@llblab/pi-kit 0.29.1 → 0.30.0

package/node_modules/@llblab/pi-telegram/dist/lib/journal.js

@@ -6,14 +6,14 @@
  * It does not own polling, update execution, queue admission, or follower routing.
  */
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { chmodSync, constants, closeSync, fstatSync, lstatSync, openSync, opendirSync, readSync, realpathSync, mkdirSync, readFileSync, readdirSync, rmdirSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { basename, dirname, join, resolve, relative, isAbsolute, sep } from "node:path";
+import { chmodSync, closeSync, fstatSync, lstatSync, mkdirSync, opendirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmdirSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import { renameTelegramPathWithRetry, withTelegramFileTransaction, } from "./locks.js";
-import { getTelegramProcessLiveness, } from "./bus.js";
+import { TELEGRAM_STRICT_READ_FLAGS, renameTelegramPathWithRetry, withTelegramFileTransaction, } from "./locks.js";
 import { decodeTelegramSessionDirectoryName, getTelegramProfilePathSuffix, TELEGRAM_DEFAULT_PROFILE_NAME, } from "./paths.js";
-import { runWithTelegramWorkspaceAdmissions, } from "./workspace-admission.js";
-import { isWireRecord as isRecord, hasOnlyWireKeys as hasOnlyKeys, isNonNegativeWireInteger as isSafeNonNegativeInteger, isNonEmptyWireString as isNonEmptyString, } from "./wire.js";
+import { getTelegramProcessLiveness, } from "./process-identity.js";
+import { hasOnlyWireKeys as hasOnlyKeys, isNonEmptyWireString as isNonEmptyString, isWireRecord as isRecord, isNonNegativeWireInteger as isSafeNonNegativeInteger, } from "./wire.js";
+import { getTelegramWorkspaceAdmissionScopeKey, runWithTelegramWorkspaceAdmissions, } from "./workspace-admission.js";
 export const TELEGRAM_UPDATE_JOURNAL_VERSION = 1;
 export const TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION = 2;
 export const TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION = 3;
@@ -105,13 +105,17 @@ export function discoverTelegramSessionJournalPaths(input) {
             return { paths: [], complete: false };
     }
     catch (error) {
-        return { paths: [], complete: error.code === "ENOENT" };
+        return {
+            paths: [],
+            complete: error.code === "ENOENT",
+        };
     }
     try {
         for (const session of scan(root)) {
             if (!complete)
                 break;
-            if (!session.isDirectory() || decodeTelegramSessionDirectoryName(session.name) === undefined) {
+            if (!session.isDirectory() ||
+                decodeTelegramSessionDirectoryName(session.name) === undefined) {
                 complete = false;
                 break;
             }
@@ -125,7 +129,8 @@ export function discoverTelegramSessionJournalPaths(input) {
                 if (!complete)
                     break;
                 // The leader polling journal and legacy recovery folders are not recipient custody.
-                if (entry.name === "recovery" || /^inbox(?:\.[a-zA-Z0-9._-]+)?\.json(?:\.segments|\.retained)?$/u.test(entry.name))
+                if (entry.name === "recovery" ||
+                    /^inbox(?:\.[a-zA-Z0-9._-]+)?\.json(?:\.segments|\.retained)?$/u.test(entry.name))
                     continue;
                 const match = /^journal\.([a-f0-9]{16})(\.[a-zA-Z0-9._-]+)?\.json(\.segments|\.retained)?$/u.exec(entry.name);
                 if (!match) {
@@ -133,7 +138,8 @@ export function discoverTelegramSessionJournalPaths(input) {
                     break;
                 }
                 const stat = lstatSync(join(directory, entry.name));
-                if (stat.isSymbolicLink() || (match[3] ? !stat.isDirectory() : !stat.isFile())) {
+                if (stat.isSymbolicLink() ||
+                    (match[3] ? !stat.isDirectory() : !stat.isFile())) {
                     complete = false;
                     break;
                 }
@@ -152,8 +158,10 @@ export function discoverTelegramSessionJournalPaths(input) {
 export function discoverTelegramRecipientJournalPaths(input) {
     const legacy = discoverTelegramFollowerJournalPaths(input);
     const sessions = discoverTelegramSessionJournalPaths(input);
-    return { paths: Array.from(new Set([...legacy.paths, ...sessions.paths])).sort(),
-        complete: legacy.complete && sessions.complete };
+    return {
+        paths: Array.from(new Set([...legacy.paths, ...sessions.paths])).sort(),
+        complete: legacy.complete && sessions.complete,
+    };
 }
 const TELEGRAM_UPDATE_JOURNAL_TERMINAL_REASON_MAX_LENGTH = 256;
 export const TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_COUNT = 256;
@@ -212,18 +220,11 @@ function getUpdateAdmissionScope(update) {
     if (payloadKey === "callback_query") {
         const query = update.callback_query;
         return isRecord(query)
-            ? getUpdateCarrierScope(query.message) ?? { kind: "profile" }
+            ? (getUpdateCarrierScope(query.message) ?? { kind: "profile" })
             : { kind: "profile" };
     }
     return { kind: "profile" };
 }
-function getWorkspaceAdmissionScopeKey(scope) {
-    if (scope.kind === "profile")
-        return "profile";
-    if (scope.kind === "chat")
-        return `chat:${scope.chatId}`;
-    return `target:${scope.target.chatId}:${scope.target.threadId}`;
-}
 export function getTelegramUpdateJournalAdmissionScopes(updates) {
     if (updates.length === 0)
         return [{ kind: "profile" }];
@@ -238,52 +239,148 @@ export function getTelegramUpdateJournalAdmissionScopes(updates) {
     for (const scope of scopes) {
         if (scope.kind === "target" && chatIds.has(scope.target.chatId))
             continue;
-        unique.set(getWorkspaceAdmissionScopeKey(scope), scope);
+        unique.set(getTelegramWorkspaceAdmissionScopeKey(scope), scope);
     }
     return Array.from(unique.entries())
         .sort(([left], [right]) => left.localeCompare(right))
         .map(([, scope]) => scope);
 }
 function listTelegramUpdateJournalLegacyCustodyCandidates(snapshot) {
-    return snapshot.entries.flatMap(entry => {
+    return snapshot.entries
+        .flatMap((entry) => {
         const evidence = createTelegramUpdateJournalLegacyCustodyEvidence(entry);
-        return evidence ? [{ updateId: evidence.updateId, state: evidence.state,
-                attemptCount: evidence.attemptCount, failureClass: evidence.failureClass,
-                evidenceSha256: evidence.evidenceSha256 }] : [];
-    }).sort((left, right) => left.updateId - right.updateId);
+        return evidence
+            ? [
+                {
+                    updateId: evidence.updateId,
+                    state: evidence.state,
+                    attemptCount: evidence.attemptCount,
+                    failureClass: evidence.failureClass,
+                    evidenceSha256: evidence.evidenceSha256,
+                },
+            ]
+            : [];
+    })
+        .sort((left, right) => left.updateId - right.updateId);
 }
 export function createTelegramUpdateJournalLegacyCustodyEvidence(entry) {
-    if ((entry.state !== "retry-wait" && entry.state !== "failed") || !entry.failure ||
-        entry.inputClaim || entry.inputProvenance)
+    if ((entry.state !== "retry-wait" && entry.state !== "failed") ||
+        !entry.failure ||
+        entry.inputClaim ||
+        entry.inputProvenance)
         return undefined;
-    const base = { updateId: entry.updateId, state: entry.state,
-        attemptCount: entry.failure.attemptCount, failedAtMs: entry.failure.failedAtMs,
-        failureClass: entry.failure.failureClass, summary: entry.failure.summary,
-        ...(entry.nextRetryAtMs === undefined ? {} : { nextRetryAtMs: entry.nextRetryAtMs }),
-        ...(entry.terminalAtMs === undefined ? {} : { terminalAtMs: entry.terminalAtMs }),
-        ...(entry.terminalReason === undefined ? {} : { terminalReason: entry.terminalReason }),
-        ...(entry.terminalFailureId === undefined ? {} : { terminalFailureId: entry.terminalFailureId }) };
-    return { ...base, evidenceSha256: createHash("sha256").update(JSON.stringify(base)).digest("hex") };
+    const base = {
+        updateId: entry.updateId,
+        state: entry.state,
+        attemptCount: entry.failure.attemptCount,
+        failedAtMs: entry.failure.failedAtMs,
+        failureClass: entry.failure.failureClass,
+        summary: entry.failure.summary,
+        ...(entry.nextRetryAtMs === undefined
+            ? {}
+            : { nextRetryAtMs: entry.nextRetryAtMs }),
+        ...(entry.terminalAtMs === undefined
+            ? {}
+            : { terminalAtMs: entry.terminalAtMs }),
+        ...(entry.terminalReason === undefined
+            ? {}
+            : { terminalReason: entry.terminalReason }),
+        ...(entry.terminalFailureId === undefined
+            ? {}
+            : { terminalFailureId: entry.terminalFailureId }),
+    };
+    return {
+        ...base,
+        evidenceSha256: createHash("sha256")
+            .update(JSON.stringify(base))
+            .digest("hex"),
+    };
 }
 export function normalizeTelegramUpdateJournalLegacyCustodyDispositionAuthority(value, expected) {
     if (!isRecord(value))
         return undefined;
-    const keys = ["version", "dispositionId", "updateId", "evidenceSha256", "action",
-        "operatorAuthorityId", "authorizedAtMs"];
-    if (Object.keys(value).some(key => !keys.includes(key)) || value.version !== 1 ||
+    const keys = [
+        "version",
+        "dispositionId",
+        "updateId",
+        "evidenceSha256",
+        "action",
+        "operatorAuthorityId",
+        "authorizedAtMs",
+    ];
+    if (Object.keys(value).some((key) => !keys.includes(key)) ||
+        value.version !== 1 ||
         !isBoundedString(value.dispositionId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
-        value.updateId !== expected.updateId || value.evidenceSha256 !== expected.evidenceSha256 ||
+        value.updateId !== expected.updateId ||
+        value.evidenceSha256 !== expected.evidenceSha256 ||
         (value.action !== "requeue-v3" && value.action !== "discard") ||
         !isBoundedString(value.operatorAuthorityId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
         !isSafeNonNegativeInteger(value.authorizedAtMs))
         return undefined;
-    return { version: 1, dispositionId: value.dispositionId, updateId: expected.updateId,
-        evidenceSha256: expected.evidenceSha256, action: value.action,
-        operatorAuthorityId: value.operatorAuthorityId, authorizedAtMs: value.authorizedAtMs };
+    return {
+        version: 1,
+        dispositionId: value.dispositionId,
+        updateId: expected.updateId,
+        evidenceSha256: expected.evidenceSha256,
+        action: value.action,
+        operatorAuthorityId: value.operatorAuthorityId,
+        authorizedAtMs: value.authorizedAtMs,
+    };
 }
 export const TELEGRAM_ROUTING_INPUT_TTL_MS = 60 * 60 * 1000;
+function isTelegramUpdateJournalRoutingChooser(value) {
+    return (isRecord(value) &&
+        hasOnlyKeys(value, ["chatId", "threadId", "messageId"]) &&
+        Number.isSafeInteger(value.chatId) &&
+        (value.threadId === undefined || isSafePositiveInteger(value.threadId)) &&
+        isSafePositiveInteger(value.messageId));
+}
 export function createTelegramUpdateJournalEntryDigest(entry) {
-    return { updateId: entry.updateId, sourceSha256: createHash("sha256").update(JSON.stringify(entry)).digest("hex") };
+    return {
+        updateId: entry.updateId,
+        sourceSha256: createHash("sha256")
+            .update(JSON.stringify(entry))
+            .digest("hex"),
+    };
+}
+function inspectRoutingInputExpiry(file, journalBindingKey, updateId) {
+    const disposition = file.operatorDispositions?.find((value) => value.updateId === updateId &&
+        "dispositionKind" in value &&
+        value.dispositionKind === "legacy-custody" &&
+        value.action === "discard" &&
+        value.failureId === `routing-expiry:${value.evidenceSha256}`);
+    if (!disposition ||
+        !("operatorAuthorityId" in disposition) ||
+        file.entries.some((entry) => entry.updateId === updateId))
+        return undefined;
+    return {
+        journalBindingKey,
+        updateId,
+        operatorAuthorityId: disposition.operatorAuthorityId,
+    };
+}
+function inspectRoutingGroupExpiry(file, journalBindingKey, updateIds) {
+    if (!Array.isArray(updateIds) ||
+        !updateIds.length ||
+        updateIds.length > TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES ||
+        updateIds.some((id, index) => !isSafeNonNegativeInteger(id) ||
+            (index > 0 && id <= updateIds[index - 1])))
+        return undefined;
+    if (file.entries.some((entry) => updateIds.includes(entry.updateId)))
+        return undefined;
+    const expired = updateIds
+        .map((id) => inspectRoutingInputExpiry(file, journalBindingKey, id))
+        .filter((value) => value !== undefined);
+    if (!expired.length ||
+        expired.some((value) => value.operatorAuthorityId !== expired[0].operatorAuthorityId))
+        return undefined;
+    // Some members may have been acknowledged earlier. Whole donor absence plus one exact expiry ends this known cohort,
+    // not recipient custody; fresh Thread protection still independently gates deletion.
+    return updateIds.map((updateId) => ({
+        journalBindingKey,
+        updateId,
+        operatorAuthorityId: expired[0].operatorAuthorityId,
+    }));
 }
 function createJournalError(code, path, detail, cause) {
     return new TelegramUpdateJournalError(code, path, `Telegram update journal ${detail}: ${path}`, cause === undefined ? undefined : { cause });
@@ -418,11 +515,11 @@ function createTelegramUpdateQueueHandoffId(input) {
         .slice(0, 32)}`;
 }
 function isTelegramInputHandoffId(value) {
-    return isBoundedString(value, TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_ID_MAX_LENGTH) &&
-        /^input-handoff-[a-f0-9]{32}$/u.test(value);
+    return (isBoundedString(value, TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_ID_MAX_LENGTH) && /^input-handoff-[a-f0-9]{32}$/u.test(value));
 }
 function createTelegramInputHandoffId(input) {
-    return `input-handoff-${createHash("sha256").update(JSON.stringify({
+    return `input-handoff-${createHash("sha256")
+        .update(JSON.stringify({
         version: 1,
         token: input.handoffToken,
         source: input.journalBindingKey,
@@ -430,7 +527,9 @@ function createTelegramInputHandoffId(input) {
         donorOwner: input.donorOwner,
         recipientOwner: input.recipientOwner,
         recipientBindingKey: input.recipientBindingKey,
-    })).digest("hex").slice(0, 32)}`;
+    }))
+        .digest("hex")
+        .slice(0, 32)}`;
 }
 function validateJournalHandoff(value, path, kind) {
     if (!isRecord(value) ||
@@ -480,38 +579,72 @@ function createTelegramUpdateTerminalFailureId(input) {
 }
 function validateJournalOperatorDisposition(value, path) {
     if (isRecord(value) && value.dispositionKind === "legacy-custody") {
-        if (!hasOnlyKeys(value, ["dispositionKind", "failureId", "updateId", "action",
-            "committedAtMs", "evidenceSha256", "operatorAuthorityId", "authorizedAtMs"]) ||
+        if (!hasOnlyKeys(value, [
+            "dispositionKind",
+            "failureId",
+            "updateId",
+            "action",
+            "committedAtMs",
+            "evidenceSha256",
+            "operatorAuthorityId",
+            "authorizedAtMs",
+        ]) ||
             !isBoundedString(value.failureId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
             !isSafeNonNegativeInteger(value.updateId) ||
             (value.action !== "requeue-v3" && value.action !== "discard") ||
             !isSafeNonNegativeInteger(value.committedAtMs) ||
-            typeof value.evidenceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(value.evidenceSha256) ||
+            typeof value.evidenceSha256 !== "string" ||
+            !/^[a-f0-9]{64}$/u.test(value.evidenceSha256) ||
             !isBoundedString(value.operatorAuthorityId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
-            !isSafeNonNegativeInteger(value.authorizedAtMs) || value.committedAtMs < value.authorizedAtMs)
+            !isSafeNonNegativeInteger(value.authorizedAtMs) ||
+            value.committedAtMs < value.authorizedAtMs)
             throw createJournalError("invalid", path, "contains invalid legacy custody disposition metadata");
-        return { dispositionKind: "legacy-custody", failureId: value.failureId,
-            updateId: value.updateId, action: value.action, committedAtMs: value.committedAtMs,
-            evidenceSha256: value.evidenceSha256, operatorAuthorityId: value.operatorAuthorityId,
-            authorizedAtMs: value.authorizedAtMs };
+        return {
+            dispositionKind: "legacy-custody",
+            failureId: value.failureId,
+            updateId: value.updateId,
+            action: value.action,
+            committedAtMs: value.committedAtMs,
+            evidenceSha256: value.evidenceSha256,
+            operatorAuthorityId: value.operatorAuthorityId,
+            authorizedAtMs: value.authorizedAtMs,
+        };
     }
-    if (!isRecord(value) || !hasOnlyKeys(value, ["failureId", "updateId", "action",
-        "committedAtMs", "attemptCount", "failureClass", "terminalAtMs", "terminalReason"]) ||
+    if (!isRecord(value) ||
+        !hasOnlyKeys(value, [
+            "failureId",
+            "updateId",
+            "action",
+            "committedAtMs",
+            "attemptCount",
+            "failureClass",
+            "terminalAtMs",
+            "terminalReason",
+        ]) ||
         !isBoundedString(value.failureId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
         !isSafeNonNegativeInteger(value.updateId) ||
         (value.action !== "retry" && value.action !== "discard") ||
-        !isSafeNonNegativeInteger(value.committedAtMs) || !isSafePositiveInteger(value.attemptCount) ||
+        !isSafeNonNegativeInteger(value.committedAtMs) ||
+        !isSafePositiveInteger(value.attemptCount) ||
         !isBoundedString(value.failureClass, TELEGRAM_UPDATE_JOURNAL_FAILURE_CLASS_MAX_LENGTH) ||
-        !isSafeNonNegativeInteger(value.terminalAtMs) || value.committedAtMs < value.terminalAtMs ||
+        !isSafeNonNegativeInteger(value.terminalAtMs) ||
+        value.committedAtMs < value.terminalAtMs ||
         !isBoundedString(value.terminalReason, TELEGRAM_UPDATE_JOURNAL_TERMINAL_REASON_MAX_LENGTH))
         throw createJournalError("invalid", path, "contains invalid operator disposition metadata");
-    return { failureId: value.failureId, updateId: value.updateId, action: value.action,
-        committedAtMs: value.committedAtMs, attemptCount: value.attemptCount,
-        failureClass: value.failureClass, terminalAtMs: value.terminalAtMs,
-        terminalReason: value.terminalReason };
+    return {
+        failureId: value.failureId,
+        updateId: value.updateId,
+        action: value.action,
+        committedAtMs: value.committedAtMs,
+        attemptCount: value.attemptCount,
+        failureClass: value.failureClass,
+        terminalAtMs: value.terminalAtMs,
+        terminalReason: value.terminalReason,
+    };
 }
 function journalRequiresExclusion(version) {
-    return version === TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION || journalHasCustodyFields(version);
+    return (version === TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION ||
+        journalHasCustodyFields(version));
 }
 function journalHasCustodyFields(version) {
     return version === TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION;
@@ -522,21 +655,33 @@ export function isTelegramUpdateJournalLegacyFamilyVersion(version) {
 }
 function validateJournalInputClaim(value, path, updateId) {
     if (!isRecord(value) ||
-        !hasOnlyKeys(value, ["phase", "owner", "recipientBindingKey", "handoff", "executionUpdate"]) ||
+        !hasOnlyKeys(value, [
+            "phase",
+            "owner",
+            "recipientBindingKey",
+            "handoff",
+            "executionUpdate",
+        ]) ||
         (value.phase !== "ready" && value.phase !== "running") ||
         !isBoundedString(value.recipientBindingKey, TELEGRAM_UPDATE_JOURNAL_INPUT_BINDING_MAX_LENGTH) ||
         !value.recipientBindingKey.trim()) {
         throw createJournalError("invalid", path, "contains invalid input claim metadata");
     }
     const owner = validateJournalQueueOwner(value.owner, path);
-    const handoff = value.handoff === undefined ? undefined : validateJournalHandoff(value.handoff, path, "input");
-    if ((owner.handoffId !== undefined && !isTelegramInputHandoffId(owner.handoffId)) ||
-        (handoff && (!isTelegramInputHandoffId(handoff.handoffId) || value.phase !== "ready" ||
-            isTelegramUpdateJournalQueueOwnerProcess(owner, handoff.recipientOwner)))) {
+    const handoff = value.handoff === undefined
+        ? undefined
+        : validateJournalHandoff(value.handoff, path, "input");
+    if ((owner.handoffId !== undefined &&
+        !isTelegramInputHandoffId(owner.handoffId)) ||
+        (handoff &&
+            (!isTelegramInputHandoffId(handoff.handoffId) ||
+                value.phase !== "ready" ||
+                isTelegramUpdateJournalQueueOwnerProcess(owner, handoff.recipientOwner)))) {
         throw createJournalError("invalid", path, "contains conflicting input handoff metadata");
     }
     const executionUpdate = value.executionUpdate === undefined
-        ? undefined : validateJournaledUpdate(value.executionUpdate, path);
+        ? undefined
+        : validateJournaledUpdate(value.executionUpdate, path);
     if (executionUpdate && executionUpdate.update_id !== updateId) {
         throw createJournalError("invalid", path, "contains an input claim/update id mismatch");
     }
@@ -556,20 +701,26 @@ function validateJournalInputProvenance(value, path, updateId) {
         throw createJournalError("invalid", path, "contains invalid input queue provenance");
     }
     const owner = validateJournalQueueOwner(value.owner, path);
-    if (owner.handoffId !== undefined && !isTelegramInputHandoffId(owner.handoffId)) {
+    if (owner.handoffId !== undefined &&
+        !isTelegramInputHandoffId(owner.handoffId)) {
         throw createJournalError("invalid", path, "contains invalid input queue provenance");
     }
     const executionUpdate = value.executionUpdate === undefined
-        ? undefined : validateJournaledUpdate(value.executionUpdate, path);
+        ? undefined
+        : validateJournaledUpdate(value.executionUpdate, path);
     if (executionUpdate && executionUpdate.update_id !== updateId) {
         throw createJournalError("invalid", path, "contains an input provenance/update id mismatch");
     }
-    return { owner, recipientBindingKey: value.recipientBindingKey,
-        ...(executionUpdate ? { executionUpdate } : {}) };
+    return {
+        owner,
+        recipientBindingKey: value.recipientBindingKey,
+        ...(executionUpdate ? { executionUpdate } : {}),
+    };
 }
 function validateJournalEntry(value, path, version) {
     if (journalRequiresExclusion(version) &&
-        (!isRecord(value) || typeof value.preApprovalExcluded !== "boolean" ||
+        (!isRecord(value) ||
+            typeof value.preApprovalExcluded !== "boolean" ||
             (value.preApprovalExcluded && value.state === "queued"))) {
         throw createJournalError("pairing-evidence", path, "contains missing, malformed, or queued exclusion evidence");
     }
@@ -578,7 +729,9 @@ function validateJournalEntry(value, path, version) {
             "updateId",
             "update",
             "admittedAtMs",
-            ...(isTelegramUpdateJournalLegacyFamilyVersion(version) ? ["routingInput"] : []),
+            ...(isTelegramUpdateJournalLegacyFamilyVersion(version)
+                ? ["routingInput"]
+                : []),
             "state",
             "queueKind",
             "queueReceiptId",
@@ -591,7 +744,8 @@ function validateJournalEntry(value, path, version) {
             "terminalFailureId",
             ...(journalRequiresExclusion(version) ? ["preApprovalExcluded"] : []),
             ...(journalHasCustodyFields(version)
-                ? ["inputClaim", "inputProvenance"] : []),
+                ? ["inputClaim", "inputProvenance"]
+                : []),
         ]) ||
         !isSafeNonNegativeInteger(value.updateId) ||
         !isSafeNonNegativeInteger(value.admittedAtMs) ||
@@ -608,16 +762,39 @@ function validateJournalEntry(value, path, version) {
     let routingInput;
     if (value.routingInput !== undefined) {
         const routing = value.routingInput;
-        if (!isRecord(routing) || !hasOnlyKeys(routing, ["operatorUserId", "publishedAtMs", "expiresAtMs", "phase"]) ||
-            !isSafePositiveInteger(routing.operatorUserId) || !isSafeNonNegativeInteger(routing.publishedAtMs) ||
-            routing.publishedAtMs < value.admittedAtMs || !isSafeNonNegativeInteger(routing.expiresAtMs) ||
-            routing.expiresAtMs !== routing.publishedAtMs + TELEGRAM_ROUTING_INPUT_TTL_MS ||
+        if (!isRecord(routing) ||
+            !hasOnlyKeys(routing, [
+                "operatorUserId",
+                "publishedAtMs",
+                "expiresAtMs",
+                "phase",
+                "chooser",
+            ]) ||
+            (routing.chooser !== undefined &&
+                !isTelegramUpdateJournalRoutingChooser(routing.chooser)) ||
+            !isSafePositiveInteger(routing.operatorUserId) ||
+            !isSafeNonNegativeInteger(routing.publishedAtMs) ||
+            routing.publishedAtMs < value.admittedAtMs ||
+            !isSafeNonNegativeInteger(routing.expiresAtMs) ||
+            routing.expiresAtMs !==
+                routing.publishedAtMs + TELEGRAM_ROUTING_INPUT_TTL_MS ||
             (routing.phase !== "waiting" && routing.phase !== "selected") ||
             (routing.phase === "waiting" && value.state === "queued")) {
             throw createJournalError("invalid", path, "contains invalid routing input lifetime");
         }
-        routingInput = { operatorUserId: routing.operatorUserId, publishedAtMs: routing.publishedAtMs,
-            expiresAtMs: routing.expiresAtMs, phase: routing.phase };
+        routingInput = {
+            operatorUserId: routing.operatorUserId,
+            publishedAtMs: routing.publishedAtMs,
+            expiresAtMs: routing.expiresAtMs,
+            phase: routing.phase,
+            ...(routing.chooser !== undefined
+                ? {
+                    chooser: {
+                        ...routing.chooser,
+                    },
+                }
+                : {}),
+        };
     }
     const queueKind = value.queueKind;
     const queueReceiptId = value.queueReceiptId;
@@ -654,11 +831,14 @@ function validateJournalEntry(value, path, version) {
         throw createJournalError("pairing-evidence", path, "contains claimed exclusion evidence");
     }
     const inputClaim = value.inputClaim === undefined
-        ? undefined : validateJournalInputClaim(value.inputClaim, path, value.updateId);
+        ? undefined
+        : validateJournalInputClaim(value.inputClaim, path, value.updateId);
     const inputProvenance = value.inputProvenance === undefined
-        ? undefined : validateJournalInputProvenance(value.inputProvenance, path, value.updateId);
-    if ((inputClaim && (value.state === "queued" ||
-        (inputClaim.phase === "running" && value.state !== "pending"))) ||
+        ? undefined
+        : validateJournalInputProvenance(value.inputProvenance, path, value.updateId);
+    if ((inputClaim &&
+        (value.state === "queued" ||
+            (inputClaim.phase === "running" && value.state !== "pending"))) ||
         (inputProvenance && (value.state !== "queued" || inputClaim))) {
         throw createJournalError("invalid", path, "contains conflicting input claim state");
     }
@@ -690,15 +870,14 @@ function validateJournalEntry(value, path, version) {
         updateId: value.updateId,
         update,
         ...(journalRequiresExclusion(version)
-            ? { preApprovalExcluded: value.preApprovalExcluded } : {}),
+            ? { preApprovalExcluded: value.preApprovalExcluded }
+            : {}),
         ...(inputClaim ? { inputClaim } : {}),
         ...(inputProvenance ? { inputProvenance } : {}),
         admittedAtMs: value.admittedAtMs,
         ...(routingInput ? { routingInput } : {}),
         state: value.state,
-        ...(queueKind === "prompt" || queueKind === "control"
-            ? { queueKind }
-            : {}),
+        ...(queueKind === "prompt" || queueKind === "control" ? { queueKind } : {}),
         ...(isNonEmptyString(queueReceiptId) ? { queueReceiptId } : {}),
         ...(queueOwner ? { queueOwner } : {}),
         ...(queueHandoff ? { queueHandoff } : {}),
@@ -729,40 +908,56 @@ function validateJournalEntry(value, path, version) {
     };
 }
 function assertSupportedJournalVersion(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION) {
-    if (isRecord(value) && Number.isSafeInteger(value.version) &&
+    if (isRecord(value) &&
+        Number.isSafeInteger(value.version) &&
         value.version !== version) {
         throw createJournalError("unsupported-version", path, `uses unsupported version ${String(value.version)}`);
     }
 }
 function validateJournalSourceCompletion(value, path) {
-    if (!isRecord(value) || !hasOnlyKeys(value, ["updateId", "sourceSha256", "completionSha256"]) ||
-        !isSafeNonNegativeInteger(value.updateId) || typeof value.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(value.sourceSha256) ||
-        typeof value.completionSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(value.completionSha256)) {
+    if (!isRecord(value) ||
+        !hasOnlyKeys(value, ["updateId", "sourceSha256", "completionSha256"]) ||
+        !isSafeNonNegativeInteger(value.updateId) ||
+        typeof value.sourceSha256 !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(value.sourceSha256) ||
+        typeof value.completionSha256 !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(value.completionSha256)) {
         throw createJournalError("invalid", path, "has invalid source completion evidence");
     }
-    return { updateId: value.updateId, sourceSha256: value.sourceSha256, completionSha256: value.completionSha256 };
+    return {
+        updateId: value.updateId,
+        sourceSha256: value.sourceSha256,
+        completionSha256: value.completionSha256,
+    };
 }
 function validateJournalSourceCompletions(value, path, version, allowEmpty = false) {
-    if (!isTelegramUpdateJournalLegacyFamilyVersion(version) || !Array.isArray(value) || !allowEmpty && !value.length) {
+    if (!isTelegramUpdateJournalLegacyFamilyVersion(version) ||
+        !Array.isArray(value) ||
+        (!allowEmpty && !value.length)) {
         throw createJournalError("invalid", path, "has invalid source completion collection");
     }
-    const completions = value.map(item => validateJournalSourceCompletion(item, path));
+    const completions = value.map((item) => validateJournalSourceCompletion(item, path));
     const scopes = new Set();
     for (let index = 0; index < completions.length; index++) {
         const completion = completions[index];
-        if ((index > 0 && completions[index - 1].updateId >= completion.updateId) || scopes.has(completion.completionSha256)) {
+        if ((index > 0 && completions[index - 1].updateId >= completion.updateId) ||
+            scopes.has(completion.completionSha256)) {
             throw createJournalError("invalid", path, "has duplicate or unordered source completion evidence");
         }
         scopes.add(completion.completionSha256);
     }
     return completions;
 }
-function parseJournalFile(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION) {
-    assertSupportedJournalVersion(value, path, version);
+function assertJournalExclusionCursor(value, path, version) {
     if (journalRequiresExclusion(version) &&
-        (!isRecord(value) || !isSafeNonNegativeInteger(value.acceptedThroughUpdateId))) {
+        (!isRecord(value) ||
+            !isSafeNonNegativeInteger(value.acceptedThroughUpdateId))) {
         throw createJournalError("pairing-evidence", path, "is missing its exclusion-mode admission cursor");
     }
+}
+function parseJournalFile(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION) {
+    assertSupportedJournalVersion(value, path, version);
+    assertJournalExclusionCursor(value, path, version);
     if (!isRecord(value) ||
         !hasOnlyKeys(value, [
             "version",
@@ -798,9 +993,7 @@ function parseJournalFile(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION
     }
     const queuedReceipts = new Map();
     for (const entry of entries) {
-        if (entry.state !== "queued" ||
-            !entry.queueKind ||
-            !entry.queueReceiptId) {
+        if (entry.state !== "queued" || !entry.queueKind || !entry.queueReceiptId) {
             continue;
         }
         const existing = queuedReceipts.get(entry.queueReceiptId);
@@ -831,12 +1024,18 @@ function parseJournalFile(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION
         }
     }
     const operatorDispositions = (value.operatorDispositions ?? []).map((disposition) => validateJournalOperatorDisposition(disposition, path));
-    const sourceCompletions = value.sourceCompletions === undefined ? [] : validateJournalSourceCompletions(value.sourceCompletions, path, version);
+    const sourceCompletions = value.sourceCompletions === undefined
+        ? []
+        : validateJournalSourceCompletions(value.sourceCompletions, path, version);
     const botIdentity = validateBotIdentity(value.botIdentity, path);
-    const activeIds = new Set(entries.map(entry => entry.updateId));
-    const discardedIds = new Set(operatorDispositions.filter(disposition => disposition.action === "discard").map(disposition => disposition.updateId));
-    if (sourceCompletions.some(completion => activeIds.has(completion.updateId) || discardedIds.has(completion.updateId) ||
-        value.acceptedThroughUpdateId !== undefined && completion.updateId > value.acceptedThroughUpdateId)) {
+    const activeIds = new Set(entries.map((entry) => entry.updateId));
+    const discardedIds = new Set(operatorDispositions
+        .filter((disposition) => disposition.action === "discard")
+        .map((disposition) => disposition.updateId));
+    if (sourceCompletions.some((completion) => activeIds.has(completion.updateId) ||
+        discardedIds.has(completion.updateId) ||
+        (value.acceptedThroughUpdateId !== undefined &&
+            completion.updateId > value.acceptedThroughUpdateId))) {
         throw createJournalError("invalid", path, "has contradictory source completion evidence");
     }
     const dispositionFailureIds = new Set();
@@ -868,11 +1067,15 @@ function parseJournalFile(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION
     };
 }
 function assertJournalRoutingInputContinuity(file, entries, path) {
-    const previous = new Map(file.entries.map(entry => [entry.updateId, entry.routingInput]));
+    const previous = new Map(file.entries.map((entry) => [entry.updateId, entry.routingInput]));
     for (const entry of entries) {
         const retained = previous.get(entry.updateId), next = entry.routingInput;
-        if (retained && (!next || next.operatorUserId !== retained.operatorUserId || next.publishedAtMs !== retained.publishedAtMs ||
-            next.expiresAtMs !== retained.expiresAtMs || (retained.phase === "selected" && next.phase !== "selected"))) {
+        if (retained &&
+            (!next ||
+                next.operatorUserId !== retained.operatorUserId ||
+                next.publishedAtMs !== retained.publishedAtMs ||
+                next.expiresAtMs !== retained.expiresAtMs ||
+                (retained.phase === "selected" && next.phase !== "selected"))) {
             throw createJournalError("invalid", path, "regresses retained routing input lifetime");
         }
     }
@@ -881,14 +1084,20 @@ function assertJournalSourceCompletionContinuity(file, segment, path) {
     assertJournalRoutingInputContinuity(file, segment.upsertedEntries, path);
     if (segment.sourceCompletions === undefined)
         return;
-    const previous = new Map((file.sourceCompletions ?? []).map(completion => [completion.updateId, completion]));
-    const next = new Map(segment.sourceCompletions.map(completion => [completion.updateId, completion]));
+    const previous = new Map((file.sourceCompletions ?? []).map((completion) => [
+        completion.updateId,
+        completion,
+    ]));
+    const next = new Map(segment.sourceCompletions.map((completion) => [
+        completion.updateId,
+        completion,
+    ]));
     if ([...previous].some(([id, completion]) => !isDeepStrictEqual(completion, next.get(id)))) {
         throw createJournalError("invalid", path, "regresses retained source completion evidence");
     }
-    const entries = new Map(file.entries.map(entry => [entry.updateId, entry]));
-    const removed = new Set(segment.removedUpdateIds), upserted = new Set(segment.upsertedEntries.map(entry => entry.updateId));
-    const upsertedReceipts = new Set(segment.upsertedEntries.map(entry => entry.queueReceiptId));
+    const entries = new Map(file.entries.map((entry) => [entry.updateId, entry]));
+    const removed = new Set(segment.removedUpdateIds), upserted = new Set(segment.upsertedEntries.map((entry) => entry.updateId));
+    const upsertedReceipts = new Set(segment.upsertedEntries.map((entry) => entry.queueReceiptId));
     // Grouped markers share one whole-receipt check rather than rescanning the group per source.
