,200)
+  assert.deepEqual(await admitted.json(),{id:'tg_intake_1',scope:'telegram',status:'queued'})
+  const stored=await runs.get('tg_intake_1')
+  const storedContext=stored?.telegramApplication?.context as {aifit?:{capability?:string}}|undefined
+  assert.equal(storedContext?.aifit?.capability,'granted')
+  assert.equal(stored?.application,undefined,'owner delivery routing is untouched')
+  const retrySame=await attach('tg_intake_1',sharedToken,{context:{aifit:{capability:'granted'}}})
+  assert.equal(retrySame.status,200)
+  assert.equal((await attach('tg_intake_1',sharedToken,{context:{aifit:{capability:'changed'}}})).status,409)
+  const stranger=await runs.create({id:'tg_stranger_1',chatId:43,telegramUserId:43,texts:['Not the owner'],ownerId:ownerId(owned),ownerEpoch:ownerEpoch(owned)})
+  const stillHidden=await (await get(sharedToken)).json() as {runs:{id:string}[]}
+  assert.ok(!stillHidden.runs.some(run=>run.id===stranger.id))
+  assert.equal((await attach(stranger.id,sharedToken,{context:{}})).status,400)
+  const plain=await runs.create({id:'r_plain_1',texts:['No telegram origin'],ownerId:ownerId(owned),ownerEpoch:ownerEpoch(owned)})
+  assert.equal((await attach(plain.id,sharedToken,{context:{}})).status,404)
+  const finished=await runs.create({id:'tg_finished_1',chatId:42,telegramUserId:42,texts:['Done already'],ownerId:ownerId(owned),ownerEpoch:ownerEpoch(owned)})
+  await runs.patch(finished.id,{status:'completed'})
+  assert.equal((await attach(finished.id,sharedToken,{context:{}})).status,409)
 })

package/test/application-only.test.ts

@@ -20,12 +20,10 @@ const waitFor = async (condition: () => Promise<boolean>) => {
   throw new Error('Timed out')
 }
 
-test('application-only mode explicitly requires native listener and ignores bot credentials', () => {
-  assert.throws(()=>loadConfig({}), /TELEGRAM_BOT_TOKEN/)
-  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'false'}), /EZ_APPLICATION_PORT/)
-  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'no'}), /true or false/)
-  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8110',EZ_CHANNEL_BACKEND_URL:'http://backend',EZ_CHANNEL_BACKEND_TOKEN:'secret'}), /native Ez executor/)
-  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8110',TELEGRAM_BOT_TOKEN:'unused-secret'})
+test('application-only mode is inferred from the absence of a bot token and requires a native listener', () => {
+  assert.throws(()=>loadConfig({}), /EZ_APPLICATION_PORT/)
+  assert.throws(()=>loadConfig({EZ_APPLICATION_PORT:'8110',EZ_CHANNEL_BACKEND_URL:'http://backend',EZ_CHANNEL_BACKEND_TOKEN:'secret'}), /native Ez executor/)
+  const config=loadConfig({EZ_APPLICATION_PORT:'8110'})
   assert.equal(config.telegramBotToken,'')
   assert.equal(config.telegramEnabled,false)
 })
@@ -36,8 +34,8 @@ test('administrator bootstrap is explicit, local-only and cannot replace identit
   const token=join(root,'token'); await writeFile(token,'x'.repeat(48),{mode:0o600})
   const cli=fileURLToPath(new URL('../bin/ezenciel-agents-application.mjs',import.meta.url))
   const args=[cli,'--id','app','--token-file',token,'--owner','42']
-  const env={...process.env,EZ_CONTROL_DIR:root,EZ_RUN_ID:'',EZ_TELEGRAM_ENABLED:'false'}
-  assert.notEqual(spawnSync(process.execPath,args,{env:{...env,EZ_TELEGRAM_ENABLED:'true'}}).status,0)
+  const env={...process.env,EZ_CONTROL_DIR:root,EZ_RUN_ID:'',TELEGRAM_BOT_TOKEN:''}
+  assert.notEqual(spawnSync(process.execPath,args,{env:{...env,TELEGRAM_BOT_TOKEN:'fixture'}}).status,0)
   assert.notEqual(spawnSync(process.execPath,args,{env:{...env,EZ_RUN_ID:'r_agent'}}).status,0)
   assert.equal((await new ControlStore(root,1000).status()).owner,null)
   const invalidToken=join(root,'invalid-token');await writeFile(invalidToken,'short')
@@ -64,7 +62,7 @@ test('botless daemon executes application turn and rejects Telegram-origin work/
   const purpose=join(root,'purpose.md');await writeFile(purpose,'Fixture application agent\n');await initializeWorkspace(root,purpose)
   const portServer=createServer();await new Promise<void>(r=>portServer.listen(0,'127.0.0.1',r))
   const port=(portServer.address() as {port:number}).port;await new Promise<void>(r=>portServer.close(()=>r()))
-  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:String(port),EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'codex'})
+  const config=loadConfig({EZ_APPLICATION_PORT:String(port),EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'codex'})
   const native='11111111-1111-1111-1111-111111111111', fixture=join(root,'engine.mjs')
   await writeFile(fixture,`import {spawnSync} from 'node:child_process';if(process.env.TELEGRAM_BOT_TOKEN)throw Error('secret leak');console.log(JSON.stringify({type:'thread.started',thread_id:${JSON.stringify(native)}}));const r=spawnSync(process.execPath,[${JSON.stringify(fileURLToPath(new URL('../bin/ezenciel-agents-message.mjs',import.meta.url)))},'--text','Application reply'],{env:process.env});process.exit(r.status);`)
   const original=EXECUTOR_REGISTRY.codex,require=createRequire(import.meta.url)
@@ -91,12 +89,15 @@ test('botless daemon executes application turn and rejects Telegram-origin work/
   assert.equal((await runs.get(legacy.id))?.status,'queued')
 })
 
