@llblab/pi-telegram 0.51.6 → 0.52.1

package/dist/lib/updates.js

@@ -4,8 +4,10 @@
  * Owns update extraction, authorization, execution planning, generation-fenced journal draining, and the public update-handler registry
  */
 import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { isWireRecord as isTelegramUpdateAdmissionRecord, isNonEmptyWireString as isTelegramUpdateAdmissionString, } from "./wire.js";
 import { createTelegramPrivateTarget, createTelegramThreadTarget, } from "./target.js";
-import { TELEGRAM_UPDATE_JOURNAL_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, TELEGRAM_UPDATE_JOURNAL_FAILURE_CLASS_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_FAILURE_SUMMARY_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_QUEUE_OWNER_ID_MAX_LENGTH, areTelegramUpdateJournalQueueOwnersEqual, getTelegramUpdateJournalBindingPath, isTelegramUpdateJournalQueueOwnerProcess, parseTelegramUpdateJournalQueueOwner, } from "./journal.js";
+import { TELEGRAM_UPDATE_JOURNAL_VERSION, TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION, TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION, isTelegramUpdateJournalLegacyFamilyVersion, TELEGRAM_UPDATE_JOURNAL_FAILURE_CLASS_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_FAILURE_SUMMARY_MAX_LENGTH, TELEGRAM_UPDATE_JOURNAL_QUEUE_OWNER_ID_MAX_LENGTH, areTelegramUpdateJournalQueueOwnersEqual, createTelegramUpdateJournalEntryDigest, getTelegramUpdateJournalBindingPath, isTelegramUpdateJournalQueueOwnerProcess, parseTelegramUpdateJournalQueueOwner, } from "./journal.js";
 import { areTelegramQueueAdmissionReceiptsEqual, createTelegramQueueHandoff, removeTelegramQueueItemByReceipt, } from "./queue.js";
 import { createTelegramUserPairingRuntime, getTelegramAuthorizationState, } from "./config.js";
 export const TELEGRAM_PRIORITY_REACTIONS = [
@@ -43,23 +45,6 @@ export function collectTelegramReactionEmojis(reactions) {
 function getTelegramReactionEmoji(emojis, candidates) {
     return candidates.find((emoji) => emojis.has(emoji));
 }
-export function getTelegramQueueReactionDisposition(reactions) {
-    const emojis = collectTelegramReactionEmojis(reactions);
-    const suppressionEmoji = getTelegramReactionEmoji(emojis, TELEGRAM_REMOVAL_REACTION_EMOJIS);
-    const priorityEmoji = getTelegramReactionEmoji(emojis, TELEGRAM_PRIORITY_REACTION_EMOJIS);
-    if (suppressionEmoji && priorityEmoji) {
-        return {
-            kind: "priority-suppressed",
-            priorityEmoji,
-            suppressionEmoji,
-        };
-    }
-    if (suppressionEmoji)
-        return { kind: "suppressed", emoji: suppressionEmoji };
-    if (priorityEmoji)
-        return { kind: "priority", emoji: priorityEmoji };
-    return { kind: "default" };
-}
 function getTelegramQueueReactionTransition(oldReactions, newReactions) {
     const oldEmojis = collectTelegramReactionEmojis(oldReactions);
     const newEmojis = collectTelegramReactionEmojis(newReactions);
@@ -149,7 +134,7 @@ export function getAuthorizedTelegramGuestMessage(update) {
     }
     return guestMessage;
 }
-export class TelegramForeignUpdateSettlementError extends Error {
+class TelegramForeignUpdateSettlementError extends Error {
     settlement;
     constructor(operation, settlement) {
         super(`Telegram ${operation} forwarding did not settle: ${settlement.failureClass}.`);
@@ -175,6 +160,7 @@ function rejectTelegramForeignUpdateSettlement(settlement, operation, source) {
 }
 export const TELEGRAM_INTERNAL_AGENT_MESSAGE = Symbol("telegram.internalAgentMessage");
 const TELEGRAM_UPDATE_ADMISSION_BINDING = Symbol("telegram.update-admission.binding");
+const TELEGRAM_HELD_SOURCE_INSPECTION_LIMIT = 20;
 function bindTelegramUpdateAdmissionCarrier(value, binding) {
     if (!value || typeof value !== "object")
         return value;
@@ -195,13 +181,14 @@ function getTelegramUpdateAdmissionBinding(value) {
         ? binding
         : undefined;
 }
-export function bindTelegramUpdateAdmissionSource(update, report) {
+export function bindTelegramUpdateAdmissionSource(update, report, controls) {
     if (!Number.isSafeInteger(update.update_id) || update.update_id < 0) {
         throw new TelegramUpdateAdmissionOutcomeError("Telegram update admission requires a safe update_id.");
     }
     const binding = {
         sourceUpdateId: update.update_id,
         report,
+        ...controls,
     };
     const callbackQuery = update.callback_query
         ? bindTelegramUpdateAdmissionCarrier({
@@ -232,6 +219,24 @@ export function bindTelegramUpdateAdmissionSource(update, report) {
             : {}),
     };
 }
+/**
+ * Conservative read-only census: any retained entry naming this Thread, in any nested Telegram object or state,
+ * is unresolved custody. It cannot see updates still in transit before journal append.