     const queueGroups = new Map(), queueRemovals = new Map();
     for (const entry of file.entries) {
@@ -905,8 +1114,15 @@ function assertJournalSourceCompletionContinuity(file, segment, path) {
         if (queueRemovals.has(receiptId))
             return queueRemovals.get(receiptId);
         const group = queueGroups.get(receiptId);
-        const valid = !!group?.length && !upsertedReceipts.has(receiptId) && group.every(entry => removed.has(entry.updateId) && !upserted.has(entry.updateId) && entry.state === "queued" && entry.queueKind === source.queueKind &&
-            entry.queueHandoff === undefined && !!entry.queueOwner && areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, source.queueOwner));
+        const valid = !!group?.length &&
+            !upsertedReceipts.has(receiptId) &&
+            group.every((entry) => removed.has(entry.updateId) &&
+                !upserted.has(entry.updateId) &&
+                entry.state === "queued" &&
+                entry.queueKind === source.queueKind &&
+                entry.queueHandoff === undefined &&
+                !!entry.queueOwner &&
+                areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, source.queueOwner));
         queueRemovals.set(receiptId, valid);
         return valid;
     };
@@ -914,18 +1130,19 @@ function assertJournalSourceCompletionContinuity(file, segment, path) {
         if (previous.has(completion.updateId))
             continue;
         const source = entries.get(completion.updateId);
-        if (!removed.has(completion.updateId) || !source || (source.state === "queued" && !queueWasRemoved(source)) || source.state === "failed" ||
-            createTelegramUpdateJournalEntryDigest(source).sourceSha256 !== completion.sourceSha256) {
+        if (!removed.has(completion.updateId) ||
+            !source ||
+            (source.state === "queued" && !queueWasRemoved(source)) ||
+            source.state === "failed" ||
+            createTelegramUpdateJournalEntryDigest(source).sourceSha256 !==
+                completion.sourceSha256) {
             throw createJournalError("invalid", path, "source completion does not match its removal revision");
         }
     }
 }
 function parseJournalSegment(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERSION) {
     assertSupportedJournalVersion(value, path, version);
-    if (journalRequiresExclusion(version) &&
-        (!isRecord(value) || !isSafeNonNegativeInteger(value.acceptedThroughUpdateId))) {
-        throw createJournalError("pairing-evidence", path, "is missing its exclusion-mode admission cursor");
-    }
+    assertJournalExclusionCursor(value, path, version);
     if (!isRecord(value) ||
         !hasOnlyKeys(value, [
             "version",
@@ -992,7 +1209,11 @@ function parseJournalSegment(value, path, version = TELEGRAM_UPDATE_JOURNAL_VERS
         ...(value.operatorDispositions !== undefined
             ? { operatorDispositions }
             : {}),
-        ...(value.sourceCompletions !== undefined ? { sourceCompletions: validateJournalSourceCompletions(value.sourceCompletions, path, version, true) } : {}),
+        ...(value.sourceCompletions !== undefined
+            ? {
+                sourceCompletions: validateJournalSourceCompletions(value.sourceCompletions, path, version, true),
+            }
+            : {}),
     };
 }
 /**
@@ -1025,7 +1246,10 @@ export function inspectTelegramUpdateJournalFamily(input) {
 /** Classifies private originals against exact discard tombstones; never replay or deletion authority. */
 export function inspectTelegramUpdateJournalRetention(input) {
     const acquired = acquireTelegramUpdateJournalFamily(input, undefined, true);
-    return { evidence: acquired.evidence, retainedInputs: acquired.retainedInputs ?? [] };
+    return {
+        evidence: acquired.evidence,
+        retainedInputs: acquired.retainedInputs ?? [],
+    };
 }
 /**
  * Read-only source evidence for cooperating writers serialized by the caller through
@@ -1052,9 +1276,18 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
     const { path, limits } = input;
     const acquiredSegments = [];
     let snapshotRevision = 0;
-    const fail = (message) => { throw createJournalError("invalid", path, message); };
-    const capacity = () => { throw createJournalError("capacity", path, "exceeds inspection resource limits"); };
-    for (const key of ["maxFiles", "maxBytes", "maxEntries", "maxWork"]) {
+    const fail = (message) => {
+        throw createJournalError("invalid", path, message);
+    };
+    const capacity = () => {
+        throw createJournalError("capacity", path, "exceeds inspection resource limits");
+    };
+    for (const key of [
+        "maxFiles",
+        "maxBytes",
+        "maxEntries",
+        "maxWork",
+    ]) {
         if (!isSafePositiveInteger(limits[key]))
             fail("requires positive safe-integer limits");
     }
@@ -1063,21 +1296,34 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
         fail("requires an exact profile");
     const anchor = input.directory;
     const contained = relative(anchor, path);
-    if (!isAbsolute(anchor) || resolve(anchor) !== anchor || !isAbsolute(path) ||
-        resolve(path) !== path || !contained || contained === ".." ||
-        contained.startsWith(`..${sep}`) || isAbsolute(contained))
+    if (!isAbsolute(anchor) ||
+        resolve(anchor) !== anchor ||
+        !isAbsolute(path) ||
+        resolve(path) !== path ||
+        !contained ||
+        contained === ".." ||
+        contained.startsWith(`..${sep}`) ||
+        isAbsolute(contained))
         fail("escapes its canonical directory anchor");
-    if (!constants.O_NOFOLLOW || !constants.O_NONBLOCK)
-        fail("platform lacks no-follow nonblocking open evidence");
     let files = 0;
     let bytes = 0;
     let work = 0;
     const observed = new Map();
     const ancestors = new Set();
-    const sameAncestor = (a, b) => b.isDirectory() && !b.isSymbolicLink() && a.dev === b.dev && a.ino === b.ino &&
-        a.mode === b.mode && a.uid === b.uid && a.gid === b.gid;
-    const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode &&
-        a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;
+    const sameAncestor = (a, b) => b.isDirectory() &&
+        !b.isSymbolicLink() &&
+        a.dev === b.dev &&
+        a.ino === b.ino &&
+        a.mode === b.mode &&
+        a.uid === b.uid &&
+        a.gid === b.gid;
+    const same = (a, b) => a.dev === b.dev &&
+        a.ino === b.ino &&
+        a.mode === b.mode &&
+        a.nlink === b.nlink &&
+        a.size === b.size &&
+        a.mtimeNs === b.mtimeNs &&
+        a.ctimeNs === b.ctimeNs;
     const status = (target) => {
         try {
             return lstatSync(target, { bigint: true });
@@ -1092,7 +1338,9 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
         const value = status(target);
         if (!value && !optional)
             fail("has a missing path component");
-        if (value && (value.isSymbolicLink() || !(directory ? value.isDirectory() : value.isFile())))
+        if (value &&
+            (value.isSymbolicLink() ||
+                !(directory ? value.isDirectory() : value.isFile())))
             fail("has a linked or unexpected file type");
         observed.set(target, value);
         return value;
@@ -1100,11 +1348,18 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
     const charge = (value) => {
         if (!isRecord(value))
             return;
-        for (const key of ["entries", "upsertedEntries", "removedUpdateIds", "operatorDispositions", "sourceCompletions"]) {
+        for (const key of [
+            "entries",
+            "upsertedEntries",
+            "removedUpdateIds",
+            "operatorDispositions",
+            "sourceCompletions",
+        ]) {
             const collection = value[key];
             if (!Array.isArray(collection))
                 continue;
-            if (collection.length > limits.maxEntries || collection.length > limits.maxWork - work)
+            if (collection.length > limits.maxEntries ||
+                collection.length > limits.maxWork - work)
                 capacity();
             work += collection.length;
         }
@@ -1112,7 +1367,7 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
     const read = (target, before) => {
         if (before.size > BigInt(limits.maxBytes - bytes))
             capacity();
-        const fd = openSync(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const fd = openSync(target, TELEGRAM_STRICT_READ_FLAGS);
         try {
             const opened = fstatSync(fd, { bigint: true });
             if (!opened.isFile() || !same(before, opened))
@@ -1152,7 +1407,9 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
                     break;
                 if (names.length >= limits.maxFiles - usedFiles)
                     capacity();
-                if (!pattern.test(entry.name) || !entry.isFile() || entry.isSymbolicLink())
+                if (!pattern.test(entry.name) ||
+                    !entry.isFile() ||
+                    entry.isSymbolicLink())
                     fail("has an unexpected journal evidence entry");
                 names.push(entry.name);
             }
@@ -1168,7 +1425,9 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
         if (realpathSync(anchor) !== anchor)
             fail("requires a canonical directory anchor");
         let parent = anchor;
-        for (const component of relative(anchor, dirname(path)).split(sep).filter(Boolean)) {
+        for (const component of relative(anchor, dirname(path))
+            .split(sep)
+            .filter(Boolean)) {
             parent = join(parent, component);
             observe(parent, true);
             ancestors.add(parent);
@@ -1182,15 +1441,19 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
         let file;
         let knownBotId = expected.botId;
         const identity = (value) => {
-            if (value.profile !== input.profile || value.botIdentity.tokenSha256 !== expected.tokenSha256 ||
-                (knownBotId !== undefined && value.botIdentity.botId !== undefined && knownBotId !== value.botIdentity.botId)) {
+            if (value.profile !== input.profile ||
+                value.botIdentity.tokenSha256 !== expected.tokenSha256 ||
+                (knownBotId !== undefined &&
+                    value.botIdentity.botId !== undefined &&
+                    knownBotId !== value.botIdentity.botId)) {
                 throw createJournalError("identity-mismatch", path, "belongs to another exact journal identity");
             }
             knownBotId ??= value.botIdentity.botId;
         };
         if (snapshot) {
             const raw = read(path, snapshot);
-            if (!isRecord(raw) || (raw.version !== 1 && raw.version !== 2 && raw.version !== 3)) {
+            if (!isRecord(raw) ||
+                (raw.version !== 1 && raw.version !== 2 && raw.version !== 3)) {
                 throw createJournalError("unsupported-version", path, "has an unsupported snapshot version");
             }
             file = parseJournalFile(raw, path, raw.version);
@@ -1201,11 +1464,18 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
                 const metadata = observe(target, false);
                 const previousWork = work;
                 const segment = parseJournalSegment(read(target, metadata), target, file.version);
-                acquiredSegments.push({ name, bytes: Number(metadata.size), work: work - previousWork,
-                    ...(segment.botIdentity.botId !== undefined ? { botId: segment.botIdentity.botId } : {}) });
+                acquiredSegments.push({
+                    name,
+                    bytes: Number(metadata.size),
+                    work: work - previousWork,
+                    ...(segment.botIdentity.botId !== undefined
+                        ? { botId: segment.botIdentity.botId }
+                        : {}),
+                });
                 files += 1;
                 identity(segment);
-                if (segment.revision !== Number(name.slice(0, 16)) || segment.previousRevision !== segment.revision - 1)
+                if (segment.revision !== Number(name.slice(0, 16)) ||
+                    segment.previousRevision !== segment.revision - 1)
                     fail("has an invalid intrinsic segment revision");
                 const dispositionIds = new Set();
                 for (const disposition of segment.operatorDispositions ?? []) {
@@ -1216,19 +1486,24 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
                 const revision = file.revision ?? 0;
                 if (segment.revision <= revision)
                     continue;
-                if (segment.revision !== revision + 1 || segment.previousRevision !== revision)
+                if (segment.revision !== revision + 1 ||
+                    segment.previousRevision !== revision)
                     fail("has a newer revision gap");
-                if (segment.acceptedThroughUpdateId !== undefined && file.acceptedThroughUpdateId !== undefined &&
+                if (segment.acceptedThroughUpdateId !== undefined &&
+                    file.acceptedThroughUpdateId !== undefined &&
                     segment.acceptedThroughUpdateId < file.acceptedThroughUpdateId)
                     fail("regresses the admission cursor");
                 assertJournalSourceCompletionContinuity(file, segment, target);
-                const entries = new Map(file.entries.map(entry => [entry.updateId, entry]));
+                const entries = new Map(file.entries.map((entry) => [entry.updateId, entry]));
                 for (const id of segment.removedUpdateIds)
                     entries.delete(id);
                 for (const entry of segment.upsertedEntries) {
                     const previous = entries.get(entry.updateId);
-                    if (journalRequiresExclusion(file.version) && ((previous && previous.preApprovalExcluded !== entry.preApprovalExcluded) ||
-                        (!previous && entry.updateId <= (file.acceptedThroughUpdateId ?? -1)))) {
+                    if (journalRequiresExclusion(file.version) &&
+                        ((previous &&
+                            previous.preApprovalExcluded !== entry.preApprovalExcluded) ||
+                            (!previous &&
+                                entry.updateId <= (file.acceptedThroughUpdateId ?? -1)))) {
                         throw createJournalError("pairing-evidence", target, "changes exclusion evidence or resurrects a settled source");
                     }
                     if (!entries.has(entry.updateId) && entries.size >= limits.maxEntries)
@@ -1238,7 +1513,9 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
                 const next = {
                     ...file,
                     revision: segment.revision,
-                    ...(segment.acceptedThroughUpdateId !== undefined ? { acceptedThroughUpdateId: segment.acceptedThroughUpdateId } : {}),
+                    ...(segment.acceptedThroughUpdateId !== undefined
+                        ? { acceptedThroughUpdateId: segment.acceptedThroughUpdateId }
+                        : {}),
                     entries: [...entries.values()].sort((a, b) => a.updateId - b.updateId),
                     operatorDispositions: segment.operatorDispositions ?? file.operatorDispositions,
                     sourceCompletions: segment.sourceCompletions ?? file.sourceCompletions,
@@ -1249,16 +1526,24 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
         }
         const retainedInputs = [];
         const retentionDirectory = `${path}.retained`;
-        const retention = inspectRetention ? observe(retentionDirectory, true, true) : undefined;
+        const retention = inspectRetention
+            ? observe(retentionDirectory, true, true)
+            : undefined;
         const retentionPattern = /^abandon-[a-f0-9]{64}\.json$/u;
-        const retentionNames = retention ? enumerate(retentionDirectory, retentionPattern) : [];
+        const retentionNames = retention
+            ? enumerate(retentionDirectory, retentionPattern)
+            : [];
         if (retentionNames.length > limits.maxEntries)
             capacity();
         if (retention) {
             if (!file || file.version !== 1)
                 fail("private retention requires its exact v1 journal snapshot");
             const current = file;
-            const bindingKeys = new Set([expected, current.botIdentity].map(botIdentity => createTelegramUpdateJournalBindingKey({ path, profileName: input.profile, botIdentity })));
+            const bindingKeys = new Set([expected, current.botIdentity].map((botIdentity) => createTelegramUpdateJournalBindingKey({
+                path,
+                profileName: input.profile,
+                botIdentity,
+            })));
             const updateIds = new Set();
             for (const name of retentionNames) {
                 const target = join(retentionDirectory, name);
@@ -1272,42 +1557,70 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
                 work += 2;
                 if (!isRecord(raw))
                     throw createJournalError("invalid", target, "private retention is not an evidence record");
-                if (typeof raw.journalBindingKey !== "string" || !bindingKeys.has(raw.journalBindingKey))
+                if (typeof raw.journalBindingKey !== "string" ||
+                    !bindingKeys.has(raw.journalBindingKey))
                     throw createJournalError("invalid", target, "has foreign private retention evidence");
                 const entry = validateJournalEntry(raw.entry, target, 1);
                 const disposition = validateJournalOperatorDisposition(raw.requestedDisposition, target);
-                const digest = createHash("sha256").update(JSON.stringify({ journalBindingKey: raw.journalBindingKey, entry })).digest("hex");
-                if (!("dispositionKind" in disposition) || disposition.dispositionKind !== "legacy-custody" ||
-                    disposition.action !== "discard" || entry.state !== "pending" || disposition.updateId !== entry.updateId ||
-                    disposition.evidenceSha256 !== digest || disposition.failureId !== `abandon-${digest}` ||
-                    name !== `${disposition.failureId}.json` || !isDeepStrictEqual(raw, { version: 1, kind: "pending-input-retention",
-                    journalBindingKey: raw.journalBindingKey, entry, requestedDisposition: disposition }))
+                const digest = createHash("sha256")
+                    .update(JSON.stringify({ journalBindingKey: raw.journalBindingKey, entry }))
+                    .digest("hex");
+                if (!("dispositionKind" in disposition) ||
+                    disposition.dispositionKind !== "legacy-custody" ||
+                    disposition.action !== "discard" ||
+                    entry.state !== "pending" ||
+                    disposition.updateId !== entry.updateId ||
+                    disposition.evidenceSha256 !== digest ||
+                    disposition.failureId !== `abandon-${digest}` ||
+                    name !== `${disposition.failureId}.json` ||
+                    !isDeepStrictEqual(raw, {
+                        version: 1,
+                        kind: "pending-input-retention",
+                        journalBindingKey: raw.journalBindingKey,
+                        entry,
+                        requestedDisposition: disposition,
+                    }))
                     fail("has inconsistent private retention evidence");
                 if (updateIds.has(entry.updateId))
                     fail("has duplicate private retention sources");
                 updateIds.add(entry.updateId);
-                const committed = current.operatorDispositions?.find(value => value.failureId === disposition.failureId || value.updateId === entry.updateId);
-                if (committed && (!isDeepStrictEqual(committed, disposition) || current.entries.some(value => value.updateId === entry.updateId)))
+                const committed = current.operatorDispositions?.find((value) => value.failureId === disposition.failureId ||
+                    value.updateId === entry.updateId);
+                if (committed &&
+                    (!isDeepStrictEqual(committed, disposition) ||
+                        current.entries.some((value) => value.updateId === entry.updateId)))
                     fail("private retention contradicts its journal disposition");
-                retainedInputs.push({ path: target, journalBindingKey: raw.journalBindingKey,
-                    failureId: disposition.failureId, updateId: entry.updateId, state: committed ? "committed" : "uncommitted" });
+                retainedInputs.push({
+                    path: target,
+                    journalBindingKey: raw.journalBindingKey,
+                    failureId: disposition.failureId,
+                    updateId: entry.updateId,
+                    state: committed ? "committed" : "uncommitted",
+                });
             }
         }
-        if (inspectRetention && file?.operatorDispositions?.some(disposition => "dispositionKind" in disposition && disposition.dispositionKind === "legacy-custody" &&
-            disposition.action === "discard" && /^abandon-[a-f0-9]{64}$/u.test(disposition.failureId) &&
-            !retainedInputs.some(original => original.updateId === disposition.updateId && original.state === "committed")))
+        if (inspectRetention &&
+            file?.operatorDispositions?.some((disposition) => "dispositionKind" in disposition &&
+                disposition.dispositionKind === "legacy-custody" &&
+                disposition.action === "discard" &&
+                /^abandon-[a-f0-9]{64}$/u.test(disposition.failureId) &&
+                !retainedInputs.some((original) => original.updateId === disposition.updateId &&
+                    original.state === "committed")))
             fail("committed abandonment lost its private original");
         // Re-enumeration has the same bound, rather than allocating an unbounded census.
