@jungjaehoon/mama-os 0.74.0 → 0.76.0

package/dist/gateways/telegram.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TelegramGateway = void 0;
+const personal_turns_js_1 = require("../runtime/personal-turns.js");
 const node_async_hooks_1 = require("node:async_hooks");
 const node_crypto_1 = require("node:crypto");
+const owner_authority_js_1 = require("../runtime/owner-authority.js");
+const principal_access_js_1 = require("../runtime/principal-access.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const grammy_1 = require("grammy");
@@ -65,13 +68,13 @@ function chatIdFromSourceMessageRef(value) {
     }
     return rest.slice(0, separator);
 }
-function outboundLedgerKey(idempotencyKey) {
-    return `outbound:${(0, node_crypto_1.createHash)('sha256').update(`text\0${idempotencyKey}`).digest('hex')}`;
-}
-/** Telegram owner ingress and its durable response transport. */
+/** Telegram personal/common ingress and its durable response transport. */
 class TelegramGateway extends base_gateway_js_1.BaseGateway {
     source = 'telegram';
     token;
+    registry;
+    memberIntake;
+    principalPaths;
     config;
     filesRoot;
     downloadsDir;
@@ -80,11 +83,17 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
     onFatalError;
     messageLedger;
     chatTails = new Map();
+    pendingMemberIntakes = new Map();
+    stopIntake;
+    intakeStopped = new Promise((resolve) => {
+        this.stopIntake = () => resolve(undefined);
+    });
+    enrollmentCompletions = new Set();
     activePresenters = new Map();
     recentMessageIds = new Map();
     activeChat = new node_async_hooks_1.AsyncLocalStorage();
     nextEnrollmentRequestId = (0, node_crypto_1.randomInt)(1, 0x7fffffff);
-    pendingEnrollment;
+    pendingEnrollments = new Map();
     onMemberSelection;
     recordMemberSelection;
     bot = null;
@@ -96,14 +105,14 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
     constructor(options) {
         super({ intake: options.intake });
         this.token = options.token;
+        this.registry = options.registry;
+        this.memberIntake = options.memberIntake;
+        this.principalPaths = options.principalPaths;
         this.onMemberSelection = options.onMemberSelection;
         this.recordMemberSelection = options.recordMemberSelection;
         this.config = {
             enabled: options.config?.enabled ?? true,
             allowedChats: options.config?.allowedChats ?? [],
-            ...(options.config?.ownerUserIds === undefined
-                ? {}
-                : { ownerUserIds: options.config.ownerUserIds }),
             ...(options.config?.ownerChatId === undefined
                 ? {}
                 : { ownerChatId: options.config.ownerChatId }),
@@ -130,6 +139,10 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
     async start() {
         if (this.connected)
             return;
+        this.accepting = true;
+        this.intakeStopped = new Promise((resolve) => {
+            this.stopIntake = () => resolve(undefined);
+        });
         if (!this.config.allowedChats?.some((chatId) => chatId.trim().length > 0)) {
             throw new Error('telegram gateway disabled: allowed_chats is not set. Run: mama status');
         }
@@ -174,10 +187,21 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             throw error;
         }
     }
-    async stop() {
-        this.pendingEnrollment = undefined;
+    async beginStop() {
+        this.accepting = false;
+        this.stopIntake();
         if (this.bot)
             await this.bot.stop().catch(() => { });
+    }
+    async drain() {
+        await super.drain();
+        await Promise.allSettled([...this.enrollmentCompletions]);
+        await Promise.allSettled([...this.chatTails.values()]);
+    }
+    async stop() {
+        await this.beginStop();
+        await this.drain();
+        this.pendingEnrollments.clear();
         this.bot = null;
         this.connected = false;
         this.recentMessageIds.clear();
@@ -187,10 +211,9 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
     answered(sourceRef) {
         return this.messageLedger.get(sourceRef)?.state === 'delivered';
     }
-    /** Final response callback used by the owner runtime after a native turn settles. */
+    /** Final response callback used after a common or personal native turn settles. */
     async deliverResponse(sourceRef, response) {
         const chatId = chatIdFromSourceMessageRef(sourceRef);
-        this.requireAllowedChat(chatId);
         const existing = this.messageLedger.get(sourceRef);
         if (!existing)
             throw new Error(`Telegram response has no accepted message ${sourceRef}`);
@@ -199,6 +222,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         }
         if (existing.state === 'delivered')
             return;
+        await this.responseIntake(sourceRef);
         if (existing.state === 'ready' && existing.response !== response) {
             throw new Error('Telegram response conflicts with its durable ledger entry');
         }
@@ -208,6 +232,18 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             return;
