@llblab/pi-telegram 0.51.5 → 0.52.0

package/dist/lib/workspace-retirement.d.ts

@@ -4,10 +4,10 @@
  * Owns fail-closed protection, demand-driven pressure retirement, exact-intent admission,
  * successor recovery, and fenced one-shot deletion before durable slot reuse.
  */
-import type { TelegramUpdateJournalDeadQueueOwnerRecoveryInput, TelegramUpdateJournalDeadQueueOwnerRecoveryResult, TelegramUpdateJournalEntry, TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
-import type { TelegramTarget } from "./target.ts";
+import type { TelegramJournalNamespaceInspection, TelegramUpdateJournalDeadQueueOwnerRecoveryInput, TelegramUpdateJournalDeadQueueOwnerRecoveryResult, TelegramUpdateJournalEntry, TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
+import { type TelegramTarget } from "./target.ts";
 import { type TelegramWorkspaceThreadDeletionTransport } from "./telegram-api.ts";
-import type { TelegramTopicTargetStore, TelegramWorkspaceExternalProtectionEvidence, TelegramWorkspaceRetirementIntent, TelegramWorkspaceProtectionState, TelegramWorkspaceThreadBinding } from "./threads.ts";
+import type { TelegramTopicTargetStore, TelegramWorkspaceJournalSource, TelegramWorkspaceExternalProtectionEvidence, TelegramWorkspaceRetirementIntent, TelegramWorkspaceProtectionState, TelegramWorkspaceThreadBinding } from "./threads.ts";
 import { type TelegramWorkspaceAdmissionLedger, type TelegramWorkspaceAdmissionScope, type TelegramWorkspaceDeletionPermit } from "./workspace-admission.ts";
 export interface TelegramWorkspaceOperationGate {
     runExclusive: <T>(operation: () => Promise<T>) => Promise<T>;
@@ -36,18 +36,21 @@ interface TelegramWorkspaceJournalReader {
             entries: readonly {
                 update: unknown;
             }[];
+            exists?: boolean;
         };
     };
     readForProtection?: () => {
         entries: readonly {
             update: unknown;
         }[];
+        exists?: boolean;
     };
 }
 export declare function captureTelegramWorkspaceJournalProtectionSources(input: {
     binding: TelegramWorkspaceThreadBinding;
     resolveLeader: () => TelegramWorkspaceJournalReader | undefined;
     createFollowerResolver: (journalBindingKey: string) => () => TelegramWorkspaceJournalReader | undefined;
+    createSessionResolver?: (recipientBindingKey: string, sessionId: string) => () => TelegramWorkspaceJournalReader | undefined;
     withJournalReference?: <T>(binding: TelegramWorkspaceJournalReader, operation: () => T) => T;
     discovery?: {
         paths: readonly string[];
@@ -63,6 +66,7 @@ export type TelegramWorkspaceJournalProtectionSource = {
         kind: "binding";
         bindingKey: string;
         journalBindingKey: string;
+        sessionId?: string;
     } | {
         kind: "discovered";
         path: string;
@@ -70,6 +74,8 @@ export type TelegramWorkspaceJournalProtectionSource = {
     entries: readonly {
         update: unknown;
     }[];
+    /** Positive filesystem presence is distinct from a complete namespace with a missing historical family. */
+    exists?: boolean;
 } | {
     kind: "unknown";
     scope: {
@@ -78,6 +84,7 @@ export type TelegramWorkspaceJournalProtectionSource = {
         kind: "binding";
         bindingKey: string;
         journalBindingKey: string;
+        sessionId?: string;
     } | {
         kind: "discovered";
         path: string;
@@ -91,19 +98,24 @@ export declare function resolveTelegramWorkspaceAcceptedWorkProtection(input: {
     }[];
     journalSources: readonly TelegramWorkspaceJournalProtectionSource[];
     sourcesComplete: boolean;
+    /** Relocation cannot infer execution ownership from the original Telegram message target. */
+    requireBindingProvenance?: boolean;
 }): TelegramWorkspaceProtectionState;
 export type TelegramWorkspaceJournalPruneResult = {
     kind: "committed";
     binding: TelegramWorkspaceThreadBinding;
     removedKeys: string[];
+    removedSources?: TelegramWorkspaceJournalSource[];
 } | {
     kind: "blocked";
-    reason: "incomplete-evidence" | "writer-not-quiescent" | "state-changed";