         files = snapshot ? 1 : 0;
         if (segments && !isDeepStrictEqual(names, enumerate()))
             fail("changed segment namespace");
         files += names.length;
-        if (retention && !isDeepStrictEqual(retentionNames, enumerate(retentionDirectory, retentionPattern)))
+        if (retention &&
+            !isDeepStrictEqual(retentionNames, enumerate(retentionDirectory, retentionPattern)))
             fail("changed private retention namespace");
         files += retentionNames.length;
         for (const [target, before] of observed) {
             const after = status(target);
-            const compare = selectedVersion !== undefined && ancestors.has(target) ? sameAncestor : same;
+            const compare = selectedVersion !== undefined && ancestors.has(target)
+                ? sameAncestor
+                : same;
             if (before ? !after || !compare(before, after) : after !== undefined)
                 fail("changed observed namespace or file");
         }
@@ -1318,14 +1631,27 @@ function acquireTelegramUpdateJournalFamily(input, selectedVersion, inspectReten
                 if (file.version !== selectedVersion) {
                     throw createJournalError("unsupported-version", path, "does not match the selected source version");
                 }
-                if (createTelegramUpdateJournalReceiptScope({ profileName: input.profile, botIdentity: expected }) !==
-                    createTelegramUpdateJournalReceiptScope({ profileName: file.profile, botIdentity: file.botIdentity })) {
+                if (createTelegramUpdateJournalReceiptScope({
+                    profileName: input.profile,
+                    botIdentity: expected,
+                }) !==
+                    createTelegramUpdateJournalReceiptScope({
+                        profileName: file.profile,
+                        botIdentity: file.botIdentity,
+                    })) {
                     throw createJournalError("identity-mismatch", path, "does not retain the expected receipt scope");
                 }
             }
         }
         return {
-            evidence: file ? { kind: "present", file, ...(knownBotId !== undefined ? { knownBotId } : {}), accounting: { files, bytes, work } } : { kind: "absent" },
+            evidence: file
+                ? {
+                    kind: "present",
+                    file,
+                    ...(knownBotId !== undefined ? { knownBotId } : {}),
+                    accounting: { files, bytes, work },
+                }
+                : { kind: "absent" },
             snapshotRevision,
             segments: acquiredSegments,
             ...(inspectRetention ? { retainedInputs } : {}),
@@ -1346,9 +1672,19 @@ export function inspectTelegramSessionJournalNamespace(input) {
 }
 function inspectTelegramJournalNamespace(input, includeSessions) {
     const { directory, profile, limits } = input;
-    const fail = (message) => { throw createJournalError("invalid", directory, message); };
-    const capacity = () => { throw createJournalError("capacity", directory, "exceeds namespace inspection resource limits"); };
-    for (const key of ["maxDirectoryEntries", "maxFiles", "maxBytes", "maxEntries", "maxWork"]) {
+    const fail = (message) => {
+        throw createJournalError("invalid", directory, message);
+    };
+    const capacity = () => {
+        throw createJournalError("capacity", directory, "exceeds namespace inspection resource limits");
+    };
+    for (const key of [
+        "maxDirectoryEntries",
+        "maxFiles",
+        "maxBytes",
+        "maxEntries",
+        "maxWork",
+    ]) {
         if (!isSafePositiveInteger(limits[key]))
             fail("requires positive safe-integer limits");
     }
@@ -1357,26 +1693,37 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
     const expected = validateBotIdentity(input.botIdentity, directory);
     if (!isAbsolute(directory) || resolve(directory) !== directory)
         fail("requires a canonical directory anchor");
-    if (!constants.O_NOFOLLOW || !constants.O_NONBLOCK)
-        fail("platform lacks no-follow nonblocking open evidence");
     const metadata = (target) => {
         const value = lstatSync(target, { bigint: true });
-        return { dev: value.dev, ino: value.ino, mode: value.mode, nlink: value.nlink,
-            size: value.size, mtimeNs: value.mtimeNs, ctimeNs: value.ctimeNs };
+        return {
+            dev: value.dev,
+            ino: value.ino,
+            mode: value.mode,
+            nlink: value.nlink,
+            size: value.size,
+            mtimeNs: value.mtimeNs,
+            ctimeNs: value.ctimeNs,
+        };
     };
     const suffix = profile === "default" ? "" : `.${profile}`;
     const pollingPath = input.pollingPath ?? join(directory, `inbox${suffix}.json`);
     const polling = relative(directory, pollingPath);
     {
         const parts = polling.split(sep);
-        if (!isAbsolute(pollingPath) || resolve(pollingPath) !== pollingPath || parts.at(-1) !== `inbox${suffix}.json` ||
-            !(parts.length === 1 || (parts.length === 3 && parts[0] === "sessions" &&
-                decodeTelegramSessionDirectoryName(parts[1]) !== undefined)))
+        if (!isAbsolute(pollingPath) ||
+            resolve(pollingPath) !== pollingPath ||
+            parts.at(-1) !== `inbox${suffix}.json` ||
+            !(parts.length === 1 ||
+                (parts.length === 3 &&
+                    parts[0] === "sessions" &&
+                    decodeTelegramSessionDirectoryName(parts[1]) !== undefined)))
             fail("requires a canonical polling journal path");
     }
     try {
         const root = lstatSync(directory);
-        if (!root.isDirectory() || root.isSymbolicLink() || realpathSync(directory) !== directory)
+        if (!root.isDirectory() ||
+            root.isSymbolicLink() ||
+            realpathSync(directory) !== directory)
             fail("requires a canonical directory anchor");
         const beforeRoot = metadata(directory);
         const census = () => {
@@ -1405,7 +1752,8 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
             };
             const requireType = (target, isDirectory) => {
                 const value = lstatSync(target);
-                if (value.isSymbolicLink() || !(isDirectory ? value.isDirectory() : value.isFile()) ||
+                if (value.isSymbolicLink() ||
+                    !(isDirectory ? value.isDirectory() : value.isFile()) ||
                     (!isDirectory && value.nlink !== 1))
                     fail("has a linked or unexpected journal type");
             };
@@ -1451,7 +1799,9 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
                 if (!/inbox/iu.test(name))
                     return;
                 const match = /^(inbox|follower-inbox-[a-f0-9]{16})(?:\.([a-z0-9]{1,32}))?\.json(\.(?:segments|retained))?$/u.exec(name);
-                if (!match || match[2] === "default" || (!includeSessions && match[3] === ".retained"))
+                if (!match ||
+                    match[2] === "default" ||
+                    (!includeSessions && match[3] === ".retained"))
                     fail("has a noncanonical journal-like entry");
                 requireType(target, !!match[3]);
                 if (includeSessions && match[3])
@@ -1461,26 +1811,58 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
                 if (familyProfile === profile && base !== pollingPath)
                     families.set(base, match[1] === "inbox" ? "session" : "follower");
             });
-            return { entries: [...entries].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0),
-                families: [...families].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0), profiles: [...profiles].sort() };
+            return {
+                entries: [...entries].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
+                families: [...families].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0),
+                profiles: [...profiles].sort(),
+            };
         };
         const before = census();
-        const sourceInventory = [[pollingPath, "polling"], ...before.families];
+        const sourceInventory = [
+            [pollingPath, "polling"],
+            ...before.families,
+        ];
         const sources = [];
         const retainedInputs = [];
-        const accounting = { directoryEntries: before.entries.length, files: 0, bytes: 0, work: 0 };
+        const accounting = {
+            directoryEntries: before.entries.length,
+            files: 0,
+            bytes: 0,
+            work: 0,
+        };
         let knownBotId = expected.botId;
         for (const [path, role] of sourceInventory) {
-            const remaining = { maxFiles: limits.maxFiles - accounting.files, maxBytes: limits.maxBytes - accounting.bytes,
-                maxWork: limits.maxWork - accounting.work, maxEntries: limits.maxEntries };
-            if (remaining.maxFiles <= 0 || remaining.maxBytes <= 0 || remaining.maxWork <= 0)
+            const remaining = {
+                maxFiles: limits.maxFiles - accounting.files,
+                maxBytes: limits.maxBytes - accounting.bytes,
+                maxWork: limits.maxWork - accounting.work,
+                maxEntries: limits.maxEntries,
+            };
+            if (remaining.maxFiles <= 0 ||
+                remaining.maxBytes <= 0 ||
+                remaining.maxWork <= 0)
                 capacity();
-            const acquire = () => acquireTelegramUpdateJournalFamily({ directory, path, profile,
-                botIdentity: { ...expected, ...(knownBotId !== undefined ? { botId: knownBotId } : {}) }, limits: remaining }, undefined, includeSessions);
-            const acquired = input.withSourceReference ? input.withSourceReference(path, acquire) : acquire();
+            const acquire = () => acquireTelegramUpdateJournalFamily({
+                directory,
+                path,
+                profile,
+                botIdentity: {
+                    ...expected,
+                    ...(knownBotId !== undefined ? { botId: knownBotId } : {}),
+                },
+                limits: remaining,
+            }, undefined, includeSessions);
+            const acquired = input.withSourceReference
+                ? input.withSourceReference(path, acquire)
+                : acquire();
             const evidence = acquired.evidence;
-            retainedInputs.push(...(acquired.retainedInputs ?? []).map(original => ({ ...original, journalPath: path })));
-            if (evidence.kind === "absent" && (role !== "polling" || before.entries.some(([entry]) => entry === polling || entry === `${polling}.segments`))) {
+            retainedInputs.push(...(acquired.retainedInputs ?? []).map((original) => ({
+                ...original,
+                journalPath: path,
+            })));
+            if (evidence.kind === "absent" &&
+                (role !== "polling" ||
+                    before.entries.some(([entry]) => entry === polling || entry === `${polling}.segments`))) {
                 fail("lost a discovered journal family");
             }
             if (evidence.kind === "present") {
@@ -1488,13 +1870,15 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
                 accounting.files += evidence.accounting.files;
                 accounting.bytes += evidence.accounting.bytes;
             }
-            accounting.work += evidence.kind === "present" ? Math.max(1, evidence.accounting.work) : 1;
+            accounting.work +=
+                evidence.kind === "present" ? Math.max(1, evidence.accounting.work) : 1;
             sources.push({ role, path, evidence });
         }
         const namespaceCurrent = () => {
             try {
-                return isDeepStrictEqual(beforeRoot, metadata(directory)) && isDeepStrictEqual(before, census()) &&
-                    isDeepStrictEqual(beforeRoot, metadata(directory));
+                return (isDeepStrictEqual(beforeRoot, metadata(directory)) &&
+                    isDeepStrictEqual(before, census()) &&
+                    isDeepStrictEqual(beforeRoot, metadata(directory)));
             }
             catch {
                 return false;
@@ -1502,7 +1886,12 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
         };
         if (!namespaceCurrent())
             fail("changed observed root namespace or identity");
-        return { sources, accounting, ...(includeSessions ? { retainedInputs } : {}), ...(knownBotId !== undefined ? { knownBotId } : {}) };
+        return {
+            sources,
+            accounting,
+            ...(includeSessions ? { retainedInputs } : {}),
+            ...(knownBotId !== undefined ? { knownBotId } : {}),
+        };
     }
     catch (error) {
         if (error instanceof TelegramUpdateJournalError)
@@ -1510,35 +1899,105 @@ function inspectTelegramJournalNamespace(input, includeSessions) {
         throw createJournalError("io", directory, "could not establish canonical namespace evidence", error);
     }
 }
+/** Whether an update addresses this private-chat Thread anywhere in its payload (message, callback, reaction, …). */
+export function doesTelegramJournalUpdateNameThread(update, target) {
+    const matches = (value, depth) => {
+        if (depth > 8 || !value || typeof value !== "object")
+            return false;
+        const record = value;
+        if (record.message_thread_id === target.threadId) {
+            const chat = record.chat;
+            if (!chat || typeof chat !== "object" || chat.id === target.chatId)
+                return true;
+        }
+        return Object.values(record).some((child) => matches(child, depth + 1));
+    };
+    return matches(update, 0);
+}
+/** A button tap alone carries no input, so it never keeps a tab whose inputs are resolved (the in-flight Cancel itself). */
+export function isTelegramJournalLoneCallbackUpdate(update) {
+    if (!update || typeof update !== "object")
+        return false;
+    const kinds = Object.keys(update).filter((key) => key !== "update_id");
+    return kinds.length === 1 && kinds[0] === "callback_query";
+}
+/** Plain inbound kinds whose address is readable; anything else stays protective. */
+const TELEGRAM_CLEANUP_PLAIN_UPDATE_KINDS = [
+    "message",
+    "edited_message",
+    "callback_query",
+    "message_reaction",
+];
 /** Complete-empty protection only; caller holds source serialization through consumption. Never deletion authority. */
 export function isTelegramThreadCleanupJournalNamespaceClear(input) {
-    if (!input.requiredJournalBindingKeys.length || input.requiredJournalBindingKeys.length > input.limits.maxDirectoryEntries)
+    if (!input.requiredJournalBindingKeys.length ||
+        input.requiredJournalBindingKeys.length > input.limits.maxDirectoryEntries)
         throw new Error("Telegram temporary cleanup requires bounded exact journal references.");
     const requiredPaths = new Set();
     for (const key of input.requiredJournalBindingKeys) {
         const path = getTelegramUpdateJournalBindingPath(key);
-        const identities = [input.botIdentity, { tokenSha256: input.botIdentity.tokenSha256 }];
-        if (!path || !identities.some(botIdentity => key === createTelegramUpdateJournalBindingKey({
-            path, profileName: input.profile, botIdentity,
-        })))
+        const identities = [
+            input.botIdentity,
+            { tokenSha256: input.botIdentity.tokenSha256 },
+        ];
+        if (!path ||
+            !identities.some((botIdentity) => key ===
+                createTelegramUpdateJournalBindingKey({
+                    path,
+                    profileName: input.profile,
+                    botIdentity,
+                })))
             throw new Error("Telegram temporary cleanup has foreign or malformed journal references.");
         requiredPaths.add(path);
     }
     const namespace = inspectTelegramSessionJournalNamespace(input);
-    if (namespace.sources.filter(source => source.role === "polling").length !== 1 ||
-        namespace.retainedInputs?.some(original => original.state !== "committed") ||
-        [...requiredPaths].some(path => !namespace.sources.some(source => source.path === path && source.evidence.kind === "present")))
+    if (namespace.sources.filter((source) => source.role === "polling").length !==
+        1 ||
+        namespace.retainedInputs?.some((original) => original.state !== "committed") ||
+        [...requiredPaths].some((path) => !namespace.sources.some((source) => source.path === path && source.evidence.kind === "present")))
         return false;
-    // Original Telegram targets do not certify execution ownership. No nonempty family gets a source exemption.
-    return namespace.sources.every(source => source.evidence.kind === "absent" || source.evidence.file.entries.length === 0);
+    const cleanup = input.cleanup;
+    const ownPaths = new Map();
+    for (const own of cleanup?.ownInputs ?? []) {
+        const path = getTelegramUpdateJournalBindingPath(own.journalBindingKey);
+        if (!path)
+            return false;
+        const ids = ownPaths.get(path) ?? new Set();
+        for (const id of own.updateIds)
+            ids.add(id);
+        ownPaths.set(path, ids);
+    }
+    // Custody-bearing, failed or unreadable work protects every tab: its reply target is not its message address.
+    const isUnrelatedPlainInput = (entry, path) => {
+        const kinds = Object.keys(entry.update).filter((key) => key !== "update_id");
+        return (!!cleanup &&
+            entry.state === "pending" &&
+            !entry.queueOwner &&
+            !entry.queueReceiptId &&
+            !entry.queueKind &&
+            !entry.queueHandoff &&
+            !entry.inputClaim &&
+            !("inputProvenance" in entry) &&
+            !entry.failure &&
+            kinds.length === 1 &&
+            TELEGRAM_CLEANUP_PLAIN_UPDATE_KINDS.includes(kinds[0]) &&
+            (isTelegramJournalLoneCallbackUpdate(entry.update) ||
+                !doesTelegramJournalUpdateNameThread(entry.update, cleanup.target)) &&
+            !ownPaths.get(path)?.has(entry.updateId));
+    };
+    return namespace.sources.every((source) => source.evidence.kind === "absent" ||
+        source.evidence.file.entries.every((entry) => isUnrelatedPlainInput(entry, source.path)));
 }
 function cloneEntry(entry) {
     return {
         ...entry,
         update: structuredClone(entry.update),
-        ...(entry.inputClaim ? { inputClaim: structuredClone(entry.inputClaim) } : {}),
+        ...(entry.inputClaim
+            ? { inputClaim: structuredClone(entry.inputClaim) }
+            : {}),
         ...(entry.inputProvenance
-            ? { inputProvenance: structuredClone(entry.inputProvenance) } : {}),
+            ? { inputProvenance: structuredClone(entry.inputProvenance) }
+            : {}),
         ...(entry.queueOwner
             ? { queueOwner: cloneJournalQueueOwner(entry.queueOwner) }
             : {}),
@@ -1559,7 +2018,13 @@ function cloneFile(file) {
         profile: file.profile,
         botIdentity: { ...file.botIdentity },
         entries: file.entries.map(cloneEntry),
-        ...(file.sourceCompletions?.length ? { sourceCompletions: file.sourceCompletions.map(completion => ({ ...completion })) } : {}),
+        ...(file.sourceCompletions?.length
+            ? {
+                sourceCompletions: file.sourceCompletions.map((completion) => ({
+                    ...completion,
+                })),
+            }
+            : {}),
         ...(file.operatorDispositions?.length
             ? {
                 operatorDispositions: file.operatorDispositions.map((disposition) => ({ ...disposition })),
@@ -1590,7 +2055,8 @@ function publishTelegramUpdateJournalSegmentUnlocked(path, segment, onPublicatio
     let snapshotRevision = 0;
     try {
         const parsed = JSON.parse(readFileSync(path, "utf8"));
-        snapshotRevision = parseJournalFile(parsed, path, segment.version).revision ?? 0;
+        snapshotRevision =
+            parseJournalFile(parsed, path, segment.version).revision ?? 0;
     }
     catch (error) {
         if (error?.code !== "ENOENT")
@@ -1661,7 +2127,9 @@ function mergeBotIdentity(stored, current) {
 }
 function createPendingRetentionReference(input) {
     const { path, journalBindingKey, entry, maxBytes } = input;
-    const evidenceSha256 = createHash("sha256").update(JSON.stringify({ journalBindingKey, entry })).digest("hex");
+    const evidenceSha256 = createHash("sha256")
+        .update(JSON.stringify({ journalBindingKey, entry }))
+        .digest("hex");
     const failureId = `abandon-${evidenceSha256}`;
     const retainedDirectory = `${path}.retained`;
     const retainedPath = join(retainedDirectory, `${failureId}.json`);
@@ -1687,22 +2155,37 @@ function createPendingRetentionReference(input) {
                 return undefined;
             throw error;
         }
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes + 4096) {
+        if (!stat.isFile() ||
+            stat.isSymbolicLink() ||
+            stat.size > maxBytes + 4096) {
             throw createJournalError("invalid", retainedPath, "retained input is not a bounded regular file");
         }
         const retained = JSON.parse(readFileSync(retainedPath, "utf8"));
         if (!isRecord(retained))
             throw createJournalError("invalid", retainedPath, "retained input is not an evidence record");
         const disposition = validateJournalOperatorDisposition(retained.requestedDisposition, retainedPath);
-        if (!("dispositionKind" in disposition) || disposition.dispositionKind !== "legacy-custody" ||
-            disposition.failureId !== failureId || disposition.updateId !== entry.updateId ||
-            disposition.action !== "discard" || disposition.evidenceSha256 !== evidenceSha256 ||
-            !isDeepStrictEqual(retained, { version: 1, kind: "pending-input-retention", journalBindingKey,
-                entry, requestedDisposition: disposition })) {
+        if (!("dispositionKind" in disposition) ||
+            disposition.dispositionKind !== "legacy-custody" ||
+            disposition.failureId !== failureId ||
+            disposition.updateId !== entry.updateId ||
+            disposition.action !== "discard" ||
+            disposition.evidenceSha256 !== evidenceSha256 ||
+            !isDeepStrictEqual(retained, {
+                version: 1,
+                kind: "pending-input-retention",
+                journalBindingKey,
+                entry,
+                requestedDisposition: disposition,
+            })) {
             throw createJournalError("conflict", retainedPath, "retained input does not match abandonment evidence");
         }
-        return { version: 1, kind: "pending-input-retention", journalBindingKey, entry,
-            requestedDisposition: disposition };
+        return {
+            version: 1,
+            kind: "pending-input-retention",
+            journalBindingKey,
+            entry,
+            requestedDisposition: disposition,
+        };
     };
     return { evidenceSha256, failureId, retainedPath, read };
 }
@@ -1826,26 +2309,47 @@ export function createTelegramUpdateJournalRuntimeBindingResolver(deps) {
         });
         const path = deps.getJournalPath(configuredProfileName);
         const workspaceAdmission = deps.getWorkspaceAdmission?.();
-        const sourceAccess = { directory: dirname(path), limits: {
-                maxFiles: 1024, maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
-                maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES, maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024,
-            } };
-        const options = { path, profileName, botIdentity,
-            ...(deps.getQueueRuntimeIdentity ? { queueRuntimeIdentity: deps.getQueueRuntimeIdentity() } : {}),
+        const sourceAccess = {
+            directory: dirname(path),
+            limits: {
+                maxFiles: 1024,
+                maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
+                maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES,
+                maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024,
+            },
+        };
+        const options = {
+            path,
+            profileName,
+            botIdentity,
+            ...(deps.getQueueRuntimeIdentity
+                ? { queueRuntimeIdentity: deps.getQueueRuntimeIdentity() }
+                : {}),
             ...(workspaceAdmission ? { workspaceAdmission } : {}),
-            ...(deps.withWriterAdmission ? { withWriterAdmission: deps.withWriterAdmission } : {}),
-            ...(deps.withSourceSerialization ? { withSourceSerialization: deps.withSourceSerialization } : {}),
-            ...(deps.onRecovery ? { onRecovery: deps.onRecovery } : {}) };
+            ...(deps.withWriterAdmission
+                ? { withWriterAdmission: deps.withWriterAdmission }
+                : {}),
+            ...(deps.withSourceSerialization
+                ? { withSourceSerialization: deps.withSourceSerialization }
+                : {}),
+            ...(deps.onRecovery ? { onRecovery: deps.onRecovery } : {}),
+        };
         const journal = createTelegramUpdateJournalStore(options);
-        // Scoped completion and receipt observation use strict private handles where the platform provides no-follow
-        // evidence; elsewhere (Windows) the same capabilities read through the ordinary journal so queue receipts still work.
-        const strict = deps.strictSourceAccess ?? Boolean(constants.O_NOFOLLOW && constants.O_NONBLOCK);
+        // Scoped completion and receipt observation always use strict private handles; see TELEGRAM_STRICT_READ_FLAGS.
+        const strict = deps.strictSourceAccess ?? true;
         const completionJournal = deps.withSourceSerialization
-            ? createTelegramUpdateJournalStore({ ...options, ...(strict ? { sourceAccess } : {}) }) : undefined;
+            ? createTelegramUpdateJournalStore({
+                ...options,
+                ...(strict ? { sourceAccess } : {}),
+            })
+            : undefined;
         // Queue receipt readiness gates every ordinary prompt; without strict handles it uses the ordinary journal read.
         const observeQueuedReceipt = (expected) => strict
             ? completionJournal.inspectQueuedReceipt(expected)
-            : inspectJournalQueuedReceipt(journal.read(), { ...expected, queueOwner: validateQueuedReceiptObservation(expected, path) }, path);
+            : inspectJournalQueuedReceipt(journal.read(), {
+                ...expected,
+                queueOwner: validateQueuedReceiptObservation(expected, path),
+            }, path);
         return {
             runtimeKey: JSON.stringify({
                 path,
@@ -1860,25 +2364,48 @@ export function createTelegramUpdateJournalRuntimeBindingResolver(deps) {
             readForProtection() {
                 // Protection must never turn corruption/recovery into empty-work evidence.
                 const evidence = inspectTelegramUpdateJournalFamily({
-                    ...sourceAccess, path, profile: profileName, botIdentity,
+                    ...sourceAccess,
+                    path,
+                    profile: profileName,
+                    botIdentity,
                 });
-                return { entries: evidence.kind === "present" ? evidence.file.entries : [], exists: evidence.kind === "present" };
+                return {
+                    entries: evidence.kind === "present" ? evidence.file.entries : [],
+                    exists: evidence.kind === "present",
+                };
             },
-            journal: completionJournal ? { ...journal,
-                removeCompletedExact(updateIds, expectedSources, completions) {
-                    return completions !== undefined ? completionJournal.removeCompletedExact(updateIds, expectedSources, completions)
-                        : journal.removeCompletedExact(updateIds, expectedSources);
-                },
-                completeQueuedExact(receipts, completions) { return completionJournal.completeQueuedExact(receipts, completions); },
-                inspectSourceCompletion(expected) { return completionJournal.inspectSourceCompletion(expected); },
-                inspectQueuedReceipt: observeQueuedReceipt,
-                isQueueReceiptCurrent(receipt, owner) {
-                    if (receipt.journalBindingKey !== createTelegramUpdateJournalBindingKey({ path, profileName, botIdentity }))
-                        return false;
-                    return observeQueuedReceipt({ queueKind: receipt.queueKind, receiptId: receipt.receiptId,
-                        sourceUpdateIds: [...receipt.sourceUpdateIds], queueOwner: { ...owner } }) !== undefined;
-                },
-            } : journal,
+            journal: completionJournal
+                ? {
+                    ...journal,
+                    removeCompletedExact(updateIds, expectedSources, completions, isCurrent) {
+                        return completions !== undefined
+                            ? completionJournal.removeCompletedExact(updateIds, expectedSources, completions, isCurrent)
+                            : journal.removeCompletedExact(updateIds, expectedSources, undefined, isCurrent);
+                    },
+                    completeQueuedExact(receipts, completions) {
+                        return completionJournal.completeQueuedExact(receipts, completions);
+                    },
+                    inspectSourceCompletion(expected) {
+                        return completionJournal.inspectSourceCompletion(expected);
+                    },
+                    inspectQueuedReceipt: observeQueuedReceipt,
+                    isQueueReceiptCurrent(receipt, owner) {
+                        if (receipt.journalBindingKey !==
+                            createTelegramUpdateJournalBindingKey({
+                                path,
+                                profileName,
+                                botIdentity,
+                            }))
+                            return false;
+                        return (observeQueuedReceipt({
+                            queueKind: receipt.queueKind,
+                            receiptId: receipt.receiptId,
+                            sourceUpdateIds: [...receipt.sourceUpdateIds],
+                            queueOwner: { ...owner },
+                        }) !== undefined);
+                    },
+                }
+                : journal,
         };
     };
 }
@@ -1899,12 +2426,13 @@ export function createTelegramUpdateJournalReferenceRegistry(input = {}) {
                 released = true;
             };
         },
-        list: () => [...active.values()].map(reference => ({ ...reference })),
+        list: () => [...active.values()].map((reference) => ({ ...reference })),
         withReference(reference, operation) {
             const release = this.acquire(reference);
             try {
                 const result = operation();
-                if (result && typeof result.finally === "function")
+                if (result &&
+                    typeof result.finally === "function")
                     return result.finally(release);
                 release();
                 return result;
@@ -1920,15 +2448,23 @@ export function withTelegramResolvedUpdateJournalReference(input) {
     const binding = input.resolveBinding();
     if (!binding)
         return undefined;
-    return input.registry.withReference({ referenceClass: input.referenceClass,
-        recoveryKey: binding.recoveryKey }, () => input.operation(binding));
+    return input.registry.withReference({ referenceClass: input.referenceClass, recoveryKey: binding.recoveryKey }, () => input.operation(binding));
 }
 function validateQueuedReceiptObservation(expected, path) {
-    if (!isRecord(expected) || !hasOnlyKeys(expected, ["queueKind", "receiptId", "sourceUpdateIds", "queueOwner"]) || (expected.queueKind !== "prompt" && expected.queueKind !== "control") ||
+    if (!isRecord(expected) ||
+        !hasOnlyKeys(expected, [
+            "queueKind",
+            "receiptId",
+            "sourceUpdateIds",
+            "queueOwner",
+        ]) ||
+        (expected.queueKind !== "prompt" && expected.queueKind !== "control") ||
         !isNonEmptyString(expected.receiptId) ||
-        !Array.isArray(expected.sourceUpdateIds) || expected.sourceUpdateIds.length === 0 ||
+        !Array.isArray(expected.sourceUpdateIds) ||
+        expected.sourceUpdateIds.length === 0 ||
         expected.sourceUpdateIds.length > TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES ||
-        expected.sourceUpdateIds.some((id, index) => !isSafeNonNegativeInteger(id) || (index > 0 && id <= expected.sourceUpdateIds[index - 1]))) {
+        expected.sourceUpdateIds.some((id, index) => !isSafeNonNegativeInteger(id) ||
+            (index > 0 && id <= expected.sourceUpdateIds[index - 1]))) {
         throw createJournalError("invalid", path, "received invalid queue receipt observation authority");
     }
     return validateJournalQueueOwner(expected.queueOwner, path);
@@ -1937,19 +2473,31 @@ function inspectJournalQueuedReceipt(file, expected, path) {
     if (!isTelegramUpdateJournalLegacyFamilyVersion(file.version))
         throw createJournalError("invalid", path, "queue receipt observation requires an exact legacy v1 source handle");
     const { queueOwner } = expected;
-    const entries = file.entries.filter(entry => entry.queueReceiptId === expected.receiptId);
-    if (entries.length !== expected.sourceUpdateIds.length || entries.some((entry, index) => entry.updateId !== expected.sourceUpdateIds[index] || entry.state !== "queued" || entry.queueKind !== expected.queueKind ||
-        entry.queueHandoff !== undefined || !isDeepStrictEqual(entry.queueOwner, queueOwner)))
+    const entries = file.entries.filter((entry) => entry.queueReceiptId === expected.receiptId);
+    if (entries.length !== expected.sourceUpdateIds.length ||
+        entries.some((entry, index) => entry.updateId !== expected.sourceUpdateIds[index] ||
+            entry.state !== "queued" ||
+            entry.queueKind !== expected.queueKind ||
+            entry.queueHandoff !== undefined ||
+            !isDeepStrictEqual(entry.queueOwner, queueOwner)))
         return undefined;
-    return { receipt: { queueKind: expected.queueKind, receiptId: expected.receiptId,
-            sourceUpdateIds: [...expected.sourceUpdateIds], queueOwner: { ...queueOwner } },
+    return {
+        receipt: {
+            queueKind: expected.queueKind,
+            receiptId: expected.receiptId,
+            sourceUpdateIds: [...expected.sourceUpdateIds],
+            queueOwner: { ...queueOwner },
+        },
         sources: entries.map(createTelegramUpdateJournalEntryDigest),
-        queueOwnerSha256: createHash("sha256").update(JSON.stringify(queueOwner)).digest("hex") };
+        queueOwnerSha256: createHash("sha256")
+            .update(JSON.stringify(queueOwner))
+            .digest("hex"),
+    };
 }
 function inspectJournalSourceCompletion(file, completion, path) {
     if (!isTelegramUpdateJournalLegacyFamilyVersion(file.version))
         throw createJournalError("invalid", path, "source completion requires a legacy v1 source");
-    const retained = file.sourceCompletions?.find(value => value.updateId === completion.updateId);
+    const retained = file.sourceCompletions?.find((value) => value.updateId === completion.updateId);
     if (!retained)
         return undefined;
     if (!isDeepStrictEqual(retained, completion))
@@ -1959,35 +2507,48 @@ function inspectJournalSourceCompletion(file, completion, path) {
 /** Operator-distinct authority: routing never treats it as an owner cancellation. */
 export const TELEGRAM_SESSION_ADOPTION_AUTHORITY_PREFIX = "session-successor:";
 function isAdoptablePendingEntry(entry) {
-    return entry.state === "pending" && !entry.inputClaim && !entry.inputProvenance && !entry.routingInput &&
-        !entry.queueOwner && !entry.queueHandoff && !entry.queueReceiptId && !entry.queueKind && !entry.failure &&
-        entry.preApprovalExcluded !== true;
+    return (entry.state === "pending" &&
+        !entry.inputClaim &&
+        !entry.inputProvenance &&
+        !entry.routingInput &&
+        !entry.queueOwner &&
+        !entry.queueHandoff &&
+        !entry.queueReceiptId &&
+        !entry.queueKind &&
+        !entry.failure &&
+        entry.preApprovalExcluded !== true);
 }
 export function createTelegramUpdateJournalBindingRuntime(deps) {
     const resolveLeader = createTelegramUpdateJournalRuntimeBindingResolver({
         ...deps.base,
         getJournalPath: deps.getLeaderJournalPath,
     });
+    // Follower and path journals share identity and admission ports, never the leader's queue identity or strict source mode.
