@llblab/pi-telegram 0.50.0 → 0.51.0

package/dist/lib/updates.d.ts

@@ -441,6 +441,8 @@ export interface TelegramUpdateWorkerJournalSnapshot {
 }
 export interface TelegramUpdateWorkerJournalPort {
     read: () => TelegramUpdateWorkerJournalSnapshot;
+    /** Optional strict observation; it must not recover, repair or grant new receipt authority. */
+    isQueueReceiptCurrent?: (receipt: TelegramQueueAdmissionReceiptLike, owner: TelegramUpdateJournalQueueOwner) => boolean;
     markQueued: (receipt: {
         queueKind: "prompt" | "control";
         receiptId: string;
@@ -527,7 +529,7 @@ export interface TelegramUpdateWorkerRuntime<TContext> {
         receipts: readonly TelegramQueueAdmissionReceiptLike[];
         ctx: TContext;
         reason: TelegramQueueReceiptCompletionReason;
-    }) => void;
+    }) => boolean;
     stop: () => Promise<void>;
     waitForDrain: () => Promise<void>;
     getState: () => TelegramUpdateWorkerStateSnapshot;
@@ -1000,9 +1002,9 @@ export interface TelegramQueueAdmissionItemLike {
 export interface TelegramQueueAdmissionSettlementRuntime<TContext> {
     isItemReady: (item: TelegramQueueAdmissionItemLike) => boolean;
     getQueueReceiptOwner: (receipt: TelegramQueueAdmissionReceiptLike) => TelegramUpdateJournalQueueOwner | undefined;
-    onPromptHandedOff: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => void;
-    onControlSettled: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => void;
-    onItemsDiscarded: (items: readonly TelegramQueueAdmissionItemLike[], ctx: TContext) => void;
+    onPromptHandedOff: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => boolean;
+    onControlSettled: (item: TelegramQueueAdmissionItemLike, ctx: TContext) => boolean;
+    onItemsDiscarded: (items: readonly TelegramQueueAdmissionItemLike[], ctx: TContext) => boolean;
 }
 export declare function createTelegramQueueAdmissionSettlementMuxRuntime<TContext>(runtimes: readonly TelegramQueueAdmissionSettlementRuntime<TContext>[]): TelegramQueueAdmissionSettlementRuntime<TContext>;
 export declare function createTelegramQueueAdmissionSettlementRuntime<TContext>(worker: TelegramUpdateWorkerRuntime<TContext>): TelegramQueueAdmissionSettlementRuntime<TContext>;

package/dist/lib/updates.js

@@ -303,10 +303,10 @@ export function reportTelegramQueueAdmission(values, receipts) {
     return true;
 }
 export function buildTelegramUpdateFlowAction(update, allowedUserId) {
-    const deletedMessageIds = extractDeletedTelegramMessageIds(update);
-    if (deletedMessageIds.length > 0) {
-        return { kind: "deleted", messageIds: deletedMessageIds };
-    }
+    // Business chats are independent from bot chats even when chat/message IDs coincide.
+    // Raw handlers may own that namespace; the default DM runtime has no deletion authority.
+    if (update.deleted_business_messages !== undefined)
+        return { kind: "ignore" };
     if (update.message_reaction) {
         return { kind: "reaction", reactionUpdate: update.message_reaction };
     }
@@ -1017,6 +1017,22 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         }
         return true;
     };
+    const getCurrentQueueReceipt = (receipt) => {
+        const committed = committedQueueReceipts.get(receipt.receiptId);
+        if (!committed || !areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt)))
+            return undefined;
+        try {
+            if (deps.journal.isQueueReceiptCurrent &&
+                deps.journal.isQueueReceiptCurrent(committed.receipt, committed.queueOwner) !== true) {
+                return undefined;
+            }
+        }
+        catch (error) {
+            recordRuntimeEvent(error, { phase: "queue-receipt-observation" });
+            return undefined;
+        }
+        return committed;
+    };
     const clearRetryTimer = () => {
         if (retryTimer !== undefined)
             cancelRetry(retryTimer);
@@ -1581,11 +1597,9 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 owner === expectedOwner &&
                 !expectedOwner.controller.signal.aborted) {
                 pendingSignal = false;
-                const result = await drain(expectedOwner);
-                if (result !== "idle") {
-                    pendingSignal = false;
-                    return;
-                }
+                // Keep newer wakes in this run so waitForDrain also covers them. A failure
+                // observed after signal() still keeps its latch; this loop never clears it.