         await this.deliverReadyEntry(sourceRef);
     }
+    /** Close one accepted input with the configured host notice, preserving any ready reply. */
+    async interruptResponse(sourceRef) {
+        const entry = this.messageLedger.get(sourceRef);
+        if (!entry)
+            throw new Error(`Telegram interruption has no accepted message ${sourceRef}`);
+        if (entry.state === 'delivered')
+            return;
+        await this.responseIntake(sourceRef);
+        if (entry.state === 'processing')
+            this.messageLedger.markInterrupted(sourceRef, this.interruptedNotice, 'html-v1');
+        await this.deliverReadyEntry(sourceRef);
+    }
     async sendMessage(chatId, text, idempotencyKey) {
         if (!this.bot || !this.connected)
             throw new Error('Telegram gateway not connected');
@@ -224,6 +260,19 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         await this.sendMessage(ownerChatId, text, idempotencyKey);
     }
     /** Host receipt only. The dispatcher never exposes arbitrary member text/destination input. */
+    memberTextDelivered(access, operationId) {
+        const destinations = access.destinations?.filter((target) => target.kind === 'telegram');
+        if (destinations?.length !== 1 || !destinations[0].id.trim())
+            throw new Error('Member text delivery requires exactly one Telegram destination');
+        if (!operationId.trim())
+            throw new Error('Member text operation id is required');
+        const entry = this.messageLedger.get((0, telegram_message_ledger_js_1.outboundLedgerKey)(operationId));
+        return (entry?.state === 'delivered' && entry.deliveryTarget === `telegram:${destinations[0].id}`);
+    }
+    /** Host-only retirement after the mailbox occurrence closes, including inactive recipients. */
+    retireMemberJobText(operationId) {
+        (0, telegram_message_ledger_js_1.retirePersonalTurnReceipt)(this.messageLedger, operationId);
+    }
     async sendMemberText(access, text, operationId) {
         const destinations = access.destinations?.filter((target) => target.kind === 'telegram');
         if (destinations?.length !== 1 || !destinations[0].id.trim())
@@ -234,9 +283,12 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             throw new Error('Member text operation id is required');
         const chatId = destinations[0].id;
         await this.runInChatQueue(chatId, () => this.sendMessageNow(chatId, text, operationId));
-        return this.messageLedger.get(outboundLedgerKey(operationId))?.state === 'delivered';
+        return this.memberTextDelivered(access, operationId);
+    }
+    sendFile(path, caption, operationId, member) {
+        return this.trackDelivery(() => this.sendFileNow(path, caption, operationId, member));
     }
-    async sendFile(path, caption, operationId, member) {
+    async sendFileNow(path, caption, operationId, member) {
         if (!this.bot || !this.connected)
             throw new Error('Telegram gateway not connected');
         if (operationId.trim() === '')
@@ -249,6 +301,8 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             if (destinations?.length !== 1 || !destinations[0].id.trim())
                 throw new Error('Member file delivery requires exactly one Telegram destination');
             chatId = destinations[0].id;
+            if ((0, principal_access_js_1.roomChannel)(member.access) !== undefined)
+                this.requireAllowedChat(chatId);
             filesRoot = member.filesRoot;
         }
         else {
@@ -300,21 +354,26 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         }
     }
     /** The source ref was verified as an owner turn by the runtime; only an owner DM can select. */
-    async requestMemberEnrollment(sourceRef) {
+    async requestMemberEnrollment(sourceRef, requestingOwnerUserId, name) {
         if (!sourceRef.startsWith('telegram:'))
             throw Object.assign(new Error("Enrollment requires the owner's own Telegram DM"), {
                 name: 'denied',
             });
-        const ownerUserId = chatIdFromSourceMessageRef(sourceRef);
+        const ownerUserId = requestingOwnerUserId;
         const chatId = Number(ownerUserId);
-        if (!this.bot || !this.onMemberSelection || !this.ownerAllowed(ownerUserId, ownerUserId)) {
+        if (!this.bot || !this.onMemberSelection || !this.ownerAllowed(ownerUserId)) {
             throw Object.assign(new Error("Enrollment requires the owner's own Telegram DM"), {
                 name: 'denied',
             });
         }
         const requestId = this.nextEnrollmentRequestId;
         this.nextEnrollmentRequestId = requestId === 0x7fffffff ? 1 : requestId + 1;
-        this.pendingEnrollment = { requestId, sourceMessageRef: sourceRef, ownerUserId };
+        this.pendingEnrollments.set(ownerUserId, {
+            requestId,
+            sourceMessageRef: sourceRef,
+            ownerUserId,
+            ...(name === undefined ? {} : { name }),
+        });
         // Telegram shows a request_users button only on the reply keyboard, under the message box.