+    const getSharedResolverPorts = () => ({
+        getProfileName: deps.base.getProfileName,
+        getBotToken: deps.base.getBotToken,
+        getBotId: deps.base.getBotId,
+        ...(deps.base.withWriterAdmission
+            ? { withWriterAdmission: deps.base.withWriterAdmission }
+            : {}),
+        // Follower journals need the same strict exact-receipt ports as the leader; without them queue publication cannot complete.
+        ...(deps.base.withSourceSerialization
+            ? { withSourceSerialization: deps.base.withSourceSerialization }
+            : {}),
+        ...(deps.base.getWorkspaceAdmission
+            ? { getWorkspaceAdmission: deps.base.getWorkspaceAdmission }
+            : {}),
+        ...(deps.base.onRecovery ? { onRecovery: deps.base.onRecovery } : {}),
+    });
     const createFollowerResolver = (bindingKey, includeQueueRuntimeIdentity, sessionId, legacy = false) => {
         // Session-aware composition must not fall back to a process journal before preparation supplies its ID.
         if (!legacy && deps.getActiveFollowerSessionId && !sessionId)
             return () => undefined;
         return createTelegramUpdateJournalRuntimeBindingResolver({
-            getProfileName: deps.base.getProfileName,
-            getBotToken: deps.base.getBotToken,
-            getBotId: deps.base.getBotId,
+            ...getSharedResolverPorts(),
             ...(includeQueueRuntimeIdentity && deps.base.getQueueRuntimeIdentity
                 ? { getQueueRuntimeIdentity: deps.base.getQueueRuntimeIdentity }
                 : {}),
-            ...(deps.base.withWriterAdmission
-                ? { withWriterAdmission: deps.base.withWriterAdmission } : {}),
-            // Follower journals need the same strict exact-receipt ports as the leader; without them queue publication cannot complete.
-            ...(deps.base.withSourceSerialization
-                ? { withSourceSerialization: deps.base.withSourceSerialization } : {}),
-            ...(deps.base.getWorkspaceAdmission
-                ? { getWorkspaceAdmission: deps.base.getWorkspaceAdmission }
-                : {}),
-            ...(deps.base.onRecovery ? { onRecovery: deps.base.onRecovery } : {}),
             getJournalPath(profileName) {
                 return deps.getFollowerJournalPath(bindingKey, profileName, sessionId);
             },
@@ -2001,8 +2562,15 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
         const profile = deps.base.getProfileName() ?? TELEGRAM_DEFAULT_PROFILE_NAME;
         if (!path || !token)
             return undefined;
-        const botIdentity = createTelegramUpdateJournalBotIdentity({ botToken: token, botId });
-        const keys = [botIdentity, { tokenSha256: botIdentity.tokenSha256 }].map(identity => createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: identity }));
+        const botIdentity = createTelegramUpdateJournalBotIdentity({
+            botToken: token,
+            botId,
+        });
+        const keys = [botIdentity, { tokenSha256: botIdentity.tokenSha256 }].map((identity) => createTelegramUpdateJournalBindingKey({
+            path,
+            profileName: profile,
+            botIdentity: identity,
+        }));
         if (!keys.includes(journalBindingKey))
             return undefined;
         const getRoot = () => deps.getRuntimeDir?.() ?? dirname(deps.getLeaderJournalPath(profile));
@@ -2011,23 +2579,43 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
         const suffix = escapeTelegramJournalPathPattern(getTelegramProfilePathSuffix(profile));
         const flat = new RegExp(`^(?:inbox|follower-inbox-[a-f0-9]{16})${suffix}\\.json$`, "u");
         const session = new RegExp(`^(?:journal\\.[a-f0-9]{16}|inbox)${suffix}\\.json$`, "u");
-        if (!isAbsolute(root) || resolve(root) !== root || !isAbsolute(path) || resolve(path) !== path ||
-            !(parts.length === 1 && flat.test(parts[0]) || parts.length === 3 && parts[0] === "sessions" &&
-                decodeTelegramSessionDirectoryName(parts[1]) !== undefined && session.test(parts[2])))
+        if (!isAbsolute(root) ||
+            resolve(root) !== root ||
+            !isAbsolute(path) ||
+            resolve(path) !== path ||
+            !((parts.length === 1 && flat.test(parts[0])) ||
+                (parts.length === 3 &&
+                    parts[0] === "sessions" &&
+                    decodeTelegramSessionDirectoryName(parts[1]) !== undefined &&
+                    session.test(parts[2]))))
             return undefined;
-        const current = () => deps.base.getBotToken() === token && deps.base.getBotId() === botId &&
-            (deps.base.getProfileName() ?? TELEGRAM_DEFAULT_PROFILE_NAME) === profile && getRoot() === root;
+        const current = () => deps.base.getBotToken() === token &&
+            deps.base.getBotId() === botId &&
+            (deps.base.getProfileName() ?? TELEGRAM_DEFAULT_PROFILE_NAME) ===
+                profile &&
+            getRoot() === root;
         const inspect = () => {
             if (!current())
                 return undefined;
-            const observed = inspectTelegramUpdateJournalRetention({ directory: root, path, profile, botIdentity,
-                limits: { maxFiles: 1024, maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
-                    maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES, maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024 } });
+            const observed = inspectTelegramUpdateJournalRetention({
+                directory: root,
+                path,
+                profile,
+                botIdentity,
+                limits: {
+                    maxFiles: 1024,
+                    maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
+                    maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES,
+                    maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024,
+                },
+            });
             if (observed.evidence.kind !== "present" || !current())
                 return undefined;
             return operation(observed.evidence.file, observed.retainedInputs, path);
         };
-        const result = deps.base.withSourceSerialization ? deps.base.withSourceSerialization(inspect) : inspect();
+        const result = deps.base.withSourceSerialization
+            ? deps.base.withSourceSerialization(inspect)
+            : inspect();
         return current() ? result : undefined;
     };
     let preparedFollower;
@@ -2042,9 +2630,15 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
             if (!sessionId)
                 return undefined;
             const previous = preparedFollower;
-            const result = previous && previous.recipientBindingKey === recipientBindingKey && previous.sessionId !== sessionId
-                ? runtime.adoptPredecessorPending({ recipientBindingKey, predecessorSessionId: previous.sessionId,
-                    successorSessionId: sessionId, isCurrent })
+            const result = previous &&
+                previous.recipientBindingKey === recipientBindingKey &&
+                previous.sessionId !== sessionId
+                ? runtime.adoptPredecessorPending({
+                    recipientBindingKey,
+                    predecessorSessionId: previous.sessionId,
+                    successorSessionId: sessionId,
+                    isCurrent,
+                })
                 : undefined;
             // Only a completed adoption advances the predecessor; failures retry idempotently on the next preparation.
             preparedFollower = { recipientBindingKey, sessionId };
@@ -2054,16 +2648,27 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
             if (!isSafeNonNegativeInteger(updateId))
                 throw new Error("Telegram abandonment proof requires an exact update ID.");
             return inspectHistoricalSource(journalBindingKey, (file, originals) => {
-                const original = originals.find(value => value.updateId === updateId && value.state === "committed" &&
+                const original = originals.find((value) => value.updateId === updateId &&
+                    value.state === "committed" &&
                     value.journalBindingKey === journalBindingKey);
                 if (!original)
                     return undefined;
-                const disposition = file.operatorDispositions?.find(value => value.failureId === original.failureId);
-                if (!disposition || !("dispositionKind" in disposition) || disposition.dispositionKind !== "legacy-custody")
+                const disposition = file.operatorDispositions?.find((value) => value.failureId === original.failureId);
+                if (!disposition ||
+                    !("dispositionKind" in disposition) ||
+                    disposition.dispositionKind !== "legacy-custody")
                     return undefined;
-                return { journalBindingKey, updateId, retainedPath: original.path, operatorAuthorityId: disposition.operatorAuthorityId };
+                return {
+                    journalBindingKey,
+                    updateId,
+                    retainedPath: original.path,
+                    operatorAuthorityId: disposition.operatorAuthorityId,
+                };
             });
         },
+        inspectSourceGroupExpiry(journalBindingKey, updateIds) {
+            return inspectHistoricalSource(journalBindingKey, (file) => inspectRoutingGroupExpiry(file, journalBindingKey, updateIds));
+        },
         inspectSourceCompletion(journalBindingKey, expected) {
             const completion = validateJournalSourceCompletion(expected, getTelegramUpdateJournalBindingPath(journalBindingKey) ?? "journal");
             return inspectHistoricalSource(journalBindingKey, (file, _originals, path) => inspectJournalSourceCompletion(file, completion, path));
@@ -2073,9 +2678,12 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
             return inspectHistoricalSource(journalBindingKey, (file, _originals, path) => inspectJournalQueuedReceipt(file, { ...expected, queueOwner }, path));
         },
         adoptPredecessorPending(input) {
-            const { recipientBindingKey, predecessorSessionId, successorSessionId, isCurrent } = input;
-            if (!recipientBindingKey || !predecessorSessionId || !successorSessionId ||
-                predecessorSessionId === successorSessionId || typeof isCurrent !== "function") {
+            const { recipientBindingKey, predecessorSessionId, successorSessionId, isCurrent, } = input;
+            if (!recipientBindingKey ||
+                !predecessorSessionId ||
+                !successorSessionId ||
+                predecessorSessionId === successorSessionId ||
+                typeof isCurrent !== "function") {
                 throw new Error("Telegram session adoption requires distinct exact session identities.");
             }
             const assertCurrent = () => {
@@ -2085,18 +2693,29 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
             assertCurrent();
             const predecessor = createFollowerResolver(recipientBindingKey, false, predecessorSessionId)();
             const successor = createFollowerResolver(recipientBindingKey, false, successorSessionId)();
-            if (!predecessor?.readForProtection || !successor || predecessor.recoveryKey === successor.recoveryKey) {
+            if (!predecessor?.readForProtection ||
+                !successor ||
+                predecessor.recoveryKey === successor.recoveryKey) {
                 throw new Error("Telegram session adoption requires exact predecessor and successor journals.");
             }
-            const result = { adoptedUpdateIds: [], retainedUpdateIds: [] };
+            const result = {
+                adoptedUpdateIds: [],
+                retainedUpdateIds: [],
+            };
             // Non-repairing selection; the abandonment CAS rechecks each exact entry under the source lock.
-            const candidates = predecessor.readForProtection().entries.filter(isAdoptablePendingEntry)
+            const candidates = predecessor
+                .readForProtection()
+                .entries.filter(isAdoptablePendingEntry)
                 .sort((left, right) => left.updateId - right.updateId);
             for (const entry of candidates) {
                 assertCurrent();
                 // Commit away first: a crash afterwards preserves the private original instead of duplicating execution.
-                const committed = predecessor.journal.abandonPending({ journalBindingKey: predecessor.recoveryKey, entry,
-                    operatorAuthorityId: `${TELEGRAM_SESSION_ADOPTION_AUTHORITY_PREFIX}${successorSessionId}`, isCurrent });
+                const committed = predecessor.journal.abandonPending({
+                    journalBindingKey: predecessor.recoveryKey,
+                    entry,
+                    operatorAuthorityId: `${TELEGRAM_SESSION_ADOPTION_AUTHORITY_PREFIX}${successorSessionId}`,
+                    isCurrent,
+                });
                 if (committed.duplicate) {
                     result.retainedUpdateIds.push(entry.updateId);
                     continue;
@@ -2110,17 +2729,7 @@ export function createTelegramUpdateJournalBindingRuntime(deps) {
         createRecipientResolver: (bindingKey, sessionId) => createFollowerResolver(bindingKey, false, sessionId),
         createLegacyRecipientResolver: (bindingKey) => createFollowerResolver(bindingKey, false, undefined, true),
         createPathResolver: (path) => createTelegramUpdateJournalRuntimeBindingResolver({
-            getProfileName: deps.base.getProfileName,
-            getBotToken: deps.base.getBotToken,
-            getBotId: deps.base.getBotId,
-            ...(deps.base.withWriterAdmission
-                ? { withWriterAdmission: deps.base.withWriterAdmission } : {}),
-            ...(deps.base.withSourceSerialization
-                ? { withSourceSerialization: deps.base.withSourceSerialization } : {}),
-            ...(deps.base.getWorkspaceAdmission
-                ? { getWorkspaceAdmission: deps.base.getWorkspaceAdmission }
-                : {}),
-            ...(deps.base.onRecovery ? { onRecovery: deps.base.onRecovery } : {}),
+            ...getSharedResolverPorts(),
             getJournalPath: () => path,
         }),
     };
@@ -2132,15 +2741,26 @@ export function createTelegramUpdateJournalStore(options) {
 /** Opt-in v3 only; does not migrate old files or expose legacy unowned mutation ports. */
 export function createTelegramInputJournalStore(options) {
     const captured = { ...options };
-    if (!captured.sourceAccess || !captured.queueRuntimeIdentity ||
+    if (!captured.sourceAccess ||
+        !captured.queueRuntimeIdentity ||
         typeof captured.withSourceSerialization !== "function" ||
         typeof captured.withPairingAdmission !== "function" ||
         typeof captured.getInputContext !== "function" ||
-        ("withPairedAdmission" in captured && captured.withPairedAdmission !== undefined)) {
+        ("withPairedAdmission" in captured &&
+            captured.withPairedAdmission !== undefined)) {
         throw new Error("Telegram input custody requires strict serialized polling admission and runtime identity.");
     }
     return createJournalStoreCore({ ...captured, queueRuntimeIdentity: { ...captured.queueRuntimeIdentity } }, captured.getInputContext).input;
 }
+/** Exact unhanded queued receipt member: requested id, queue kind and owner identity. */
+function isExactQueuedReceiptEntry(entry, requestedIds, queueKind, owner) {
+    return (requestedIds.has(entry.updateId) &&
+        entry.state === "queued" &&
+        entry.queueKind === queueKind &&
+        !!entry.queueOwner &&
+        entry.queueHandoff === undefined &&
+        areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, owner));
+}
 function createJournalStoreCore(options, getInputContext) {
     const path = options.path;
     const profile = options.profileName ?? TELEGRAM_DEFAULT_PROFILE_NAME;
@@ -2174,8 +2794,11 @@ function createJournalStoreCore(options, getInputContext) {
     if (withPairingAdmission && withPairedAdmission) {
         throw new Error("Telegram journal admission modes are mutually exclusive.");
     }
-    const version = getInputContext ? TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION
-        : withPairingAdmission ? TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION : TELEGRAM_UPDATE_JOURNAL_VERSION;
+    const version = getInputContext
+        ? TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION
+        : withPairingAdmission
+            ? TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION
+            : TELEGRAM_UPDATE_JOURNAL_VERSION;
     const notifyRecovery = (event) => {
         try {
             options.onRecovery?.(event);
@@ -2361,7 +2984,8 @@ function createJournalStoreCore(options, getInputContext) {
             }
             if (segment.profile !== storedProfile ||
                 !identitiesMatch(segment.botIdentity, storedIdentity) ||
-                (withPairingAdmission && segment.botIdentity.tokenSha256 !== storedIdentity.tokenSha256)) {
+                (withPairingAdmission &&
+                    segment.botIdentity.tokenSha256 !== storedIdentity.tokenSha256)) {
                 throw createJournalError("identity-mismatch", segmentPath, "belongs to another journal identity");
             }
             assertJournalSourceCompletionContinuity(file, segment, segmentPath);
@@ -2377,8 +3001,10 @@ function createJournalStoreCore(options, getInputContext) {
             for (const entry of segment.upsertedEntries) {
                 const previous = entriesById.get(entry.updateId);
                 if (withPairingAdmission &&
-                    ((previous && previous.preApprovalExcluded !== entry.preApprovalExcluded) ||
-                        (!previous && entry.updateId <= (file.acceptedThroughUpdateId ?? -1)))) {
+                    ((previous &&
+                        previous.preApprovalExcluded !== entry.preApprovalExcluded) ||
+                        (!previous &&
+                            entry.updateId <= (file.acceptedThroughUpdateId ?? -1)))) {
                     throw createJournalError("pairing-evidence", segmentPath, "changes exclusion evidence or resurrects a settled source");
                 }
                 entriesById.set(entry.updateId, entry);
@@ -2401,16 +3027,23 @@ function createJournalStoreCore(options, getInputContext) {
                     : file.operatorDispositions?.length
                         ? { operatorDispositions: file.operatorDispositions }
                         : {}),
-                ...(segment.sourceCompletions !== undefined ? { sourceCompletions: segment.sourceCompletions }
-                    : file.sourceCompletions?.length ? { sourceCompletions: file.sourceCompletions } : {}),
+                ...(segment.sourceCompletions !== undefined
+                    ? { sourceCompletions: segment.sourceCompletions }
+                    : file.sourceCompletions?.length
+                        ? { sourceCompletions: file.sourceCompletions }
+                        : {}),
             }, segmentPath, version);
             revision = segment.revision;
         }
         const identityChanged = storedProfile !== profile ||
             !identitiesMatch(file.botIdentity, expectedIdentity) ||
-            ((withPairingAdmission || !!file.sourceCompletions?.length) && file.botIdentity.tokenSha256 !== expectedIdentity.tokenSha256);
+            ((withPairingAdmission || !!file.sourceCompletions?.length) &&
+                file.botIdentity.tokenSha256 !== expectedIdentity.tokenSha256);
         if (identityChanged) {
-            if (file.entries.length > 0 || file.sourceCompletions?.length || withPairingAdmission || !allowReconciliation) {
+            if (file.entries.length > 0 ||
+                file.sourceCompletions?.length ||
+                withPairingAdmission ||
+                !allowReconciliation) {
                 throw createJournalError("identity-mismatch", path, storedProfile !== profile
                     ? `belongs to profile ${storedProfile}, not ${profile}`
                     : "belongs to another Telegram bot identity");
@@ -2592,15 +3225,26 @@ function createJournalStoreCore(options, getInputContext) {
         try {
             // Acquire before the transaction helper can create parents or staging names.
             // The config continuation excludes participating writers through consumption.