+                await drain(expectedOwner);
             }
         };
         const operation = run();
@@ -1785,27 +1799,20 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             }
             transition("queued", input.updateId);
         },
-        isQueueReceiptCommitted(receipt) {
-            const committed = committedQueueReceipts.get(receipt.receiptId);
-            return (committed !== undefined &&
-                areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt)));
-        },
+        isQueueReceiptCommitted: receipt => getCurrentQueueReceipt(receipt) !== undefined,
         getQueueReceiptOwner(receipt) {
-            const committed = committedQueueReceipts.get(receipt.receiptId);
-            return committed &&
-                areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt))
-                ? { ...committed.queueOwner }
-                : undefined;
+            const committed = getCurrentQueueReceipt(receipt);
+            return committed ? { ...committed.queueOwner } : undefined;
         },
         completeQueueReceipts(input) {
             const expectedOwner = owner;
             if (!expectedOwner ||
                 expectedOwner.controller.signal.aborted ||
                 !(deps.isContextCurrent?.(input.ctx) ?? expectedOwner.ctx === input.ctx)) {
-                return;
+                return false;
             }
             if (input.receipts.length === 0)
-                return;
+                return true;
             const normalizedReceipts = input.receipts.map(normalizeQueueReceipt);
             const receiptIds = new Set();
             const sourceUpdateIds = new Set();
@@ -1813,13 +1820,13 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             for (const receipt of normalizedReceipts) {
                 const committed = committedQueueReceipts.get(receipt.receiptId);
                 if (!committed)
-                    continue;
+                    return false;
                 if (receiptIds.has(receipt.receiptId) ||
                     !areTelegramQueueAdmissionReceiptsEqual(committed.receipt, receipt) ||
                     !isTelegramUpdateJournalQueueOwnerProcess(committed.queueOwner, expectedOwner.queueOwnerIdentity) ||
                     receipt.sourceUpdateIds.some((updateId) => sourceUpdateIds.has(updateId))) {
                     blockWithFailure("invalid-outcome", "queue-receipt-completion-invalid", new TelegramUpdateAdmissionOutcomeError(`Telegram ${input.reason} requested invalid queue receipt ${receipt.receiptId}.`));
-                    return;
+                    return false;
                 }
                 receiptIds.add(receipt.receiptId);
                 queuedCompletions.push({
@@ -1830,22 +1837,23 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     sourceUpdateIds.add(updateId);
                 }
             }
-            if (receiptIds.size === 0)
-                return;
             let removedUpdateIds;
             try {
                 removedUpdateIds = deps.journal.completeQueued(queuedCompletions).removedUpdateIds;
             }
             catch (error) {
                 blockWithFailure("journal-write", "queue-receipt-completion", error);
-                return;
+                return false;
             }
             const removed = new Set(removedUpdateIds);
             if (removed.size !== sourceUpdateIds.size ||
                 [...sourceUpdateIds].some((updateId) => !removed.has(updateId))) {
                 blockWithFailure("journal-write", "queue-receipt-completion", new Error(`Telegram ${input.reason} did not complete every receipt source.`));
-                return;
+                return false;
             }
+            input.receipts.forEach((receipt, index) => {
+                acknowledgedQueueReceiptCompletions.set(receipt, normalizedReceipts[index]);
+            });
             for (const updateId of sourceUpdateIds)
                 claims.delete(updateId);
             for (const receiptId of receiptIds) {
@@ -1859,6 +1867,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             notifyStateChange();
             pendingSignal = true;
             launchDrain();
+            return true;
         },
         async stop() {
             const expectedOwner = owner;
@@ -2023,9 +2032,17 @@ export function createTelegramInputCustodyWorkerJournalPort(store) {
     };
     return {
         read: () => store.read(),
+        isQueueReceiptCurrent(receipt, owner) {
+            const entries = store.read().entries.filter(entry => entry.queueReceiptId === receipt.receiptId);
+            return receipt.sourceUpdateIds.length > 0 && entries.length === receipt.sourceUpdateIds.length &&
+                entries.every((entry, index) => entry.updateId === receipt.sourceUpdateIds[index] &&
+                    entry.state === "queued" && entry.queueKind === receipt.queueKind && !entry.queueHandoff &&
+                    entry.queueOwner !== undefined && areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, owner));
+        },
         markQueued: legacyMutation,
         markExecutionFailure: legacyMutation,
-        removeCompleted: legacyMutation,
+        // The common drain batches excluded IDs here; the store rejects all non-vetoed input atomically.