-test('Docker health accepts application readiness only with explicit botless configuration', async t => {
+test('Docker health accepts application readiness when the agent has no bot', async t => {
   const root=await mkdtemp(join(tmpdir(),'ez-app-only-health-'))
   t.after(()=>rm(root,{recursive:true,force:true}))
-  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true}))
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true,telegramConfigured:false}))
   const command=fileURLToPath(new URL('../docker/healthcheck.mjs',import.meta.url))
   const env={...process.env,EZ_HEALTH_RELAY_CONTROL_DIR:root,EZ_EXECUTOR_TRANSPORT:'local'}
-  assert.equal(spawnSync(process.execPath,[command],{env:{...env,EZ_TELEGRAM_ENABLED:'false'}}).status,0)
-  assert.notEqual(spawnSync(process.execPath,[command],{env:{...env,EZ_TELEGRAM_ENABLED:'true'}}).status,0)
+  assert.equal(spawnSync(process.execPath,[command],{env}).status,0)
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:false,telegramConfigured:false}))
+  assert.notEqual(spawnSync(process.execPath,[command],{env}).status,0)
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true,telegramConfigured:true}))
+  assert.notEqual(spawnSync(process.execPath,[command],{env}).status,0)
 })

package/test/channel-backend.test.ts

@@ -43,7 +43,6 @@ test('structured photo transport and deterministic reply recovery', async () =>
 test('backend dispatch keeps owner/private gate and never starts a CLI', async () => {
   const { createRelay } = await import('../src/index.js')
   const { ControlStore } = await import('../src/control-state.js')
-  const { recoverInterruptedRuns } = await import('../docker/recovery.js')
   const root = await mkdtemp(join(tmpdir(), 'channel-gate-'))
   const originalFetch = globalThis.fetch
   let calls = 0
@@ -68,16 +67,14 @@ test('backend dispatch keeps owner/private gate and never starts a CLI', async (
     assert.equal(calls, 1)
     const store = new RunStore(root)
     assert.equal((await store.get('tg_3'))?.status, 'completed')
-    await store.patch('tg_3', { status: 'running' })
-    await recoverInterruptedRuns(root, true)
-    assert.equal((await store.get('tg_3'))?.status, 'queued')
+    await store.patch('tg_3', { status: 'running', backendSubmitted: true })
     const cancel = update(4, 42); cancel.message.text = '/cancel'
     await relay.bot.handleUpdate(cancel)
-    assert.equal((await store.get('tg_3'))?.status, 'queued', 'cancel must retain submitted operation polling')
+    assert.equal((await store.get('tg_3'))?.status, 'running', 'cancel must retain submitted operation polling')
   } finally { await relay.stop(); globalThis.fetch = originalFetch; await rm(root, { recursive: true, force: true }) }
 })
 