-            const source = sourceAccess ? acquireTelegramUpdateJournalFamily({
-                ...sourceAccess, path, profile, botIdentity: expectedIdentity,
-            }, version) : undefined;
+            const source = sourceAccess
+                ? acquireTelegramUpdateJournalFamily({
+                    ...sourceAccess,
+                    path,
+                    profile,
+                    botIdentity: expectedIdentity,
+                }, version)
+                : undefined;
             const readSource = () => {
                 if (!source)
                     return readCurrent();
-                const file = source.evidence.kind === "present" ? source.evidence.file : emptyFile();
-                return { file, exists: source.evidence.kind === "present",
-                    serializedBytes: assertCapacity(file), source };
+                const file = source.evidence.kind === "present"
+                    ? source.evidence.file
+                    : emptyFile();
+                return {
+                    file,
+                    exists: source.evidence.kind === "present",
+                    serializedBytes: assertCapacity(file),
+                    source,
+                };
             };
             return withTelegramFileTransaction(`${path}.transaction`, () => operation(readSource));
         }
@@ -2620,7 +3264,9 @@ function createJournalStoreCore(options, getInputContext) {
         if (!sourceAccess)
             return;
         const limits = sourceAccess.limits;
-        if (files > limits.maxFiles || bytes > limits.maxBytes || work > limits.maxWork ||
+        if (files > limits.maxFiles ||
+            bytes > limits.maxBytes ||
+            work > limits.maxWork ||
             collections.some((length) => length > limits.maxEntries)) {
             throw createJournalError("capacity", path, "publication would exceed source inspection resource limits");
         }
@@ -2628,20 +3274,31 @@ function createJournalStoreCore(options, getInputContext) {
     const inputHeadroomText = "\0".repeat(TELEGRAM_UPDATE_JOURNAL_QUEUE_OWNER_ID_MAX_LENGTH);
     const inputBindingHeadroomText = "\0".repeat(TELEGRAM_UPDATE_JOURNAL_INPUT_BINDING_MAX_LENGTH);
     const inputHandoffHeadroomText = "\0".repeat(TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_ID_MAX_LENGTH);
-    const getFileWork = (file) => file.entries.length + (file.operatorDispositions?.length ?? 0) + (file.sourceCompletions?.length ?? 0);
+    const getFileWork = (file) => file.entries.length +
+        (file.operatorDispositions?.length ?? 0) +
+        (file.sourceCompletions?.length ?? 0);
     const advanceInputHeadroomState = (state, entries, projectionSlack) => {
         const revision = (state.file.revision ?? 0) + 1;
         if (!isSafePositiveInteger(revision))
             throw createJournalError("capacity", path, "exhausted input custody revisions");
         return { file: { ...state.file, revision, entries }, projectionSlack };
     };
-    const replaceInputHeadroomEntry = (file, updateId, replacement) => file.entries.flatMap(entry => entry.updateId === updateId ? (replacement ? [replacement] : []) : [entry]);
+    const replaceInputHeadroomEntry = (file, updateId, replacement) => file.entries.flatMap((entry) => entry.updateId === updateId
+        ? replacement
+            ? [replacement]
+            : []
+        : [entry]);
     const createInputHeadroomClaim = (entry, phase) => ({
         phase,
-        owner: { instanceId: inputHeadroomText, processId: Number.MAX_SAFE_INTEGER,
-            processBirthId: inputHeadroomText, sessionGeneration: Number.MAX_SAFE_INTEGER,
-            acquisitionId: inputHeadroomText, acquiredAtMs: Number.MAX_SAFE_INTEGER,
-            handoffId: inputHandoffHeadroomText },
+        owner: {
+            instanceId: inputHeadroomText,
+            processId: Number.MAX_SAFE_INTEGER,
+            processBirthId: inputHeadroomText,
+            sessionGeneration: Number.MAX_SAFE_INTEGER,
+            acquisitionId: inputHeadroomText,
+            acquiredAtMs: Number.MAX_SAFE_INTEGER,
+            handoffId: inputHandoffHeadroomText,
+        },
         recipientBindingKey: inputBindingHeadroomText,
         executionUpdate: structuredClone(entry.update),
     });
@@ -2656,29 +3313,64 @@ function createJournalStoreCore(options, getInputContext) {
     const createInputHeadroomTransitionPlan = (file, entry) => {
         const initial = { file, projectionSlack: 0 };
         if (entry.inputClaim?.phase === "running")
-            return [advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES)];
-        if (entry.state === "pending" && entry.inputClaim?.phase === "ready" && entry.inputClaim.handoff) {
-            const acceptedClaim = { ...entry.inputClaim,
-                owner: { ...entry.inputClaim.handoff.recipientOwner, acquisitionId: inputHeadroomText,
-                    acquiredAtMs: Number.MAX_SAFE_INTEGER, handoffId: inputHandoffHeadroomText } };
+            return [
+                advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES),
+            ];
+        if (entry.state === "pending" &&
+            entry.inputClaim?.phase === "ready" &&
+            entry.inputClaim.handoff) {
+            const acceptedClaim = {
+                ...entry.inputClaim,
+                owner: {
+                    ...entry.inputClaim.handoff.recipientOwner,
+                    acquisitionId: inputHeadroomText,
+                    acquiredAtMs: Number.MAX_SAFE_INTEGER,
+                    handoffId: inputHandoffHeadroomText,
+                },
+            };
             delete acceptedClaim.handoff;
             const acceptedEntry = { ...entry, inputClaim: acceptedClaim };
             const acceptedState = advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId, acceptedEntry), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES);
-            return [acceptedState, ...createInputHeadroomTransitionPlan(acceptedState.file, acceptedEntry)];
+            return [
+                acceptedState,
+                ...createInputHeadroomTransitionPlan(acceptedState.file, acceptedEntry),
+            ];
         }
         if (entry.state === "pending" && entry.inputClaim?.phase === "ready") {
-            const runningEntry = { ...entry, inputClaim: { ...entry.inputClaim, phase: "running" } };
+            const runningEntry = {
+                ...entry,
+                inputClaim: { ...entry.inputClaim, phase: "running" },
+            };
             const runningState = advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId, runningEntry), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES);
-            return [runningState, advanceInputHeadroomState(runningState, replaceInputHeadroomEntry(runningState.file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES)];
+            return [
+                runningState,
+                advanceInputHeadroomState(runningState, replaceInputHeadroomEntry(runningState.file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES),
+            ];
         }
-        if (entry.state === "pending" && entry.preApprovalExcluded === false && !entry.inputClaim) {
-            const readyEntry = { ...entry, inputClaim: createInputHeadroomClaim(entry, "ready") };
+        if (entry.state === "pending" &&
+            entry.preApprovalExcluded === false &&
+            !entry.inputClaim) {
+            const readyEntry = {
+                ...entry,
+                inputClaim: createInputHeadroomClaim(entry, "ready"),
+            };
             const readyState = advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId, readyEntry), TELEGRAM_UPDATE_JOURNAL_INPUT_PROJECTION_HEADROOM_BYTES);
-            const runningEntry = { ...readyEntry, inputClaim: { ...readyEntry.inputClaim, phase: "running" } };
+            const runningEntry = {
+                ...readyEntry,
+                inputClaim: { ...readyEntry.inputClaim, phase: "running" },
+            };
             const runningState = advanceInputHeadroomState(readyState, replaceInputHeadroomEntry(readyState.file, entry.updateId, runningEntry), TELEGRAM_UPDATE_JOURNAL_INPUT_PROJECTION_HEADROOM_BYTES);
-            return [readyState, runningState, advanceInputHeadroomState(runningState, replaceInputHeadroomEntry(runningState.file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES)];
+            return [
+                readyState,
+                runningState,
+                advanceInputHeadroomState(runningState, replaceInputHeadroomEntry(runningState.file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES),
+            ];
         }
-        return entry.preApprovalExcluded === true ? [advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES)] : [];
+        return entry.preApprovalExcluded === true
+            ? [
+                advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES),
+            ]
+            : [];
     };
     const createInputHeadroomCancelPlan = (file, entry) => {
         if (!entry.inputClaim?.handoff)
@@ -2688,40 +3380,54 @@ function createJournalStoreCore(options, getInputContext) {
         const cancelledEntry = { ...entry, inputClaim: claim };
         const initial = { file, projectionSlack: 0 };
         const cancelledState = advanceInputHeadroomState(initial, replaceInputHeadroomEntry(file, entry.updateId, cancelledEntry), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES);
-        return [cancelledState, ...createInputHeadroomTransitionPlan(cancelledState.file, cancelledEntry)];
+        return [
+            cancelledState,
+            ...createInputHeadroomTransitionPlan(cancelledState.file, cancelledEntry),
+        ];
     };
     const createInputHeadroomReleasePlan = (file, entry, allowOffered = false) => {
         if (entry.inputClaim?.handoff && !allowOffered)
             return [];
         const normal = createInputHeadroomTransitionPlan(file, entry);
-        const readyState = entry.inputClaim?.phase === "ready" ? { file, projectionSlack: 0 } : normal[0];
+        const readyState = entry.inputClaim?.phase === "ready"
+            ? { file, projectionSlack: 0 }
+            : normal[0];
         if (!readyState)
             return [];
-        const readyEntry = readyState.file.entries.find(candidate => candidate.updateId === entry.updateId);
+        const readyEntry = readyState.file.entries.find((candidate) => candidate.updateId === entry.updateId);
         if (readyEntry?.inputClaim?.phase !== "ready")
             return [];
         const releasedEntry = cloneEntry(readyEntry);
         delete releasedEntry.inputClaim;
         const releasedState = advanceInputHeadroomState(readyState, replaceInputHeadroomEntry(readyState.file, entry.updateId, releasedEntry), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES);
         const reacquisition = createInputHeadroomTransitionPlan(releasedState.file, releasedEntry);
-        return [...(readyState.file === file ? [] : [readyState]), releasedState, ...reacquisition];
+        return [
+            ...(readyState.file === file ? [] : [readyState]),
+            releasedState,
+            ...reacquisition,
+        ];
     };
     const createInputHeadroomQueueCompletionPlan = (file, entries) => {
-        if (entries.length === 0 || entries.some(entry => entry.state !== "queued" || entry.queueHandoff))
+        if (entries.length === 0 ||
+            entries.some((entry) => entry.state !== "queued" || entry.queueHandoff))
             return [];
-        const requestedIds = new Set(entries.map(entry => entry.updateId));
+        const requestedIds = new Set(entries.map((entry) => entry.updateId));
         const initial = { file, projectionSlack: 0 };
-        return [advanceInputHeadroomState(initial, file.entries.filter(entry => !requestedIds.has(entry.updateId)), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES)];
+        return [
+            advanceInputHeadroomState(initial, file.entries.filter((entry) => !requestedIds.has(entry.updateId)), TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES),
+        ];
     };
     const getInputHeadroomTransitionPlans = (file, updateId) => {
         if (updateId !== "all") {
             const requestedIds = new Set(typeof updateId === "number" ? [updateId] : [...updateId]);
-            const requestedEntries = file.entries.filter(entry => requestedIds.has(entry.updateId));
+            const requestedEntries = file.entries.filter((entry) => requestedIds.has(entry.updateId));
             const queuedReceiptId = requestedEntries[0]?.queueReceiptId;
-            if (requestedEntries.length === requestedIds.size && queuedReceiptId &&
-                requestedEntries.every(entry => entry.state === "queued" &&
+            if (requestedEntries.length === requestedIds.size &&
+                queuedReceiptId &&
+                requestedEntries.every((entry) => entry.state === "queued" &&
                     entry.queueReceiptId === queuedReceiptId) &&
-                file.entries.filter(entry => entry.queueReceiptId === queuedReceiptId).length === requestedIds.size) {
+                file.entries.filter((entry) => entry.queueReceiptId === queuedReceiptId)
+                    .length === requestedIds.size) {
                 const completion = createInputHeadroomQueueCompletionPlan(file, requestedEntries);
                 return completion.length > 0 ? [completion] : [];
             }
@@ -2731,19 +3437,47 @@ function createJournalStoreCore(options, getInputContext) {
             const plan = entry ? createInputHeadroomTransitionPlan(file, entry) : [];
             const cancel = entry ? createInputHeadroomCancelPlan(file, entry) : [];
             const recover = entry?.inputClaim?.handoff
-                ? createInputHeadroomReleasePlan(file, entry, true) : [];
-            return [plan, cancel, recover].filter(candidate => candidate.length > 0);
+                ? createInputHeadroomReleasePlan(file, entry, true)
+                : [];
+            return [plan, cancel, recover].filter((candidate) => candidate.length > 0);
         }
-        const running = smallestInputHeadroomEntry(file.entries.filter(entry => entry.inputClaim?.phase === "running"));
-        const offered = largestInputHeadroomEntry(file.entries.filter(entry => entry.state === "pending" && entry.inputClaim?.phase === "ready" && entry.inputClaim.handoff), entry => ({ ...entry, inputClaim: { ...entry.inputClaim, owner: {
-                    ...entry.inputClaim.handoff.recipientOwner, acquisitionId: inputHeadroomText,
-                    acquiredAtMs: Number.MAX_SAFE_INTEGER, handoffId: inputHandoffHeadroomText
-                }, handoff: undefined } }));
-        const ready = largestInputHeadroomEntry(file.entries.filter(entry => entry.state === "pending" && entry.inputClaim?.phase === "ready" && !entry.inputClaim.handoff), entry => ({ ...entry, inputClaim: { ...entry.inputClaim, phase: "running" } }));
-        const unclaimed = largestInputHeadroomEntry(file.entries.filter(entry => entry.state === "pending" && entry.preApprovalExcluded === false && !entry.inputClaim), entry => ({ ...entry, inputClaim: createInputHeadroomClaim(entry, "running") }));
-        const excluded = smallestInputHeadroomEntry(file.entries.filter(entry => entry.preApprovalExcluded === true));
-        const representatives = [running, offered, ready, unclaimed, excluded].filter((entry) => entry !== undefined);
-        const plans = representatives.map(entry => createInputHeadroomTransitionPlan(file, entry));
+        const running = smallestInputHeadroomEntry(file.entries.filter((entry) => entry.inputClaim?.phase === "running"));
+        const offered = largestInputHeadroomEntry(file.entries.filter((entry) => entry.state === "pending" &&
+            entry.inputClaim?.phase === "ready" &&
+            entry.inputClaim.handoff), (entry) => ({
+            ...entry,
+            inputClaim: {
+                ...entry.inputClaim,
+                owner: {
+                    ...entry.inputClaim.handoff.recipientOwner,
+                    acquisitionId: inputHeadroomText,
+                    acquiredAtMs: Number.MAX_SAFE_INTEGER,
+                    handoffId: inputHandoffHeadroomText,
+                },
+                handoff: undefined,
+            },
+        }));
+        const ready = largestInputHeadroomEntry(file.entries.filter((entry) => entry.state === "pending" &&
+            entry.inputClaim?.phase === "ready" &&
+            !entry.inputClaim.handoff), (entry) => ({
+            ...entry,
+            inputClaim: { ...entry.inputClaim, phase: "running" },
+        }));
+        const unclaimed = largestInputHeadroomEntry(file.entries.filter((entry) => entry.state === "pending" &&
+            entry.preApprovalExcluded === false &&
+            !entry.inputClaim), (entry) => ({
+            ...entry,
+            inputClaim: createInputHeadroomClaim(entry, "running"),
+        }));
+        const excluded = smallestInputHeadroomEntry(file.entries.filter((entry) => entry.preApprovalExcluded === true));
+        const representatives = [
+            running,
+            offered,
+            ready,
+            unclaimed,
+            excluded,
+        ].filter((entry) => entry !== undefined);
+        const plans = representatives.map((entry) => createInputHeadroomTransitionPlan(file, entry));
         if (offered) {
             plans.push(createInputHeadroomCancelPlan(file, offered));
             plans.push(createInputHeadroomReleasePlan(file, offered, true));
@@ -2754,7 +3488,9 @@ function createJournalStoreCore(options, getInputContext) {
         }
         const queuedReceipts = new Map();
         for (const entry of file.entries) {
-            if (entry.state !== "queued" || !entry.queueReceiptId || entry.queueHandoff)
+            if (entry.state !== "queued" ||
+                !entry.queueReceiptId ||
+                entry.queueHandoff)
                 continue;
             const grouped = queuedReceipts.get(entry.queueReceiptId) ?? [];
             grouped.push(entry);
@@ -2768,14 +3504,23 @@ function createJournalStoreCore(options, getInputContext) {
         return plans;
     };
     const createInputHeadroomSegment = (previous, next) => {
-        const previousEntries = new Map(previous.entries.map(entry => [entry.updateId, entry]));
-        const nextEntries = new Map(next.entries.map(entry => [entry.updateId, entry]));
-        return { version,
-            revision: next.revision, previousRevision: next.revision - 1,
-            profile: next.profile, botIdentity: next.botIdentity,
-            upsertedEntries: next.entries.filter(entry => !previousEntries.has(entry.updateId) || !isDeepStrictEqual(previousEntries.get(entry.updateId), entry)),
-            removedUpdateIds: previous.entries.filter(entry => !nextEntries.has(entry.updateId)).map(entry => entry.updateId),
-            ...(next.acceptedThroughUpdateId !== undefined ? { acceptedThroughUpdateId: next.acceptedThroughUpdateId } : {}) };
+        const previousEntries = new Map(previous.entries.map((entry) => [entry.updateId, entry]));
+        const nextEntries = new Map(next.entries.map((entry) => [entry.updateId, entry]));
+        return {
+            version,
+            revision: next.revision,
+            previousRevision: next.revision - 1,
+            profile: next.profile,
+            botIdentity: next.botIdentity,
+            upsertedEntries: next.entries.filter((entry) => !previousEntries.has(entry.updateId) ||
+                !isDeepStrictEqual(previousEntries.get(entry.updateId), entry)),
+            removedUpdateIds: previous.entries
+                .filter((entry) => !nextEntries.has(entry.updateId))
+                .map((entry) => entry.updateId),
+            ...(next.acceptedThroughUpdateId !== undefined
+                ? { acceptedThroughUpdateId: next.acceptedThroughUpdateId }
+                : {}),
+        };
     };
     const assertInputHeadroomCapacity = (file, extraBytes) => {
         const bytes = assertCapacity(file);
@@ -2797,46 +3542,74 @@ function createJournalStoreCore(options, getInputContext) {
             ? { ...current.source.evidence.accounting }
             : { files: 1, bytes: publishedBytes, work: getFileWork(publishedFile) };
         if (publishedSegment) {
-            const segmentWork = publishedSegment.upsertedEntries.length + publishedSegment.removedUpdateIds.length +
-                (publishedSegment.operatorDispositions?.length ?? 0) + (publishedSegment.sourceCompletions?.length ?? 0);
+            const segmentWork = publishedSegment.upsertedEntries.length +
+                publishedSegment.removedUpdateIds.length +
+                (publishedSegment.operatorDispositions?.length ?? 0) +
+                (publishedSegment.sourceCompletions?.length ?? 0);
             const segmentBytes = Buffer.byteLength(`${JSON.stringify(publishedSegment, null, 2)}\n`);
             baseRetainedCount += 1;
             baseRetainedBytes += segmentBytes;
             baseRetainedWork += segmentWork;
-            const segmentFirst = { files: baseAccounting.files + 1, bytes: baseAccounting.bytes + segmentBytes,
-                work: baseAccounting.work + segmentWork + getFileWork(publishedFile) };
-            const compactResidue = { files: 1 + baseRetainedCount,
-                bytes: publishedBytes + baseRetainedBytes, work: getFileWork(publishedFile) + baseRetainedWork };
-            baseAccounting = { files: Math.max(segmentFirst.files, compactResidue.files),
+            const segmentFirst = {
+                files: baseAccounting.files + 1,
+                bytes: baseAccounting.bytes + segmentBytes,
+                work: baseAccounting.work + segmentWork + getFileWork(publishedFile),
+            };
+            const compactResidue = {
+                files: 1 + baseRetainedCount,
+                bytes: publishedBytes + baseRetainedBytes,
+                work: getFileWork(publishedFile) + baseRetainedWork,
+            };
+            baseAccounting = {
+                files: Math.max(segmentFirst.files, compactResidue.files),
                 bytes: Math.max(segmentFirst.bytes, compactResidue.bytes),
-                work: Math.max(segmentFirst.work, compactResidue.work) };
+                work: Math.max(segmentFirst.work, compactResidue.work),
+            };
         }
         for (const transitions of plans) {
             let retainedCount = baseRetainedCount;
             let retainedBytes = baseRetainedBytes;
             let retainedWork = baseRetainedWork;
             let accounting = { ...baseAccounting };
-            let state = { file: publishedFile, projectionSlack: 0 };
+            let state = {
+                file: publishedFile,
+                projectionSlack: 0,
+            };
             for (const next of transitions) {
                 const segment = createInputHeadroomSegment(state.file, next.file);
-                const segmentCollections = [segment.upsertedEntries.length, segment.removedUpdateIds.length,
-                    segment.operatorDispositions?.length ?? 0, next.file.entries.length,
-                    next.file.operatorDispositions?.length ?? 0];
-                const segmentWork = segmentCollections[0] + segmentCollections[1] + segmentCollections[2];
-                const segmentBytes = Buffer.byteLength(`${JSON.stringify(segment, null, 2)}\n`) + next.projectionSlack;
+                const segmentCollections = [
+                    segment.upsertedEntries.length,
+                    segment.removedUpdateIds.length,
+                    segment.operatorDispositions?.length ?? 0,
+                    next.file.entries.length,
+                    next.file.operatorDispositions?.length ?? 0,
+                ];
+                const segmentWork = segmentCollections[0] +
+                    segmentCollections[1] +
+                    segmentCollections[2];
+                const segmentBytes = Buffer.byteLength(`${JSON.stringify(segment, null, 2)}\n`) +
+                    next.projectionSlack;
                 const nextBytes = assertInputHeadroomCapacity(next.file, next.projectionSlack);
-                const segmentFirst = { files: accounting.files + 1, bytes: accounting.bytes + segmentBytes,
-                    work: accounting.work + segmentWork + getFileWork(next.file) };
+                const segmentFirst = {
+                    files: accounting.files + 1,
+                    bytes: accounting.bytes + segmentBytes,
+                    work: accounting.work + segmentWork + getFileWork(next.file),
+                };
                 assertSourceResources(segmentFirst.files, segmentFirst.bytes, segmentFirst.work, segmentCollections);
                 retainedCount += 1;
                 retainedBytes += segmentBytes;
                 retainedWork += segmentWork;
-                const compactResidue = { files: 1 + retainedCount, bytes: nextBytes + retainedBytes,
-                    work: getFileWork(next.file) + retainedWork };
+                const compactResidue = {
+                    files: 1 + retainedCount,
+                    bytes: nextBytes + retainedBytes,
+                    work: getFileWork(next.file) + retainedWork,
+                };
                 assertSourceResources(compactResidue.files, compactResidue.bytes, compactResidue.work, segmentCollections);
-                accounting = { files: Math.max(segmentFirst.files, compactResidue.files),
+                accounting = {
+                    files: Math.max(segmentFirst.files, compactResidue.files),
                     bytes: Math.max(segmentFirst.bytes, compactResidue.bytes),
-                    work: Math.max(segmentFirst.work, compactResidue.work) };
+                    work: Math.max(segmentFirst.work, compactResidue.work),
+                };
                 state = next;
             }
         }
@@ -2850,9 +3623,15 @@ function createJournalStoreCore(options, getInputContext) {
         const serializedBytes = assertCapacity(revisedFile, serialized);
         const segmentText = `${JSON.stringify(segment, null, 2)}\n`;
         const segmentBytes = Buffer.byteLength(segmentText);
-        const collections = [segment.upsertedEntries.length, segment.removedUpdateIds.length,
-            segment.operatorDispositions?.length ?? 0, file.entries.length, file.operatorDispositions?.length ?? 0,
-            segment.sourceCompletions?.length ?? 0, file.sourceCompletions?.length ?? 0];
+        const collections = [
+            segment.upsertedEntries.length,
+            segment.removedUpdateIds.length,
+            segment.operatorDispositions?.length ?? 0,
+            file.entries.length,
+            file.operatorDispositions?.length ?? 0,
+            segment.sourceCompletions?.length ?? 0,
+            file.sourceCompletions?.length ?? 0,
+        ];
         const segmentWork = collections[0] + collections[1] + collections[2] + collections[5];
         const fileWork = collections[3] + collections[4] + collections[6];
         const accounting = source.evidence.accounting;
@@ -2860,10 +3639,14 @@ function createJournalStoreCore(options, getInputContext) {
         assertSourceResources(accounting.files + 1, accounting.bytes + segmentBytes, accounting.work + segmentWork + fileWork, collections);
         const unapplied = source.segments.filter((item) => Number(item.name.slice(0, 16)) > source.snapshotRevision);
         const compact = forceCompact ||
-            unapplied.length + 1 >= TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_COUNT ||
-            unapplied.reduce((sum, item) => sum + item.bytes, segmentBytes) >= TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_BYTES;
+            unapplied.length + 1 >=
+                TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_COUNT ||
+            unapplied.reduce((sum, item) => sum + item.bytes, segmentBytes) >=
+                TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_BYTES;
         if (compact) {
-            assertSourceResources(accounting.files + 1, serializedBytes + source.segments.reduce((sum, item) => sum + item.bytes, segmentBytes), fileWork + source.segments.reduce((sum, item) => sum + item.work, segmentWork), collections);
+            assertSourceResources(accounting.files + 1, serializedBytes +
+                source.segments.reduce((sum, item) => sum + item.bytes, segmentBytes), fileWork +
+                source.segments.reduce((sum, item) => sum + item.work, segmentWork), collections);
         }
         const segmentPath = getTelegramUpdateJournalSegmentPath(path, segment.revision);
         // A crash may retain staging, so keep it outside the strictly enumerated segment directory.
@@ -2872,9 +3655,13 @@ function createJournalStoreCore(options, getInputContext) {
             writeJournalFile(path, serialized, publicationBoundary);
             // Snapshot scope must not change. Preserve a validated redundant ID witness instead.
             const witness = file.botIdentity.botId === undefined
-                ? source.segments.find((item) => item.botId !== undefined)?.name : undefined;
+                ? source.segments.find((item) => item.botId !== undefined)?.name
+                : undefined;
             const segmentDirectory = getTelegramUpdateJournalSegmentDirectory(path);
-            const names = [...source.segments.map((item) => item.name), basename(segmentPath)];
+            const names = [
+                ...source.segments.map((item) => item.name),
+                basename(segmentPath),
+            ];
             for (const name of names) {
                 if (name === witness)
                     continue;
@@ -2888,12 +3675,18 @@ function createJournalStoreCore(options, getInputContext) {
             try {
                 rmdirSync(segmentDirectory);
             }
-            catch { /* Retained witness or cleanup residue. */ }
+            catch {
+                /* Retained witness or cleanup residue. */
+            }
         }
         return { file: revisedFile, serializedBytes };
     };
-    const publishMutation = (current, entries, contentChanged, operatorDispositions = current.file.operatorDispositions, acceptedThroughUpdateId = current.file.acceptedThroughUpdateId, publicationBoundary = onPublicationBoundary, inputHeadroom = journalHasCustodyFields(version) ? "all" : false, sourceCompletions = current.file.sourceCompletions) => {
-        const botIdentity = current.source ? current.file.botIdentity : mergeBotIdentity(current.file.botIdentity, expectedIdentity);
+    const publishMutation = (current, entries, contentChanged, operatorDispositions = current.file.operatorDispositions, acceptedThroughUpdateId = current.file.acceptedThroughUpdateId, publicationBoundary = onPublicationBoundary, inputHeadroom = journalHasCustodyFields(version)
+        ? "all"
+        : false, sourceCompletions = current.file.sourceCompletions) => {
+        const botIdentity = current.source
+            ? current.file.botIdentity
+            : mergeBotIdentity(current.file.botIdentity, expectedIdentity);
         if (!contentChanged &&
             isDeepStrictEqual(current.file.botIdentity, botIdentity) &&
             isDeepStrictEqual(current.file.operatorDispositions ?? [], operatorDispositions ?? []) &&
@@ -2909,9 +3702,7 @@ function createJournalStoreCore(options, getInputContext) {
             ...(acceptedThroughUpdateId !== undefined
                 ? { acceptedThroughUpdateId }
                 : {}),
-            ...(operatorDispositions?.length
-                ? { operatorDispositions }
-                : {}),
+            ...(operatorDispositions?.length ? { operatorDispositions } : {}),
             ...(sourceCompletions?.length ? { sourceCompletions } : {}),
         };
         assertJournalRoutingInputContinuity(current.file, entries, path);
@@ -2928,7 +3719,11 @@ function createJournalStoreCore(options, getInputContext) {
         }
         if (!current.exists) {
             if (current.source) {
-                const collections = [file.entries.length, file.operatorDispositions?.length ?? 0, file.sourceCompletions?.length ?? 0];
+                const collections = [
+                    file.entries.length,
+                    file.operatorDispositions?.length ?? 0,
+                    file.sourceCompletions?.length ?? 0,
+                ];
                 assertSourceResources(1, serializedBytes, collections[0] + collections[1] + collections[2], collections);
             }
             if (inputHeadroom !== false)
@@ -2937,10 +3732,11 @@ function createJournalStoreCore(options, getInputContext) {
             return { file, serializedBytes };
         }
         const previousEntries = new Map(current.file.entries.map((entry) => [entry.updateId, entry]));
-        if (withPairingAdmission && entries.some((entry) => {
-            const previous = previousEntries.get(entry.updateId);
-            return previous && previous.preApprovalExcluded !== entry.preApprovalExcluded;
-        })) {
+        if (withPairingAdmission &&
+            entries.some((entry) => {
+                const previous = previousEntries.get(entry.updateId);
+                return (previous && previous.preApprovalExcluded !== entry.preApprovalExcluded);
+            })) {
             throw createJournalError("pairing-evidence", path, "changes immutable exclusion evidence");
         }
         const nextEntries = new Map(entries.map((entry) => [entry.updateId, entry]));
@@ -2964,7 +3760,9 @@ function createJournalStoreCore(options, getInputContext) {
             ...(!isDeepStrictEqual(current.file.operatorDispositions ?? [], operatorDispositions ?? [])
                 ? { operatorDispositions: operatorDispositions ?? [] }
                 : {}),
-            ...(!isDeepStrictEqual(current.file.sourceCompletions ?? [], sourceCompletions ?? []) ? { sourceCompletions: sourceCompletions ?? [] } : {}),
+            ...(!isDeepStrictEqual(current.file.sourceCompletions ?? [], sourceCompletions ?? [])
+                ? { sourceCompletions: sourceCompletions ?? [] }
+                : {}),
         };
         if (current.source) {
             if (!isSafePositiveInteger(revision))
@@ -2980,7 +3778,8 @@ function createJournalStoreCore(options, getInputContext) {
         const segmentNames = readdirSync(segmentDirectory).filter((name) => /^\d{16}\.json$/u.test(name));
         let snapshotRevision = 0;
         try {
-            snapshotRevision = parseJournalFile(JSON.parse(readFileSync(path, "utf8")), path, version).revision ?? 0;
+            snapshotRevision =
+                parseJournalFile(JSON.parse(readFileSync(path, "utf8")), path, version).revision ?? 0;
         }
         catch (error) {
             if (error?.code !== "ENOENT")
@@ -3015,11 +3814,18 @@ function createJournalStoreCore(options, getInputContext) {
         }
         return { file: revisedFile, serializedBytes };
     };
-    const removeCompleted = (updateIds, expectedSources, exact = false, completionInput) => runMutation((readCurrent) => {
+    const removeCompleted = (updateIds, expectedSources, exact = false, completionInput, isCurrent) => runMutation((readCurrent) => {
+        const assertCurrent = () => {
+            if (isCurrent && !isCurrent())
+                throw createJournalError("conflict", path, "exact removal authority ended");
+        };
+        assertCurrent();
         const current = exact && !sourceAccess ? readCurrentStrict(false) : readCurrent();
         if (completionInput !== undefined && !sourceAccess)
             throw createJournalError("invalid", path, "source completion requires an exact source handle");
-        const completions = completionInput === undefined ? undefined : validateJournalSourceCompletions(completionInput, path, version);
+        const completions = completionInput === undefined
+            ? undefined
+            : validateJournalSourceCompletions(completionInput, path, version);
         if (exact && expectedSources === undefined)
             throw createJournalError("invalid", path, "received no exact completion sources");
         const requestedIds = new Set();
@@ -3033,133 +3839,221 @@ function createJournalStoreCore(options, getInputContext) {
                 throw createJournalError("invalid", path, "received no exact completion sources");
             const expectedIds = new Set();
             for (const expected of expectedSources) {
-                if (!isRecord(expected) || Object.keys(expected).some(key => !["updateId", "sourceSha256"].includes(key)) ||
-                    !isSafeNonNegativeInteger(expected.updateId) || !requestedIds.has(expected.updateId) || expectedIds.has(expected.updateId) ||
-                    typeof expected.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(expected.sourceSha256)) {
+                if (!isRecord(expected) ||
+                    Object.keys(expected).some((key) => !["updateId", "sourceSha256"].includes(key)) ||
+                    !isSafeNonNegativeInteger(expected.updateId) ||
+                    !requestedIds.has(expected.updateId) ||
+                    expectedIds.has(expected.updateId) ||
+                    typeof expected.sourceSha256 !== "string" ||
+                    !/^[a-f0-9]{64}$/u.test(expected.sourceSha256)) {
                     throw createJournalError("invalid", path, "received an invalid exact completion source");
                 }
                 expectedIds.add(expected.updateId);
-                const entry = current.file.entries.find(value => value.updateId === expected.updateId);
-                if (!entry || createTelegramUpdateJournalEntryDigest(entry).sourceSha256 !== expected.sourceSha256) {
+                const entry = current.file.entries.find((value) => value.updateId === expected.updateId);
+                if (!entry ||
+                    createTelegramUpdateJournalEntryDigest(entry).sourceSha256 !==
+                        expected.sourceSha256) {
                     throw createJournalError("conflict", path, "exact completion source changed or disappeared");
                 }
             }
         }
         if (completions) {
-            const guards = new Map((expectedSources ?? []).map(source => [source.updateId, source.sourceSha256]));
-            if (completions.some(completion => guards.get(completion.updateId) !== completion.sourceSha256)) {
+            const guards = new Map((expectedSources ?? []).map((source) => [