+        removeCompleted: updateIds => store.removeExcluded(updateIds),
         completeQueued: receipts => store.completeQueued(receipts),
         inputCustody: {
             acquireInput: store.acquireInput,
@@ -2620,6 +2637,8 @@ export function createTelegramInputCustodyActivationReadinessResolver(deps) {
     };
 }
 export function createTelegramInputCustodyLifecycleBindingResolver(deps) {
+    // Stable per store, not per descriptor: a renewed source has new captured worker ports.
+    const ports = new WeakMap();
     return () => {
         if (!deps.isEnabled())
             return undefined;
@@ -2627,7 +2646,11 @@ export function createTelegramInputCustodyLifecycleBindingResolver(deps) {
         const recipientBindingKey = deps.getRecipientBindingKey()?.trim();
         if (!source || !source.runtimeKey || !source.recoveryKey || !recipientBindingKey)
             return undefined;
-        const port = createTelegramInputCustodyWorkerJournalPort(source.journal);
+        let port = ports.get(source.journal);
+        if (!port) {
+            port = createTelegramInputCustodyWorkerJournalPort(source.journal);
+            ports.set(source.journal, port);
+        }
         return { runtimeKey: JSON.stringify({ source: source.runtimeKey, recipientBindingKey }),
             recoveryKey: source.recoveryKey,
             recipientBindingKey, journal: { ...port, appendBatch: source.journal.appendBatch,
@@ -2757,6 +2780,7 @@ export function createTelegramUpdateAdmissionHandle(deps) {
         try {
             execution.assertCurrent();
             await deps.defaultHandle(boundUpdate, ctx, execution);
+            execution.assertCurrent();
         }
         finally {
             immediate = false;
@@ -2778,10 +2802,45 @@ export function createTelegramCustodiedUpdateAdmissionHandle(deps) {
     });
     return (update, ctx, signal) => session.execute(update, started => admission(started, ctx, signal));
 }
+// A dispatched prompt can remain in memory until agent_start. Remember only acknowledged
+// removal of these exact receipt objects for later local discard, never for dispatch/replay.
+const acknowledgedQueueReceiptCompletions = new WeakMap();
+const isQueueReceiptCompletionAcknowledged = (receipt) => {
+    const acknowledged = acknowledgedQueueReceiptCompletions.get(receipt);
+    return acknowledged !== undefined && areTelegramQueueAdmissionReceiptsEqual(acknowledged, receipt);
+};
 export function createTelegramQueueAdmissionSettlementMuxRuntime(runtimes) {
-    const settle = (operation) => {
-        for (const runtime of runtimes)
-            operation(runtime);
+    // Plan the whole request before mutation; unready is not an acknowledgement of completion.