+ */
+export function collectTelegramJournalThreadUpdateIds(entries, target) {
+    const matches = (value, depth) => {
+        if (depth > 8 || !value || typeof value !== "object")
+            return false;
+        const record = value;
+        if (record.message_thread_id === target.threadId) {
+            const chat = record.chat;
+            if (!chat || typeof chat !== "object" || chat.id === target.chatId)
+                return true;
+        }
+        return Object.values(record).some(child => matches(child, depth + 1));
+    };
+    return entries.filter(entry => matches(entry.update, 0)).map(entry => entry.updateId).sort((left, right) => left - right);
+}
 export function collectTelegramAdmissionSourceUpdateIds(values) {
     const sourceUpdateIds = new Set();
     for (const value of values) {
@@ -241,27 +246,122 @@ export function collectTelegramAdmissionSourceUpdateIds(values) {
     }
     return [...sourceUpdateIds].sort((left, right) => left - right);
 }
+/** Observe the original journal entry, never the mutable routed carrier, through current worker authority. */
+export function inspectTelegramDeferredSource(value) {
+    const execution = getTelegramUpdateExecutionFence(value);
+    if (execution?.isCurrent() !== true)
+        return undefined;
+    return getTelegramUpdateAdmissionBinding(value)?.inspectSource?.();
+}
+/** A route-owned pre-disposition acceptance publisher; wraps only this carrier, never the shared worker binding. */
+export function bindTelegramUpdateCompletionAcceptance(value, publish) {
+    const binding = getTelegramUpdateAdmissionBinding(value);
+    if (!binding || getTelegramUpdateExecutionFence(value)?.isCurrent() !== true) {
+        throw new TelegramUpdateAdmissionOutcomeError("Telegram completion acceptance requires a live source carrier.");
+    }
+    let retained;
+    let queued = false;
+    const scoped = { ...binding, report(outcome) {
+            if (outcome.kind !== "complete") {
+                if (outcome.kind === "queued")
+                    queued = true;
+                binding.report(outcome);
+                return;
+            }
+            assertTelegramUpdateExecutionCurrent(value);
+            // A command's trailing implicit completion cannot dispose receipt-owned or uncertain queued work.
+            if (queued) {
+                if (outcome.expectedSource)
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram completion acceptance cannot dispose a queued source.");
+                return;
+            }
+            if (!retained) {
+                const published = validateTelegramUpdateAdmissionOutcome({ kind: "complete", expectedSource: publish() }, binding.sourceUpdateId, new Set([binding.sourceUpdateId]));
+                if (published.kind !== "complete" || !published.expectedSource?.completionSha256) {
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram completion acceptance lacks its scoped journal proof.");
+                }
+                retained = published.expectedSource;
+            }
+            assertTelegramUpdateExecutionCurrent(value);
+            if (outcome.expectedSource && (outcome.expectedSource.updateId !== retained.updateId ||
+                outcome.expectedSource.journalBindingKey !== retained.journalBindingKey || outcome.expectedSource.sourceSha256 !== retained.sourceSha256 ||
+                outcome.expectedSource.completionSha256 !== undefined && outcome.expectedSource.completionSha256 !== retained.completionSha256)) {
+                throw new TelegramUpdateAdmissionOutcomeError("Telegram completion acceptance conflicts with its reported source.");
+            }
+            binding.report({ kind: "complete", expectedSource: { ...retained } });
+        } };
+    return carryTelegramUpdateExecutionFence(value, bindTelegramUpdateAdmissionCarrier(value, scoped));
+}
 /** Report source completion; true means reported, not a durable settlement acknowledgement. */
-export function reportTelegramUpdateCompleted(value) {
+export function reportTelegramUpdateCompleted(value, expectedSource) {
     const binding = getTelegramUpdateAdmissionBinding(value);
     if (!binding)
         return false;
     const execution = getTelegramUpdateExecutionFence(value);
     if (execution && !execution.isCurrent())