+    reason: "incomplete-evidence" | "writer-not-quiescent" | "state-changed" | "publication-refused";
 };
 export declare function pruneTelegramWorkspaceJournalEvidence(input: {
-    store: Pick<TelegramTopicTargetStore, "commitWorkspaceJournalEvidence" | "persist">;
+    store: Pick<TelegramTopicTargetStore, "commitWorkspaceJournalEvidence" | "persistWorkspaceJournalEvidence">;
     binding: TelegramWorkspaceThreadBinding;
-    capture: TelegramWorkspaceJournalProtectionCapture;
+    /** Capture fresh source evidence after admission, not a snapshot taken before the lease. */
+    capture: () => TelegramWorkspaceJournalProtectionCapture;
+    runExclusive: TelegramWorkspaceOperationGate["runExclusive"];
     getJournalWriterProtection: (journalBindingKey: string) => TelegramWorkspaceProtectionState;
     getLeaderEpoch: () => number | string | undefined;
     getProfileKey: () => string;
@@ -113,6 +125,7 @@ export declare function pruneTelegramWorkspaceJournalEvidence(input: {
 }): Promise<TelegramWorkspaceJournalPruneResult>;
 export declare function captureTelegramWorkspaceExternalProtection(input: {
     binding: TelegramWorkspaceThreadBinding;
+    requireBindingProvenance?: boolean;
     getLiveOwnerProtection: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceProtectionState;
     getLocalAcceptedTargets: (binding: TelegramWorkspaceThreadBinding) => {
         targets: readonly TelegramTarget[];
@@ -121,7 +134,7 @@ export declare function captureTelegramWorkspaceExternalProtection(input: {
     captureJournalSources: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceJournalProtectionCapture;
     getDeliveryAuthorityProtection?: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceProtectionState;
 }): TelegramWorkspaceExternalProtectionEvidence;
-export declare function createTelegramWorkspaceExternalProtectionCapture(deps: {
+interface TelegramWorkspaceProtectionObserverDeps {
     listFollowers: () => readonly {
         target?: TelegramTarget;
     }[];
@@ -132,15 +145,35 @@ export declare function createTelegramWorkspaceExternalProtectionCapture(deps: {
     }[];
     resolveLeaderJournal: () => TelegramWorkspaceJournalReader | undefined;
     createFollowerJournalResolver: (journalBindingKey: string) => () => TelegramWorkspaceJournalReader | undefined;
+    createSessionJournalResolver?: (recipientBindingKey: string, sessionId: string) => () => TelegramWorkspaceJournalReader | undefined;
     discoverFollowerJournals?: () => {
         paths: readonly string[];
         complete: boolean;
     };
+    /** Strict read-only namespace evidence; it never substitutes for writer closure. */
+    inspectJournalNamespace?: () => TelegramJournalNamespaceInspection;
     createJournalPathResolver?: (path: string) => () => TelegramWorkspaceJournalReader | undefined;
     withJournalReference?: <T>(binding: TelegramWorkspaceJournalReader, operation: () => T) => T;
     getJournalWriterProtection?: (journalBindingKey: string) => TelegramWorkspaceProtectionState;
     getDeliveryAuthorityProtection?: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceProtectionState;
-}): (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
+}
+export interface TelegramWorkspaceProtectionObserver {
+    capture: (binding: TelegramWorkspaceThreadBinding, options?: {
+        requireBindingProvenance?: boolean;
+    }) => TelegramWorkspaceExternalProtectionEvidence;
+    captureJournalSources: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceJournalProtectionCapture;
+    getJournalWriterProtection: (journalBindingKey: string) => TelegramWorkspaceProtectionState;
+}
+/** Shared read-only observer: protection and metadata pruning use the same scoped evidence path. */
+export declare function createTelegramWorkspaceProtectionObserver(deps: TelegramWorkspaceProtectionObserverDeps): TelegramWorkspaceProtectionObserver;
+/** Callable protection view retained for callers that need no metadata observation ports. */
+export declare function createTelegramWorkspaceExternalProtectionCapture(deps: TelegramWorkspaceProtectionObserverDeps): TelegramWorkspaceProtectionObserver["capture"];