+                source.updateId,
+                source.sourceSha256,
+            ]));
+            if (completions.some((completion) => guards.get(completion.updateId) !== completion.sourceSha256)) {
                 throw createJournalError("invalid", path, "source completion has no matching exact guard");
             }
         }
-        const requestedEntries = current.file.entries.filter(entry => requestedIds.has(entry.updateId));
-        const protectedEntry = requestedEntries.find(entry => entry.state === "failed" || entry.state === "queued");
+        const requestedEntries = current.file.entries.filter((entry) => requestedIds.has(entry.updateId));
+        const protectedEntry = requestedEntries.find((entry) => entry.state === "failed" || entry.state === "queued");
         if (protectedEntry)
             throw createJournalError("conflict", path, protectedEntry.state === "failed"
                 ? `cannot complete terminal update ${protectedEntry.updateId} without an operator disposition`
                 : `cannot complete queued update ${protectedEntry.updateId} without its exact owner receipt`);
-        const removedUpdateIds = requestedEntries.map(entry => entry.updateId);
+        const removedUpdateIds = requestedEntries.map((entry) => entry.updateId);
         const sourceCompletions = completions
-            ? [...(current.file.sourceCompletions ?? []), ...completions].sort((a, b) => a.updateId - b.updateId) : current.file.sourceCompletions;
+            ? [...(current.file.sourceCompletions ?? []), ...completions].sort((a, b) => a.updateId - b.updateId)
+            : current.file.sourceCompletions;
         if (sourceCompletions?.length)
             validateJournalSourceCompletions(sourceCompletions, path, version);
-        const published = publishMutation(current, current.file.entries.filter(entry => !requestedIds.has(entry.updateId)), removedUpdateIds.length > 0, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, false, sourceCompletions);
-        return { removedUpdateIds, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes,
-            ...(completions ? { sourceCompletions: completions.map(completion => ({ ...completion })) } : {}) };
+        assertCurrent();
+        const published = publishMutation(current, current.file.entries.filter((entry) => !requestedIds.has(entry.updateId)), removedUpdateIds.length > 0, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, isCurrent
+            ? (boundary, target) => {
+                onPublicationBoundary?.(boundary, target);
+                assertCurrent();
+            }
+            : onPublicationBoundary, false, sourceCompletions);
+        assertCurrent();
+        return {
+            removedUpdateIds,
+            entryCount: published.file.entries.length,
+            serializedBytes: published.serializedBytes,
+            ...(completions
+                ? {
+                    sourceCompletions: completions.map((completion) => ({
+                        ...completion,
+                    })),
+                }
+                : {}),
+        };
     });
     const completeQueued = (receipts, completionInput, exact = false) => runMutation((readCurrent) => {
         if (exact && !sourceAccess)
             throw createJournalError("invalid", path, "source completion requires an exact source handle");
-        const completions = exact ? validateJournalSourceCompletions(completionInput, path, version) : undefined;
+        const completions = exact
+            ? validateJournalSourceCompletions(completionInput, path, version)
+            : undefined;
         if (!Array.isArray(receipts) || receipts.length === 0)
             throw createJournalError("invalid", path, "received no queued receipts to complete");
         const current = readCurrent();
         const receiptIds = new Set(), requestedUpdateIds = new Set();
         for (const receipt of receipts) {
-            if ((receipt.queueKind !== "prompt" && receipt.queueKind !== "control") || !isNonEmptyString(receipt.receiptId) ||
-                receiptIds.has(receipt.receiptId) || !Array.isArray(receipt.sourceUpdateIds) || receipt.sourceUpdateIds.length === 0) {
+            if ((receipt.queueKind !== "prompt" && receipt.queueKind !== "control") ||
+                !isNonEmptyString(receipt.receiptId) ||
+                receiptIds.has(receipt.receiptId) ||
+                !Array.isArray(receipt.sourceUpdateIds) ||
+                receipt.sourceUpdateIds.length === 0) {
                 throw createJournalError("invalid", path, "received an invalid queued completion receipt");
             }
             receiptIds.add(receipt.receiptId);
             const queueOwner = validateJournalQueueOwner(receipt.queueOwner, path);
-            if (queueRuntimeIdentity && (queueOwner.instanceId !== queueRuntimeIdentity.instanceId || queueOwner.processId !== queueRuntimeIdentity.processId ||
-                queueOwner.processBirthId !== queueRuntimeIdentity.processBirthId)) {
+            if (queueRuntimeIdentity &&
+                (queueOwner.instanceId !== queueRuntimeIdentity.instanceId ||
+                    queueOwner.processId !== queueRuntimeIdentity.processId ||
+                    queueOwner.processBirthId !== queueRuntimeIdentity.processBirthId)) {
                 throw createJournalError("conflict", path, `cannot complete foreign queue receipt ${receipt.receiptId}`);
             }
             const sourceUpdateIds = new Set();
             for (const updateId of receipt.sourceUpdateIds) {
-                if (!isSafeNonNegativeInteger(updateId) || sourceUpdateIds.has(updateId) || requestedUpdateIds.has(updateId)) {
+                if (!isSafeNonNegativeInteger(updateId) ||
+                    sourceUpdateIds.has(updateId) ||
+                    requestedUpdateIds.has(updateId)) {
                     throw createJournalError("invalid", path, "received overlapping queued completion update ids");
                 }
                 sourceUpdateIds.add(updateId);
                 requestedUpdateIds.add(updateId);
             }
-            const persistedReceiptEntries = current.file.entries.filter(entry => entry.queueReceiptId === receipt.receiptId);
-            if (persistedReceiptEntries.length !== sourceUpdateIds.size || persistedReceiptEntries.some(entry => !sourceUpdateIds.has(entry.updateId) || entry.state !== "queued" || entry.queueKind !== receipt.queueKind || !entry.queueOwner ||
-                entry.queueHandoff !== undefined || !areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, queueOwner))) {
+            const persistedReceiptEntries = current.file.entries.filter((entry) => entry.queueReceiptId === receipt.receiptId);
+            if (persistedReceiptEntries.length !== sourceUpdateIds.size ||
+                persistedReceiptEntries.some((entry) => !sourceUpdateIds.has(entry.updateId) ||
+                    entry.state !== "queued" ||
+                    entry.queueKind !== receipt.queueKind ||
+                    !entry.queueOwner ||
+                    entry.queueHandoff !== undefined ||
+                    !areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, queueOwner))) {
                 throw createJournalError("conflict", path, `cannot complete stale or foreign queue receipt ${receipt.receiptId}`);
             }
         }
-        const removedEntries = current.file.entries.filter(entry => requestedUpdateIds.has(entry.updateId));
-        const removedUpdateIds = removedEntries.map(entry => entry.updateId);
+        const removedEntries = current.file.entries.filter((entry) => requestedUpdateIds.has(entry.updateId));
+        const removedUpdateIds = removedEntries.map((entry) => entry.updateId);
         if (removedUpdateIds.length !== requestedUpdateIds.size)
             throw createJournalError("conflict", path, "queued completion did not resolve every source update");
         if (completions) {
-            const sources = new Map(removedEntries.map(entry => [entry.updateId, createTelegramUpdateJournalEntryDigest(entry).sourceSha256]));
-            if (completions.some(completion => sources.get(completion.updateId) !== completion.sourceSha256)) {
+            const sources = new Map(removedEntries.map((entry) => [
+                entry.updateId,
+                createTelegramUpdateJournalEntryDigest(entry).sourceSha256,
+            ]));
+            if (completions.some((completion) => sources.get(completion.updateId) !== completion.sourceSha256)) {
                 throw createJournalError("conflict", path, "queued completion source changed or belongs to another receipt");
             }
         }
-        const sourceCompletions = completions ? [...(current.file.sourceCompletions ?? []), ...completions].sort((a, b) => a.updateId - b.updateId)
+        const sourceCompletions = completions
+            ? [...(current.file.sourceCompletions ?? []), ...completions].sort((a, b) => a.updateId - b.updateId)
             : current.file.sourceCompletions;
         if (sourceCompletions?.length)
             validateJournalSourceCompletions(sourceCompletions, path, version);
-        const published = publishMutation(current, current.file.entries.filter(entry => !requestedUpdateIds.has(entry.updateId)), true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, exact ? false : undefined, sourceCompletions);
-        return { removedUpdateIds, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes,
-            ...(completions ? { sourceCompletions: completions.map(completion => ({ ...completion })) } : {}) };
+        const published = publishMutation(current, current.file.entries.filter((entry) => !requestedUpdateIds.has(entry.updateId)), true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, exact ? false : undefined, sourceCompletions);
+        return {
+            removedUpdateIds,
+            entryCount: published.file.entries.length,
+            serializedBytes: published.serializedBytes,
+            ...(completions
+                ? {
+                    sourceCompletions: completions.map((completion) => ({
+                        ...completion,
+                    })),
+                }
+                : {}),
+        };
     });
-    const mutateRoutingInputs = (input, select, publishedAtMs) => runMutation(readCurrent => {
+    const mutateRoutingInputs = (input, select, publishedAtMs, chooser) => runMutation((readCurrent) => {
         if (!isTelegramUpdateJournalLegacyFamilyVersion(version))
             throw createJournalError("unsupported-version", path, "routing input lifetime requires a private v1 source");
-        const binding = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
-        if (input.journalBindingKey !== binding || !isSafePositiveInteger(input.operatorUserId) ||
-            typeof input.isCurrent !== "function" || !Array.isArray(input.entries) || !input.entries.length || input.entries.length > maxEntries) {
+        const binding = createTelegramUpdateJournalBindingKey({
+            path,
+            profileName: profile,
+            botIdentity: expectedIdentity,
+        });
+        if (input.journalBindingKey !== binding ||
+            !isSafePositiveInteger(input.operatorUserId) ||
+            typeof input.isCurrent !== "function" ||
+            !Array.isArray(input.entries) ||
+            !input.entries.length ||
+            input.entries.length > maxEntries) {
             throw createJournalError("invalid", path, "invalid routing input lifetime authority");
         }
-        const assertCurrent = () => { if (!input.isCurrent())
-            throw createJournalError("conflict", path, "routing input lifetime authority ended"); };
+        const assertCurrent = () => {
+            if (!input.isCurrent())
+                throw createJournalError("conflict", path, "routing input lifetime authority ended");
+        };
         assertCurrent();
-        const expected = input.entries.map(entry => validateJournalEntry(entry, path, version));
-        if (new Set(expected.map(entry => entry.updateId)).size !== expected.length)
+        const expected = input.entries.map((entry) => validateJournalEntry(entry, path, version));
+        if (new Set(expected.map((entry) => entry.updateId)).size !==
+            expected.length)
             throw createJournalError("invalid", path, "duplicate routing input sources");
         const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
         const nowMs = select ? getNowMs() : publishedAtMs;
-        if (!isSafeNonNegativeInteger(nowMs) || !Number.isSafeInteger(nowMs + TELEGRAM_ROUTING_INPUT_TTL_MS) || (!select && nowMs > getNowMs()))
+        if (!isSafeNonNegativeInteger(nowMs) ||
+            !Number.isSafeInteger(nowMs + TELEGRAM_ROUTING_INPUT_TTL_MS) ||
+            (!select && nowMs > getNowMs()))
             throw createJournalError("invalid", path, "invalid routing input lifetime clock");
         let issued = false;
         const changed = new Map();
-        const result = expected.map(original => {
-            const entry = current.file.entries.find(value => value.updateId === original.updateId);
-            if (!entry || entry.state !== "pending" || original.state !== "pending" || entry.inputClaim || entry.inputProvenance || entry.queueOwner) {
+        const result = expected.map((original) => {
+            const entry = current.file.entries.find((value) => value.updateId === original.updateId);
+            if (!entry ||
+                entry.state !== "pending" ||
+                original.state !== "pending" ||
+                entry.inputClaim ||
+                entry.inputProvenance ||
+                entry.queueOwner) {
                 throw createJournalError("conflict", path, "routing input source is not unclaimed pending work");
             }
-            const withoutLifetime = (value) => { const copy = cloneEntry(value); delete copy.routingInput; return copy; };
-            if (!isDeepStrictEqual(entry, original) && (!isDeepStrictEqual(withoutLifetime(entry), withoutLifetime(original)) ||
-                (original.routingInput && !isDeepStrictEqual(original.routingInput, entry.routingInput)))) {
+            const withoutLifetime = (value) => {
+                const copy = cloneEntry(value);
+                delete copy.routingInput;
+                return copy;
+            };
+            if (!isDeepStrictEqual(entry, original) &&
+                (!isDeepStrictEqual(withoutLifetime(entry), withoutLifetime(original)) ||
+                    (original.routingInput &&
+                        !isDeepStrictEqual(original.routingInput, entry.routingInput)))) {
                 throw createJournalError("conflict", path, "routing input source changed");
             }
             const lifetime = entry.routingInput;
             if (lifetime && lifetime.operatorUserId !== input.operatorUserId)
                 throw createJournalError("conflict", path, "routing input belongs to another operator");
-            if (createPendingRetentionReference({ path, journalBindingKey: binding, entry, maxBytes }).read()) {
+            if (createPendingRetentionReference({
+                path,
+                journalBindingKey: binding,
+                entry,
+                maxBytes,
+            }).read()) {
                 throw createJournalError("conflict", path, "routing input has protected retention");
             }
             if (select) {
-                if (!lifetime || (lifetime.phase === "waiting" && nowMs >= lifetime.expiresAtMs))
+                if (!lifetime ||
+                    (lifetime.phase === "waiting" && nowMs >= lifetime.expiresAtMs))
                     throw createJournalError("conflict", path, "routing input choice expired or was not armed");
                 if (lifetime.phase === "selected")
                     return cloneEntry(entry);
                 issued = true;
-                const selected = { ...cloneEntry(entry), routingInput: { ...lifetime, phase: "selected" } };
+                const selected = {
+                    ...cloneEntry(entry),
+                    routingInput: { ...lifetime, phase: "selected" },
+                };
                 changed.set(entry.updateId, selected);
                 return cloneEntry(selected);
             }
@@ -3171,16 +4065,29 @@ function createJournalStoreCore(options, getInputContext) {
             if (nowMs < entry.admittedAtMs)
                 throw createJournalError("conflict", path, "routing input publication predates admission");
             issued = true;
-            const armed = { ...cloneEntry(entry), routingInput: { operatorUserId: input.operatorUserId,
-                    publishedAtMs: nowMs, expiresAtMs: nowMs + TELEGRAM_ROUTING_INPUT_TTL_MS, phase: "waiting" } };
+            const armed = {
+                ...cloneEntry(entry),
+                routingInput: {
+                    operatorUserId: input.operatorUserId,
+                    publishedAtMs: nowMs,
+                    expiresAtMs: nowMs + TELEGRAM_ROUTING_INPUT_TTL_MS,
+                    phase: "waiting",
+                    ...(chooser ? { chooser: { ...chooser } } : {}),
+                },
+            };
             changed.set(entry.updateId, armed);
             return cloneEntry(armed);
         });
         assertCurrent();
-        if (select && issued && result.some(entry => !changed.has(entry.updateId)))
+        if (select &&
+            issued &&
+            result.some((entry) => !changed.has(entry.updateId)))
             throw createJournalError("conflict", path, "routing input selection has mixed prior phases");
         if (changed.size)
-            publishMutation(current, current.file.entries.map(entry => changed.get(entry.updateId) ?? entry), true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
+            publishMutation(current, current.file.entries.map((entry) => changed.get(entry.updateId) ?? entry), true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, (boundary, target) => {
+                onPublicationBoundary?.(boundary, target);
+                assertCurrent();
+            });
         assertCurrent();
         return { issued, entries: result };
     });
@@ -3212,7 +4119,9 @@ function createJournalStoreCore(options, getInputContext) {
                 normalizedUpdates.push(normalized);
             }
             const appendWithEvidence = (preApprovalExcluded) => runJournalTransaction((readCurrent) => {
-                if (withPairingAdmission && (typeof preApprovalExcluded !== "boolean" || requestedAcceptedThroughUpdateId === undefined)) {
+                if (withPairingAdmission &&
+                    (typeof preApprovalExcluded !== "boolean" ||
+                        requestedAcceptedThroughUpdateId === undefined)) {
                     throw createJournalError("pairing-evidence", path, "requires exclusion evidence and an admission cursor");
                 }
                 if (requestedAcceptedThroughUpdateId !== undefined &&
@@ -3226,7 +4135,7 @@ function createJournalStoreCore(options, getInputContext) {
                     ...(current.file.operatorDispositions ?? [])
                         .filter((disposition) => disposition.action === "discard")
                         .map((disposition) => disposition.updateId),
-                    ...(current.file.sourceCompletions ?? []).map(completion => completion.updateId),
+                    ...(current.file.sourceCompletions ?? []).map((completion) => completion.updateId),
                 ]);
                 let admittedAtMs;
                 const addedUpdateIds = [];
@@ -3244,7 +4153,9 @@ function createJournalStoreCore(options, getInputContext) {
                         duplicateUpdateIds.push(update.update_id);
                         continue;
                     }
-                    if (withPairingAdmission && previousAcceptedThroughUpdateId !== undefined && update.update_id <= previousAcceptedThroughUpdateId) {
+                    if (withPairingAdmission &&
+                        previousAcceptedThroughUpdateId !== undefined &&
+                        update.update_id <= previousAcceptedThroughUpdateId) {
                         duplicateUpdateIds.push(update.update_id);
                         continue;
                     }
@@ -3257,7 +4168,9 @@ function createJournalStoreCore(options, getInputContext) {
                     const entry = {
                         updateId: update.update_id,
                         update,
-                        ...(withPairingAdmission ? { preApprovalExcluded: preApprovalExcluded } : {}),
+                        ...(withPairingAdmission
+                            ? { preApprovalExcluded: preApprovalExcluded }
+                            : {}),
                         admittedAtMs,
                         state: "pending",
                     };
@@ -3283,7 +4196,9 @@ function createJournalStoreCore(options, getInputContext) {
                 return {
                     nonExcludedUpdateIds: normalizedUpdates.flatMap((update) => {
                         const entry = entriesById.get(update.update_id);
-                        return entry && entry.preApprovalExcluded !== true ? [entry.updateId] : [];
+                        return entry && entry.preApprovalExcluded !== true
+                            ? [entry.updateId]
+                            : [];
                     }),
                     addedUpdateIds,
                     duplicateUpdateIds,
@@ -3321,12 +4236,12 @@ function createJournalStoreCore(options, getInputContext) {
                 });
             };
             return options.withWriterAdmission
-                ? options.withWriterAdmission(admittedAppend) : admittedAppend();
+                ? options.withWriterAdmission(admittedAppend)
+                : admittedAppend();
         },
         markQueued(receipt) {
             return runMutation((readCurrent) => {
-                if ((receipt.queueKind !== "prompt" &&
-                    receipt.queueKind !== "control") ||
+                if ((receipt.queueKind !== "prompt" && receipt.queueKind !== "control") ||
                     !isNonEmptyString(receipt.receiptId) ||
                     !Array.isArray(receipt.sourceUpdateIds) ||
                     receipt.sourceUpdateIds.length === 0) {
@@ -3400,7 +4315,12 @@ function createJournalStoreCore(options, getInputContext) {
                         updateId: entry.updateId,
                         update: entry.update,
                         admittedAtMs: entry.admittedAtMs,
-                        ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+                        ...(entry.preApprovalExcluded !== undefined
+                            ? { preApprovalExcluded: entry.preApprovalExcluded }
+                            : {}),
+                        ...(entry.routingInput
+                            ? { routingInput: { ...entry.routingInput } }
+                            : {}),
                         state: "queued",
                         queueKind: receipt.queueKind,
                         queueReceiptId: receipt.receiptId,
@@ -3430,8 +4350,7 @@ function createJournalStoreCore(options, getInputContext) {
                     !isSafeNonNegativeInteger(input.failedAtMs) ||
                     !isBoundedString(input.failureClass, TELEGRAM_UPDATE_JOURNAL_FAILURE_CLASS_MAX_LENGTH) ||
                     !isBoundedString(input.summary, TELEGRAM_UPDATE_JOURNAL_FAILURE_SUMMARY_MAX_LENGTH) ||
-                    (input.disposition !== "retry-wait" &&
-                        input.disposition !== "failed")) {
+                    (input.disposition !== "retry-wait" && input.disposition !== "failed")) {
                     throw createJournalError("invalid", path, "received invalid execution failure metadata");
                 }
                 if (input.disposition === "retry-wait" &&
@@ -3477,8 +4396,12 @@ function createJournalStoreCore(options, getInputContext) {
                     updateId: entry.updateId,
                     update: entry.update,
                     admittedAtMs: entry.admittedAtMs,
-                    ...(entry.routingInput ? { routingInput: { ...entry.routingInput } } : {}),
-                    ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+                    ...(entry.routingInput
+                        ? { routingInput: { ...entry.routingInput } }
+                        : {}),
+                    ...(entry.preApprovalExcluded !== undefined
+                        ? { preApprovalExcluded: entry.preApprovalExcluded }
+                        : {}),
                     state: input.disposition,
                     failure,
                     ...(input.disposition === "retry-wait"
@@ -3548,14 +4471,19 @@ function createJournalStoreCore(options, getInputContext) {
                             updateId: entry.updateId,
                             update: entry.update,
                             admittedAtMs: entry.admittedAtMs,
-                            ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+                            ...(entry.preApprovalExcluded !== undefined
+                                ? { preApprovalExcluded: entry.preApprovalExcluded }
+                                : {}),
                             state: "retry-wait",
                             failure: entry.failure,
                             nextRetryAtMs: disposition.committedAtMs,
                         }
                         : candidate)
                     : current.file.entries.filter((candidate) => candidate.updateId !== entry.updateId);
-                const published = publishMutation(current, nextEntries, true, [...(current.file.operatorDispositions ?? []), disposition]);
+                const published = publishMutation(current, nextEntries, true, [
+                    ...(current.file.operatorDispositions ?? []),
+                    disposition,
+                ]);
                 return {
                     disposition: { ...disposition },
                     duplicate: false,
@@ -3569,30 +4497,44 @@ function createJournalStoreCore(options, getInputContext) {
                 const current = readCurrent();
                 if (!journalHasCustodyFields(current.file.version))
                     throw createJournalError("conflict", path, "legacy custody disposition requires a custody journal");
-                const existing = current.file.operatorDispositions?.find(candidate => candidate.failureId === authority.dispositionId);
+                const existing = current.file.operatorDispositions?.find((candidate) => candidate.failureId === authority.dispositionId);
                 if (existing) {
-                    if (!("dispositionKind" in existing) || existing.dispositionKind !== "legacy-custody")
+                    if (!("dispositionKind" in existing) ||
+                        existing.dispositionKind !== "legacy-custody")
                         throw createJournalError("conflict", path, `legacy custody disposition ${authority.dispositionId} already has another authority`);
-                    const normalizedDuplicate = normalizeTelegramUpdateJournalLegacyCustodyDispositionAuthority(authority, { updateId: existing.updateId, state: "retry-wait", attemptCount: 1,
-                        failedAtMs: 0, failureClass: "retained-audit", summary: "retained-audit",
-                        evidenceSha256: existing.evidenceSha256 });
-                    if (!normalizedDuplicate || existing.action !== normalizedDuplicate.action ||
-                        existing.operatorAuthorityId !== normalizedDuplicate.operatorAuthorityId ||
+                    const normalizedDuplicate = normalizeTelegramUpdateJournalLegacyCustodyDispositionAuthority(authority, {
+                        updateId: existing.updateId,
+                        state: "retry-wait",
+                        attemptCount: 1,
+                        failedAtMs: 0,
+                        failureClass: "retained-audit",
+                        summary: "retained-audit",
+                        evidenceSha256: existing.evidenceSha256,
+                    });
+                    if (!normalizedDuplicate ||
+                        existing.action !== normalizedDuplicate.action ||
+                        existing.operatorAuthorityId !==
+                            normalizedDuplicate.operatorAuthorityId ||
                         existing.authorizedAtMs !== normalizedDuplicate.authorizedAtMs)
                         throw createJournalError("conflict", path, `legacy custody disposition ${authority.dispositionId} already has another authority`);
                     let authorized = false;
                     try {
-                        authorized = options.authorizeLegacyCustodyDisposition?.(normalizedDuplicate) === true;
+                        authorized =
+                            options.authorizeLegacyCustodyDisposition?.(normalizedDuplicate) === true;
                     }
                     catch {
                         authorized = false;
                     }
                     if (!authorized)
                         throw createJournalError("conflict", path, "legacy custody disposition is unauthorized");
-                    return { disposition: { ...existing }, duplicate: true,
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        disposition: { ...existing },
+                        duplicate: true,
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 }
-                const entry = current.file.entries.find(candidate => candidate.updateId === authority.updateId);
+                const entry = current.file.entries.find((candidate) => candidate.updateId === authority.updateId);
                 const evidence = entry && createTelegramUpdateJournalLegacyCustodyEvidence(entry);
                 if (!evidence)
                     throw createJournalError("conflict", path, `cannot dispose non-quarantined update ${authority.updateId}`);
@@ -3601,7 +4543,8 @@ function createJournalStoreCore(options, getInputContext) {
                     throw createJournalError("conflict", path, `legacy custody evidence changed for update ${authority.updateId}`);
                 let authorized = false;
                 try {
-                    authorized = options.authorizeLegacyCustodyDisposition?.(normalized) === true;
+                    authorized =
+                        options.authorizeLegacyCustodyDisposition?.(normalized) === true;
                 }
                 catch {
                     authorized = false;
@@ -3612,24 +4555,38 @@ function createJournalStoreCore(options, getInputContext) {
                 if (!isSafeNonNegativeInteger(nowMs))
                     throw createJournalError("invalid", path, "received an invalid legacy custody disposition timestamp");
                 const disposition = {
-                    dispositionKind: "legacy-custody", failureId: normalized.dispositionId,
-                    updateId: normalized.updateId, action: normalized.action,
+                    dispositionKind: "legacy-custody",
+                    failureId: normalized.dispositionId,
+                    updateId: normalized.updateId,
+                    action: normalized.action,
                     committedAtMs: Math.max(nowMs, normalized.authorizedAtMs),
                     evidenceSha256: normalized.evidenceSha256,
                     operatorAuthorityId: normalized.operatorAuthorityId,
-                    authorizedAtMs: normalized.authorizedAtMs
+                    authorizedAtMs: normalized.authorizedAtMs,
                 };
                 const nextEntries = normalized.action === "discard"
-                    ? current.file.entries.filter(candidate => candidate.updateId !== entry.updateId)
-                    : current.file.entries.map(candidate => candidate.updateId === entry.updateId
-                        ? { updateId: entry.updateId, update: entry.update,
+                    ? current.file.entries.filter((candidate) => candidate.updateId !== entry.updateId)
+                    : current.file.entries.map((candidate) => candidate.updateId === entry.updateId
+                        ? {
+                            updateId: entry.updateId,
+                            update: entry.update,
                             admittedAtMs: entry.admittedAtMs,
-                            ...(entry.preApprovalExcluded === undefined ? {} :
-                                { preApprovalExcluded: entry.preApprovalExcluded }), state: "pending" }
+                            ...(entry.preApprovalExcluded === undefined
+                                ? {}
+                                : { preApprovalExcluded: entry.preApprovalExcluded }),
+                            state: "pending",
+                        }
                         : candidate);
-                const published = publishMutation(current, nextEntries, true, [...(current.file.operatorDispositions ?? []), disposition]);
-                return { disposition: { ...disposition }, duplicate: false,
-                    entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                const published = publishMutation(current, nextEntries, true, [
+                    ...(current.file.operatorDispositions ?? []),
+                    disposition,
+                ]);
+                return {
+                    disposition: { ...disposition },
+                    duplicate: false,
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         offerQueuedHandoff(input) {
@@ -3725,13 +4682,18 @@ function createJournalStoreCore(options, getInputContext) {
                         updateId: entry.updateId,
                         update: entry.update,
                         admittedAtMs: entry.admittedAtMs,
-                        ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+                        ...(entry.preApprovalExcluded !== undefined
+                            ? { preApprovalExcluded: entry.preApprovalExcluded }
+                            : {}),
                         state: "queued",
                         queueKind: input.queueKind,
                         queueReceiptId: input.receiptId,
                         queueOwner: cloneJournalQueueOwner(queueOwner),
                         ...(entry.inputProvenance
-                            ? { inputProvenance: structuredClone(entry.inputProvenance) } : {}),
+                            ? {
+                                inputProvenance: structuredClone(entry.inputProvenance),
+                            }
+                            : {}),
                     }
                     : entry), true);
                 return {
@@ -3777,12 +4739,15 @@ function createJournalStoreCore(options, getInputContext) {
                 };
             });
         },
-        completeQueued(receipts) { return completeQueued(receipts); },
-        completeQueuedExact(receipts, completions) { return completeQueued(receipts, completions, true); },
+        completeQueued(receipts) {
+            return completeQueued(receipts);
+        },
+        completeQueuedExact(receipts, completions) {
+            return completeQueued(receipts, completions, true);
+        },
         discardQueued(input) {
             return runMutation((readCurrent) => {
-                if ((input.queueKind !== "prompt" &&
-                    input.queueKind !== "control") ||
+                if ((input.queueKind !== "prompt" && input.queueKind !== "control") ||
                     !isNonEmptyString(input.receiptId) ||
                     !Array.isArray(input.sourceUpdateIds) ||
                     input.sourceUpdateIds.length === 0) {
@@ -3807,12 +4772,7 @@ function createJournalStoreCore(options, getInputContext) {
                 const current = readCurrent();
                 const receiptEntries = current.file.entries.filter((entry) => entry.queueReceiptId === input.receiptId);
                 if (receiptEntries.length !== requestedIds.size ||
-                    receiptEntries.some((entry) => !requestedIds.has(entry.updateId) ||
-                        entry.state !== "queued" ||
-                        entry.queueKind !== input.queueKind ||
-                        !entry.queueOwner ||
-                        entry.queueHandoff !== undefined ||
-                        !areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, expectedOwner))) {
+                    receiptEntries.some((entry) => !isExactQueuedReceiptEntry(entry, requestedIds, input.queueKind, expectedOwner))) {
                     throw createJournalError("conflict", path, `cannot discard stale queue receipt ${input.receiptId}`);
                 }
                 const removedUpdateIds = [...requestedIds].sort((a, b) => a - b);
@@ -3859,17 +4819,11 @@ function createJournalStoreCore(options, getInputContext) {
                 }
                 const current = readCurrent();
                 const receiptEntries = current.file.entries.filter((entry) => entry.queueReceiptId === input.receiptId);
-                if ((input.queueKind !== "prompt" &&
-                    input.queueKind !== "control") ||
+                if ((input.queueKind !== "prompt" && input.queueKind !== "control") ||
                     !isNonEmptyString(input.receiptId) ||
                     requestedIds.size === 0 ||
                     receiptEntries.length !== requestedIds.size ||
-                    receiptEntries.some((entry) => !requestedIds.has(entry.updateId) ||
-                        entry.state !== "queued" ||
-                        entry.queueKind !== input.queueKind ||
-                        !entry.queueOwner ||
-                        entry.queueHandoff !== undefined ||
-                        !areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, deadOwner))) {
+                    receiptEntries.some((entry) => !isExactQueuedReceiptEntry(entry, requestedIds, input.queueKind, deadOwner))) {
                     throw createJournalError("conflict", path, `cannot recover stale queue receipt ${input.receiptId}`);
                 }
                 if (ownerLiveness !== "dead") {
@@ -3903,14 +4857,21 @@ function createJournalStoreCore(options, getInputContext) {
                     throw createJournalError("invalid", path, "invalid abandonment update id");
                 // Inspection never repairs or quarantines source evidence.