         return false;
-    binding.report({ kind: "complete" });
+    binding.report(validateTelegramUpdateAdmissionOutcome({ kind: "complete", ...(expectedSource !== undefined ? { expectedSource } : {}) }, binding.sourceUpdateId, new Set([binding.sourceUpdateId])));
     return true;
 }
 export function reportTelegramUpdateDeferred(value) {
     const binding = getTelegramUpdateAdmissionBinding(value);
     if (!binding)
         return false;
+    const execution = getTelegramUpdateExecutionFence(value);
+    if (execution && !execution.isCurrent())
+        return false;
     binding.report({ kind: "deferred" });
     return true;
 }
+/** Exact source-bound cancellation; undefined means no eligible attempt was made. */
+export function abandonTelegramDeferredUpdate(value, authority) {
+    return getTelegramUpdateAdmissionBinding(value)?.abandon?.(authority);
+}
+/** Capability for chooser publication; the eventual action still requires exact deferred authority. */
+export function supportsTelegramDeferredAbandonment(value, journalBindingKey) {
+    return getTelegramUpdateAdmissionBinding(value)?.supportsAbandonment?.(journalBindingKey) === true;
+}
+/** Observe protected attempts through a current carrier; the UI still owns human authorization. */
+export function inspectTelegramAbandoningUpdates(value, request) {
+    return getTelegramUpdateAdmissionBinding(value)?.inspectAbandoning?.(request);
+}
+/** Historical inspection is not human confirmation or permission to stop delivery. */
+export function inspectTelegramHistoricalInputs(value, request) {
+    return getTelegramUpdateAdmissionBinding(value)?.inspectHistorical?.(request);
+}
+export function isTelegramHistoricalInput(value, matchesOriginal) {
+    return getTelegramUpdateAdmissionBinding(value)?.isHistorical?.(matchesOriginal) === true;
+}
+/** Routing's last-boundary hold when ownership changed after early classification. */
+export function reportTelegramHistoricalRoutingReview(value) {
+    if (!isTelegramHistoricalInput(value) || getTelegramUpdateExecutionFence(value)?.isCurrent() !== true)
+        return false;
+    getTelegramUpdateAdmissionBinding(value).report({ kind: "deferred", routingReview: true });
+    return true;
+}
+/** Arm only a positively published chooser; the journal owns the immutable hour deadline. */
+export function armTelegramRoutingInputs(values, operatorUserId) {
+    const first = values[0], execution = getTelegramUpdateExecutionFence(first);
+    if (!execution || values.some(value => getTelegramUpdateExecutionFence(value)?.signal !== execution.signal))
+        return undefined;
+    for (const value of values)
+        assertTelegramUpdateExecutionCurrent(value);
+    const ids = collectTelegramAdmissionSourceUpdateIds(values);
+    if (!ids.length)
+        return undefined;
+    return getTelegramUpdateAdmissionBinding(first)?.armRoutingInput?.(operatorUserId, ids);
+}
+/** Reserve source execution; an actual choice must also freeze its durable TTL before any effect. */
+export function acquireTelegramUpdateRouting(value, select = false, sourceUpdateIds) {
+    assertTelegramUpdateExecutionCurrent(value);
+    return getTelegramUpdateAdmissionBinding(value)?.acquireRouting?.(select, sourceUpdateIds) ?? (() => { });
+}
 export function reportTelegramQueueAdmission(values, receipts) {
     const bindings = new Map();
     for (const value of values) {
+        const execution = getTelegramUpdateExecutionFence(value);
+        if (execution && !execution.isCurrent())
+            return false;
         const binding = getTelegramUpdateAdmissionBinding(value);
         if (!binding)
             continue;
@@ -427,7 +527,13 @@ function getForeignTelegramMessageOwnership(target, deps) {
         : undefined;
 }
 function getForeignTelegramCallbackOwnership(query, deps) {
-    const messageOwnership = getForeignTelegramMessageOwnership(getTelegramCallbackMessageTarget(query), deps);
+    const messageTarget = getTelegramCallbackMessageTarget(query);
+    const currentInstanceId = deps.getCurrentInstanceId?.();
+    const knownOwner = messageTarget && deps.getMessageOwnership?.(messageTarget.chatId, messageTarget.messageId);
+    // A locally published chooser stays local when Restore moves its Thread to a follower.
