@llblab/pi-kit 0.19.2 → 0.21.0

package/node_modules/@llblab/pi-telegram/dist/lib/threads.js

@@ -11,7 +11,7 @@ import { isDeepStrictEqual } from "node:util";
 import { isTelegramApiCommitUnknownError, TelegramApiCommitUnknownError, } from "./telegram-api.js";
 import { withTelegramFileTransaction } from "./locks.js";
 import * as ThreadReconciler from "./thread-reconciler.js";
-import { planTelegramWorkspaceSlotAllocation, TELEGRAM_WORKSPACE_SLOTS, } from "./workspace-slots.js";
+import { planTelegramWorkspaceSlotAllocation, TELEGRAM_WORKSPACE_SLOTS, TelegramWorkspaceSlotUnavailableError, } from "./workspace-slots.js";
 import { resolveAgentDir, resolveTelegramProfileTempFilePath, } from "./paths.js";
 const TELEGRAM_WORKSPACE_KEY_MAX_LENGTH = 180;
 const TELEGRAM_SESSION_ID_MAX_LENGTH = 256;
@@ -1301,19 +1301,31 @@ export function createTelegramTopicTargetStore(options) {
         dirty = true;
         mutationRevision += 1;
     };
-    const persistSnapshot = (invalidation) => {
+    const markWorkspaceBindingInactiveByTarget = (target, inactiveSinceMs = getNowMs()) => {
+        if (!Number.isFinite(inactiveSinceMs) || inactiveSinceMs < 0)
+            return false;
+        for (const [key, binding] of workspaceBindings) {
+            if (!targetMatches(binding.target, target) || binding.inactiveSinceMs !== undefined)
+                continue;
+            workspaceBindings.set(key, { ...binding, inactiveSinceMs });
+            markDirty();
+            return true;
+        }
+        return false;
+    };
+    const persistSnapshot = (transition) => {
         const persist = persistQueue.then(async () => {
             const path = getPath();
             if (loadedPath !== path && !dirty)
                 resetForPath(path);
             if (options.canPersist && !options.canPersist()) {
-                if (!invalidation)
+                if (!transition)
                     await loadFromDisk();
                 return false;
             }
             if (!dirty || !loaded)
                 await loadFromDisk();
-            if (invalidation && !invalidation.isCurrent())
+            if (transition && !transition.isCurrent())
                 return false;
             const nowMs = getNowMs();
             reservations = reservations.filter((reservation) => reservation.expiresAtMs === undefined ||
@@ -1322,6 +1334,11 @@ export function createTelegramTopicTargetStore(options) {
             const currentRecords = Array.from(records.values())
                 .filter(isPersistedThreadRecord)
                 .map(cloneRecord);
+            if (transition?.kind === "detach") {
+                const owners = currentRecords.filter((record) => targetMatches(record.target, transition.target));
+                if (owners.length !== 1 || !isDeepStrictEqual(normalizeRecord(owners[0]), transition.owner))
+                    return false;
+            }
             records = new Map(currentRecords.map((record) => [
                 getRecordOwnerKey(record),
                 cloneRecord(record),
@@ -1358,21 +1375,34 @@ export function createTelegramTopicTargetStore(options) {
                     return serialized;
                 }),
             };
-            if (invalidation) {
-                const record = file.threads.find((record) => targetMatches(record.target, invalidation.target));
+            if (transition) {
+                const record = file.threads.find((record) => targetMatches(record.target, transition.target));
                 if (!record)
                     return false;
+                if (transition.kind === "detach") {
+                    const bindings = file.workspaceBindings.filter((binding) => targetMatches(binding.target, record.target));
+                    if (bindings.length !== 1 || !/^[A-Z]$/.test(record.slot ?? "") ||
+                        bindings[0].slot !== record.slot)
+                        return false;
+                }
                 file.threads = file.threads.filter((candidate) => candidate !== record);
-                file.syncObservations = file.syncObservations.filter((observation) => !targetMatches(observation.target, record.target));
-                file.syncObservations.push({
-                    target: { ...record.target },
-                    syncStatus: "deleted",
-                    observedAtMs: nowMs,
-                    ...(record.instanceId ? { instanceId: record.instanceId } : {}),
-                    ...(record.slot ? { slot: record.slot } : {}),
-                    lastSyncError: invalidation.lastSyncError,
-                    lastReconcileAction: "mark-stale",
-                });
+                for (const binding of file.workspaceBindings) {
+                    if (targetMatches(binding.target, transition.target) && binding.inactiveSinceMs === undefined) {
+                        binding.inactiveSinceMs = nowMs;
+                    }
+                }
+                if (transition.kind === "invalidate") {
+                    file.syncObservations = file.syncObservations.filter((observation) => !targetMatches(observation.target, record.target));
+                    file.syncObservations.push({