+    const complete = (items, ctx, kind) => {
+        const plan = new Map();
+        for (const receipt of items.flatMap(item => item.admissionReceipts ?? [])) {
+            if (kind === "discard" && isQueueReceiptCompletionAcknowledged(receipt))
+                continue;
+            const candidates = runtimes.filter(runtime => runtime.isItemReady({ admissionReceipts: [receipt] }));
+            const selected = candidates[0];
+            if (!selected)
+                return false;
+            if (candidates.length > 1) {
+                const owner = selected.getQueueReceiptOwner(receipt);
+                if (!owner || candidates.some(runtime => {
+                    const candidate = runtime.getQueueReceiptOwner(receipt);
+                    return !candidate || !areTelegramUpdateJournalQueueOwnersEqual(owner, candidate);
+                }))
+                    return false;
+            }
+            const receipts = plan.get(selected) ?? [];
+            receipts.push(receipt);
+            plan.set(selected, receipts);
+        }
+        for (const [runtime, receipts] of plan) {
+            const item = { admissionReceipts: receipts };
+            const completed = kind === "discard" ? runtime.onItemsDiscarded([item], ctx)
+                : kind === "prompt" ? runtime.onPromptHandedOff(item, ctx)
+                    : runtime.onControlSettled(item, ctx);
+            if (completed !== true)
+                return false;
+        }
+        return true;
     };
     return {
         isItemReady: (item) => (item.admissionReceipts ?? []).every((receipt) => runtimes.some((runtime) => runtime.isItemReady({ admissionReceipts: [receipt] }))),
@@ -2799,19 +2858,21 @@ export function createTelegramQueueAdmissionSettlementMuxRuntime(runtimes) {
             }
             return owner ? { ...owner } : undefined;
         },
-        onPromptHandedOff: (item, ctx) => settle((runtime) => runtime.onPromptHandedOff(item, ctx)),
-        onControlSettled: (item, ctx) => settle((runtime) => runtime.onControlSettled(item, ctx)),
-        onItemsDiscarded: (items, ctx) => settle((runtime) => runtime.onItemsDiscarded(items, ctx)),
+        onPromptHandedOff: (item, ctx) => complete([item], ctx, "prompt"),
+        onControlSettled: (item, ctx) => complete([item], ctx, "control"),
+        onItemsDiscarded: (items, ctx) => complete(items, ctx, "discard"),
     };
 }
 export function createTelegramQueueAdmissionSettlementRuntime(worker) {
     const complete = (items, ctx, reason) => {
         const receipts = [];
         for (const item of items) {
-            if (item.admissionReceipts)
-                receipts.push(...item.admissionReceipts);
+            for (const receipt of item.admissionReceipts ?? []) {
+                if (reason !== "discard" || !isQueueReceiptCompletionAcknowledged(receipt))
+                    receipts.push(receipt);
+            }
         }
-        worker.completeQueueReceipts({ receipts, ctx, reason });
+        return receipts.length === 0 || worker.completeQueueReceipts({ receipts, ctx, reason });
     };
     return {
         isItemReady: (item) => (item.admissionReceipts ?? []).every(worker.isQueueReceiptCommitted),
@@ -3065,10 +3126,6 @@ export function createTelegramQueueHandoffReconciler(deps) {
             const recipientJournalBindingKey = deps.createRecipientJournalBindingKey(recipient);
             if (!recipientJournalBindingKey)
                 continue;
-            const recipientItem = structuredClone(item);
-            recipientItem.admissionReceipts = [
-                { ...receipt, journalBindingKey: recipientJournalBindingKey },
-            ];
             const expectedOwner = deps.getReceiptOwner(receipt);
             const lifecycle = deps.getLifecycleForReceipt(receipt);
             if (!expectedOwner ||
@@ -3091,11 +3148,11 @@ export function createTelegramQueueHandoffReconciler(deps) {
                 },
                 handoffToken,
                 lifecycle,
-                stageRemote: async () => {
-                    const payload = createTelegramQueueHandoff({
-                        handoffToken,
-                        item: recipientItem,
-                    }).payload;
+                stageRemote: async ({ payload: sourcePayload }) => {
+                    const payload = {
+                        ...sourcePayload,
+                        admissionReceipts: [{ ...sourcePayload.admissionReceipts[0], journalBindingKey: recipientJournalBindingKey }],
+                    };
                     if (followerRegistered) {
                         return deps.stageThroughFollower({
                             recipient,
@@ -3244,11 +3301,27 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
     let activeRuntimeKey;
     let journal;
     let worker;
+    let workerInputCustody;
     let settlement;
     let journalBindingKey;
     let operation = Promise.resolve();
     let foreignQueueOwnerLiveness;
     let releaseSourceReference;
+    let sourceReferenceBinding;
+    const withRetainedSourceReference = (operation) => {
+        if (!journal || !worker)
+            throw new Error("Telegram update admission worker is not active.");
+        // Synchronous retained-source access needs a reference, not renewed execution authority.