+    if (currentInstanceId && knownOwner?.instanceId === currentInstanceId)
+        return undefined;
+    const messageOwnership = getForeignTelegramMessageOwnership(messageTarget, deps);
     const targetOwnership = getForeignTelegramTargetOwnership(query.message ? getTelegramMessageTarget(query.message) : undefined, deps);
     if (!messageOwnership)
         return targetOwnership;
@@ -727,7 +833,11 @@ export async function executeTelegramUpdatePlan(plan, deps) {
             deps.handleUnboundTelegramTopicMessage) {
             assertExecutionCurrent();
             await deps.handleUnboundTelegramTopicMessage(plan.message, deps.ctx);
-            assertExecutionCurrent();
+            // A terminal historical hold intentionally suspends this exact carrier.
+            // Do not turn its acknowledged deferral into a retryable execution failure.
+            if (getTelegramUpdateExecutionFence(plan.message) !== deps.execution ||
+                getTelegramUpdateAdmissionBinding(plan.message)?.isHistoricalReviewHeld?.() !== true)
+                assertExecutionCurrent();
             return;
         }
         if (plan.kind === "edited-message") {
@@ -746,10 +856,28 @@ export async function executeTelegramUpdatePlan(plan, deps) {
     }
 }
 // --- Durable update worker ---
-export const TELEGRAM_UPDATE_RETRY_BASE_DELAY_MS = 1_000;
-export const TELEGRAM_UPDATE_RETRY_MAX_DELAY_MS = 60_000;
-export const TELEGRAM_UPDATE_WORKER_BATCH_SIZE = 64;
-export class TelegramUpdateAdmissionOutcomeError extends Error {
+const TELEGRAM_UPDATE_RETRY_BASE_DELAY_MS = 1_000;
+const TELEGRAM_UPDATE_RETRY_MAX_DELAY_MS = 60_000;
+const TELEGRAM_UPDATE_WORKER_BATCH_SIZE = 64;
+function normalizeTelegramQueueSourceCompletions(value, sourceUpdateIds, journalBindingKey, full = true) {
+    if (!Array.isArray(value) || (full ? value.length !== sourceUpdateIds.size : value.length > sourceUpdateIds.size) || value.length === 0)
+        throw new Error("Telegram scoped queue completion requires full source coverage.");
+    const seen = new Set(), scopes = new Set();
+    return value.map(source => {
+        if (!Number.isSafeInteger(source?.updateId) || !sourceUpdateIds.has(source.updateId) || seen.has(source.updateId)) {
+            throw new Error("Telegram scoped queue completion has invalid source membership.");
+        }
+        const normalized = validateTelegramUpdateAdmissionOutcome({ kind: "complete", expectedSource: source }, source.updateId, sourceUpdateIds);
+        if (normalized.kind !== "complete" || !normalized.expectedSource?.completionSha256 ||
+            normalized.expectedSource.journalBindingKey !== journalBindingKey || scopes.has(normalized.expectedSource.completionSha256)) {
+            throw new Error("Telegram scoped queue completion has invalid source scope.");
+        }
+        seen.add(source.updateId);
+        scopes.add(normalized.expectedSource.completionSha256);
+        return { ...normalized.expectedSource, completionSha256: normalized.expectedSource.completionSha256 };
+    }).sort((a, b) => a.updateId - b.updateId);
+}
+class TelegramUpdateAdmissionOutcomeError extends Error {
     constructor(message) {
         super(message);
         this.name = "TelegramUpdateAdmissionOutcomeError";
@@ -759,20 +887,29 @@ const TELEGRAM_UPDATE_WORKER_EXECUTION_ABORTED = Symbol("telegram.update-worker.