+                        target: { ...record.target },
+                        syncStatus: "deleted",
+                        observedAtMs: nowMs,
+                        ...(record.instanceId ? { instanceId: record.instanceId } : {}),
+                        ...(record.slot ? { slot: record.slot } : {}),
+                        lastSyncError: transition.lastSyncError,
+                        lastReconcileAction: "mark-stale",
+                    });
+                }
             }
             let persistedSemanticSnapshot;
             try {
@@ -1382,7 +1412,7 @@ export function createTelegramTopicTargetStore(options) {
                 /* missing or invalid snapshots must be replaced */
             }
             // Normalize optional fields to wire JSON; object key order is not a state change.
-            if (isDeepStrictEqual(persistedSemanticSnapshot, getTelegramStateSemanticSnapshot(JSON.parse(JSON.stringify(file)))) &&
+            if (!transition && isDeepStrictEqual(persistedSemanticSnapshot, getTelegramStateSemanticSnapshot(JSON.parse(JSON.stringify(file)))) &&
                 mutationRevision === persistedRevision &&
                 statusRevision === persistedStatusRevision) {
                 loadedPath = path;
@@ -1398,18 +1428,21 @@ export function createTelegramTopicTargetStore(options) {
             });
             await chmod(tempPath, 0o600);
             try {
-                if (invalidation) {
+                if (transition) {
                     let applied = false;
                     const commit = () => {
                         if (getPath() !== path || mutationRevision !== persistedRevision ||
-                            statusRevision !== persistedStatusRevision || !invalidation.isCurrent())
+                            statusRevision !== persistedStatusRevision || !transition.isCurrent())
                             return;
                         // Fence and rename share one synchronous commit boundary. No stale
-                        // invalidation enters the live projection before durable commit.
+                        // transition enters the live projection before durable commit.
                         renameSync(tempPath, path);
                         loadedPath = path;
-                        records = new Map(Array.from(records).filter(([, record]) => !targetMatches(record.target, invalidation.target)));
+                        records = new Map(Array.from(records).filter(([, record]) => !targetMatches(record.target, transition.target)));
                         syncObservations = file.syncObservations;
+                        workspaceBindings = new Map(file.workspaceBindings.map((binding) => [
+                            getWorkspaceBindingMapKey(binding), cloneWorkspaceBinding(binding),
+                        ]));
                         mutationRevision += 1;
                         dirty = false;
                         applied = true;
@@ -1465,7 +1498,13 @@ export function createTelegramTopicTargetStore(options) {
             await persistSnapshot();
         },
         invalidateTarget(target, isCurrent, lastSyncError) {
-            return persistSnapshot({ target, isCurrent, lastSyncError });
+            return persistSnapshot({ kind: "invalidate", target, isCurrent, lastSyncError });
+        },
+        detachTargetOwner(expected, isCurrent) {
+            const owner = normalizeRecord(expected);
+            if (!owner)
+                return Promise.resolve(false);
+            return persistSnapshot({ kind: "detach", owner, target: owner.target, isCurrent });
         },
         list() {
             return Array.from(records.values()).map(cloneRecord);
@@ -1994,18 +2033,7 @@ export function createTelegramTopicTargetStore(options) {
             markDirty();
             return true;
         },
-        markWorkspaceBindingInactiveByTarget(target, inactiveSinceMs = getNowMs()) {
-            if (!Number.isFinite(inactiveSinceMs) || inactiveSinceMs < 0)
-                return false;
-            for (const [key, binding] of workspaceBindings) {
-                if (!targetMatches(binding.target, target) || binding.inactiveSinceMs !== undefined)
-                    continue;
-                workspaceBindings.set(key, { ...binding, inactiveSinceMs });
-                markDirty();
-                return true;
-            }
-            return false;
-        },
+        markWorkspaceBindingInactiveByTarget,
         markWorkspaceBindingActiveByTarget(target) {
             if (hasWorkspaceRetirementConflict({ target }))
                 return false;
@@ -2419,8 +2447,11 @@ export function createTelegramTopicTargetStore(options) {
             const record = Array.from(records.values()).find((entry) => targetMatches(entry.target, target));
             const pending = syncStatus === "deleted" ? pendingProvisions.find((entry) => entry.target && targetMatches(entry.target, target)) : undefined;
             const source = record ?? pending;
+            // Confirmed absence ends this binding's active target lifetime, even after
+            // an earlier stale observation already removed its live record.