         const prompt = 'Choose one member to enroll with the Choose member button under the message box, not in the chat. If it is hidden, open it with the keyboard icon in the message box.';
         try {
@@ -334,15 +393,24 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             });
         }
         catch (error) {
-            if (this.pendingEnrollment?.requestId === requestId)
-                this.pendingEnrollment = undefined;
+            if (this.pendingEnrollments.get(ownerUserId)?.requestId === requestId)
+                this.pendingEnrollments.delete(ownerUserId);
             throw error;
         }
     }
-    async completeMemberSelection(message) {
+    cancelMemberEnrollment(principalId) {
+        for (const ownerUserId of this.pendingEnrollments.keys()) {
+            if (this.registry.resolveByExternal('telegram', 'private', ownerUserId)?.principalId ===
+                principalId)
+                this.pendingEnrollments.delete(ownerUserId);
+        }
+    }
+    async completeMemberSelection(message, senderPrincipalId) {
         const chatId = String(message.chat.id);
         const ownerUserId = String(message.from.id);
-        if (message.chat.type !== 'private' || chatId !== ownerUserId)
+        if (message.chat.type !== 'private' ||
+            chatId !== ownerUserId ||
+            !this.ownerAllowed(ownerUserId))
             return;
         let receiptText = 'Enrollment selection received.';
         let deliveryVerified = false;
@@ -355,7 +423,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             deliveryVerified = true;
         };
         try {
-            const pending = this.pendingEnrollment;
+            const pending = this.pendingEnrollments.get(ownerUserId);
             const shared = message.users_shared;
             if (!pending ||
                 shared.request_id !== pending.requestId ||
@@ -364,7 +432,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                 return;
             }
             // Consume before awaiting the serial host chain, so concurrent duplicate updates cannot enroll.
-            this.pendingEnrollment = undefined;
+            this.pendingEnrollments.delete(ownerUserId);
             if (shared.users.length !== 1 ||
                 !Number.isSafeInteger(shared.users[0].user_id) ||
                 shared.users[0].user_id <= 0) {
@@ -378,6 +446,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                     sourceMessageRef: pending.sourceMessageRef,
                     ownerUserId,
                     userId: String(shared.users[0].user_id),
+                    ...(pending.name === undefined ? {} : { name: pending.name }),
                 });
             }
             catch (error) {
@@ -411,6 +480,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                     message: {
                         id: sourceMessageRef(chatId, message.message_id),
                         channelKey: chatId,
+                        senderPrincipalId,
                         occurredAt: message.date * 1000,
                         text: 'Member selection for enrollment (Choose member button)',
                         // manage.member.list finds the receipts by this marker, not by the text.
@@ -431,31 +501,125 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
     getLastMessageAt() {
         return this.lastMessageAt;
     }
-    ownerAllowed(chatId, userId) {
-        if (!this.config.allowedChats?.includes(chatId))
-            return false;
-        if (this.config.ownerUserIds !== undefined)
-            return this.config.ownerUserIds.includes(userId);
-        return this.config.allowedChats.length === 1 && this.config.allowedChats[0] === userId;
+    ownerAllowed(userId) {
+        const principal = this.registry.resolveByExternal('telegram', 'private', userId);
+        return (principal?.kind === 'member' &&
+            principal.status === 'active' &&
+            (0, owner_authority_js_1.holdsOwnerRole)(this.registry, principal.principalId));
+    }
+    async responseIntake(sourceRef) {
+        const chatId = chatIdFromSourceMessageRef(sourceRef);
+        const recipient = this.registry.resolveByExternal('telegram', 'private', chatId);
+        if (recipient) {
+            if (recipient.kind !== 'member' || recipient.status !== 'active') {
+                throw new Error('Telegram DM response requires its registered active member');
+            }
+            return this.memberIntake(recipient.principalId);
+        }
+        this.requireAllowedChat(chatId);
+        // A room turn records its member on the ledger; a common message handed to a member's room
+        // is found through the durable room input, so a crash between the two cannot misroute it.