 function getTelegramUpdateWorkerStateSnapshot(state) {
     return { ...state };
 }
-function isTelegramUpdateAdmissionRecord(value) {
-    return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function isTelegramUpdateAdmissionString(value) {
-    return typeof value === "string" && value.length > 0;
-}
 function validateTelegramUpdateAdmissionOutcome(value, currentUpdateId, claimableUpdateIds) {
     if (!isTelegramUpdateAdmissionRecord(value)) {
         throw new TelegramUpdateAdmissionOutcomeError(`Telegram update ${currentUpdateId} returned no admission outcome.`);
     }
-    if (value.kind === "complete")
-        return { kind: "complete" };
-    if (value.kind === "deferred")
-        return { kind: "deferred" };
+    if (value.kind === "complete") {
+        if (value.expectedSource === undefined)
+            return { kind: "complete" };
+        const source = value.expectedSource;
+        if (!isTelegramUpdateAdmissionRecord(source) || Object.keys(source).some(key => !["journalBindingKey", "updateId", "sourceSha256", "completionSha256"].includes(key)) ||
+            source.updateId !== currentUpdateId || !isTelegramUpdateAdmissionString(source.journalBindingKey) ||
+            typeof source.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(source.sourceSha256) ||
+            source.completionSha256 !== undefined && (typeof source.completionSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(source.completionSha256))) {
+            throw new TelegramUpdateAdmissionOutcomeError(`Telegram update ${currentUpdateId} returned an invalid completion source.`);
+        }
+        return { kind: "complete", expectedSource: { journalBindingKey: source.journalBindingKey,
+                updateId: currentUpdateId, sourceSha256: source.sourceSha256,
+                ...(source.completionSha256 !== undefined ? { completionSha256: source.completionSha256 } : {}) } };
+    }
+    if (value.kind === "deferred") {
+        if (value.routingReview !== undefined && value.routingReview !== true)
+            throw new TelegramUpdateAdmissionOutcomeError("Invalid historical review outcome.");
+        return { kind: "deferred", ...(value.routingReview === true ? { routingReview: true } : {}) };
+    }
     if (value.kind === "queued") {
         if ((value.queueKind !== "prompt" && value.queueKind !== "control") ||
             !isTelegramUpdateAdmissionString(value.receiptId) ||
@@ -871,12 +1008,23 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         throw new Error("Telegram update retry scheduling requires matching schedule and cancel ports.");
     }
     const getNowMs = deps.getNowMs ?? Date.now;
+    const onHeldSourcesPrepared = deps.onHeldSourcesPrepared;
+    const spendHistorical = deps.spendHistoricalInput === true;
+    const routingJournal = deps.journal.routingInputs;
+    const armRouting = routingJournal?.arm.bind(routingJournal);
+    const selectRouting = routingJournal?.select.bind(routingJournal);
+    const expireRouting = routingJournal?.expire.bind(routingJournal);
+    const expireRoutingObserver = deps.expireRoutingInput;
     const batchSize = deps.batchSize ?? TELEGRAM_UPDATE_WORKER_BATCH_SIZE;
     if (!Number.isSafeInteger(batchSize) || batchSize <= 0) {
         throw new Error("Telegram update worker batch size must be positive.");
     }
     const yieldToEventLoop = deps.yieldToEventLoop ??
         (() => new Promise((resolve) => setTimeout(resolve, 0)));
+    const completeQueuedExact = deps.journal.completeQueuedExact?.bind(deps.journal);
+    const completeExact = deps.journal.removeCompletedExact?.bind(deps.journal);
+    const inspectCompletion = deps.journal.inspectSourceCompletion?.bind(deps.journal);
+    const observeQueuedCompletion = deps.onQueueReceiptCompleted;
     const fallbackQueueOwnerInstanceId = `worker-${randomUUID()}`;
     const fallbackQueueOwnerProcessId = process.pid > 0 ? process.pid : 1;
     const createAbortController = deps.createAbortController ?? (() => new AbortController());
@@ -890,6 +1038,13 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         processBirthId: `${fallbackQueueOwnerProcessId}:${fallbackQueueOwnerInstanceId}`,
         sessionGeneration: generation,
     });
+    const isQueueOwnerIdentityCurrent = (expected) => {
+        if (!deps.getQueueOwnerIdentity)
+            return true;
+        const live = deps.getQueueOwnerIdentity(expected.ctx), captured = expected.queueOwnerIdentity;
+        return !!live && live.instanceId === captured.instanceId && live.processId === captured.processId &&
+            live.processBirthId === captured.processBirthId && live.sessionGeneration === captured.sessionGeneration;
+    };
     const state = {
         phase: "stopped",
         generation: 0,
@@ -903,8 +1058,11 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         unsettledExecutionCount: 0,
     };
     const claims = new Map();
+    const deferredSources = new Map();