+            const inactive = syncStatus === "deleted" && markWorkspaceBindingInactiveByTarget(target);
             if (!source?.target)
-                return false;
+                return inactive;
             syncObservations = syncObservations.filter((entry) => !targetMatches(entry.target, target));
             syncObservations.push({
                 target: { ...source.target }, syncStatus, observedAtMs: getNowMs(),
@@ -3576,7 +3607,7 @@ export function createTelegramTopicTargetProvisioner(deps) {
         if (existing && isCurrentThreadRecord(existing)) {
             const slot = existing.slot ?? deps.store.allocateSlot(request.profileKey);
             if (!slot) {
-                throw new Error("Telegram Workspace slot reservation is unavailable.");
+                throw new TelegramWorkspaceSlotUnavailableError();
             }
             const occupied = listOccupiedTelegramThreadIdentities({
                 records: deps.store.list(),
@@ -3691,7 +3722,7 @@ export function createTelegramTopicTargetProvisioner(deps) {
                     (candidateThreadName ? undefined : identity?.slot) ??
                     preferredNameSlot), request.workspaceBindingKey);
         if (!slot) {
-            throw new Error("Telegram Workspace slot reservation is unavailable.");
+            throw new TelegramWorkspaceSlotUnavailableError();
         }
         const uniqueCandidate = candidateThreadName &&
             isTelegramTopicThreadNameValidForSlot(candidateThreadName, slot) &&

package/node_modules/@llblab/pi-telegram/dist/lib/updates.d.ts

@@ -441,6 +441,8 @@ export interface TelegramUpdateWorkerJournalSnapshot {
 }
 export interface TelegramUpdateWorkerJournalPort {
     read: () => TelegramUpdateWorkerJournalSnapshot;
+    /** Optional strict observation; it must not recover, repair or grant new receipt authority. */
+    isQueueReceiptCurrent?: (receipt: TelegramQueueAdmissionReceiptLike, owner: TelegramUpdateJournalQueueOwner) => boolean;
     markQueued: (receipt: {
         queueKind: "prompt" | "control";
         receiptId: string;
@@ -527,7 +529,7 @@ export interface TelegramUpdateWorkerRuntime<TContext> {
         receipts: readonly TelegramQueueAdmissionReceiptLike[];
         ctx: TContext;
         reason: TelegramQueueReceiptCompletionReason;
-    }) => void;
+    }) => boolean;
     stop: () => Promise<void>;
     waitForDrain: () => Promise<void>;
     getState: () => TelegramUpdateWorkerStateSnapshot;
@@ -1000,9 +1002,9 @@ export interface TelegramQueueAdmissionItemLike {
 export interface TelegramQueueAdmissionSettlementRuntime<TContext> {
     isItemReady: (item: TelegramQueueAdmissionItemLike) => boolean;
     getQueueReceiptOwner: (receipt: TelegramQueueAdmissionReceiptLike) => TelegramUpdateJournalQueueOwner | undefined;
-    onPromptHandedOff: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => void;
-    onControlSettled: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => void;
-    onItemsDiscarded: (items: readonly TelegramQueueAdmissionItemLike[], ctx: TContext) => void;
+    onPromptHandedOff: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => boolean;
+    onControlSettled: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => boolean;
+    onItemsDiscarded: (items: readonly TelegramQueueAdmissionItemLike[], ctx: TContext) => boolean;
 }
 export declare function createTelegramQueueAdmissionSettlementMuxRuntime<TContext>(runtimes: readonly TelegramQueueAdmissionSettlementRuntime<TContext>[]): TelegramQueueAdmissionSettlementRuntime<TContext>;
 export declare function createTelegramQueueAdmissionSettlementRuntime<TContext>(worker: TelegramUpdateWorkerRuntime<TContext>): TelegramQueueAdmissionSettlementRuntime<TContext>;

package/node_modules/@llblab/pi-telegram/dist/lib/updates.js

@@ -303,10 +303,10 @@ export function reportTelegramQueueAdmission(values, receipts) {
     return true;
 }
 export function buildTelegramUpdateFlowAction(update, allowedUserId) {
-    const deletedMessageIds = extractDeletedTelegramMessageIds(update);
-    if (deletedMessageIds.length > 0) {
-        return { kind: "deleted", messageIds: deletedMessageIds };
-    }
+    // Business chats are independent from bot chats even when chat/message IDs coincide.