                 const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
-                const matches = (current.file.operatorDispositions ?? []).filter(item => item.updateId === updateId);
+                const matches = (current.file.operatorDispositions ?? []).filter((item) => item.updateId === updateId);
                 const disposition = matches[0];
-                if (matches.length !== 1 || !disposition || !("dispositionKind" in disposition) ||
-                    disposition.dispositionKind !== "legacy-custody" || disposition.action !== "discard" ||
+                if (matches.length !== 1 ||
+                    !disposition ||
+                    !("dispositionKind" in disposition) ||
+                    disposition.dispositionKind !== "legacy-custody" ||
+                    disposition.action !== "discard" ||
                     disposition.failureId !== `abandon-${disposition.evidenceSha256}` ||
-                    current.file.entries.some(entry => entry.updateId === updateId))
+                    current.file.entries.some((entry) => entry.updateId === updateId))
                     return undefined;
-                const journalBindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+                const journalBindingKey = createTelegramUpdateJournalBindingKey({
+                    path,
+                    profileName: profile,
+                    botIdentity: expectedIdentity,
+                });
                 const retainedPath = join(`${path}.retained`, `${disposition.failureId}.json`);
                 let stat;
                 try {
@@ -3921,20 +4882,33 @@ function createJournalStoreCore(options, getInputContext) {
                         throw createJournalError("conflict", retainedPath, "committed abandonment lost its retained input");
                     throw error;
                 }
-                if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes + 4096) {
+                if (!stat.isFile() ||
+                    stat.isSymbolicLink() ||
+                    stat.size > maxBytes + 4096) {
                     throw createJournalError("invalid", retainedPath, "retained input is not a bounded regular file");
                 }
                 const parsed = JSON.parse(readFileSync(retainedPath, "utf8"));
                 if (!isRecord(parsed))
                     throw createJournalError("invalid", retainedPath, "retained input is not an evidence record");
                 const entry = validateJournalEntry(parsed.entry, retainedPath, version);
-                const reference = createPendingRetentionReference({ path, journalBindingKey, entry, maxBytes });
+                const reference = createPendingRetentionReference({
+                    path,
+                    journalBindingKey,
+                    entry,
+                    maxBytes,
+                });
                 const retained = reference.read();
-                if (entry.updateId !== updateId || reference.retainedPath !== retainedPath ||
+                if (entry.updateId !== updateId ||
+                    reference.retainedPath !== retainedPath ||
                     !isDeepStrictEqual(retained?.requestedDisposition, disposition)) {
                     throw createJournalError("conflict", retainedPath, "retained input does not match committed abandonment");
                 }
-                return { journalBindingKey, updateId, retainedPath, operatorAuthorityId: disposition.operatorAuthorityId };
+                return {
+                    journalBindingKey,
+                    updateId,
+                    retainedPath,
+                    operatorAuthorityId: disposition.operatorAuthorityId,
+                };
             });
         },
         inspectPendingRetention(entry) {
@@ -3945,11 +4919,25 @@ function createJournalStoreCore(options, getInputContext) {
                 const expected = validateJournalEntry(entry, path, version);
                 if (expected.state !== "pending")
                     throw createJournalError("conflict", path, "retention inspection requires a pending source");
-                const journalBindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
-                const reference = createPendingRetentionReference({ path, journalBindingKey, entry: expected, maxBytes });
+                const journalBindingKey = createTelegramUpdateJournalBindingKey({
+                    path,
+                    profileName: profile,
+                    botIdentity: expectedIdentity,
+                });
+                const reference = createPendingRetentionReference({
+                    path,
+                    journalBindingKey,
+                    entry: expected,
+                    maxBytes,
+                });
                 const retained = reference.read();
-                return retained ? { journalBindingKey, retainedPath: reference.retainedPath,
-                    requestedDisposition: retained.requestedDisposition } : undefined;
+                return retained
+                    ? {
+                        journalBindingKey,
+                        retainedPath: reference.retainedPath,
+                        requestedDisposition: retained.requestedDisposition,
+                    }
+                    : undefined;
             });
         },
         abandonPending(input) {
@@ -3957,12 +4945,17 @@ function createJournalStoreCore(options, getInputContext) {
                 if (!isTelegramUpdateJournalLegacyFamilyVersion(version)) {
                     throw createJournalError("unsupported-version", path, "pending abandonment requires the legacy v1 source");
                 }
-                const journalBindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+                const journalBindingKey = createTelegramUpdateJournalBindingKey({
+                    path,
+                    profileName: profile,
+                    botIdentity: expectedIdentity,
+                });
                 if (input.journalBindingKey !== journalBindingKey) {
                     throw createJournalError("identity-mismatch", path, "pending abandonment belongs to another source");
                 }
                 if (!isBoundedString(input.operatorAuthorityId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
-                    !input.operatorAuthorityId.trim() || typeof input.isCurrent !== "function") {
+                    !input.operatorAuthorityId.trim() ||
+                    typeof input.isCurrent !== "function") {
                     throw createJournalError("invalid", path, "pending abandonment requires explicit operator authority");
                 }
                 const assertCurrent = () => {
@@ -3971,30 +4964,52 @@ function createJournalStoreCore(options, getInputContext) {
                 };
                 assertCurrent();
                 const expected = validateJournalEntry(input.entry, path, version);
-                if (expected.state !== "pending" || expected.inputClaim || expected.inputProvenance ||
-                    expected.queueOwner || expected.queueHandoff || expected.queueReceiptId || expected.failure) {
+                if (expected.state !== "pending" ||
+                    expected.inputClaim ||
+                    expected.inputProvenance ||
+                    expected.queueOwner ||
+                    expected.queueHandoff ||
+                    expected.queueReceiptId ||
+                    expected.failure) {
                     throw createJournalError("conflict", path, "only an exact unclaimed pending source may be abandoned");
                 }
                 // Never repair/quarantine source evidence while deciding an operator cancellation.
-                const readStrict = sourceAccess ? readCurrent : () => readCurrentStrict(false);
+                const readStrict = sourceAccess
+                    ? readCurrent
+                    : () => readCurrentStrict(false);
                 const current = readStrict();
-                const { evidenceSha256, failureId, retainedPath, read: readRetention } = createPendingRetentionReference({ path, journalBindingKey, entry: expected, maxBytes });
-                const existing = current.file.operatorDispositions?.find(item => item.failureId === failureId || item.updateId === expected.updateId);
-                const currentEntry = current.file.entries.find(entry => entry.updateId === expected.updateId);
+                const { evidenceSha256, failureId, retainedPath, read: readRetention, } = createPendingRetentionReference({
+                    path,
+                    journalBindingKey,
+                    entry: expected,
+                    maxBytes,
+                });
+                const existing = current.file.operatorDispositions?.find((item) => item.failureId === failureId || item.updateId === expected.updateId);
+                const currentEntry = current.file.entries.find((entry) => entry.updateId === expected.updateId);
                 const assertRetention = (retained, disposition) => {
-                    if (!retained || !isDeepStrictEqual(retained.requestedDisposition, disposition)) {
+                    if (!retained ||
+                        !isDeepStrictEqual(retained.requestedDisposition, disposition)) {
                         throw createJournalError("conflict", retainedPath, "retained input does not match abandonment evidence");
                     }
                 };
                 if (existing) {
-                    if (currentEntry || !("dispositionKind" in existing) || existing.dispositionKind !== "legacy-custody" ||
-                        existing.failureId !== failureId || existing.action !== "discard" || existing.evidenceSha256 !== evidenceSha256) {
+                    if (currentEntry ||
+                        !("dispositionKind" in existing) ||
+                        existing.dispositionKind !== "legacy-custody" ||
+                        existing.failureId !== failureId ||
+                        existing.action !== "discard" ||
+                        existing.evidenceSha256 !== evidenceSha256) {
                         throw createJournalError("conflict", path, "pending source already has another disposition");
                     }
                     assertRetention(readRetention(), existing);
                     assertCurrent();
-                    return { disposition: existing, retainedPath, duplicate: true,
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        disposition: existing,
+                        retainedPath,
+                        duplicate: true,
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 }
                 if (!currentEntry || !isDeepStrictEqual(currentEntry, expected)) {
                     throw createJournalError("conflict", path, "pending source changed before abandonment");
@@ -4010,11 +5025,23 @@ function createJournalStoreCore(options, getInputContext) {
                 else {
                     // Reuse the existing legacy discard tombstone so older v1 readers also refuse replay.
                     // This is an operator disposition, not a fabricated execution failure or completion.
-                    disposition = { dispositionKind: "legacy-custody", failureId, updateId: expected.updateId,
-                        action: "discard", committedAtMs: nowMs, evidenceSha256,
-                        operatorAuthorityId: input.operatorAuthorityId, authorizedAtMs: nowMs };
-                    const copy = { version: 1, kind: "pending-input-retention",
-                        journalBindingKey, entry: expected, requestedDisposition: disposition };
+                    disposition = {
+                        dispositionKind: "legacy-custody",
+                        failureId,
+                        updateId: expected.updateId,
+                        action: "discard",
+                        committedAtMs: nowMs,
+                        evidenceSha256,
+                        operatorAuthorityId: input.operatorAuthorityId,
+                        authorizedAtMs: nowMs,
+                    };
+                    const copy = {
+                        version: 1,
+                        kind: "pending-input-retention",
+                        journalBindingKey,
+                        entry: expected,
+                        requestedDisposition: disposition,
+                    };
                     writeJournalFile(retainedPath, `${JSON.stringify(copy)}\n`, (boundary, target) => {
                         onPublicationBoundary?.(boundary, target);
                         assertCurrent();
@@ -4022,12 +5049,20 @@ function createJournalStoreCore(options, getInputContext) {
                 }
                 assertCurrent();
                 assertRetention(readRetention(), disposition);
-                const committed = (snapshot) => !snapshot.file.entries.some(entry => entry.updateId === expected.updateId) &&
-                    snapshot.file.operatorDispositions?.some(item => isDeepStrictEqual(item, disposition));
+                const committed = (snapshot) => !snapshot.file.entries.some((entry) => entry.updateId === expected.updateId) &&
+                    snapshot.file.operatorDispositions?.some((item) => isDeepStrictEqual(item, disposition));
                 try {
-                    const published = publishMutation(current, current.file.entries.filter(entry => entry.updateId !== expected.updateId), true, [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId, (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
-                    return { disposition, retainedPath, duplicate: false,
-                        entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                    const published = publishMutation(current, current.file.entries.filter((entry) => entry.updateId !== expected.updateId), true, [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId, (boundary, target) => {
+                        onPublicationBoundary?.(boundary, target);
+                        assertCurrent();
+                    });
+                    return {
+                        disposition,
+                        retainedPath,
+                        duplicate: false,
+                        entryCount: published.file.entries.length,
+                        serializedBytes: published.serializedBytes,
+                    };
                 }
                 catch (error) {
                     // A segment may be durable even if later snapshot compaction failed.
@@ -4042,16 +5077,26 @@ function createJournalStoreCore(options, getInputContext) {
                     if (!committed(observed))
                         throw error;
                     assertRetention(readRetention(), disposition);
-                    return { disposition, retainedPath, duplicate: false,
-                        entryCount: observed.file.entries.length, serializedBytes: observed.serializedBytes };
+                    return {
+                        disposition,
+                        retainedPath,
+                        duplicate: false,
+                        entryCount: observed.file.entries.length,
+                        serializedBytes: observed.serializedBytes,
+                    };
                 }
             });
         },
-        removeCompleted(updateIds) { return removeCompleted(updateIds); },
-        removeCompletedExact(updateIds, expectedSources, completions) { return removeCompleted(updateIds, expectedSources, true, completions); },
+        removeCompleted(updateIds) {
+            return removeCompleted(updateIds);
+        },
+        removeCompletedExact(updateIds, expectedSources, completions, isCurrent) {
+            return removeCompleted(updateIds, expectedSources, true, completions, isCurrent);
+        },
         inspectQueuedReceipt(expected) {
-            return runMutationCore(readCurrent => {
-                if (!sourceAccess || !isTelegramUpdateJournalLegacyFamilyVersion(version)) {
+            return runMutationCore((readCurrent) => {
+                if (!sourceAccess ||
+                    !isTelegramUpdateJournalLegacyFamilyVersion(version)) {
                     throw createJournalError("invalid", path, "queue receipt observation requires an exact legacy v1 source handle");
                 }
                 const queueOwner = validateQueuedReceiptObservation(expected, path);
@@ -4060,7 +5105,7 @@ function createJournalStoreCore(options, getInputContext) {
             });
         },
         inspectSourceCompletion(expected) {
-            return runMutation(readCurrent => {
+            return runMutation((readCurrent) => {
                 if (!sourceAccess)
                     throw createJournalError("invalid", path, "source completion requires an exact source handle");
                 const completion = validateJournalSourceCompletion(expected, path);
@@ -4069,28 +5114,128 @@ function createJournalStoreCore(options, getInputContext) {
             });
         },
     };
-    const abandonRoutingPending = journal.abandonPending.bind(journal);
     if (isTelegramUpdateJournalLegacyFamilyVersion(version))
         journal.routingInputs = {
-            arm(input) { return mutateRoutingInputs(input, false, input.publishedAtMs).entries; },
-            select(input) { return mutateRoutingInputs(input, true); },
+            arm(input) {
+                if (input.chooser !== undefined &&
+                    !isTelegramUpdateJournalRoutingChooser(input.chooser))
+                    throw createJournalError("invalid", path, "invalid routing input chooser location");
+                return mutateRoutingInputs(input, false, input.publishedAtMs, input.chooser).entries;
+            },
+            select(input) {
+                return mutateRoutingInputs(input, true);
+            },
+            inspectExpiry(updateId) {
+                return runMutation((readCurrent) => {
+                    if (!isSafeNonNegativeInteger(updateId))
+                        throw createJournalError("invalid", path, "invalid routing expiry update ID");
+                    return inspectRoutingInputExpiry(readCurrent().file, createTelegramUpdateJournalBindingKey({
+                        path,
+                        profileName: profile,
+                        botIdentity: expectedIdentity,
+                    }), updateId);
+                });
+            },
+            inspectGroupExpiry(updateIds) {
+                return runMutation((readCurrent) => inspectRoutingGroupExpiry(readCurrent().file, createTelegramUpdateJournalBindingKey({
+                    path,
+                    profileName: profile,
+                    botIdentity: expectedIdentity,
+                }), updateIds));
+            },
             expire(input) {
-                const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
-                if (!lifetime || lifetime.phase !== "waiting" || lifetime.operatorUserId !== input.operatorUserId ||
-                    !isSafePositiveInteger(input.operatorUserId) || typeof input.isCurrent !== "function") {
-                    throw createJournalError("conflict", path, "routing input expiry lacks exact waiting authority");
-                }
-                const current = () => { const now = getNowMs(); return isSafeNonNegativeInteger(now) && now >= lifetime.expiresAtMs && input.isCurrent(); };
-                if (!current())
-                    throw createJournalError("conflict", path, "routing input has not expired under current authority");
-                return abandonRoutingPending({ journalBindingKey: input.journalBindingKey, entry: original,
-                    operatorAuthorityId: `telegram-owner:${input.operatorUserId}`, isCurrent: current });
+                return runMutation((readCurrent) => {
+                    const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
+                    const binding = createTelegramUpdateJournalBindingKey({
+                        path,
+                        profileName: profile,
+                        botIdentity: expectedIdentity,
+                    });
+                    if (!lifetime ||
+                        original.state !== "pending" ||
+                        original.inputClaim ||
+                        original.inputProvenance ||
+                        original.queueOwner ||
+                        original.queueReceiptId ||
+                        original.queueHandoff ||
+                        original.failure ||
+                        input.journalBindingKey !== binding ||
+                        lifetime.operatorUserId !== input.operatorUserId ||
+                        !isSafePositiveInteger(input.operatorUserId) ||
+                        typeof input.isCurrent !== "function") {
+                        throw createJournalError("conflict", path, "routing expiry requires an exact unclaimed chooser source");
+                    }
+                    const assertCurrent = () => {
+                        const now = getNowMs();
+                        if (!isSafeNonNegativeInteger(now) ||
+                            now < lifetime.expiresAtMs ||
+                            !input.isCurrent())
+                            throw createJournalError("conflict", path, "routing source has not expired under current authority");
+                    };
+                    assertCurrent();
+                    const current = sourceAccess
+                        ? readCurrent()
+                        : readCurrentStrict(false);
+                    const evidenceSha256 = createHash("sha256")
+                        .update(JSON.stringify(original))
+                        .digest("hex");
+                    const failureId = `routing-expiry:${evidenceSha256}`;
+                    const existing = current.file.operatorDispositions?.find((value) => value.updateId === original.updateId);
+                    const entry = current.file.entries.find((value) => value.updateId === original.updateId);
+                    if (existing) {
+                        if (entry ||
+                            !("dispositionKind" in existing) ||
+                            existing.dispositionKind !== "legacy-custody" ||
+                            existing.action !== "discard" ||
+                            existing.failureId !== failureId ||
+                            existing.evidenceSha256 !== evidenceSha256 ||
+                            existing.operatorAuthorityId !==
+                                `telegram-owner:${input.operatorUserId}`)
+                            throw createJournalError("conflict", path, "routing source has contradictory expiry evidence");
+                        assertCurrent();
+                        return {
+                            disposition: existing,
+                            duplicate: true,
+                            entryCount: current.file.entries.length,
+                            serializedBytes: current.serializedBytes,
+                        };
+                    }
+                    if (!entry || !isDeepStrictEqual(entry, original))
+                        throw createJournalError("conflict", path, "routing source changed before expiry");
+                    // A discard tombstone prevents old readers and delayed reports from replaying; no prompt-body archive is written.
+                    const now = getNowMs();
+                    const disposition = {
+                        dispositionKind: "legacy-custody",
+                        failureId,
+                        updateId: original.updateId,
+                        action: "discard",
+                        committedAtMs: now,
+                        authorizedAtMs: now,
+                        evidenceSha256,
+                        operatorAuthorityId: `telegram-owner:${input.operatorUserId}`,
+                    };
+                    const published = publishMutation(current, current.file.entries.filter((value) => value.updateId !== original.updateId), true, [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId, (boundary, target) => {
+                        onPublicationBoundary?.(boundary, target);
+                        assertCurrent();
+                    });
+                    assertCurrent();
+                    return {
+                        disposition,
+                        duplicate: false,
+                        entryCount: published.file.entries.length,
+                        serializedBytes: published.serializedBytes,
+                    };
+                });
             },
         };
     if (!getInputContext)
         return { journal };
     // Strict source acquisition already requires this exact stored receipt scope.
-    const bindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+    const bindingKey = createTelegramUpdateJournalBindingKey({
+        path,
+        profileName: profile,
+        botIdentity: expectedIdentity,
+    });
     const createInputSourceReference = (updateId) => ({
         journalBindingKey: bindingKey,
         tokenSha256: expectedIdentity.tokenSha256,
@@ -4123,10 +5268,15 @@ function createJournalStoreCore(options, getInputContext) {
         assertInputProcess(owner);
         return { owner, recipientBindingKey };
     };
-    const runInputAdmission = (kind, operation) => workspaceAdmission ? runWithTelegramWorkspaceAdmissions({
-        ledger: workspaceAdmission, operationId: `input:${randomUUID()}`, operationKind: `journal.input.${kind}`,
-        scopes: [{ kind: "profile" }], operation,
-    }) : operation();
+    const runInputAdmission = (kind, operation) => workspaceAdmission
+        ? runWithTelegramWorkspaceAdmissions({
+            ledger: workspaceAdmission,
+            operationId: `input:${randomUUID()}`,
+            operationKind: `journal.input.${kind}`,
+            scopes: [{ kind: "profile" }],
+            operation,
+        })
+        : operation();
     const runInputMutation = (kind, operation) => runInputAdmission(kind, () => runMutation(operation));
     const publishInputMutation = (current, entries, updateId, context) => publishMutation(current, entries, true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, (boundary, publicationPath) => {
         onPublicationBoundary?.(boundary, publicationPath);
@@ -4136,33 +5286,49 @@ function createJournalStoreCore(options, getInputContext) {
     }, updateId);
     const publishInputSettlement = (current, entries, contentChanged) => publishMutation(current, entries, contentChanged, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, false);
     const normalizeInputSourceReference = (value, operation) => {
-        if (!isRecord(value) || !hasOnlyKeys(value, ["journalBindingKey", "tokenSha256", "updateId"])) {
+        if (!isRecord(value) ||
+            !hasOnlyKeys(value, ["journalBindingKey", "tokenSha256", "updateId"])) {
             throw createJournalError("invalid", path, `received invalid input handoff ${operation} source`);
         }
         const journalBindingKey = value.journalBindingKey;
         const updateId = value.updateId;
-        if (journalBindingKey !== bindingKey || value.tokenSha256 !== expectedIdentity.tokenSha256 ||
+        if (journalBindingKey !== bindingKey ||
+            value.tokenSha256 !== expectedIdentity.tokenSha256 ||
             !isSafeNonNegativeInteger(updateId)) {
             throw createJournalError("conflict", path, "input receipt does not match its source identity");
         }
-        return { journalBindingKey, tokenSha256: expectedIdentity.tokenSha256, updateId };
+        return {
+            journalBindingKey,
+            tokenSha256: expectedIdentity.tokenSha256,
+            updateId,
+        };
     };
     const normalizeInputReceipt = (value, requireCurrentProcess = true) => {
         if (!isRecord(value) ||
-            !hasOnlyKeys(value, ["journalBindingKey", "tokenSha256", "updateId", "owner"])) {
+            !hasOnlyKeys(value, [
+                "journalBindingKey",
+                "tokenSha256",
+                "updateId",
+                "owner",
+            ])) {
             throw createJournalError("invalid", path, "received an invalid input receipt");
         }
-        const source = normalizeInputSourceReference({ journalBindingKey: value.journalBindingKey,
-            tokenSha256: value.tokenSha256, updateId: value.updateId }, "receipt");
+        const source = normalizeInputSourceReference({
+            journalBindingKey: value.journalBindingKey,
+            tokenSha256: value.tokenSha256,
+            updateId: value.updateId,
+        }, "receipt");
         const owner = validateJournalQueueOwner(value.owner, path);
         if (requireCurrentProcess)
             assertInputProcess(owner);
         return { ...source, owner };
     };
     const normalizeInputHandoffOffer = (value) => {
-        if (!isRecord(value) || !hasOnlyKeys(value, ["receipt", "recipientOwner", "handoffToken"]) ||
+        if (!isRecord(value) ||
+            !hasOnlyKeys(value, ["receipt", "recipientOwner", "handoffToken"]) ||
             !isBoundedString(value.handoffToken, TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MAX_LENGTH) ||
-            value.handoffToken.length < TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MIN_LENGTH) {
+            value.handoffToken.length <
+                TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MIN_LENGTH) {
             throw createJournalError("invalid", path, "received invalid input handoff offer");
         }
         const receipt = normalizeInputReceipt(value.receipt);
@@ -4179,52 +5345,81 @@ function createJournalStoreCore(options, getInputContext) {
         return value;
     };
     const normalizeInputHandoffAccept = (value) => {
-        if (!isRecord(value) || !hasOnlyKeys(value, ["source", "recipientOwner", "handoffId"])) {
+        if (!isRecord(value) ||
+            !hasOnlyKeys(value, ["source", "recipientOwner", "handoffId"])) {
             throw createJournalError("invalid", path, "received invalid input handoff accept");
         }
         const source = normalizeInputSourceReference(value.source, "accept");
         const recipientOwner = validateJournalQueueOwnerIdentity(value.recipientOwner, path);
         assertInputProcess(recipientOwner);
-        return { source, recipientOwner, handoffId: normalizeInputHandoffId(value.handoffId, "accept") };
+        return {
+            source,
+            recipientOwner,
+            handoffId: normalizeInputHandoffId(value.handoffId, "accept"),
+        };
     };
     const normalizeInputHandoffCancel = (value) => {
-        if (!isRecord(value) || !hasOnlyKeys(value, ["receipt", "recipientOwner", "handoffId"])) {
+        if (!isRecord(value) ||
+            !hasOnlyKeys(value, ["receipt", "recipientOwner", "handoffId"])) {
             throw createJournalError("invalid", path, "received invalid input handoff cancel");
         }
-        return { receipt: normalizeInputReceipt(value.receipt),
+        return {
+            receipt: normalizeInputReceipt(value.receipt),
             recipientOwner: validateJournalQueueOwnerIdentity(value.recipientOwner, path),
-            handoffId: normalizeInputHandoffId(value.handoffId, "cancel") };
+            handoffId: normalizeInputHandoffId(value.handoffId, "cancel"),
+        };
     };
     const normalizeInputQueue = (value) => {
-        if (!isRecord(value) || !hasOnlyKeys(value, ["queueKind", "receiptId", "receipts"]) ||
+        if (!isRecord(value) ||
+            !hasOnlyKeys(value, ["queueKind", "receiptId", "receipts"]) ||
             (value.queueKind !== "prompt" && value.queueKind !== "control") ||
             !isBoundedString(value.receiptId, TELEGRAM_UPDATE_JOURNAL_QUEUE_OWNER_ID_MAX_LENGTH) ||
-            !value.receiptId.trim() || !Array.isArray(value.receipts) || value.receipts.length === 0) {
+            !value.receiptId.trim() ||
+            !Array.isArray(value.receipts) ||
+            value.receipts.length === 0) {
             throw createJournalError("invalid", path, "received invalid input queue transition");
         }
-        const receipts = value.receipts.map(receipt => normalizeInputReceipt(receipt)).sort((left, right) => left.updateId - right.updateId);
+        const receipts = value.receipts
+            .map((receipt) => normalizeInputReceipt(receipt))
+            .sort((left, right) => left.updateId - right.updateId);
         if (receipts.some((receipt, index) => index > 0 && receipt.updateId === receipts[index - 1].updateId)) {
             throw createJournalError("invalid", path, "received duplicate input queue transition receipts");
         }
         return { queueKind: value.queueKind, receiptId: value.receiptId, receipts };
     };
     const ownedInput = (current, receipt) => {
-        const entry = current.file.entries.find(candidate => candidate.updateId === receipt.updateId);
-        if (!entry?.inputClaim || entry.state !== "pending" ||
+        const entry = current.file.entries.find((candidate) => candidate.updateId === receipt.updateId);
+        if (!entry?.inputClaim ||
+            entry.state !== "pending" ||
             !areTelegramUpdateJournalQueueOwnersEqual(entry.inputClaim.owner, receipt.owner)) {
             throw createJournalError("conflict", path, "input receipt lost its exact acquisition or phase");
         }
         return entry;
     };
+    // Handoff offer/cancel require an idle ready donor claim owned by this exact context and binding.