+        const principalId = this.messageLedger.get(sourceRef)?.principalId ?? this.intake.handedOffTo?.(sourceRef);
+        if (principalId !== undefined) {
+            const member = this.registry.findById(principalId);
+            if (member?.kind !== 'member' || member.status !== 'active')
+                throw new Error('Telegram room response requires its recorded active member');
+            return this.memberIntake(principalId, chatId);
+        }
+        return this.intake;
     }
     requireAllowedChat(chatId) {
         if (!this.config.allowedChats?.includes(chatId)) {
             throw new Error('Telegram destination is not allowlisted');
         }
     }
-    async handleMessage(message) {
+    handleMessage(message) {
+        return this.trackIntake(() => this.handleMessageInput(message));
+    }
+    async handleMessageInput(message) {
         if (!message.chat || !message.from)
             return;
         const chatId = String(message.chat.id);
         const userId = String(message.from.id);
-        if (message.from.is_bot || !this.ownerAllowed(chatId, userId)) {
+        const principal = this.registry.resolveByExternal('telegram', 'private', userId);
+        const privateChat = message.chat.type === 'private';
+        const admitted = principal?.kind === 'member' &&
+            principal.status === 'active' &&
+            (privateChat || this.config.allowedChats?.includes(chatId));
+        if (message.from.is_bot || !admitted) {
+            if (principal?.status === 'suspended')
+                this.cancelMemberEnrollment(principal.principalId);
             const chatHash = (0, node_crypto_1.createHash)('sha256').update(`chat\0${chatId}`).digest('hex');
             const senderHash = (0, node_crypto_1.createHash)('sha256').update(`sender\0${userId}`).digest('hex');
             console.warn(`telegram message dropped reason=non_owner chat_hash=${chatHash} sender_hash=${senderHash}`);
             return;
         }
         if (message.users_shared) {
-            await this.completeMemberSelection(message);
+            // Enrollment can wait for running member turns. Let polling admit other updates while
+            // the host completion sends and records its own final receipt.
+            const completion = this.completeMemberSelection(message, principal.principalId).catch((error) => this.log(`telegram enrollment completion failed error=${telegramErrorMessage(error)}`));
+            this.enrollmentCompletions.add(completion);
+            void completion.finally(() => this.enrollmentCompletions.delete(completion));
+            return;
+        }
+        const principalId = principal.principalId;
+        const recorded = this.messageLedger.get(sourceMessageRef(chatId, message.message_id));
+        const memberRoom = !privateChat && (recorded ? recorded.principalId !== undefined : !this.ownerAllowed(userId));
+        const selectedIntake = () => privateChat || memberRoom
+            ? this.memberIntake(principalId, memberRoom ? chatId : undefined)
+            : this.intake;
+        const queued = (intake) => {
+            const selected = (0, telegram_text_entities_js_1.selectTelegramTextEntities)(message);
+            const files = (0, telegram_attachments_js_1.telegramFiles)(message);
+            if (!selected.text.trim() && files.length === 0)
+                return;
+            const ref = sourceMessageRef(chatId, message.message_id);
+            const claim = this.claimMessage(message, privateChat || memberRoom ? principalId : undefined);
+            this.pendingMemberIntakes.set(chatId, (this.pendingMemberIntakes.get(chatId) ?? 0) + 1);
+            void this.runInChatQueue(chatId, async () => {
+                const target = await Promise.race([
+                    Promise.resolve(intake ?? selectedIntake()),
+                    this.intakeStopped,
+                ]);
+                // The claimed inbound ledger already preserves this wait. Stop leaves it for startup
+                // interruption recovery rather than waiting for a directory/model slot to open.