+    // Raw handlers may own that namespace; the default DM runtime has no deletion authority.
+    if (update.deleted_business_messages !== undefined)
+        return { kind: "ignore" };
     if (update.message_reaction) {
         return { kind: "reaction", reactionUpdate: update.message_reaction };
     }
@@ -1017,6 +1017,22 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         }
         return true;
     };
+    const getCurrentQueueReceipt = (receipt) => {
+        const committed = committedQueueReceipts.get(receipt.receiptId);
+        if (!committed || !areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt)))
+            return undefined;
+        try {
+            if (deps.journal.isQueueReceiptCurrent &&
+                deps.journal.isQueueReceiptCurrent(committed.receipt, committed.queueOwner) !== true) {
+                return undefined;
+            }
+        }
+        catch (error) {
+            recordRuntimeEvent(error, { phase: "queue-receipt-observation" });
+            return undefined;
+        }
+        return committed;
+    };
     const clearRetryTimer = () => {
         if (retryTimer !== undefined)
             cancelRetry(retryTimer);
@@ -1581,11 +1597,9 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 owner === expectedOwner &&
                 !expectedOwner.controller.signal.aborted) {
                 pendingSignal = false;
-                const result = await drain(expectedOwner);
-                if (result !== "idle") {
-                    pendingSignal = false;
-                    return;
-                }
+                // Keep newer wakes in this run so waitForDrain also covers them. A failure
+                // observed after signal() still keeps its latch; this loop never clears it.
+                await drain(expectedOwner);
             }
         };
         const operation = run();
@@ -1785,27 +1799,20 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             }
             transition("queued", input.updateId);
         },
-        isQueueReceiptCommitted(receipt) {
-            const committed = committedQueueReceipts.get(receipt.receiptId);
-            return (committed !== undefined &&
-                areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt)));
-        },
+        isQueueReceiptCommitted: receipt => getCurrentQueueReceipt(receipt) !== undefined,
         getQueueReceiptOwner(receipt) {
-            const committed = committedQueueReceipts.get(receipt.receiptId);
-            return committed &&
-                areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt))
-                ? { ...committed.queueOwner }
-                : undefined;
+            const committed = getCurrentQueueReceipt(receipt);
+            return committed ? { ...committed.queueOwner } : undefined;
         },
         completeQueueReceipts(input) {
             const expectedOwner = owner;
             if (!expectedOwner ||
                 expectedOwner.controller.signal.aborted ||
                 !(deps.isContextCurrent?.(input.ctx) ?? expectedOwner.ctx === input.ctx)) {
-                return;
+                return false;
             }
             if (input.receipts.length === 0)
-                return;
+                return true;
             const normalizedReceipts = input.receipts.map(normalizeQueueReceipt);
             const receiptIds = new Set();
             const sourceUpdateIds = new Set();
@@ -1813,13 +1820,13 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             for (const receipt of normalizedReceipts) {
                 const committed = committedQueueReceipts.get(receipt.receiptId);
                 if (!committed)
-                    continue;
+                    return false;
                 if (receiptIds.has(receipt.receiptId) ||