-test('backend mode cannot dispatch restricted, external, scheduled or update runs', async () => {
+test('backend mode cannot dispatch restricted, external or scheduled runs', async () => {
   const { createRelay } = await import('../src/index.js')
   const { ControlStore } = await import('../src/control-state.js')
   const root = await mkdtemp(join(tmpdir(), 'channel-authority-'))
@@ -92,7 +89,6 @@ test('backend mode cannot dispatch restricted, external, scheduled or update run
     await runs.create({ ...common, id: 'restricted', taskId: `task_${'a'.repeat(32)}` })
     await runs.create({ ...common, id: 'external', external: { sourceId: 'fixture', bindingId: 'binding', eventIds: ['1'] } })
     await runs.create({ ...common, id: 'scheduled', scheduled: { id: 's', revision: 'r', dueAt: new Date().toISOString(), pairedAt: owner.pairedAt } })
-    await runs.create({ ...common, id: 'r_update_fixture' })
     await relay.drainSources()
     assert.equal(calls, 0); assert.equal(launches, 0)
     assert.ok((await runs.list()).every(run => run.status === 'failed'))

package/test/channel-delivery.test.ts

@@ -8,11 +8,14 @@ import {ControlStore} from '../src/control-state.js'
 import {RunStore} from '../src/runs.js'
 import {authorizeDeliveryContext,captureDeliveryContext} from '../src/delivery-context.mjs'
 import {nativeTasks,nativeTaskBinding} from '../src/plugins/native-tasks.mjs'
+import {serveTestLedger} from './helpers/ledger.js'
 
 test('authenticated connection sends text and files through ordinary outbox receipts without a native run',async()=>{
   const root=await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(),'ez-channel-delivery-'))),workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),home=path.join(root,'tools'),hostConfig=path.join(root,'host-executor.json')
   for(const dir of [workspace,controlDir,home])await fs.mkdir(dir)
   const relay=createRelay({controlDir,workspace,pairingTtlMs:1000,executorTimeoutMs:1000,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('Must not launch native execution')})
+  // The message CLI child reaches the relay memory ledger through the delivery socket.
+  const ledger=await serveTestLedger(controlDir)
   const calls:string[]=[];relay.bot.api.config.use(async(_prev,method)=>{calls.push(method);return {ok:true,result:{message_id:42}} as never})
   try {
     await fs.writeFile(path.join(home,'config.json'),JSON.stringify({schemaVersion:1,workspace,hostConfig}))
@@ -38,7 +41,7 @@ test('authenticated connection sends text and files through ordinary outbox rece
     await relay.drainOutbox();assert.equal(calls.length,2);await assert.rejects(store.waitForDelivery(queued.id),/revoked/)
     await assert.rejects(nativeTasks(home,['--text','denied'],{command:'message',deliveryContext:context}),/revoked/)
     await assert.rejects(store.ownerDeliveryReceipt(context,queued.id),/revoked/)
-  } finally {await relay.stop();await fs.rm(root,{recursive:true,force:true})}
+  } finally {await relay.stop();await ledger.stop();await fs.rm(root,{recursive:true,force:true})}
 })
 test('delivery authority cannot revive after Telegram relink or same-time owner replacement',async t=>{
   const root=await fs.mkdtemp(path.join(os.tmpdir(),'ez-channel-delivery-epoch-'))

package/test/channel-owner.test.ts

@@ -16,6 +16,7 @@ import { ownsRun, isOwner } from '../src/identity.js'
 import { createRelay } from '../src/index.js'
 import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { loadConfig } from '../src/config.js'
+import { serveTestLedger } from './helpers/ledger.js'
 