+                if (!target || !this.accepting)
+                    return;
+                await this.acceptMessage(message, principalId, target, claim.claimed ? ref : undefined);
+            })
+                .catch((error) => {
+                this.lastError = telegramErrorMessage(error);
+                this.log(`telegram deferred intake failed error=${this.lastError}`);
+            })
+                .finally(() => {
+                const pending = this.pendingMemberIntakes.get(chatId) - 1;
+                if (pending)
+                    this.pendingMemberIntakes.set(chatId, pending);
+                else
+                    this.pendingMemberIntakes.delete(chatId);
+            });
+        };
+        // While an intake for this chat waits, every later message queues behind it, whichever
+        // session it selects, so the group's order holds.
+        if (this.pendingMemberIntakes.has(chatId)) {
+            queued();
+            return;
+        }
+        const intake = selectedIntake();
+        if ('then' in intake) {
+            queued(intake);
+            return;
+        }
+        await this.acceptMessage(message, principalId, intake);
+    }
+    async acceptMessage(message, principalId, intake, queuedClaim) {
+        const chatId = String(message.chat.id);
+        const privateChat = message.chat.type === 'private';
+        const principal = this.registry.resolveByExternal('telegram', 'private', String(message.from.id));
+        if (principal?.principalId !== principalId || principal.status !== 'active') {
+            const chatHash = (0, node_crypto_1.createHash)('sha256').update(`chat\0${chatId}`).digest('hex');
+            const senderHash = (0, node_crypto_1.createHash)('sha256').update(`sender\0${message.from.id}`).digest('hex');
+            console.warn(`telegram message dropped reason=principal_inactive chat_hash=${chatHash} sender_hash=${senderHash}`);
             return;
         }
         const ref = sourceMessageRef(chatId, message.message_id);
@@ -477,11 +641,10 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         }
         if (durable?.state === 'processing' && this.activePresenters.has(ref))
             return;
-        if (durable?.state === 'processing' && this.intake.isPending?.(ref))
+        if (durable?.state === 'processing' && intake.isPending?.(ref))
             return;
-        if (durable?.state === 'processing') {
-            this.messageLedger.markInterrupted(ref, this.interruptedNotice, 'html-v1');
-            await this.deliverReadyEntry(ref);
+        if (durable?.state === 'processing' && queuedClaim !== ref) {
+            await this.interruptResponse(ref);
             return;
         }
         const selected = (0, telegram_text_entities_js_1.selectTelegramTextEntities)(message);
@@ -489,13 +652,23 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         if (!selected.text.trim() && files.length === 0)
             return;
         const formatting = (0, telegram_text_entities_js_1.captureTelegramTextFormatting)(selected.field, selected.text, selected.entities);
-        const inputIdentity = (0, node_crypto_1.createHash)('sha256')
-            .update(`${selected.text}\0${files.map(({ file }) => file.file_unique_id).join(',')}`)
-            .digest('hex');
-        const ledgerEntry = this.messageLedger.claim(ref, {
-            deliveryTarget: `telegram:${chatId}`,
-            payloadIdentity: inputIdentity,
-        }).entry;
+        const memberRoom = !privateChat &&
+            (durable ? durable.principalId !== undefined : !(0, owner_authority_js_1.holdsOwnerRole)(this.registry, principalId));
+        const ledgerEntry = this.claimMessage(message, privateChat || memberRoom ? principalId : undefined).entry;
+        if (intake.deferIncoming?.()) {
+            intake.acceptOwnerMessage({
+                id: ref,
+                channelKey: chatId,
+                senderPrincipalId: principalId,
+                occurredAt: message.date * 1000,
+                text: selected.text,
+                payload: { pendingTelegramMessage: JSON.parse(JSON.stringify(message)) },
+            });
+            const pendingPresenter = this.createResponsePresenter(ref, Number(message.chat.id));
+            this.activePresenters.set(ref, pendingPresenter);
+            await pendingPresenter.start();
+            return;
+        }
         const presenter = this.createResponsePresenter(ref, Number(message.chat.id));
         this.activePresenters.set(ref, presenter);
         try {
@@ -504,12 +677,16 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             const attachments = await (0, telegram_attachments_js_1.downloadTelegramFiles)(files, {
                 api: this.bot.api,
                 token: this.token,
-                downloadsDir: this.downloadsDir,
+                downloadsDir: privateChat || memberRoom
+                    ? this.principalPaths(principal.principalId, memberRoom ? chatId : undefined)
+                        .downloadsDir
+                    : this.downloadsDir,
                 messageId: message.message_id,
             });
             const input = {
                 id: ref,
                 channelKey: chatId,
+                senderPrincipalId: principal.principalId,