+export declare function createTelegramWorkspaceJournalEvidencePruner(deps: TelegramWorkspaceOperationGate & {
+    store: TelegramTopicTargetStore;
+    getAdmission: () => TelegramWorkspaceAdmissionLedger | undefined;
+    getLeaderEpoch: () => number | string | undefined;
+    protection: Pick<TelegramWorkspaceProtectionObserver, "captureJournalSources" | "getJournalWriterProtection">;
+}): (binding: TelegramWorkspaceThreadBinding, isCurrent: () => boolean) => Promise<TelegramWorkspaceJournalPruneResult>;
 export declare function isCurrentTelegramWorkspaceBinding(store: Pick<TelegramTopicTargetStore, "listWorkspaceBindings">, expected: TelegramWorkspaceThreadBinding): boolean;
 export interface TelegramWorkspaceDeadQueueJournalBinding {
     recoveryKey?: string;
@@ -175,6 +208,7 @@ export declare function createTelegramWorkspaceDeadOwnerQueueReclaimer(deps: {
     }[];
     resolveLeaderJournal: () => TelegramWorkspaceDeadQueueJournalBinding | undefined;
     createFollowerJournalResolver: (journalBindingKey: string) => () => TelegramWorkspaceDeadQueueJournalBinding | undefined;
+    createSessionJournalResolver?: (recipientBindingKey: string, sessionId: string) => () => TelegramWorkspaceDeadQueueJournalBinding | undefined;
     discoverFollowerJournals?: () => {
         paths: readonly string[];
         complete: boolean;
@@ -218,7 +252,7 @@ export type TelegramWorkspaceRetirementExecution = {
 };
 export type TelegramWorkspaceRetirementAbsence = "absent" | "present" | "unknown";
 export declare function executeTelegramWorkspaceRetirement(input: {
-    store: Pick<TelegramTopicTargetStore, "captureWorkspaceSlotOccupancy" | "listWorkspaceBindings" | "listWorkspaceRetirementIntents" | "commitWorkspaceRetirement" | "removeWorkspaceRetirementIntent" | "persist">;
+    store: Pick<TelegramTopicTargetStore, "captureWorkspaceSlotOccupancy" | "listWorkspaceBindings" | "listWorkspaceRetirementIntents" | "commitWorkspaceRetirement" | "removeWorkspaceRetirementIntent" | "markStaleByTarget" | "persist">;
     admission: Pick<TelegramWorkspaceAdmissionLedger, "getOwner" | "read" | "acquireRetirementFence" | "adoptRetirementFence" | "issueDeletionPermit" | "confirmRetirementAbsence" | "confirmRetirementRejection" | "completeRejectedRetirementFence" | "releaseUnissuedRetirementFence" | "completeRetirementFence">;
     intent: TelegramWorkspaceRetirementIntent;
     getExternalProtection: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
@@ -263,7 +297,7 @@ export type TelegramWorkspaceRetirementLifecycleResult = TelegramWorkspaceRetire
     reason: string;
 };
 export declare function runTelegramWorkspaceRetirementLifecycle(input: {
-    store: TelegramWorkspaceRetirementPreparationDeps["store"] & Pick<TelegramTopicTargetStore, "replaceWorkspaceRetirementIntent" | "commitWorkspaceRetirement">;
+    store: TelegramWorkspaceRetirementPreparationDeps["store"] & Pick<TelegramTopicTargetStore, "replaceWorkspaceRetirementIntent" | "commitWorkspaceRetirement" | "markStaleByTarget">;
     getExternalProtection: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
     getLeaderEpoch: () => number | string | undefined;
     getProfileKey: () => string;
@@ -278,6 +312,7 @@ export type TelegramWorkspaceCapacityRunner = <T>(operation: () => Promise<T>) =
 export interface TelegramWorkspaceSlotRotationPorts extends TelegramWorkspaceOperationGate {
     getAdmission: () => TelegramWorkspaceAdmissionLedger | undefined;
     deleteThread: TelegramWorkspaceThreadDeletionTransport;
+    pruneJournalEvidence?: (binding: TelegramWorkspaceThreadBinding, isCurrent: () => boolean) => Promise<TelegramWorkspaceJournalPruneResult>;
     reclaimDeadOwnerQueuedWork?: (binding: TelegramWorkspaceThreadBinding, isCurrent: () => boolean) => Promise<TelegramWorkspaceDeadQueueReclamation>;
 }
 /** Retry allocation once, only after the failed operation released all ordinary leases. */

package/dist/lib/workspace-retirement.js

@@ -5,6 +5,7 @@
  * successor recovery, and fenced one-shot deletion before durable slot reuse.