 const secret = () => randomBytes(32).toString('base64url')
 const waitFor = async (check: () => Promise<boolean>) => {
@@ -87,13 +88,15 @@ test('web owner uses the standard schedule CLI, executor and outbox with Telegra
     if(!scheduled){const r=spawnSync(process.execPath,[${JSON.stringify(scheduleCli)},'create','followup','--now','--name','Followup','--text','Finish the requested work'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr)}
     const r=spawnSync(process.execPath,[${JSON.stringify(messageCli)},'--text',scheduled?'Scheduled reply':'Chat reply'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr);`)
   EXECUTOR_REGISTRY.grok={...original,command:process.execPath,buildArgs:()=>['--import',require.resolve('tsx'),fixture]}
-  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8787',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'})
+  const config=loadConfig({EZ_APPLICATION_PORT:'8787',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'})
   const relay=createRelay(config), control=new ControlStore(root,60000), runs=new RunStore(root)
+  // Engine children reach the relay memory ledger through the delivery socket.
+  const ledger=await serveTestLedger(root)
   const owner=await control.registerOwner('web-owner'),token=secret()
   const binding=(await relay.applicationChannel.bindings.register('web',token,owner))!
   const address=await relay.applicationChannel.listen(0) as {port:number}
   const timer=setInterval(()=>{void relay.drainSources();void relay.drainOutbox()},25)
-  t.after(async()=>{clearInterval(timer);await relay.stop();EXECUTOR_REGISTRY.grok=original;await rm(root,{recursive:true,force:true})})
+  t.after(async()=>{clearInterval(timer);await relay.stop();EXECUTOR_REGISTRY.grok=original;await ledger.stop();await rm(root,{recursive:true,force:true})})
   const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'chat',scope:'main',text:'Schedule a followup'})
   await waitFor(async()=> (await runs.get(first.id))?.status==='completed')
   await waitFor(async()=> (await runs.list()).some(r=>r.scheduled && r.status==='completed'))
@@ -141,7 +144,7 @@ for (const mode of ['owner','web','telegram']) test(`${mode} revocation stops it
   const control=new ControlStore(root,60000),runs=new RunStore(root),scheduler=new Scheduler(root)
   await control.requestPairing(42,42)
   const owner=await control.approveOwner(42)
-  const relay=createRelay(loadConfig({TELEGRAM_BOT_TOKEN:'synthetic',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'}),async()=>({child:spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'pipe'}),stdout:'',cleanup:async()=>{}}))
+  const relay=createRelay(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'}),async()=>({child:spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'pipe'}),stdout:'',cleanup:async()=>{}}))
   relay.bot.api.config.use(async()=>({ok:true,result:true}) as never)
   t.after(async()=>{await relay.stop();await rm(root,{recursive:true,force:true})})
   if (mode==='telegram') {

package/test/codex-context.test.ts

@@ -110,11 +110,11 @@ if(q.method==='turn/start'){send({id:q.id,result:{turn:{id:'one'}}});send({metho
 send({id:q.id,result:q.method==='thread/goal/get'?{goal:null}:{}});});setInterval(()=>{},1000);
 `,{mode:0o700})
   process.env.HOME=root;process.env.PATH=bin+path.delimiter+priorPath
-  await assert.rejects(startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId:'r_schedule_/../../escape',timeoutMs:0}),/Invalid native task run ID/)
+  await assert.rejects(startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId:'r_schedule_/../../escape',timeoutMs:0,nativeSession:true}),/Invalid native task run ID/)
   await ownerRun(controlDir, 'r_pair_fixture')
   await Promise.all(['r_schedule_one','r_schedule_two'].map(async runId=>{
    await ownerRun(controlDir, runId)
-   const job=await startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:0})
+   const job=await startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:0,nativeSession:true})
    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
    const home=path.join(controlDir,'cli/codex/tasks',runId)
    assert.equal(JSON.parse(await readFile(path.join(home,'observed.json'),'utf8')).home,home)

package/test/config.test.ts

@@ -2,13 +2,13 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 import { loadConfig } from '../src/config.js'
 