                 occurredAt: message.date * 1000,
                 text: selected.text.trim()
                     ? selected.text
@@ -523,7 +700,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                         },
                     }),
             };
-            this.intake.acceptOwnerMessage(input);
+            intake.acceptOwnerMessage(input);
             this.emitEvent({
                 type: 'message_received',
                 source: 'telegram',
@@ -536,6 +713,48 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             throw error;
         }
     }
+    /** Host preparation of a transport-verified envelope accepted while the member was retired. */
+    async prepareDeferredMemberInput(principalId, input) {
+        const payload = input.payload;
+        const message = payload.pendingTelegramMessage;
+        const person = this.registry.resolveByExternal('telegram', 'private', String(message.from.id));
+        if (person?.principalId !== principalId ||
+            person.status !== 'active' ||
+            sourceMessageRef(String(message.chat.id), message.message_id) !== input.id)
+            throw new Error('Deferred Telegram input does not belong to this active person');
+        const selected = (0, telegram_text_entities_js_1.selectTelegramTextEntities)(message);
+        const formatting = (0, telegram_text_entities_js_1.captureTelegramTextFormatting)(selected.field, selected.text, selected.entities);
+        const attachments = await (0, telegram_attachments_js_1.downloadTelegramFiles)((0, telegram_attachments_js_1.telegramFiles)(message), {
+            api: this.bot.api,
+            token: this.token,
+            // A member's room message downloads into that room session's paths.
+            downloadsDir: this.principalPaths(principalId, message.chat.type === 'private' ? undefined : String(message.chat.id)).downloadsDir,
+            messageId: message.message_id,
+        });
+        return {
+            ...input,
+            text: selected.text.trim()
+                ? selected.text
+                : attachments.map(({ name }) => `[file: ${name}]`).join('\n'),
+            payload: {
+                ...(formatting === undefined ? {} : { telegramFormatting: formatting }),
+                ...(attachments.length ? { attachments } : {}),
+            },
+        };
+    }
+    claimMessage(message, principalId) {
+        const selected = (0, telegram_text_entities_js_1.selectTelegramTextEntities)(message);
+        const files = (0, telegram_attachments_js_1.telegramFiles)(message);
+        const inputIdentity = (0, node_crypto_1.createHash)('sha256')
+            .update(`${selected.text}\0${files.map(({ file }) => file.file_unique_id).join(',')}`)
+            .digest('hex');
+        const chatId = String(message.chat.id);
+        return this.messageLedger.claim(sourceMessageRef(chatId, message.message_id), {
+            deliveryTarget: `telegram:${chatId}`,
+            payloadIdentity: inputIdentity,
+            ...(principalId === undefined ? {} : { principalId }),
+        });
+    }
     createResponsePresenter(sourceRef, chatId) {
         if (!this.bot)
             throw new Error('Telegram gateway not connected');
@@ -571,6 +790,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                 return;
             if (current.deliveryUncertain)
                 throw new Error('Telegram response delivery is uncertain');
+            const intake = await this.responseIntake(sourceRef);
             const presenter = this.activePresenters.get(sourceRef) ?? this.createResponsePresenter(sourceRef, chatId);
             try {
                 await presenter.finalize(current.response);
@@ -583,8 +803,13 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             if (current.responseAuthor === undefined) {
                 this.log(`telegram reply archive skipped key=${sourceRef} reason=missing_response_author`);
             }
+            else if (current.responseAuthor === 'host' &&
+                intake.hasOwnerMessage?.(sourceRef) === false) {
+                // An intake interrupted before storage has no original to attach its notice to.
+                this.log(`telegram reply archive skipped key=${sourceRef} reason=missing_owner_message`);
+            }
             else {
-                this.intake.recordOwnerReply({
+                intake.recordOwnerReply({
                     messageRef: sourceRef,
                     text: current.response,
                     occurredAt: this.messageLedger.get(sourceRef).updatedAt,
@@ -600,7 +825,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                 timestamp: new Date(),
                 data: { sourceMessageRef: sourceRef },
             });
-        });
+        }, true);
     }
     async recoverPendingResponses() {
         for (const entry of this.messageLedger.listUndelivered()) {
@@ -610,27 +835,31 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                     continue;
                 }
                 if (entry.key.startsWith('outbound:') && entry.state === 'ready') {
+                    // Personal turn recovery belongs to mailbox reconciliation, which checks the current person
+                    // and input before sending. Gateway startup cannot establish that authority.