     const unsettledExecutionsByUpdateId = new Map();
     const committedQueueReceipts = new Map();
+    const requiredScopedQueueReceipts = new Set();
+    const scopedQueueCompletionAttempts = new Map();
     const unsettledExecutions = new Set();
     let owner;
     let drainPromise;
@@ -914,6 +1072,8 @@ export function createTelegramUpdateWorkerRuntime(deps) {
     let retryTimer;
     let retryTimerAtMs;
     let retryTimerToken;
+    let routingTimer;
+    let routingTimerToken;
     let launchDrain = () => { };
     const recordRuntimeEvent = (error, details) => {
         try {
@@ -934,14 +1094,28 @@ export function createTelegramUpdateWorkerRuntime(deps) {
     const updateClaimCounts = () => {
         let deferredClaimCount = 0;
         let queuedClaimCount = 0;
+        let abandoningClaimCount = 0;
+        let historicalClaimCount = 0;
         for (const claim of claims.values()) {
             if (claim === "queued")
                 queuedClaimCount += 1;
             else
                 deferredClaimCount += 1;
+            if (claim === "abandoning")
+                abandoningClaimCount += 1;
+            if (claim === "historical" || claim === "retained")
+                historicalClaimCount += 1;
         }
         state.deferredClaimCount = deferredClaimCount;
         state.queuedClaimCount = queuedClaimCount;
+        if (abandoningClaimCount > 0)
+            state.abandoningClaimCount = abandoningClaimCount;
+        else
+            delete state.abandoningClaimCount;
+        if (historicalClaimCount > 0)
+            state.historicalClaimCount = historicalClaimCount;
+        else
+            delete state.historicalClaimCount;
     };
     const releaseDeferredClaims = (updateIds) => {
         let changed = false;
@@ -949,6 +1123,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             if (claims.get(updateId) !== "deferred")
                 continue;
             claims.delete(updateId);
+            deferredSources.delete(updateId);
             changed = true;
         }
         if (!changed)
@@ -992,7 +1167,13 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             ? { journalBindingKey: deps.getJournalBindingKey() }
             : {}),
     });
-    const publishCommittedQueueReceipt = (receipt, queueOwner, ctx) => {
+    const inspectQueueReceipt = deps.journal.isQueueReceiptCurrent?.bind(deps.journal);
+    const inspectQueuedSources = deps.journal.inspectQueuedReceipt?.bind(deps.journal);
+    const prepareQueueReceipt = deps.beforeQueueReceiptPublished;
+    const pendingQueuePublications = new Map();
+    const publishCommittedQueueReceipt = async (receipt, queueOwner, expectedOwner) => {
+        const ctx = expectedOwner.ctx;
+        let sourceCompletions;
         const normalized = bindQueueReceiptToJournal(receipt);
         const existing = committedQueueReceipts.get(receipt.receiptId);
         if (existing) {
@@ -1002,28 +1183,90 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             }
             return false;
         }
-        committedQueueReceipts.set(receipt.receiptId, {
-            receipt: normalized,
-            queueOwner: { ...queueOwner },
-        });
-        try {
-            deps.onQueueReceiptCommitted?.(normalized, ctx);
+        if (prepareQueueReceipt) {
+            const pending = pendingQueuePublications.get(normalized.receiptId);
+            if (pending) {
+                if (pending.owner !== expectedOwner || !areTelegramQueueAdmissionReceiptsEqual(pending.receipt, normalized) ||
+                    !areTelegramUpdateJournalQueueOwnersEqual(pending.queueOwner, queueOwner)) {
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram queue publication has conflicting in-flight authority.");
+                }
+                await pending.task;
+                return false;
+            }
+            const journalBindingKey = deps.getJournalBindingKey?.();
+            const current = () => owner === expectedOwner && !expectedOwner.controller.signal.aborted && deps.hasAuthority(ctx) && deps.isContextCurrent?.(ctx) !== false &&
+                isQueueOwnerIdentityCurrent(expectedOwner) && deps.getJournalBindingKey?.() === journalBindingKey;
+            if (!journalBindingKey || !current() || !inspectQueueReceipt ||
+                inspectQueueReceipt(normalizeQueueReceipt(normalized), { ...queueOwner }) !== true || !current()) {
+                throw new TelegramUpdateAdmissionOutcomeError("Telegram queue publication requires exact current receipt inspection.");
+            }
+            const task = Promise.resolve().then(async () => {
+                if (!current())
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram queue publication authority ended before acceptance.");
+                const prepared = await prepareQueueReceipt(normalizeQueueReceipt(normalized), { ...queueOwner }, ctx, current);
+                if (prepared !== undefined) {