  */
 import { isDeepStrictEqual } from "node:util";
+import { areTelegramTargetsEqual as sameTarget } from "./target.js";
 import { getTelegramApiErrorRequestTarget, isTelegramApiRequestRejected, } from "./telegram-api.js";
 import { planTelegramWorkspaceSlotAllocation, TelegramWorkspaceSlotUnavailableError, } from "./workspace-slots.js";
 import { createTelegramWorkspaceAdmissionOperationId, isTelegramWorkspaceRetirementFence, runWithTelegramWorkspaceAdmissionsAsync, } from "./workspace-admission.js";
@@ -55,7 +56,8 @@ export function captureTelegramWorkspaceJournalProtectionSources(input) {
             const snapshot = input.withJournalReference
                 ? input.withJournalReference(binding, read)
                 : read();
-            sources.push({ kind: "available", scope, entries: snapshot.entries });
+            sources.push({ kind: "available", scope, entries: snapshot.entries,
+                ...(snapshot.exists === undefined ? {} : { exists: snapshot.exists }) });
         }
         catch {
             complete = false;
@@ -70,6 +72,10 @@ export function captureTelegramWorkspaceJournalProtectionSources(input) {
             journalBindingKey,
         }, input.createFollowerResolver(journalBindingKey));
     }
+    for (const source of input.binding.journalSources ?? []) {
+        capture({ kind: "binding", bindingKey: input.binding.bindingKey,
+            journalBindingKey: source.recipientBindingKey, sessionId: source.sessionId }, input.createSessionResolver?.(source.recipientBindingKey, source.sessionId) ?? (() => undefined));
+    }
     for (const path of input.discovery?.paths ?? []) {
         capture({ kind: "discovered", path }, input.discovery.createResolver(path));
     }
@@ -101,9 +107,6 @@ function getJournalUpdateTarget(update) {
         ...(typeof threadId === "number" ? { threadId } : {}),
     };
 }
-function sameTarget(left, right) {
-    return left.chatId === right.chatId && left.threadId === right.threadId;
-}
 export function resolveTelegramWorkspaceAcceptedWorkProtection(input) {
     if (input.localAcceptedTargets.some((target) => sameTarget(target, input.binding.target))) {
         return "protected";
@@ -118,9 +121,17 @@ export function resolveTelegramWorkspaceAcceptedWorkProtection(input) {
             unknown = true;
             continue;
         }
+        if (input.requireBindingProvenance && source.scope.kind === "binding" && source.exists === false) {
+            unknown = true;
+            continue;
+        }
         if (source.scope.kind === "binding" && source.entries.length > 0) {
             return "protected";
         }
+        if (input.requireBindingProvenance && source.entries.length > 0) {
+            unknown = true;
+            continue;
+        }
         for (const entry of source.entries) {
             const target = getJournalUpdateTarget(entry.update);
             if (!target) {
@@ -144,49 +155,73 @@ export async function pruneTelegramWorkspaceJournalEvidence(input) {
         if (!isCurrent()) {
             throw new Error("Telegram Workspace journal pruning requires current leader authority.");
         }
-        const shared = input.capture.sources.filter((source) => source.scope.kind === "shared");
-        const bindingSources = input.capture.sources.filter((source) => source.scope.kind === "binding" &&
+        let capture;
+        try {
+            capture = input.capture();
+        }
+        catch {
+            return { kind: "blocked", reason: "incomplete-evidence" };
+        }
+        const address = (key, sessionId) => JSON.stringify([sessionId ?? null, key]);
+        const keys = input.binding.journalBindingKeys ?? [];
+        const sessions = input.binding.journalSources ?? [];
+        const expected = [
+            ...keys.map(key => address(key)),
+            ...sessions.map(source => address(source.recipientBindingKey, source.sessionId)),
+        ];
+        const shared = capture.sources.filter(source => source.scope.kind === "shared");
+        const bindingSources = capture.sources.filter(source => source.scope.kind === "binding" &&
             source.scope.bindingKey === input.binding.bindingKey);
-        const sourceByKey = new Map(bindingSources.flatMap((source) => source.scope.kind === "binding"
-            ? [[source.scope.journalBindingKey, source]]
-            : []));
-        if (!input.capture.complete ||
-            shared.length !== 1 ||
-            shared[0]?.kind !== "available" ||
-            bindingSources.length !==
-                (input.binding.journalBindingKeys ?? []).length ||
-            sourceByKey.size !== (input.binding.journalBindingKeys ?? []).length ||
-            Array.from(sourceByKey.values()).some((source) => source.kind !== "available")) {
+        const sourceByAddress = new Map(bindingSources.flatMap(source => source.scope.kind === "binding"
+            ? [[address(source.scope.journalBindingKey, source.scope.sessionId), source]] : []));
+        if (!capture.complete || shared.length !== 1 || shared[0]?.kind !== "available" ||
+            bindingSources.length !== expected.length || sourceByAddress.size !== expected.length ||
+            expected.some(key => sourceByAddress.get(key)?.kind !== "available")) {
             return { kind: "blocked", reason: "incomplete-evidence" };
         }
-        const emptyKeys = (input.binding.journalBindingKeys ?? []).filter((key) => {
-            const source = sourceByKey.get(key);
+        const empty = new Set(expected.filter(key => {
+            const source = sourceByAddress.get(key);
             return source?.kind === "available" && source.entries.length === 0;