                     !areTelegramQueueAdmissionReceiptsEqual(committed.receipt, receipt) ||
                     !isTelegramUpdateJournalQueueOwnerProcess(committed.queueOwner, expectedOwner.queueOwnerIdentity) ||
                     receipt.sourceUpdateIds.some((updateId) => sourceUpdateIds.has(updateId))) {
                     blockWithFailure("invalid-outcome", "queue-receipt-completion-invalid", new TelegramUpdateAdmissionOutcomeError(`Telegram ${input.reason} requested invalid queue receipt ${receipt.receiptId}.`));
-                    return;
+                    return false;
                 }
                 receiptIds.add(receipt.receiptId);
                 queuedCompletions.push({
@@ -1830,22 +1837,23 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     sourceUpdateIds.add(updateId);
                 }
             }
-            if (receiptIds.size === 0)
-                return;
             let removedUpdateIds;
             try {
                 removedUpdateIds = deps.journal.completeQueued(queuedCompletions).removedUpdateIds;
             }
             catch (error) {
                 blockWithFailure("journal-write", "queue-receipt-completion", error);
-                return;
+                return false;
             }
             const removed = new Set(removedUpdateIds);
             if (removed.size !== sourceUpdateIds.size ||
                 [...sourceUpdateIds].some((updateId) => !removed.has(updateId))) {
                 blockWithFailure("journal-write", "queue-receipt-completion", new Error(`Telegram ${input.reason} did not complete every receipt source.`));
-                return;
+                return false;
             }
+            input.receipts.forEach((receipt, index) => {
+                acknowledgedQueueReceiptCompletions.set(receipt, normalizedReceipts[index]);
+            });
             for (const updateId of sourceUpdateIds)
                 claims.delete(updateId);
             for (const receiptId of receiptIds) {
@@ -1859,6 +1867,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             notifyStateChange();
             pendingSignal = true;
             launchDrain();
+            return true;
         },
         async stop() {
             const expectedOwner = owner;
@@ -2023,9 +2032,17 @@ export function createTelegramInputCustodyWorkerJournalPort(store) {
     };
     return {
         read: () => store.read(),
+        isQueueReceiptCurrent(receipt, owner) {
+            const entries = store.read().entries.filter(entry => entry.queueReceiptId === receipt.receiptId);
+            return receipt.sourceUpdateIds.length > 0 && entries.length === receipt.sourceUpdateIds.length &&
+                entries.every((entry, index) => entry.updateId === receipt.sourceUpdateIds[index] &&
+                    entry.state === "queued" && entry.queueKind === receipt.queueKind && !entry.queueHandoff &&
+                    entry.queueOwner !== undefined && areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, owner));
+        },
         markQueued: legacyMutation,
         markExecutionFailure: legacyMutation,
-        removeCompleted: legacyMutation,
+        // The common drain batches excluded IDs here; the store rejects all non-vetoed input atomically.
+        removeCompleted: updateIds => store.removeExcluded(updateIds),
         completeQueued: receipts => store.completeQueued(receipts),
         inputCustody: {
             acquireInput: store.acquireInput,
@@ -2620,6 +2637,8 @@ export function createTelegramInputCustodyActivationReadinessResolver(deps) {
     };
 }
 export function createTelegramInputCustodyLifecycleBindingResolver(deps) {
+    // Stable per store, not per descriptor: a renewed source has new captured worker ports.