+        const release = !releaseSourceReference && sourceReferenceBinding
+            ? deps.acquireSourceReference?.(sourceReferenceBinding) : undefined;
+        try {
+            return operation(journal);
+        }
+        finally {
+            release?.();
+        }
+    };
+    const readObservedJournal = () => withRetainedSourceReference(source => source.read());
     const stopCurrent = async (forget) => {
         await worker?.stop();
         const release = releaseSourceReference;
@@ -3261,8 +3334,10 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
         }
         if (!forget)
             return;
+        sourceReferenceBinding = undefined;
         journal = undefined;
         worker = undefined;
+        workerInputCustody = undefined;
         settlement = undefined;
         journalBindingKey = undefined;
         activeRuntimeKey = undefined;
@@ -3274,7 +3349,8 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
             await stopCurrent(true);
             return;
         }
-        if (replace || !worker || activeRuntimeKey !== binding.runtimeKey) {
+        if (replace || !worker || activeRuntimeKey !== binding.runtimeKey ||
+            workerInputCustody !== binding.journal.inputCustody) {
             const { runtimeKey, recoveryKey } = binding;
             await stopCurrent(true);
             binding = deps.resolveBinding();
@@ -3283,10 +3359,13 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
                 throw new Error("Telegram update source binding changed during startup.");
             }
             const release = deps.acquireSourceReference?.(binding);
+            const inputCustody = binding.journal.inputCustody;
             try {
                 journal = binding.journal;
                 worker = deps.createWorker(binding.journal, binding);
+                workerInputCustody = inputCustody;
                 settlement = createTelegramQueueAdmissionSettlementRuntime(worker);
+                sourceReferenceBinding = { ...binding, journal };
                 releaseSourceReference = release;
             }
             catch (error) {
@@ -3430,7 +3509,7 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
             if (!journal || !worker || !journal.cancelQueuedHandoff) {
                 throw new Error("Telegram update journal queue handoff cancellation is not available.");
             }
-            const result = journal.cancelQueuedHandoff(input);
+            const result = withRetainedSourceReference(source => source.cancelQueuedHandoff(input));
             worker.signal();
             return result;
         },
@@ -3468,18 +3547,12 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
             : undefined,
         ownsJournalBinding: (candidate) => journalBindingKey !== undefined && journalBindingKey === candidate,
         getForeignQueueOwnerLiveness: () => foreignQueueOwnerLiveness,
-        getJournalEntryCount() {
-            if (!journal || !worker) {
-                throw new Error("Telegram update admission worker is not active.");
-            }
-            return journal.read().entries.length;
-        },
+        getJournalEntryCount: () => readObservedJournal().entries.length,
         hasPendingQueueMutationForItem(item) {
             return Boolean(journal &&
                 worker &&
-                journal
-                    .read()
-                    .entries.some((entry) => entry.state !== "queued" &&
+                readObservedJournal().entries.some((entry) => entry.state !== "queued" &&
+                    entry.preApprovalExcluded !== true &&
                     isTelegramReactionDependencyForQueueItem(entry.update, item)));
         },
         signal: () => worker?.signal(),
@@ -3496,9 +3569,9 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
         },
         isItemReady: (item) => settlement?.isItemReady(item) ??