-        });
-        if (emptyKeys.some((key) => input.getJournalWriterProtection(key) !== "clear")) {
+        }));
+        const emptyWriterKeys = new Set([
+            ...keys.filter(key => empty.has(address(key))),
+            ...sessions.filter(source => empty.has(address(source.recipientBindingKey, source.sessionId)))
+                .map(source => source.recipientBindingKey),
+        ]);
+        const quiescent = new Set([...emptyWriterKeys].filter(key => input.getJournalWriterProtection(key) === "clear"));
+        const removedKeys = keys.filter(key => empty.has(address(key)) && quiescent.has(key));
+        const removedSources = sessions.filter(source => empty.has(address(source.recipientBindingKey, source.sessionId)) &&
+            quiescent.has(source.recipientBindingKey));
+        if (empty.size > 0 && removedKeys.length === 0 && removedSources.length === 0) {
             return { kind: "blocked", reason: "writer-not-quiescent" };
         }
-        const retainedKeys = (input.binding.journalBindingKeys ?? []).filter((key) => !emptyKeys.includes(key));
+        const retainedKeys = keys.filter(key => !removedKeys.includes(key));
+        const retainedSources = sessions.filter(source => !removedSources.includes(source));
         if (!isCurrent()) {
             throw new Error("Telegram Workspace journal pruning lost leader authority.");
         }
-        const binding = input.store.commitWorkspaceJournalEvidence(input.binding, retainedKeys, input.binding.journalBindingsComplete === true);
+        const binding = input.store.commitWorkspaceJournalEvidence(input.binding, retainedKeys, input.binding.journalBindingsComplete === true, retainedSources);
         if (!binding)
             return { kind: "blocked", reason: "state-changed" };
-        const removedKeys = (input.binding.journalBindingKeys ?? []).filter((key) => !retainedKeys.includes(key));
-        if (removedKeys.length > 0)
-            await input.store.persist();
+        if (removedKeys.length > 0 || removedSources.length > 0) {
+            const published = await input.store.persistWorkspaceJournalEvidence(binding, isCurrent);
+            if (!isCurrent())
+                throw new Error("Telegram Workspace journal pruning lost leader authority.");
+            if (!published)
+                return { kind: "blocked", reason: "publication-refused" };
+        }
         if (!isCurrent()) {
             throw new Error("Telegram Workspace journal pruning lost leader authority.");
         }
-        return { kind: "committed", binding, removedKeys };
+        return { kind: "committed", binding, removedKeys,
+            ...(removedSources.length ? { removedSources: removedSources.map(source => ({ ...source })) } : {}) };
     };
     return runWithTelegramWorkspaceAdmissionsAsync({
         ledger: input.admission,
         operationId: createTelegramWorkspaceAdmissionOperationId(),
         operationKind: "workspace.prune-journal-evidence",
         scopes: [{ kind: "target", target: input.binding.target }],
-        operation,
+        operation: () => input.runExclusive(operation),
         onReleaseError(error) {
             input.onAdmissionReleaseError?.(error);
         },
@@ -210,6 +245,7 @@ export function captureTelegramWorkspaceExternalProtection(input) {
             localAcceptedTargets: local.targets,
             journalSources: journals.sources,
             sourcesComplete: journals.complete && local.complete,
+            requireBindingProvenance: input.requireBindingProvenance,
         });
     }
     catch {
@@ -223,17 +259,45 @@ export function captureTelegramWorkspaceExternalProtection(input) {
     }
     return { liveOwner, acceptedWork, deliveryAuthority };
 }
-export function createTelegramWorkspaceExternalProtectionCapture(deps) {
-    return function (binding) {
+/** Shared read-only observer: protection and metadata pruning use the same scoped evidence path. */
+export function createTelegramWorkspaceProtectionObserver(deps) {
+    const captureJournalSources = (candidate) => {
+        const namespace = deps.inspectJournalNamespace?.();
+        if (deps.inspectJournalNamespace && (!namespace || namespace.sources.filter(source => source.role === "polling").length !== 1))
+            throw new Error("Telegram strict namespace evidence is unavailable or incomplete.");
+        if (namespace?.retainedInputs?.some(original => original.state !== "committed"))
+            throw new Error("Telegram namespace contains uncommitted private retention evidence.");
+        const discovery = namespace
+            ? { paths: namespace.sources.filter(source => source.role !== "polling" && source.evidence.kind === "present")
+                    .map(source => source.path), complete: true }
+            : candidate.journalBindingsComplete === true ? undefined : deps.discoverFollowerJournals?.();
+        if (namespace && !deps.createJournalPathResolver)
+            throw new Error("Telegram strict namespace protection requires discovered source resolution.");
+        return captureTelegramWorkspaceJournalProtectionSources({
+            binding: candidate,
+            resolveLeader: deps.resolveLeaderJournal,
+            createFollowerResolver: deps.createFollowerJournalResolver,
+            ...(deps.createSessionJournalResolver ? { createSessionResolver: deps.createSessionJournalResolver } : {}),
+            ...(deps.withJournalReference ? { withJournalReference: deps.withJournalReference } : {}),
+            ...(discovery && deps.createJournalPathResolver
+                ? { discovery: { ...discovery, createResolver: deps.createJournalPathResolver } } : {}),