-test('requires a Telegram token', () => {
-  assert.throws(() => loadConfig({}), /TELEGRAM_BOT_TOKEN is required/)
+test('requires an application listener when no Telegram bot token is present', () => {
+  assert.throws(() => loadConfig({}), /EZ_APPLICATION_PORT/)
 })
 
 test('uses a relative agent workspace and protected control state defaults', () => {
   const config = loadConfig({
-    TELEGRAM_BOT_TOKEN: 'test-token',
+    TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',
     EZ_AGENT_WORKSPACE: './fixture-agent',
     EZ_CONTROL_DIR: './fixture-control',
   })
@@ -19,73 +19,68 @@ test('uses a relative agent workspace and protected control state defaults', ()
 })
 
 test('rejects malformed timeouts', () => {
-  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
-  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
 })
 
 test('loads executor CLI configuration with agy fallback', () => {
-  const defaultConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test' })
+  const defaultConfig = loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY' })
   assert.equal(defaultConfig.executorCli, 'agy')
 
-  const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_CLI: 'claude' })
+  const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_EXECUTOR_CLI: 'claude' })
   assert.equal(customConfig.executorCli, 'claude')
 })
 
 test('Codex context limit is configurable and rejects invalid values', () => {
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexAutoCompactTokens,undefined)
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexAutoCompactTokens,undefined)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
   for(const value of ['0','-1','bad','1.5','9007199254740992'])
-    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
+    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
 })
 
-test('PagerDuty Stocks monitoring requires a routing key and validates its target', () => {
-  assert.throws(
-    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical' }),
-    /PAGERDUTY_ROUTING_KEY is required/,
-  )
-  assert.throws(
-    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', PAGERDUTY_ROUTING_KEY: 'key', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'file:///private/health' }),
-    /absolute HTTP\(S\) URL/,
-  )
-  const config = loadConfig({
-    TELEGRAM_BOT_TOKEN: 'test',
-    PAGERDUTY_ROUTING_KEY: 'pagerduty-key',
-    EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical',
-    EZ_PAGERDUTY_POLL_SECONDS: '45',
-    EZ_PAGERDUTY_FAILURE_THRESHOLD: '4',
-  })
-  assert.equal(config.pagerDutyRoutingKey, 'pagerduty-key')
-  assert.equal(config.pagerDutyStocksHealthUrl, 'http://stocks.test/health/critical')
-  assert.equal(config.pagerDutyPollMs, 45_000)
-  assert.equal(config.pagerDutyFailureThreshold, 4)
-})
 
 test('external Codex isolation requires explicit native local deployment', () => {
-  const env = {EZ_TELEGRAM_ENABLED:'false', EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
+  const env = {EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
   assert.equal(loadConfig(env).codexSandbox, 'external')
-  assert.equal(loadConfig({...env,EZ_TELEGRAM_ENABLED:'true',TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, 'external')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, undefined)
+  assert.equal(loadConfig({...env,TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexSandbox, 'external')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexSandbox, undefined)
   assert.equal(loadConfig({...env,EZ_EXECUTOR_TRANSPORT:''}).isolation, 'isolated')
   assert.throws(() => loadConfig({...env,EZ_EXECUTOR_TRANSPORT:'host'}), /sandbox|SANDBOX|Isolation/)
   assert.throws(() => loadConfig({...env,EZ_CODEX_SANDBOX:'danger-full-access'}), /sandbox|SANDBOX/)
 })
 
 test('isolation class is isolated by default and rejects host transport mismatch', () => {
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).isolation, 'isolated')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'local'}).isolation, 'isolated')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
-  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'host'}), /Isolation isolated requires EZ_EXECUTOR_TRANSPORT=local/)
-  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'local'}), /Isolation host-capable requires EZ_EXECUTOR_TRANSPORT=host/)
-  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'seatbelt'}), /isolated or host-capable/)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'local'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'host'}), /Isolation isolated requires EZ_EXECUTOR_TRANSPORT=local/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'local'}), /Isolation host-capable requires EZ_EXECUTOR_TRANSPORT=host/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'seatbelt'}), /isolated or host-capable/)
   assert.throws(() => loadConfig({
-    TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host',
+    TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host',
     EZ_CHANNEL_BACKEND_URL:'https://backend.example',EZ_CHANNEL_BACKEND_TOKEN:'secret',
   }), /Host-capable isolation requires the host native CLI/)
 })
 