             (item.admissionReceipts?.length ?? 0) === 0,
-        onPromptHandedOff: (item, ctx) => settlement?.onPromptHandedOff(item, ctx),
-        onControlSettled: (item, ctx) => settlement?.onControlSettled(item, ctx),
-        onItemsDiscarded: (items, ctx) => settlement?.onItemsDiscarded(items, ctx),
+        onPromptHandedOff: (item, ctx) => settlement?.onPromptHandedOff(item, ctx) ?? false,
+        onControlSettled: (item, ctx) => settlement?.onControlSettled(item, ctx) ?? false,
+        onItemsDiscarded: (items, ctx) => settlement?.onItemsDiscarded(items, ctx) ?? false,
     };
 }
 /** Compose source-bound routing and late grouped settlement under one worker. */

package/dist/lib/workspace-admission.d.ts

@@ -75,6 +75,11 @@ export type TelegramWorkspaceRetirementFence = (TelegramWorkspaceRetirementFence
 }) | (TelegramWorkspaceRetirementFenceBase & {
     phase: "deletion-issued";
     deletionIssuedAtMs: number;
+}) | (TelegramWorkspaceRetirementFenceBase & {
+    destructiveKind?: "pressure-retirement";
+    phase: "deletion-rejected";
+    deletionIssuedAtMs: number;
+    rejectionConfirmedAtMs: number;
 }) | (TelegramWorkspaceRetirementFenceBase & {
     phase: "commit-ready";
     absenceConfirmedAtMs: number;
@@ -215,6 +220,10 @@ export interface TelegramWorkspaceAdmissionLedger {
     issueThreadCleanupDeletionPermit: TelegramWorkspaceAdmissionLedger["issueDeletionPermit"];
     confirmRetirementAbsence: (expected: TelegramWorkspaceRetirementFence) => TelegramWorkspaceRetirementFence;
     confirmThreadCleanupAbsence: TelegramWorkspaceAdmissionLedger["confirmRetirementAbsence"];
+    /** Caller must have exact transport proof of rejection, never merely target presence. */
+    confirmRetirementRejection: (expected: TelegramWorkspaceRetirementFence) => TelegramWorkspaceRetirementFence;
+    /** Caller must first durably withdraw the exact rejected intent, retaining its binding. */
+    completeRejectedRetirementFence: (expected: TelegramWorkspaceRetirementFence) => boolean;
     releaseUnissuedRetirementFence: (expected: TelegramWorkspaceRetirementFence) => boolean;
     releaseUnissuedThreadCleanupFence: TelegramWorkspaceAdmissionLedger["releaseUnissuedRetirementFence"];
     completeRetirementFence: (expected: TelegramWorkspaceRetirementFence) => boolean;

package/dist/lib/workspace-admission.js

@@ -195,6 +195,12 @@ function normalizeFence(value, profileKey) {
             deletionIssuedAtMs: value.deletionIssuedAtMs,
         };
     }
+    if (value.phase === "deletion-rejected" &&
+        (value.destructiveKind === undefined || value.destructiveKind === "pressure-retirement") &&
+        isSafeTimestamp(value.deletionIssuedAtMs) && isSafeTimestamp(value.rejectionConfirmedAtMs)) {
+        return { ...base, destructiveKind: value.destructiveKind, phase: "deletion-rejected",
+            deletionIssuedAtMs: value.deletionIssuedAtMs, rejectionConfirmedAtMs: value.rejectionConfirmedAtMs };
+    }
     if (value.phase === "commit-ready" &&
         isSafeTimestamp(value.absenceConfirmedAtMs) &&
         (value.deletionIssuedAtMs === undefined ||
@@ -395,6 +401,10 @@ function areFencesEqual(left, right) {
         right.phase === "deletion-issued") {
         return left.deletionIssuedAtMs === right.deletionIssuedAtMs;
     }
+    if (left.phase === "deletion-rejected" && right.phase === "deletion-rejected") {
+        return left.deletionIssuedAtMs === right.deletionIssuedAtMs &&
+            left.rejectionConfirmedAtMs === right.rejectionConfirmedAtMs;
+    }
     return (left.phase === "commit-ready" &&
         right.phase === "commit-ready" &&
         left.absenceConfirmedAtMs === right.absenceConfirmedAtMs &&
@@ -1023,6 +1033,9 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
         if (!areOwnersEqual(expected.owner, options.owner)) {
             authorityChanged("Telegram Workspace absence confirmation requires fence owner authority.");
         }
+        if (expected.phase === "deletion-rejected") {