+    const readReadyDonorInput = (current, receipt) => {
+        const context = currentInputContext();
+        const entry = ownedInput(current, receipt);
+        const claim = entry.inputClaim;
+        if (claim.phase !== "ready" ||
+            !inputOwnerMatchesIdentity(receipt.owner, context.owner) ||
+            claim.recipientBindingKey !== context.recipientBindingKey) {
+            throw createJournalError("conflict", path, "input handoff donor authority is stale or running");
+        }
+        return { context, current, entry, claim };
+    };
     const getReadyInputRelease = (current, receipt, allowOffered = false) => {
-        const entry = current.file.entries.find(candidate => candidate.updateId === receipt.updateId);
-        if (!entry || entry.state !== "pending" || entry.preApprovalExcluded !== false) {
+        const entry = current.file.entries.find((candidate) => candidate.updateId === receipt.updateId);
+        if (!entry ||
+            entry.state !== "pending" ||
+            entry.preApprovalExcluded !== false) {
             throw createJournalError("conflict", path, "input is unavailable for ready-claim release");
         }
         if (!entry.inputClaim)
             return { entry, unclaimed: true };
         if (!areTelegramUpdateJournalQueueOwnersEqual(entry.inputClaim.owner, receipt.owner) ||
-            entry.inputClaim.phase !== "ready" || (!allowOffered && entry.inputClaim.handoff !== undefined)) {
+            entry.inputClaim.phase !== "ready" ||
+            (!allowOffered && entry.inputClaim.handoff !== undefined)) {
             throw createJournalError("conflict", path, "cannot release stale, running, or offered input authority");
         }
         return { entry, unclaimed: false };
@@ -4232,7 +5427,7 @@ function createJournalStoreCore(options, getInputContext) {
     const publishReadyInputRelease = (current, entry) => {
         const released = cloneEntry(entry);
         delete released.inputClaim;
-        return publishMutation(current, current.file.entries.map(candidate => candidate.updateId === entry.updateId ? released : candidate), true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, entry.updateId);
+        return publishMutation(current, current.file.entries.map((candidate) => candidate.updateId === entry.updateId ? released : candidate), true, current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, entry.updateId);
     };
     const input = {
         read: journal.read,
@@ -4240,12 +5435,16 @@ function createJournalStoreCore(options, getInputContext) {
         listLegacyCustodyCandidates() {
             const sourceAccess = options.sourceAccess;
             const evidence = readTelegramUpdateJournalSource({
-                directory: sourceAccess.directory, path, profile,
-                botIdentity: expectedIdentity, limits: sourceAccess.limits,
+                directory: sourceAccess.directory,
+                path,
+                profile,
+                botIdentity: expectedIdentity,
+                limits: sourceAccess.limits,
                 version,
             });
             return evidence.kind === "present"
-                ? listTelegramUpdateJournalLegacyCustodyCandidates(evidence.file) : [];
+                ? listTelegramUpdateJournalLegacyCustodyCandidates(evidence.file)
+                : [];
         },
         applyLegacyCustodyDisposition(value) {
             return runInputAdmission("legacy-custody-disposition", () => journal.applyLegacyCustodyDisposition(value));
@@ -4276,117 +5475,163 @@ function createJournalStoreCore(options, getInputContext) {
                 }
                 requestedIds.add(updateId);
             }
-            return runInputMutation("remove-excluded", read => {
+            return runInputMutation("remove-excluded", (read) => {
                 const current = read();
-                if (!current.exists || [...requestedIds].some(id => id > (current.file.acceptedThroughUpdateId ?? -1))) {
+                if (!current.exists ||
+                    [...requestedIds].some((id) => id > (current.file.acceptedThroughUpdateId ?? -1))) {
                     throw createJournalError("conflict", path, "exclusion removal lacks retained source admission evidence");
                 }
-                const selected = current.file.entries.filter(entry => requestedIds.has(entry.updateId));
-                if (selected.some(entry => entry.preApprovalExcluded !== true)) {
+                const selected = current.file.entries.filter((entry) => requestedIds.has(entry.updateId));
+                if (selected.some((entry) => entry.preApprovalExcluded !== true)) {
                     throw createJournalError("conflict", path, "cannot remove input without immutable exclusion evidence");
                 }
                 // Strict v3 decoding already excludes raw claims and queued authority on vetoed entries.
-                const removedUpdateIds = selected.map(entry => entry.updateId);
-                const published = publishInputSettlement(current, current.file.entries.filter(entry => !requestedIds.has(entry.updateId)), removedUpdateIds.length > 0);
-                return { removedUpdateIds, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                const removedUpdateIds = selected.map((entry) => entry.updateId);
+                const published = publishInputSettlement(current, current.file.entries.filter((entry) => !requestedIds.has(entry.updateId)), removedUpdateIds.length > 0);
+                return {
+                    removedUpdateIds,
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         releaseInput(value) {
             const receipt = normalizeInputReceipt(value);
-            return runInputMutation("release", read => {
+            return runInputMutation("release", (read) => {
                 const current = read();
                 const release = getReadyInputRelease(current, receipt);
                 if (release.unclaimed)
-                    return { released: false,
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        released: false,
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 const published = publishReadyInputRelease(current, release.entry);
-                return { released: true, entryCount: published.file.entries.length,
-                    serializedBytes: published.serializedBytes };
+                return {
+                    released: true,
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         recoverReadyInput(value) {
-            if (!isRecord(value) || !hasOnlyKeys(value, ["receipt", "recoveryOwner"])) {
+            if (!isRecord(value) ||
+                !hasOnlyKeys(value, ["receipt", "recoveryOwner"])) {
                 throw createJournalError("invalid", path, "received invalid ready-input recovery authority");
             }
             const receipt = normalizeInputReceipt(value.receipt, false);
             const recoveryOwner = validateJournalQueueOwnerIdentity(value.recoveryOwner, path);
             assertInputProcess(recoveryOwner);
-            return runInputMutation("recover-ready", read => {
+            return runInputMutation("recover-ready", (read) => {
                 const current = read();
                 const release = getReadyInputRelease(current, receipt, true);
                 if (release.unclaimed)
-                    return { status: "unclaimed",
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        status: "unclaimed",
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 let liveness;
                 try {
-                    liveness = getQueueProcessLiveness({ processId: receipt.owner.processId,
-                        processBirthId: receipt.owner.processBirthId });
+                    liveness = getQueueProcessLiveness({
+                        processId: receipt.owner.processId,
+                        processBirthId: receipt.owner.processBirthId,
+                    });
                 }
                 catch (error) {
                     throw createJournalError("io", path, "could not prove ready input owner liveness", error);
                 }
                 if (liveness !== "dead")
-                    return { status: liveness === "alive" ? "owner-alive" : "owner-unverifiable",
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        status: liveness === "alive"
+                            ? "owner-alive"
+                            : "owner-unverifiable",
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 const published = publishReadyInputRelease(current, release.entry);
-                return { status: "recovered", entryCount: published.file.entries.length,
-                    serializedBytes: published.serializedBytes };
+                return {
+                    status: "recovered",
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         offerInputHandoff(value) {
             const { receipt, recipientOwner, handoffToken } = normalizeInputHandoffOffer(value);
-            return runInputMutation("offer", read => {
-                const context = currentInputContext();
-                const current = read();
-                const entry = ownedInput(current, receipt);
-                const claim = entry.inputClaim;
-                if (claim.phase !== "ready" || !inputOwnerMatchesIdentity(receipt.owner, context.owner) ||
-                    claim.recipientBindingKey !== context.recipientBindingKey) {
-                    throw createJournalError("conflict", path, "input handoff donor authority is stale or running");
-                }
+            return runInputMutation("offer", (read) => {
+                const { context, current, claim } = readReadyDonorInput(read(), receipt);
                 if (claim.handoff) {
                     if (!isDeepStrictEqual(claim.handoff.recipientOwner, recipientOwner)) {
                         throw createJournalError("conflict", path, "input already has another handoff offer");
                     }
-                    return { source: createInputSourceReference(receipt.updateId),
+                    return {
+                        source: createInputSourceReference(receipt.updateId),
                         handoff: cloneJournalQueueHandoff(claim.handoff),
-                        previousOwner: cloneJournalQueueOwner(receipt.owner), duplicate: true,
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                        previousOwner: cloneJournalQueueOwner(receipt.owner),
+                        duplicate: true,
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 }
-                const handoffId = createTelegramInputHandoffId({ handoffToken, journalBindingKey: bindingKey,
-                    updateId: receipt.updateId, donorOwner: receipt.owner, recipientOwner,
-                    recipientBindingKey: claim.recipientBindingKey });
+                const handoffId = createTelegramInputHandoffId({
+                    handoffToken,
+                    journalBindingKey: bindingKey,
+                    updateId: receipt.updateId,
+                    donorOwner: receipt.owner,
+                    recipientOwner,
+                    recipientBindingKey: claim.recipientBindingKey,
+                });
                 const offeredAtMs = getNowMs();
                 if (!isSafeNonNegativeInteger(offeredAtMs)) {
                     throw createJournalError("invalid", path, "received an invalid input handoff offer timestamp");
                 }
-                const handoff = { handoffId, offeredAtMs,
-                    recipientOwner: { ...recipientOwner } };
+                const handoff = {
+                    handoffId,
+                    offeredAtMs,
+                    recipientOwner: { ...recipientOwner },
+                };
                 const offeredClaim = { ...claim, handoff };
-                const published = publishInputMutation(current, current.file.entries.map(candidate => candidate.updateId === receipt.updateId ? { ...candidate, inputClaim: offeredClaim } : candidate), receipt.updateId, context);
-                return { source: createInputSourceReference(receipt.updateId),
+                const published = publishInputMutation(current, current.file.entries.map((candidate) => candidate.updateId === receipt.updateId
+                    ? { ...candidate, inputClaim: offeredClaim }
+                    : candidate), receipt.updateId, context);
+                return {
+                    source: createInputSourceReference(receipt.updateId),
                     handoff: cloneJournalQueueHandoff(handoff),
-                    previousOwner: cloneJournalQueueOwner(receipt.owner), duplicate: false,
-                    entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                    previousOwner: cloneJournalQueueOwner(receipt.owner),
+                    duplicate: false,
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         acceptInputHandoff(value) {
             const { source, recipientOwner, handoffId } = normalizeInputHandoffAccept(value);
-            return runInputMutation("accept", read => {
+            return runInputMutation("accept", (read) => {
                 const context = currentInputContext();
                 const current = read();
-                const entry = current.file.entries.find(candidate => candidate.updateId === source.updateId);
+                const entry = current.file.entries.find((candidate) => candidate.updateId === source.updateId);
                 const claim = entry?.inputClaim;
-                if (!entry || entry.state !== "pending" || entry.preApprovalExcluded !== false || !claim ||
+                if (!entry ||
+                    entry.state !== "pending" ||
+                    entry.preApprovalExcluded !== false ||
+                    !claim ||
                     !isDeepStrictEqual(context.owner, recipientOwner) ||
                     context.recipientBindingKey !== claim.recipientBindingKey) {
                     throw createJournalError("conflict", path, "input handoff recipient authority is unavailable or changed");
                 }
-                if (claim.owner.handoffId === handoffId && inputOwnerMatchesIdentity(claim.owner, recipientOwner)) {
-                    return { handoffId, receipt: createInputReceipt(source.updateId, claim.owner), duplicate: true,
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                if (claim.owner.handoffId === handoffId &&
+                    inputOwnerMatchesIdentity(claim.owner, recipientOwner)) {
+                    return {
+                        handoffId,
+                        receipt: createInputReceipt(source.updateId, claim.owner),
+                        duplicate: true,
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 }
-                if (claim.phase !== "ready" || claim.handoff?.handoffId !== handoffId ||
+                if (claim.phase !== "ready" ||
+                    claim.handoff?.handoffId !== handoffId ||
                     !isDeepStrictEqual(claim.handoff.recipientOwner, recipientOwner)) {
                     throw createJournalError("conflict", path, "cannot accept stale or unauthenticated input handoff");
                 }
@@ -4395,75 +5640,109 @@ function createJournalStoreCore(options, getInputContext) {
                     throw createJournalError("invalid", path, "received an invalid input handoff acquisition timestamp");
                 }
                 const previousOwner = cloneJournalQueueOwner(claim.owner);
-                const owner = { ...recipientOwner,
-                    acquisitionId: randomUUID(), acquiredAtMs, handoffId };
+                const owner = {
+                    ...recipientOwner,
+                    acquisitionId: randomUUID(),
+                    acquiredAtMs,
+                    handoffId,
+                };
                 const acceptedClaim = structuredClone(claim);
                 acceptedClaim.owner = owner;
                 delete acceptedClaim.handoff;
-                const publishedEntries = current.file.entries.map(candidate => candidate.updateId === source.updateId ? { ...candidate, inputClaim: acceptedClaim } : candidate);
+                const publishedEntries = current.file.entries.map((candidate) => candidate.updateId === source.updateId
+                    ? { ...candidate, inputClaim: acceptedClaim }
+                    : candidate);
                 const published = publishInputMutation(current, publishedEntries, source.updateId, context);
-                return { handoffId, previousOwner, receipt: createInputReceipt(source.updateId, owner), duplicate: false,
-                    entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                return {
+                    handoffId,
+                    previousOwner,
+                    receipt: createInputReceipt(source.updateId, owner),
+                    duplicate: false,
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         cancelInputHandoff(value) {
             const { receipt, recipientOwner, handoffId } = normalizeInputHandoffCancel(value);
-            return runInputMutation("cancel", read => {
-                const context = currentInputContext();
-                const current = read();
-                const entry = ownedInput(current, receipt);
-                const claim = entry.inputClaim;
-                if (claim.phase !== "ready" || !inputOwnerMatchesIdentity(receipt.owner, context.owner) ||
-                    claim.recipientBindingKey !== context.recipientBindingKey) {
-                    throw createJournalError("conflict", path, "input handoff donor authority is stale or running");
-                }
+            return runInputMutation("cancel", (read) => {
+                const { context, current, claim } = readReadyDonorInput(read(), receipt);
                 if (!claim.handoff)
-                    return { handoffId, previousOwner: cloneJournalQueueOwner(receipt.owner),
-                        cancelled: false, entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        handoffId,
+                        previousOwner: cloneJournalQueueOwner(receipt.owner),
+                        cancelled: false,
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 if (claim.handoff.handoffId !== handoffId ||
                     !isDeepStrictEqual(claim.handoff.recipientOwner, recipientOwner)) {
                     throw createJournalError("conflict", path, "cannot cancel another input handoff offer");
                 }
                 const cancelledClaim = structuredClone(claim);
                 delete cancelledClaim.handoff;
-                const publishedEntries = current.file.entries.map(candidate => candidate.updateId === receipt.updateId ? { ...candidate, inputClaim: cancelledClaim } : candidate);
+                const publishedEntries = current.file.entries.map((candidate) => candidate.updateId === receipt.updateId
+                    ? { ...candidate, inputClaim: cancelledClaim }
+                    : candidate);
                 const published = publishInputMutation(current, publishedEntries, receipt.updateId, context);
-                return { handoffId, previousOwner: cloneJournalQueueOwner(receipt.owner), cancelled: true,
-                    entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                return {
+                    handoffId,
+                    previousOwner: cloneJournalQueueOwner(receipt.owner),
+                    cancelled: true,
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         queueInputs(value) {
             const { queueKind, receiptId, receipts } = normalizeInputQueue(value);
-            return runInputMutation("queue", read => {
+            return runInputMutation("queue", (read) => {
                 const context = currentInputContext();
-                if (receipts.some(receipt => !inputOwnerMatchesIdentity(receipt.owner, context.owner))) {
+                if (receipts.some((receipt) => !inputOwnerMatchesIdentity(receipt.owner, context.owner))) {
                     throw createJournalError("conflict", path, "input queue transition belongs to another session");
                 }
                 const current = read();
-                const receiptsById = new Map(receipts.map(receipt => [receipt.updateId, receipt]));
-                const requestedIds = receipts.map(receipt => receipt.updateId);
-                const existingReceiptEntries = current.file.entries.filter(entry => entry.queueReceiptId === receiptId);
+                const receiptsById = new Map(receipts.map((receipt) => [receipt.updateId, receipt]));
+                const requestedIds = receipts.map((receipt) => receipt.updateId);
+                const existingReceiptEntries = current.file.entries.filter((entry) => entry.queueReceiptId === receiptId);
                 if (existingReceiptEntries.length > 0) {
                     const queueOwner = existingReceiptEntries[0]?.queueOwner;
-                    if (existingReceiptEntries.length !== receipts.length || !queueOwner ||
+                    if (existingReceiptEntries.length !== receipts.length ||
+                        !queueOwner ||
                         !inputOwnerMatchesIdentity(queueOwner, context.owner) ||
-                        existingReceiptEntries.some(entry => {
+                        existingReceiptEntries.some((entry) => {
                             const receipt = receiptsById.get(entry.updateId);
-                            return !receipt || entry.state !== "queued" || entry.queueKind !== queueKind ||
-                                entry.queueHandoff !== undefined || !entry.inputProvenance ||
+                            return (!receipt ||
+                                entry.state !== "queued" ||
+                                entry.queueKind !== queueKind ||
+                                entry.queueHandoff !== undefined ||
+                                !entry.inputProvenance ||
                                 !areTelegramUpdateJournalQueueOwnersEqual(entry.inputProvenance.owner, receipt.owner) ||
-                                entry.inputProvenance.recipientBindingKey !== context.recipientBindingKey;
+                                entry.inputProvenance.recipientBindingKey !==
+                                    context.recipientBindingKey);
                         })) {
                         throw createJournalError("conflict", path, "input queue transition conflicts with queued authority");
                     }
-                    return { queued: false, queueReceipt: { queueKind, receiptId,
-                            sourceUpdateIds: requestedIds, queueOwner: cloneJournalQueueOwner(queueOwner) },
-                        entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                    return {
+                        queued: false,
+                        queueReceipt: {
+                            queueKind,
+                            receiptId,
+                            sourceUpdateIds: requestedIds,
+                            queueOwner: cloneJournalQueueOwner(queueOwner),
+                        },
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 }
                 for (const receipt of receipts) {
-                    const entry = current.file.entries.find(candidate => candidate.updateId === receipt.updateId);
-                    if (!entry || entry.state !== "pending" || entry.preApprovalExcluded !== false ||
-                        !entry.inputClaim || entry.inputClaim.phase !== "running" || entry.inputClaim.handoff ||
+                    const entry = current.file.entries.find((candidate) => candidate.updateId === receipt.updateId);
+                    if (!entry ||
+                        entry.state !== "pending" ||
+                        entry.preApprovalExcluded !== false ||
+                        !entry.inputClaim ||
+                        entry.inputClaim.phase !== "running" ||
+                        entry.inputClaim.handoff ||
                         !areTelegramUpdateJournalQueueOwnersEqual(entry.inputClaim.owner, receipt.owner) ||
                         entry.inputClaim.recipientBindingKey !== context.recipientBindingKey) {
                         throw createJournalError("conflict", path, "input queue transition lost exact running authority");
@@ -4473,76 +5752,122 @@ function createJournalStoreCore(options, getInputContext) {
                 if (!isSafeNonNegativeInteger(acquiredAtMs)) {
                     throw createJournalError("invalid", path, "received an invalid input queue acquisition timestamp");
                 }
-                const queueOwner = { ...context.owner,
-                    acquisitionId: randomUUID(), acquiredAtMs };
-                const queuedEntries = current.file.entries.map(entry => {
+                const queueOwner = {
+                    ...context.owner,
+                    acquisitionId: randomUUID(),
+                    acquiredAtMs,
+                };
+                const queuedEntries = current.file.entries.map((entry) => {
                     const receipt = receiptsById.get(entry.updateId);
                     if (!receipt)
                         return entry;
                     const claim = entry.inputClaim;
-                    return { updateId: entry.updateId, update: entry.update,
-                        admittedAtMs: entry.admittedAtMs, preApprovalExcluded: false, state: "queued",
-                        queueKind, queueReceiptId: receiptId, queueOwner: cloneJournalQueueOwner(queueOwner),
-                        inputProvenance: { owner: cloneJournalQueueOwner(claim.owner),
+                    return {
+                        updateId: entry.updateId,
+                        update: entry.update,
+                        admittedAtMs: entry.admittedAtMs,
+                        preApprovalExcluded: false,
+                        state: "queued",
+                        queueKind,
+                        queueReceiptId: receiptId,
+                        queueOwner: cloneJournalQueueOwner(queueOwner),
+                        inputProvenance: {
+                            owner: cloneJournalQueueOwner(claim.owner),
                             recipientBindingKey: claim.recipientBindingKey,
                             ...(claim.executionUpdate
-                                ? { executionUpdate: structuredClone(claim.executionUpdate) } : {}) } };
+                                ? { executionUpdate: structuredClone(claim.executionUpdate) }
+                                : {}),
+                        },
+                    };
                 });
                 const published = publishInputMutation(current, queuedEntries, requestedIds, context);
-                return { queued: true, queueReceipt: { queueKind, receiptId,
-                        sourceUpdateIds: requestedIds, queueOwner: cloneJournalQueueOwner(queueOwner) },
-                    entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                return {
+                    queued: true,
+                    queueReceipt: {
+                        queueKind,
+                        receiptId,
+                        sourceUpdateIds: requestedIds,
+                        queueOwner: cloneJournalQueueOwner(queueOwner),
+                    },
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
         acquireInput(value) {
             const updateId = value.updateId;
             const recipientBindingKey = value.recipientBindingKey;
-            const executionUpdate = value.executionUpdate === undefined ? undefined : normalizeIncomingJournaledUpdate(value.executionUpdate, path);
+            const executionUpdate = value.executionUpdate === undefined
+                ? undefined
+                : normalizeIncomingJournaledUpdate(value.executionUpdate, path);
             if (!isSafeNonNegativeInteger(updateId) ||
                 !isBoundedString(recipientBindingKey, TELEGRAM_UPDATE_JOURNAL_INPUT_BINDING_MAX_LENGTH) ||
-                !recipientBindingKey.trim() || (executionUpdate && executionUpdate.update_id !== updateId)) {
+                !recipientBindingKey.trim() ||
+                (executionUpdate && executionUpdate.update_id !== updateId)) {
                 throw createJournalError("invalid", path, "received invalid input acquisition identity");
             }
-            return runInputMutation("acquire", read => {
+            return runInputMutation("acquire", (read) => {
                 const context = currentInputContext();
                 const identity = context.owner;
                 if (recipientBindingKey !== context.recipientBindingKey) {
                     throw createJournalError("conflict", path, "input acquisition targets another execution binding");
                 }
                 const current = read();
-                const entry = current.file.entries.find(candidate => candidate.updateId === updateId);
-                if (!entry || entry.state !== "pending" || entry.preApprovalExcluded !== false) {
+                const entry = current.file.entries.find((candidate) => candidate.updateId === updateId);
+                if (!entry ||
+                    entry.state !== "pending" ||
+                    entry.preApprovalExcluded !== false) {
                     throw createJournalError("conflict", path, "input is not eligible for acquisition");
                 }
                 const projected = executionUpdate ?? entry.update;
                 const existing = entry.inputClaim;
                 if (existing) {
                     if (!isTelegramUpdateJournalQueueOwnerProcess(existing.owner, identity) ||
-                        existing.owner.sessionGeneration !== identity.sessionGeneration || existing.recipientBindingKey !== recipientBindingKey ||
+                        existing.owner.sessionGeneration !== identity.sessionGeneration ||
+                        existing.recipientBindingKey !== recipientBindingKey ||
                         !isDeepStrictEqual(existing.executionUpdate ?? entry.update, projected)) {
                         throw createJournalError("conflict", path, "input already has another owner or execution projection");
                     }
-                    return { acquired: false, receipt: createInputReceipt(updateId, existing.owner) };
+                    return {
+                        acquired: false,
+                        receipt: createInputReceipt(updateId, existing.owner),
+                    };
                 }
-                const claim = { phase: "ready", recipientBindingKey,
-                    owner: { ...identity, acquisitionId: randomUUID(), acquiredAtMs: getNowMs() },
-                    ...(!isDeepStrictEqual(projected, entry.update) ? { executionUpdate: projected } : {}) };
-                const claimedEntries = current.file.entries.map(candidate => candidate.updateId === updateId ? { ...candidate, inputClaim: claim } : candidate);
-                const reservedEntry = { ...entry, inputClaim: createInputHeadroomClaim(entry, "ready") };
+                const claim = {
+                    phase: "ready",
+                    recipientBindingKey,
+                    owner: {
+                        ...identity,
+                        acquisitionId: randomUUID(),
+                        acquiredAtMs: getNowMs(),
+                    },
+                    ...(!isDeepStrictEqual(projected, entry.update)
+                        ? { executionUpdate: projected }
+                        : {}),
+                };
+                const claimedEntries = current.file.entries.map((candidate) => candidate.updateId === updateId
+                    ? { ...candidate, inputClaim: claim }
+                    : candidate);
+                const reservedEntry = {
+                    ...entry,
+                    inputClaim: createInputHeadroomClaim(entry, "ready"),
+                };
                 const reservedEntries = replaceInputHeadroomEntry(current.file, updateId, reservedEntry);
                 const actualBytes = Buffer.byteLength(serializeJournalFile({ ...current.file, entries: claimedEntries }));
-                const reservedBytes = Buffer.byteLength(serializeJournalFile({ ...current.file, entries: reservedEntries })) +
-                    TELEGRAM_UPDATE_JOURNAL_INPUT_PROJECTION_HEADROOM_BYTES;
+                const reservedBytes = Buffer.byteLength(serializeJournalFile({ ...current.file, entries: reservedEntries })) + TELEGRAM_UPDATE_JOURNAL_INPUT_PROJECTION_HEADROOM_BYTES;
                 if (actualBytes > reservedBytes) {
                     throw createJournalError("capacity", path, "execution projection exceeds reserved input headroom");
                 }
                 publishInputMutation(current, claimedEntries, updateId, context);
-                return { acquired: true, receipt: createInputReceipt(updateId, claim.owner) };
+                return {
+                    acquired: true,
+                    receipt: createInputReceipt(updateId, claim.owner),
+                };
             });
         },
         startInput(value) {
             const receipt = normalizeInputReceipt(value);
-            return runInputMutation("start", read => {
+            return runInputMutation("start", (read) => {
                 const context = currentInputContext();
                 const current = read();
                 const entry = ownedInput(current, receipt);
@@ -4555,24 +5880,41 @@ function createJournalStoreCore(options, getInputContext) {
                     return { started: false };
                 if (claim.handoff)
                     throw createJournalError("conflict", path, "input handoff freezes donor execution");
-                publishInputMutation(current, current.file.entries.map(candidate => candidate.updateId === receipt.updateId
-                    ? { ...candidate, inputClaim: { ...claim, phase: "running" } } : candidate), receipt.updateId, context);
-                return { started: true, update: structuredClone(claim.executionUpdate ?? entry.update) };
+                publishInputMutation(current, current.file.entries.map((candidate) => candidate.updateId === receipt.updateId
+                    ? {
+                        ...candidate,
+                        inputClaim: { ...claim, phase: "running" },
+                    }
+                    : candidate), receipt.updateId, context);
+                return {
+                    started: true,
+                    update: structuredClone(claim.executionUpdate ?? entry.update),
+                };
             });
         },
         completeInput(value) {
             const receipt = normalizeInputReceipt(value);
-            return runInputMutation("complete", read => {
+            return runInputMutation("complete", (read) => {
                 const current = read();
-                const exists = current.file.entries.some(entry => entry.updateId === receipt.updateId);
-                if (!exists && current.exists && receipt.updateId <= (current.file.acceptedThroughUpdateId ?? -1)) {
-                    return { removedUpdateIds: [], entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+                const exists = current.file.entries.some((entry) => entry.updateId === receipt.updateId);
+                if (!exists &&
+                    current.exists &&
+                    receipt.updateId <= (current.file.acceptedThroughUpdateId ?? -1)) {
+                    return {
+                        removedUpdateIds: [],
+                        entryCount: current.file.entries.length,
+                        serializedBytes: current.serializedBytes,
+                    };
                 }
                 const entry = ownedInput(current, receipt);
                 if (entry.inputClaim.phase !== "running")
                     throw createJournalError("conflict", path, "input has not started");
-                const published = publishInputSettlement(current, current.file.entries.filter(candidate => candidate.updateId !== receipt.updateId), true);
-                return { removedUpdateIds: [receipt.updateId], entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+                const published = publishInputSettlement(current, current.file.entries.filter((candidate) => candidate.updateId !== receipt.updateId), true);
+                return {
+                    removedUpdateIds: [receipt.updateId],
+                    entryCount: published.file.entries.length,
+                    serializedBytes: published.serializedBytes,
+                };
             });
         },
     };