+        });
+    };
+    const capture = function (binding, options) {
         return captureTelegramWorkspaceExternalProtection({
             binding,
+            requireBindingProvenance: options?.requireBindingProvenance,
             getLiveOwnerProtection(candidate) {
                 if (deps.listFollowers().some((follower) => !!follower.target && sameTarget(follower.target, candidate.target)))
                     return "protected";
                 if (!deps.getJournalWriterProtection)
                     return "unknown";
                 let unknown = candidate.journalBindingsComplete !== true;
-                for (const journalBindingKey of candidate.journalBindingKeys ?? []) {
+                const writerKeys = new Set([
+                    ...(candidate.journalBindingKeys ?? []),
+                    ...(candidate.journalSources ?? []).map(source => source.recipientBindingKey),
+                ]);
+                for (const journalBindingKey of writerKeys) {
                     const protection = deps.getJournalWriterProtection(journalBindingKey);
                     if (protection === "protected")
                         return "protected";
@@ -257,29 +321,34 @@ export function createTelegramWorkspaceExternalProtectionCapture(deps) {
                 }
                 return { targets, complete };
             },
-            captureJournalSources(candidate) {
-                const discovery = candidate.journalBindingsComplete === true
-                    ? undefined
-                    : deps.discoverFollowerJournals?.();
-                return captureTelegramWorkspaceJournalProtectionSources({
-                    binding: candidate,
-                    resolveLeader: deps.resolveLeaderJournal,
-                    createFollowerResolver: deps.createFollowerJournalResolver,
-                    ...(deps.withJournalReference
-                        ? { withJournalReference: deps.withJournalReference } : {}),
-                    ...(discovery && deps.createJournalPathResolver
-                        ? { discovery: {
-                                ...discovery,
-                                createResolver: deps.createJournalPathResolver,
-                            } }
-                        : {}),
-                });
-            },
+            captureJournalSources,
             ...(deps.getDeliveryAuthorityProtection
                 ? { getDeliveryAuthorityProtection: deps.getDeliveryAuthorityProtection }
                 : {}),
         });
     };
+    return { capture, captureJournalSources,
+        getJournalWriterProtection: deps.getJournalWriterProtection ?? (() => "unknown") };
+}
+/** Callable protection view retained for callers that need no metadata observation ports. */
+export function createTelegramWorkspaceExternalProtectionCapture(deps) {
+    return createTelegramWorkspaceProtectionObserver(deps).capture;
+}
+export function createTelegramWorkspaceJournalEvidencePruner(deps) {
+    return async (binding, isCurrent) => {
+        const admission = deps.getAdmission();
+        if (!admission)
+            return { kind: "blocked", reason: "state-changed" };
+        const profileKey = admission.getProfileKey();
+        return pruneTelegramWorkspaceJournalEvidence({
+            store: deps.store, binding, admission, runExclusive: deps.runExclusive,
+            capture: () => deps.protection.captureJournalSources(binding),
+            getJournalWriterProtection: deps.protection.getJournalWriterProtection,
+            getLeaderEpoch: deps.getLeaderEpoch,
+            getProfileKey: () => deps.getAdmission()?.getProfileKey() ?? "",
+            isCurrent: () => isCurrent() && deps.getAdmission()?.getProfileKey() === profileKey,
+        });
+    };
 }
 export function isCurrentTelegramWorkspaceBinding(store, expected) {
     return store.listWorkspaceBindings().some((binding) => isDeepStrictEqual(binding, expected));
@@ -307,6 +376,9 @@ export function createTelegramWorkspaceDeadOwnerQueueReclaimer(deps) {
         if (!isCurrent() || !deps.isBindingCurrent(binding)) {
             return { kind: "blocked", reason: "authority-changed" };
         }
+        // Session addresses require exact resolution; never substitute a flat same-hash journal.
+        if (binding.journalSources?.length && !deps.createSessionJournalResolver)
+            return { kind: "blocked", reason: "incomplete-source" };
         const initial = deps.getExternalProtection(binding);
         if (initial.liveOwner !== "clear" || initial.deliveryAuthority !== "clear") {
             return { kind: "blocked", reason: "live-owner" };
@@ -345,6 +417,9 @@ export function createTelegramWorkspaceDeadOwnerQueueReclaimer(deps) {
         for (const key of binding.journalBindingKeys ?? []) {
             capture("binding", deps.createFollowerJournalResolver(key));
         }
+        for (const source of binding.journalSources ?? []) {
+            capture("binding", deps.createSessionJournalResolver(source.recipientBindingKey, source.sessionId));
+        }
         for (const path of discovery?.paths ?? []) {
             if (!deps.createJournalPathResolver) {
                 complete = false;
@@ -605,6 +680,12 @@ export async function executeTelegramWorkspaceRetirement(input) {
             }
             return { kind: "retained", reason: "stale-intent" };
         }
+        if (fence?.phase === "commit-ready") {
+            // Exact confirmed absence retires any same-target routing record that
+            // survived the deletion attempt. The fence prevents replacement target
+            // publication while this stale local projection is removed.