+            authorityChanged("Rejected Telegram Workspace deletion cannot confirm absence.");
+        }
         return transact((state) => {
             if (!state.fence || !isTelegramWorkspaceRetirementFence(state.fence)) {
                 authorityChanged("Telegram Workspace retirement fence is absent or has another kind.");
@@ -1069,7 +1082,7 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
             return { result: true, changed: true };
         });
     }
-    function completeRetirementFence(expected, expectedKind = "pressure-retirement") {
+    function completeDestructiveFence(expected, expectedKind, requiredPhase) {
         validateExpectedFence(expected, options.profileKey);
         if (resolveTelegramWorkspaceDestructiveFenceKind(expected) !== expectedKind)
             authorityChanged("Telegram Workspace destructive fence kind changed.");
@@ -1084,13 +1097,44 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
             if (!areFencesEqual(state.fence, expected)) {
                 authorityChanged("Telegram Workspace retirement fence authority changed.");
             }
-            if (state.fence.phase !== "commit-ready") {
-                authorityChanged("Telegram Workspace retirement commit is not ready.");
+            if (state.fence.phase !== requiredPhase) {
+                authorityChanged(requiredPhase === "commit-ready"
+                    ? "Telegram Workspace retirement commit is not ready."
+                    : "Telegram Workspace retirement rejection is not confirmed.");
             }
             delete state.fence;
             return { result: true, changed: true };
         });
     }
+    function confirmRetirementRejection(expected) {
+        validateExpectedFence(expected, options.profileKey);
+        if (resolveTelegramWorkspaceDestructiveFenceKind(expected) !== "pressure-retirement" ||
+            !areOwnersEqual(expected.owner, options.owner) ||
+            (expected.phase !== "deletion-issued" && expected.phase !== "deletion-rejected")) {
+            authorityChanged("Telegram Workspace rejection requires exact issued retirement authority.");
+        }
+        return transact((state) => {
+            const current = state.fence;
+            if (!current || !isTelegramWorkspaceRetirementFence(current) || !areFenceBasesEqual(current, expected) ||
+                (current.phase !== "deletion-issued" && current.phase !== "deletion-rejected") ||
+                current.deletionIssuedAtMs !== expected.deletionIssuedAtMs ||
+                (expected.phase === "deletion-rejected" && !areFencesEqual(current, expected))) {
+                authorityChanged("Telegram Workspace retirement fence authority changed.");
+            }
+            if (current.phase === "deletion-rejected")
+                return { result: cloneFence(current), changed: false };
+            const rejected = { ...current,
+                destructiveKind: "pressure-retirement", phase: "deletion-rejected", rejectionConfirmedAtMs: getNowMs() };
+            state.fence = rejected;
+            return { result: cloneFence(rejected), changed: true };
+        });
+    }
+    function completeRetirementFence(expected, expectedKind = "pressure-retirement") {
+        return completeDestructiveFence(expected, expectedKind, "commit-ready");
+    }
+    function completeRejectedRetirementFence(expected) {
+        return completeDestructiveFence(expected, "pressure-retirement", "deletion-rejected");
+    }
     function adoptThreadCleanupFence(expected, replacement) {
         return adoptRetirementFence(expected, replacement, "manual-thread-cleanup");
     }
@@ -1128,6 +1172,8 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
         issueThreadCleanupDeletionPermit,
         confirmRetirementAbsence,
         confirmThreadCleanupAbsence,
+        confirmRetirementRejection,
+        completeRejectedRetirementFence,
         releaseUnissuedRetirementFence,
         releaseUnissuedThreadCleanupFence,
         completeRetirementFence,