+    const ports = new WeakMap();
     return () => {
         if (!deps.isEnabled())
             return undefined;
@@ -2627,7 +2646,11 @@ export function createTelegramInputCustodyLifecycleBindingResolver(deps) {
         const recipientBindingKey = deps.getRecipientBindingKey()?.trim();
         if (!source || !source.runtimeKey || !source.recoveryKey || !recipientBindingKey)
             return undefined;
-        const port = createTelegramInputCustodyWorkerJournalPort(source.journal);
+        let port = ports.get(source.journal);
+        if (!port) {
+            port = createTelegramInputCustodyWorkerJournalPort(source.journal);
+            ports.set(source.journal, port);
+        }
         return { runtimeKey: JSON.stringify({ source: source.runtimeKey, recipientBindingKey }),
             recoveryKey: source.recoveryKey,
             recipientBindingKey, journal: { ...port, appendBatch: source.journal.appendBatch,
@@ -2757,6 +2780,7 @@ export function createTelegramUpdateAdmissionHandle(deps) {
         try {
             execution.assertCurrent();
             await deps.defaultHandle(boundUpdate, ctx, execution);
+            execution.assertCurrent();
         }
         finally {
             immediate = false;
@@ -2778,10 +2802,45 @@ export function createTelegramCustodiedUpdateAdmissionHandle(deps) {
     });
     return (update, ctx, signal) => session.execute(update, started => admission(started, ctx, signal));
 }
+// A dispatched prompt can remain in memory until agent_start. Remember only acknowledged
+// removal of these exact receipt objects for later local discard, never for dispatch/replay.
+const acknowledgedQueueReceiptCompletions = new WeakMap();
+const isQueueReceiptCompletionAcknowledged = (receipt) => {
+    const acknowledged = acknowledgedQueueReceiptCompletions.get(receipt);
+    return acknowledged !== undefined && areTelegramQueueAdmissionReceiptsEqual(acknowledged, receipt);
+};
 export function createTelegramQueueAdmissionSettlementMuxRuntime(runtimes) {
-    const settle = (operation) => {
-        for (const runtime of runtimes)
-            operation(runtime);
+    // Plan the whole request before mutation; unready is not an acknowledgement of completion.
+    const complete = (items, ctx, kind) => {
+        const plan = new Map();
+        for (const receipt of items.flatMap(item => item.admissionReceipts ?? [])) {
+            if (kind === "discard" && isQueueReceiptCompletionAcknowledged(receipt))
+                continue;
+            const candidates = runtimes.filter(runtime => runtime.isItemReady({ admissionReceipts: [receipt] }));
+            const selected = candidates[0];
+            if (!selected)
+                return false;
+            if (candidates.length > 1) {
+                const owner = selected.getQueueReceiptOwner(receipt);
+                if (!owner || candidates.some(runtime => {
+                    const candidate = runtime.getQueueReceiptOwner(receipt);
+                    return !candidate || !areTelegramUpdateJournalQueueOwnersEqual(owner, candidate);
+                }))
+                    return false;
+            }
+            const receipts = plan.get(selected) ?? [];
+            receipts.push(receipt);
+            plan.set(selected, receipts);
+        }
+        for (const [runtime, receipts] of plan) {
+            const item = { admissionReceipts: receipts };
+            const completed = kind === "discard" ? runtime.onItemsDiscarded([item], ctx)
+                : kind === "prompt" ? runtime.onPromptHandedOff(item, ctx)
+                    : runtime.onControlSettled(item, ctx);
+            if (completed !== true)
+                return false;
+        }
+        return true;
     };
     return {
         isItemReady: (item) => (item.admissionReceipts ?? []).every((receipt) => runtimes.some((runtime) => runtime.isItemReady({ admissionReceipts: [receipt] }))),
@@ -2799,19 +2858,21 @@ export function createTelegramQueueAdmissionSettlementMuxRuntime(runtimes) {
             }
             return owner ? { ...owner } : undefined;
         },
-        onPromptHandedOff: (item, ctx) => settle((runtime) => runtime.onPromptHandedOff(item, ctx)),
-        onControlSettled: (item, ctx) => settle((runtime) => runtime.onControlSettled(item, ctx)),
-        onItemsDiscarded: (items, ctx) => settle((runtime) => runtime.onItemsDiscarded(items, ctx)),
+        onPromptHandedOff: (item, ctx) => complete([item], ctx, "prompt"),
+        onControlSettled: (item, ctx) => complete([item], ctx, "control"),
+        onItemsDiscarded: (items, ctx) => complete(items, ctx, "discard"),