+            input.store.markStaleByTarget(binding.target, "deleted");
+        }
         const eligible = () => input.store.captureWorkspaceSlotOccupancy(input.getExternalProtection, { expectedRetirement: input.intent }).bindings.find((candidate) => candidate.bindingKey === input.intent.binding.bindingKey)?.protection === "eligible";
         if (!eligible())
             return { kind: "retained", reason: "protection-changed" };
@@ -669,6 +750,9 @@ export async function executeTelegramWorkspaceRetirement(input) {
         }
         if (!isCurrent())
             return { kind: "retained", reason: "authority-changed" };
+        if (fence.phase === "commit-ready") {
+            input.store.markStaleByTarget(binding.target, "deleted");
+        }
         if (!eligible())
             return { kind: "retained", reason: "protection-changed" };
         if (!await input.store.commitWorkspaceRetirement(input.intent, isCurrent)) {
@@ -799,19 +883,46 @@ export async function runTelegramWorkspaceRetirementLifecycle(input) {
         });
     }
     if (intent) {
-        const adoption = await adoptTelegramWorkspaceRetirementIntent({
-            store: input.store,
-            intent,
-            getExternalProtection: input.getExternalProtection,
-            getLeaderEpoch: input.getLeaderEpoch,
-            getProfileKey: input.getProfileKey,
-            isCurrent: input.isCurrent,
-            runExclusive: input.runExclusive,
-        });
-        if (adoption.kind !== "adopted") {
-            return { kind: "blocked", stage: "adoption", reason: adoption.reason };
+        if (retainedFence && isTelegramWorkspaceRetirementFence(retainedFence) &&
+            retainedFence.phase === "commit-ready" &&
+            matchesTelegramWorkspaceRetirementFence(retainedFence, intent)) {
+            const resumed = await input.runExclusive(async () => {
+                const epoch = input.getLeaderEpoch();
+                const profileKey = input.getProfileKey();
+                const isCurrent = () => epoch !== undefined && input.getLeaderEpoch() === epoch &&
+                    input.getProfileKey() === profileKey && input.isCurrent?.() !== false;
+                if (!isCurrent() || intent.profileKey !== profileKey)
+                    return undefined;
+                const intents = input.store.listWorkspaceRetirementIntents();
+                const binding = input.store.listWorkspaceBindings().find(candidate => candidate.bindingKey === intent.binding.bindingKey);
+                if (intents.length !== 1 || !isDeepStrictEqual(intents[0], intent) ||
+                    !binding || !isDeepStrictEqual(binding, intent.binding))
+                    return undefined;
+                if (intent.leaderEpoch === epoch)
+                    return intent;
+                const replacement = { ...intent, leaderEpoch: epoch };
+                return await input.store.replaceWorkspaceRetirementIntent(intent, replacement, isCurrent)
+                    ? replacement : undefined;
+            });
+            if (!resumed)
+                return { kind: "blocked", stage: "adoption", reason: "commit-rejected" };
+            intent = resumed;
+        }
+        else {
+            const adoption = await adoptTelegramWorkspaceRetirementIntent({
+                store: input.store,
+                intent,
+                getExternalProtection: input.getExternalProtection,
+                getLeaderEpoch: input.getLeaderEpoch,
+                getProfileKey: input.getProfileKey,
+                isCurrent: input.isCurrent,
+                runExclusive: input.runExclusive,
+            });
+            if (adoption.kind !== "adopted") {
+                return { kind: "blocked", stage: "adoption", reason: adoption.reason };
+            }
+            intent = adoption.intent;
         }
-        intent = adoption.intent;
     }
     else {
         const preparation = await prepareTelegramWorkspaceRetirement({
@@ -921,21 +1032,42 @@ export function createTelegramWorkspaceSlotRotation(input) {
             catch (error) {
                 if (!(error instanceof TelegramWorkspaceSlotUnavailableError))
                     throw error;
-                if (input.reclaimDeadOwnerQueuedWork) {
+                if (input.pruneJournalEvidence || input.reclaimDeadOwnerQueuedWork) {
                     const candidates = await input.runExclusive(async () => {
                         await input.store.load();
                         if (!isCurrent())
                             throw new Error("Telegram Workspace reclamation lost leader authority.");
                         const snapshot = input.store.captureWorkspaceSlotOccupancy(input.getExternalProtection);
                         const allocation = planTelegramWorkspaceSlotAllocation({ ...snapshot, nowMs: Date.now() });
-                        if (allocation.kind !== "blocked" || allocation.reason !== "protected-capacity")
+                        if (allocation.kind === "free" || (allocation.kind === "blocked" && allocation.reason !== "protected-capacity"))
+                            return [];
+                        if (allocation.kind === "reclaim" && !input.pruneJournalEvidence)
                             return [];
-                        return input.store.listWorkspaceBindings().filter((binding) => typeof binding.inactiveSinceMs === "number" &&
+                        return input.store.listWorkspaceBindings().filter((binding) => (allocation.kind !== "reclaim" || binding.bindingKey === allocation.candidate.bindingKey) &&