 test('optional web launcher preserves reserved commands and accepts only HTTPS without secrets', () => {
-  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
+  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
   assert.deepEqual(config({command:'voice',label:'Voice',url:'https://voice.example/'}).webLauncher,{command:'voice',label:'Voice',url:'https://voice.example/'})
   for (const value of [{command:'stop',label:'Voice',url:'https://voice.example/'},{command:'voice',label:'Voice',url:'http://voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/#secret'},{command:'voice',label:'Voice',url:'https://user:pass@voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/?token=secret'}]) assert.throws(()=>config(value))
 })
+
+test('Telegram transport is inferred from a valid token; legacy flag contradictions fail closed', () => {
+  const token = '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'
+  const enabled = loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_APPLICATION_PORT: '8110' })
+  assert.equal(enabled.telegramEnabled, true)
+  assert.equal(enabled.telegramBotToken, token)
+  const appOnly = loadConfig({ TELEGRAM_BOT_TOKEN: '   ', EZ_APPLICATION_PORT: '8110' })
+  assert.equal(appOnly.telegramEnabled, false)
+  assert.equal(appOnly.telegramBotToken, '')
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'garbage', EZ_APPLICATION_PORT: '8110' }), /malformed/)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }), /contradicts/)
+  assert.throws(() => loadConfig({ EZ_TELEGRAM_ENABLED: 'true', EZ_APPLICATION_PORT: '8110' }), /contradicts/)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'sometimes' }), /must be true or false/)
+  assert.equal(loadConfig({ EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }).telegramEnabled, false)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'true' }).telegramEnabled, true)
+})

package/test/control-state.test.ts

@@ -1,16 +1,16 @@
 import assert from 'node:assert/strict'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import test from 'node:test'
 import { ControlStore } from '../src/control-state.js'
 import { parseOwnerArgs } from '../src/owner-args.js'
 
-const fixture = async (run: (store: ControlStore, advance: (milliseconds: number) => void) => Promise<void>): Promise<void> => {
+const fixture = async (run: (store: ControlStore, advance: (milliseconds: number) => void, directory: string) => Promise<void>): Promise<void> => {
   const directory = await mkdtemp(path.join(tmpdir(), 'ez-control-test-'))
   let now = Date.parse('2026-01-01T00:00:00.000Z')
   try {
-    await run(new ControlStore(directory, 60_000, () => now), (milliseconds) => { now += milliseconds })
+    await run(new ControlStore(directory, 60_000, () => now), (milliseconds) => { now += milliseconds }, directory)
   } finally {
     await rm(directory, { recursive: true, force: true })
   }
@@ -35,7 +35,9 @@ test('cannot approve a telegram id that did not request pairing', async () => fi
   await store.requestPairing(101, 101)
   await assert.rejects(store.approveOwner(202), /No active pairing request/)
   assert.equal((await store.status()).owner, null)
-  assert.equal((await store.status()).pending[0]?.telegramUserId, 101)
+  const request = (await store.status()).pending[0]
+  if (!request || !('telegramUserId' in request)) throw new Error('Telegram pairing request missing')
+  assert.equal(request.telegramUserId, 101)
 }))
 
 test('expires pairing requests before an owner can approve them', async () => fixture(async (store, advance) => {
@@ -51,8 +53,85 @@ test('supports local owner recovery by revocation', async () => fixture(async (s
   assert.equal((await store.status()).owner, null)
 }))
 