+                    if (entry.idempotencyKey && (0, personal_turns_js_1.isPersonalTurnTextKey)(entry.idempotencyKey))
+                        continue;
                     const chatId = entry.deliveryTarget?.slice('telegram:'.length);
                     if (!entry.deliveryTarget?.startsWith('telegram:') || !chatId) {
                         throw new Error('Telegram outbound entry has no valid destination');
                     }
-                    if (!this.config.allowedChats?.includes(chatId))
-                        continue;
+                    if (!this.config.allowedChats?.includes(chatId)) {
+                        const recipient = this.registry.resolveByExternal('telegram', 'private', chatId);
+                        if (recipient?.kind !== 'member' || recipient.status !== 'active')
+                            continue;
+                    }
                     await this.runInChatQueue(chatId, () => this.deliverOutboundEntry(entry.key, chatId));
                     continue;
                 }
                 if (!entry.key.startsWith('telegram:'))
                     continue;
-                const chatId = chatIdFromSourceMessageRef(entry.key);
-                if (!this.config.allowedChats?.includes(chatId))
-                    continue;
+                const intake = await this.responseIntake(entry.key);
                 if (entry.state === 'ready' && entry.response !== undefined) {
                     await this.deliverReadyEntry(entry.key);
                     continue;
                 }
-                if (entry.state === 'processing' && !this.intake.isPending?.(entry.key)) {
-                    this.messageLedger.markInterrupted(entry.key, this.interruptedNotice, 'html-v1');
-                    await this.deliverReadyEntry(entry.key);
+                if (entry.state === 'processing' && !intake.isPending?.(entry.key)) {
+                    await this.interruptResponse(entry.key);
                 }
             }
             catch (error) {
@@ -648,7 +877,7 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
                 await sendFormattedMessage(this.bot.api, Number(chatId), chunk);
             return;
         }
-        const key = outboundLedgerKey(idempotencyKey);
+        const key = (0, telegram_message_ledger_js_1.outboundLedgerKey)(idempotencyKey);
         const binding = {
             deliveryTarget: `telegram:${chatId}`,
             payloadIdentity: (0, node_crypto_1.createHash)('sha256').update(text).digest('hex'),
@@ -658,6 +887,9 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         const existing = this.messageLedger.claim(key, binding).entry;
         if (existing.state === 'delivered')
             return;
+        // Keep the rejection until the occurrence closes. A restart in between must not send it.
+        if ((0, personal_turns_js_1.isPersonalTurnTextKey)(idempotencyKey) && existing.state === 'failed')
+            throw new telegram_errors_js_1.TelegramJobDeliveryRejected('Personal job DM delivery was already rejected');
         if (existing.state !== 'ready')
             this.messageLedger.markReady(key, text, 'html-v1');
         await this.deliverOutboundEntry(key, chatId);
@@ -688,7 +920,11 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
             }
             catch (error) {
                 if ((0, telegram_errors_js_1.isDefinitiveTelegramRejection)(error)) {
-                    this.messageLedger.markDeliveryProgress(key, index, false);
+                    // A personal turn refusal is final. Never persist a retryable ready receipt before its failure.
+                    if (entry.idempotencyKey && (0, personal_turns_js_1.isPersonalTurnTextKey)(entry.idempotencyKey))
+                        this.messageLedger.markFailed(key);
+                    else
+                        this.messageLedger.markDeliveryProgress(key, index, false);
                 }
                 throw error;
             }
@@ -707,12 +943,14 @@ class TelegramGateway extends base_gateway_js_1.BaseGateway {
         });
         const current = (previous ?? Promise.resolve()).catch(() => { }).then(() => gate);
         this.chatTails.set(chatId, current);
+        const context = { chatId, active: true };
         try {
             if (previous)
                 await previous.catch(() => { });
-            return await this.activeChat.run({ chatId, active: true }, work);
+            return await this.activeChat.run(context, work);
         }
         finally {
+            context.active = false;
             release();
             if (this.chatTails.get(chatId) === current)
                 this.chatTails.delete(chatId);