+                    sourceCompletions = normalizeTelegramQueueSourceCompletions(prepared, new Set(normalized.sourceUpdateIds), journalBindingKey, false);
+                    if (!completeQueuedExact || !inspectCompletion)
+                        throw new Error("Telegram scoped queue terminal capabilities are unavailable.");
+                    if (sourceCompletions.length !== normalized.sourceUpdateIds.length) {
+                        if (!current() || !inspectQueuedSources)
+                            throw new Error("Telegram partial queue scopes require strict current whole-receipt origin inspection.");
+                        const expected = { queueKind: normalized.queueKind, receiptId: normalized.receiptId,
+                            sourceUpdateIds: [...normalized.sourceUpdateIds], queueOwner: { ...queueOwner } };
+                        const proof = inspectQueuedSources(structuredClone(expected));
+                        if (!current() || !proof || !isDeepStrictEqual(proof.receipt, expected) ||
+                            !Array.isArray(proof.sources) || proof.sources.length !== expected.sourceUpdateIds.length ||
+                            proof.sources.some((source, index) => source.updateId !== expected.sourceUpdateIds[index] || typeof source.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(source.sourceSha256)) ||
+                            sourceCompletions.some(scope => proof.sources.find(source => source.updateId === scope.updateId)?.sourceSha256 !== scope.sourceSha256)) {
+                            throw new Error("Telegram partial queue scope origin was not confirmed under whole-receipt authority.");
+                        }
+                    }
+                    for (const { journalBindingKey: _binding, ...completion } of sourceCompletions) {
+                        if (!current() || inspectCompletion({ ...completion }) !== undefined || !current()) {
+                            throw new Error("Telegram queued source completion authority is contradictory.");
+                        }
+                    }
+                }
+                if (!current() || inspectQueueReceipt(normalizeQueueReceipt(normalized), { ...queueOwner }) !== true || !current()) {
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram queue publication authority changed after acceptance.");
+                }
+                publishReady();
+            }).finally(() => { if (pendingQueuePublications.get(normalized.receiptId)?.task === task)
+                pendingQueuePublications.delete(normalized.receiptId); });
+            pendingQueuePublications.set(normalized.receiptId, { receipt: normalizeQueueReceipt(normalized), queueOwner: { ...queueOwner }, owner: expectedOwner, task });
+            await task;
+            return true;
         }
-        catch (error) {
-            recordRuntimeEvent(error, {
-                phase: "queue-receipt-observer",
-                receiptId: normalized.receiptId,
+        publishReady();
+        return true;
+        function publishReady() {
+            committedQueueReceipts.set(receipt.receiptId, {
+                receipt: normalized,
+                queueOwner: { ...queueOwner },
+                ...(sourceCompletions ? { sourceCompletions: sourceCompletions.map(value => ({ ...value })) } : {}),
             });
+            if (sourceCompletions)
+                requiredScopedQueueReceipts.add(receipt.receiptId);
+            try {
+                deps.onQueueReceiptCommitted?.(normalizeQueueReceipt(normalized), ctx);
+            }
+            catch (error) {
+                recordRuntimeEvent(error, {
+                    phase: "queue-receipt-observer",
+                    receiptId: normalized.receiptId,
+                });
+            }
         }
-        return true;
     };
     const getCurrentQueueReceipt = (receipt) => {
+        if (scopedQueueCompletionAttempts.has(receipt.receiptId))
+            return undefined;
         const committed = committedQueueReceipts.get(receipt.receiptId);
         if (!committed || !areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt)))
             return undefined;
         try {
-            if (deps.journal.isQueueReceiptCurrent &&
-                deps.journal.isQueueReceiptCurrent(committed.receipt, committed.queueOwner) !== true) {
+            if (inspectQueueReceipt &&
+                inspectQueueReceipt(normalizeQueueReceipt(committed.receipt), { ...committed.queueOwner }) !== true) {
                 return undefined;
             }
         }
@@ -1066,7 +1309,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             launchDrain();
         }, Math.max(0, nextRetryAtMs - getNowMs()));
     };
-    const refreshJournalState = (snapshot, expectedOwner) => {
+    const refreshJournalState = async (snapshot, expectedOwner) => {
         // Validate the whole snapshot before reconstructing any queue authority.