+test('application-owned Telegram link is hashed, one-time, and bound to the current owner', async () => fixture(async (store, advance, directory) => {
+  const owner = await store.registerOwner('account:one')
+  const bindingId = '11111111-1111-1111-1111-111111111111'
+  const pairing = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(pairing)
+  assert.doesNotMatch(await readFile(path.join(directory, 'control-state.json'), 'utf8'), new RegExp(pairing.token))
+  const flipped = pairing.token.slice(0, -1) + (pairing.token.endsWith('A') ? 'B' : 'A')
+  assert.equal(await store.claimApplicationTelegramPairing(flipped, 101, 101, async () => true), null)
+  assert.equal(await store.claimApplicationTelegramPairing(pairing.token, 101, 101, async () => false), null)
+  assert.equal((await store.status()).owner?.telegramUserId, undefined)
+
+  const replacement = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(replacement)
+  advance(60_001)
+  assert.equal(await store.claimApplicationTelegramPairing(replacement.token, 101, 101, async () => true), null)
+
+  const active = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(active)
+  const linked = await store.claimApplicationTelegramPairing(active.token, 101, 101, async (requestedBinding, expectedOwner) =>
+    requestedBinding === bindingId && expectedOwner.id === owner.id)
+  assert.equal(linked?.id, owner.id)
+  assert.equal(linked?.telegramUserId, 101)
+  assert.equal(linked?.telegramChatId, 101)
+  assert.ok(linked?.telegramLinkedAt)
+  assert.equal(await store.claimApplicationTelegramPairing(active.token, 101, 101, async () => true), null)
+  assert.equal(await store.createApplicationTelegramPairing(bindingId, linked!), null)
+  await store.unlinkTelegram()
+  const relink = await store.createApplicationTelegramPairing(bindingId, (await store.status()).owner!)
+  assert.ok(relink)
+  assert.equal(await store.claimApplicationTelegramPairing(relink.token, 101, 101, async () => false), null)
+}))
+
 test('owner CLI treats pnpm -- as a separator, not a command', () => {
   assert.deepEqual(parseOwnerArgs(['--', 'status']), { command: 'status', value: undefined })
   assert.deepEqual(parseOwnerArgs(['--', 'approve', '101']), { command: 'approve', value: '101' })
   assert.deepEqual(parseOwnerArgs(['revoke']), { command: 'revoke', value: undefined })
 })
+
+test('provider catalog upgrades a persisted providerless Codex selection', async () => fixture(async (store) => {
+  const model = 'deepseek/deepseek-v4.1-flash'
+  await store.captureChoice({ id: 'deepseek', name: `${model} · max`, cli: 'codex', model, effort: 'max' })
+  const catalog = [{ cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['max'] }]
+
+  assert.equal(await store.normalizeProviderBindings(catalog), true)
+  const state = await store.status()
+  const preset = state.ai!.presets.find((item) => item.id === state.ai!.selectedId)!
+  assert.equal(preset.provider, 'openrouter')
+  assert.equal(preset.name, `${model} · max`)
+  assert.equal(state.activeSession?.preset?.provider, 'openrouter')
+  assert.equal(await store.normalizeProviderBindings(catalog), false)
+}))
+
+test('provider catalog leaves ambiguous and effort-mismatched selections untouched', async () => fixture(async (store) => {
+  const model = 'deepseek/deepseek-v4.1-flash'
+  await store.captureChoice({ id: 'deepseek', name: 'My deepseek', cli: 'codex', model, effort: 'max' })
+  const ambiguous = [
+    { cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['max'] },
+    { cli: 'codex', provider: 'direct', model, name: `Direct · ${model}`, efforts: ['max'] },
+  ]
+  assert.equal(await store.normalizeProviderBindings(ambiguous), false)
+  assert.equal((await store.status()).ai!.presets.find((item) => item.id === 'deepseek')!.provider, undefined)
+  const mismatch = [{ cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['low'] }]
+  assert.equal(await store.normalizeProviderBindings(mismatch), false)
+  assert.equal((await store.status()).ai!.presets.find((item) => item.id === 'deepseek')!.provider, undefined)
+}))
+
+test('steady-state owner checks and session pins write nothing to control/', async () => fixture(async (store, _advance, directory) => {
+  const { stat } = await import('node:fs/promises')
+  const { initialPreset } = await import('../src/ai.js')
+  await store.requestPairing(101, 101)
+  await store.approveOwner(101)
+  await store.aiState(initialPreset('codex'))
+  // First pin may persist the session binding; everything after must be quiet.
+  await store.captureChoice(initialPreset('codex'), 'hello')
+  const before = await stat(path.join(directory, 'control-state.json'))
+  await store.status()
+  await store.captureChoice(initialPreset('codex'), 'hello again')
+  await store.status()
+  const after = await stat(path.join(directory, 'control-state.json'))
+  assert.equal(after.mtimeMs, before.mtimeMs)
+  assert.equal(after.size, before.size)
+}))