+                            typeof binding.inactiveSinceMs === "number" &&
                             Number.isFinite(binding.inactiveSinceMs) &&
                             binding.inactiveSinceMs >= 0).sort((left, right) => left.inactiveSinceMs - right.inactiveSinceMs ||
                             (left.slot ?? "").localeCompare(right.slot ?? ""));
                     });
-                    for (const binding of candidates) {
+                    for (const original of candidates) {
+                        let binding = original;
+                        if (input.pruneJournalEvidence && ((binding.journalBindingKeys?.length ?? 0) + (binding.journalSources?.length ?? 0) > 0)) {
+                            const pruned = await input.pruneJournalEvidence(binding, isCurrent);
+                            if (!isCurrent())
+                                throw new Error("Telegram Workspace pruning lost leader authority.");
+                            if (pruned.kind !== "committed")
+                                continue;
+                            binding = pruned.binding;
+                            const removed = pruned.removedKeys.length + (pruned.removedSources?.length ?? 0);
+                            if (removed > 0) {
+                                try {
+                                    input.recordEvent("Telegram Workspace journal evidence pruned.", { slot: binding.slot, removed });
+                                }
+                                catch { /* Diagnostics cannot revoke a published metadata subset. */ }
+                            }
+                        }
+                        if (!input.reclaimDeadOwnerQueuedWork)
+                            continue;
                         const evidence = input.getExternalProtection(binding);
                         if (evidence.liveOwner !== "clear" ||
                             evidence.acceptedWork !== "protected" ||

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.51.5",
+  "version": "0.52.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -27,8 +27,8 @@
     "node": ">=22.19.0"
   },
   "scripts": {
-    "test": "node --experimental-strip-types --test --test-concurrency=4 --test-reporter=dot tests/*.test.ts",
-    "test:verbose": "node --experimental-strip-types --test --test-reporter=spec tests/*.test.ts",
+    "test": "node --experimental-strip-types --import ./tests/fixtures/canonical-tmpdir.ts --test --test-concurrency=4 --test-reporter=dot tests/*.test.ts",
+    "test:verbose": "node --experimental-strip-types --import ./tests/fixtures/canonical-tmpdir.ts --test --test-reporter=spec tests/*.test.ts",
     "typecheck": "tsc --noEmit",
     "build": "node scripts/build-dist.mjs",
     "build:check": "node scripts/build-dist.mjs --check",
@@ -109,9 +109,9 @@
     "image": "https://raw.githubusercontent.com/llblab/pi-telegram/main/screenshot.png"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.84.4",
-    "@earendil-works/pi-ai": ">=0.84.4",
-    "@earendil-works/pi-coding-agent": ">=0.84.4",
+    "@earendil-works/pi-agent-core": ">=1.0.0",
+    "@earendil-works/pi-ai": ">=1.0.0",
+    "@earendil-works/pi-coding-agent": ">=1.0.0",
     "@sinclair/typebox": "*"
   },
   "devDependencies": {

package/dist/skills/generated-control-surface/SKILL.md

@@ -46,7 +46,7 @@ A disabled control is not an action: it needs no prompt or selected style and mu
 
 Prompts must name any target, operation, constraint, or freshness identity whose omission could change the action. Reuse visible context only when it remains unambiguous under delayed or reordered clicks. Never encode volatile output that should be freshly inspected.
 
-Every generated human-readable action label must use `emoji + space + text`; emoji-free text labels are invalid. Choose the emoji by action semantics, keep its meaning consistent, and never rely on emoji or color alone. Coordinates, established symbolic controls, and intentionally spatial glyphs already satisfy the marker role through their domain grammar. If prompt buttons are unavailable, preserve the same choices as a numbered list.
+Every generated human-readable action label must use `emoji + space + text`; emoji-free text labels are invalid. Choose the emoji by action semantics, keep its meaning consistent, and never rely on emoji or color alone. State/value controls follow their UI-kit grammar; unmarked inactive list items are not action labels. Coordinates, established symbolic controls, and intentionally spatial glyphs already satisfy the marker role through their domain grammar. If prompt buttons are unavailable, preserve the same choices as a numbered list.
 
 ## Layout Kernel
 
@@ -97,10 +97,10 @@ Show concise failure evidence and emit valid recovery controls such as diagnose,
 Before sending:
 
 - At least one useful button is present whenever the transport supports prompt buttons.
-- Every human-readable button label begins with a semantic emoji and one ASCII space.
+- Every human-readable action label begins with a semantic emoji and one ASCII space; state/value controls follow their owning documented grammar.
 - State, actions, owner, and target agree.
 - Live claims are fresh; adaptation and incompleteness are explicit.
-- Every prompt is sufficient and every label follows its semantic emoji rule.
+- Every prompt is sufficient; labels follow their control grammar.
 - Row grouping reflects real hierarchy or peer relationships.
 - High-impact actions require confirmation.
 - No secret or hidden reasoning appears.