     };
 }
 export function createTelegramQueueAdmissionSettlementRuntime(worker) {
     const complete = (items, ctx, reason) => {
         const receipts = [];
         for (const item of items) {
-            if (item.admissionReceipts)
-                receipts.push(...item.admissionReceipts);
+            for (const receipt of item.admissionReceipts ?? []) {
+                if (reason !== "discard" || !isQueueReceiptCompletionAcknowledged(receipt))
+                    receipts.push(receipt);
+            }
         }
-        worker.completeQueueReceipts({ receipts, ctx, reason });
+        return receipts.length === 0 || worker.completeQueueReceipts({ receipts, ctx, reason });
     };
     return {
         isItemReady: (item) => (item.admissionReceipts ?? []).every(worker.isQueueReceiptCommitted),
@@ -3065,10 +3126,6 @@ export function createTelegramQueueHandoffReconciler(deps) {
             const recipientJournalBindingKey = deps.createRecipientJournalBindingKey(recipient);
             if (!recipientJournalBindingKey)
                 continue;
-            const recipientItem = structuredClone(item);
-            recipientItem.admissionReceipts = [
-                { ...receipt, journalBindingKey: recipientJournalBindingKey },
-            ];
             const expectedOwner = deps.getReceiptOwner(receipt);
             const lifecycle = deps.getLifecycleForReceipt(receipt);
             if (!expectedOwner ||
@@ -3091,11 +3148,11 @@ export function createTelegramQueueHandoffReconciler(deps) {
                 },
                 handoffToken,
                 lifecycle,
-                stageRemote: async () => {
-                    const payload = createTelegramQueueHandoff({
-                        handoffToken,
-                        item: recipientItem,
-                    }).payload;
+                stageRemote: async ({ payload: sourcePayload }) => {
+                    const payload = {
+                        ...sourcePayload,
+                        admissionReceipts: [{ ...sourcePayload.admissionReceipts[0], journalBindingKey: recipientJournalBindingKey }],
+                    };
                     if (followerRegistered) {
                         return deps.stageThroughFollower({
                             recipient,
@@ -3244,11 +3301,27 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
     let activeRuntimeKey;
     let journal;
     let worker;
+    let workerInputCustody;
     let settlement;
     let journalBindingKey;
     let operation = Promise.resolve();
     let foreignQueueOwnerLiveness;
     let releaseSourceReference;
+    let sourceReferenceBinding;
+    const withRetainedSourceReference = (operation) => {
+        if (!journal || !worker)
+            throw new Error("Telegram update admission worker is not active.");
+        // Synchronous retained-source access needs a reference, not renewed execution authority.
+        const release = !releaseSourceReference && sourceReferenceBinding
+            ? deps.acquireSourceReference?.(sourceReferenceBinding) : undefined;
+        try {
+            return operation(journal);
+        }
+        finally {
+            release?.();
+        }
+    };
+    const readObservedJournal = () => withRetainedSourceReference(source => source.read());
     const stopCurrent = async (forget) => {
         await worker?.stop();
         const release = releaseSourceReference;
@@ -3261,8 +3334,10 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
         }
         if (!forget)
             return;
+        sourceReferenceBinding = undefined;
         journal = undefined;
         worker = undefined;
+        workerInputCustody = undefined;
         settlement = undefined;
         journalBindingKey = undefined;
         activeRuntimeKey = undefined;
@@ -3274,7 +3349,8 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
             await stopCurrent(true);
             return;
         }
-        if (replace || !worker || activeRuntimeKey !== binding.runtimeKey) {
+        if (replace || !worker || activeRuntimeKey !== binding.runtimeKey ||
+            workerInputCustody !== binding.journal.inputCustody) {
             const { runtimeKey, recoveryKey } = binding;
             await stopCurrent(true);
             binding = deps.resolveBinding();
@@ -3283,10 +3359,13 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
                 throw new Error("Telegram update source binding changed during startup.");
             }
             const release = deps.acquireSourceReference?.(binding);
+            const inputCustody = binding.journal.inputCustody;
             try {
                 journal = binding.journal;
                 worker = deps.createWorker(binding.journal, binding);
+                workerInputCustody = inputCustody;
                 settlement = createTelegramQueueAdmissionSettlementRuntime(worker);
+                sourceReferenceBinding = { ...binding, journal };
                 releaseSourceReference = release;
             }
             catch (error) {
@@ -3430,7 +3509,7 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
             if (!journal || !worker || !journal.cancelQueuedHandoff) {
                 throw new Error("Telegram update journal queue handoff cancellation is not available.");
             }
-            const result = journal.cancelQueuedHandoff(input);
+            const result = withRetainedSourceReference(source => source.cancelQueuedHandoff(input));
             worker.signal();
             return result;
         },
@@ -3468,18 +3547,12 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
             : undefined,
         ownsJournalBinding: (candidate) => journalBindingKey !== undefined && journalBindingKey === candidate,
         getForeignQueueOwnerLiveness: () => foreignQueueOwnerLiveness,
-        getJournalEntryCount() {
-            if (!journal || !worker) {
-                throw new Error("Telegram update admission worker is not active.");
-            }
-            return journal.read().entries.length;
-        },
+        getJournalEntryCount: () => readObservedJournal().entries.length,
         hasPendingQueueMutationForItem(item) {
             return Boolean(journal &&
                 worker &&
-                journal
-                    .read()
-                    .entries.some((entry) => entry.state !== "queued" &&
+                readObservedJournal().entries.some((entry) => entry.state !== "queued" &&
+                    entry.preApprovalExcluded !== true &&
                     isTelegramReactionDependencyForQueueItem(entry.update, item)));
         },
         signal: () => worker?.signal(),
@@ -3496,9 +3569,9 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
         },
         isItemReady: (item) => settlement?.isItemReady(item) ??
             (item.admissionReceipts?.length ?? 0) === 0,
-        onPromptHandedOff: (item, ctx) => settlement?.onPromptHandedOff(item, ctx),
-        onControlSettled: (item, ctx) => settlement?.onControlSettled(item, ctx),
-        onItemsDiscarded: (items, ctx) => settlement?.onItemsDiscarded(items, ctx),
+        onPromptHandedOff: (item, ctx) => settlement?.onPromptHandedOff(item, ctx) ?? false,
+        onControlSettled: (item, ctx) => settlement?.onControlSettled(item, ctx) ?? false,
+        onItemsDiscarded: (items, ctx) => settlement?.onItemsDiscarded(items, ctx) ?? false,
     };
 }
 /** Compose source-bound routing and late grouped settlement under one worker. */

package/node_modules/@llblab/pi-telegram/dist/lib/workspace-admission.d.ts

@@ -75,6 +75,11 @@ export type TelegramWorkspaceRetirementFence = (TelegramWorkspaceRetirementFence
 }) | (TelegramWorkspaceRetirementFenceBase & {
     phase: "deletion-issued";
     deletionIssuedAtMs: number;
+}) | (TelegramWorkspaceRetirementFenceBase & {
+    destructiveKind?: "pressure-retirement";
+    phase: "deletion-rejected";
+    deletionIssuedAtMs: number;
+    rejectionConfirmedAtMs: number;
 }) | (TelegramWorkspaceRetirementFenceBase & {
     phase: "commit-ready";
     absenceConfirmedAtMs: number;
@@ -215,6 +220,10 @@ export interface TelegramWorkspaceAdmissionLedger {
     issueThreadCleanupDeletionPermit: TelegramWorkspaceAdmissionLedger["issueDeletionPermit"];
     confirmRetirementAbsence: (expected: TelegramWorkspaceRetirementFence) => TelegramWorkspaceRetirementFence;
     confirmThreadCleanupAbsence: TelegramWorkspaceAdmissionLedger["confirmRetirementAbsence"];
+    /** Caller must have exact transport proof of rejection, never merely target presence. */
+    confirmRetirementRejection: (expected: TelegramWorkspaceRetirementFence) => TelegramWorkspaceRetirementFence;
+    /** Caller must first durably withdraw the exact rejected intent, retaining its binding. */
+    completeRejectedRetirementFence: (expected: TelegramWorkspaceRetirementFence) => boolean;
     releaseUnissuedRetirementFence: (expected: TelegramWorkspaceRetirementFence) => boolean;
     releaseUnissuedThreadCleanupFence: TelegramWorkspaceAdmissionLedger["releaseUnissuedRetirementFence"];
     completeRetirementFence: (expected: TelegramWorkspaceRetirementFence) => boolean;