         if ((snapshot.version !== TELEGRAM_UPDATE_JOURNAL_VERSION &&
             snapshot.version !== TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION &&
@@ -1095,7 +1338,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 oldestAdmittedAtMs === undefined
                     ? entry.admittedAtMs
                     : Math.min(oldestAdmittedAtMs, entry.admittedAtMs);
-            if (entry.state === "retry-wait" && entry.nextRetryAtMs !== undefined) {
+            if (entry.state === "retry-wait" && entry.nextRetryAtMs !== undefined && !claims.has(entry.updateId)) {
                 scheduledRetryAtMs =
                     scheduledRetryAtMs === undefined
                         ? entry.nextRetryAtMs
@@ -1156,17 +1399,22 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             }
         }
         for (const [updateId, claim] of claims) {
-            if (!availableUpdateIds.has(updateId) ||
+            if ((claim !== "abandoning" && !availableUpdateIds.has(updateId)) ||
                 (claim === "queued" && !locallyOwnedQueuedUpdateIds.has(updateId))) {
                 claims.delete(updateId);
             }
         }
+        for (const updateId of deferredSources.keys()) {
+            const claim = claims.get(updateId);
+            if (claim !== "deferred" && claim !== "abandoning" && claim !== "historical" && claim !== "retained")
+                deferredSources.delete(updateId);
+        }
         for (const [receiptId, receipt] of queuedReceiptEntries) {
-            publishCommittedQueueReceipt({
+            await publishCommittedQueueReceipt({
                 queueKind: receipt.queueKind,
                 receiptId,
                 sourceUpdateIds: receipt.sourceUpdateIds,
-            }, receipt.queueOwner, expectedOwner.ctx);
+            }, receipt.queueOwner, expectedOwner);
         }
         for (const [receiptId] of committedQueueReceipts) {
             if (!queuedReceiptEntries.has(receiptId)) {
@@ -1307,13 +1555,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         for (const sourceUpdateId of normalized.sourceUpdateIds) {
             claims.set(sourceUpdateId, "queued");
         }
-        try {
-            publishCommittedQueueReceipt(normalized, queueOwner, expectedOwner.ctx);
-        }
-        catch (error) {
-            return blockWithFailure("invalid-outcome", "queue-receipt-publish", error, currentUpdateId);
-        }
-        return "committed";
+        return publishCommittedQueueReceipt(normalized, queueOwner, expectedOwner).then(() => "committed", error => blockWithFailure("invalid-outcome", "queue-receipt-publish", error, currentUpdateId));
     };
     const persistExecutionFailure = (expectedOwner, entry, error) => {
         const authorityResult = checkAuthority(expectedOwner, entry.updateId);
@@ -1372,14 +1614,52 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         transition(disposition, entry.updateId);
         return disposition;
     };
-    const commitCompletedBatch = (expectedOwner, updateIds) => {
+    const commitCompletedBatch = (expectedOwner, completions) => {
+        const updateIds = completions.map(value => value.updateId);
         if (updateIds.length === 0)
             return undefined;
         const commitAuthority = checkAuthority(expectedOwner, updateIds[updateIds.length - 1]);
         if (commitAuthority)
             return commitAuthority;
+        const journalBindingKey = deps.getJournalBindingKey?.();
         try {
-            const removed = deps.journal.removeCompleted(updateIds);
+            const expectedSources = completions.flatMap(value => value.expectedSource ? [value.expectedSource] : []);
+            if (expectedSources.some(value => value.journalBindingKey !== journalBindingKey) ||
+                (expectedSources.length > 0 && (deps.isContextCurrent?.(expectedOwner.ctx) === false || !isQueueOwnerIdentityCurrent(expectedOwner)))) {
+                throw new Error("Telegram guarded completion source authority changed.");
+            }
+            const scoped = expectedSources.flatMap(({ updateId, sourceSha256, completionSha256 }) => completionSha256 !== undefined
+                ? [{ updateId, sourceSha256, completionSha256 }] : []).sort((a, b) => a.updateId - b.updateId);
+            if (scoped.length > 0 && !inspectCompletion)
+                throw new Error("Telegram source completion inspection is unavailable.");
+            let removed;
+            if (expectedSources.length > 0) {
+                if (!completeExact)
+                    throw new Error("Telegram exact source completion is unavailable.");
+                removed = completeExact(updateIds, expectedSources.map(({ updateId, sourceSha256 }) => ({ updateId, sourceSha256 })), scoped.length > 0 ? scoped.map(completion => ({ ...completion })) : undefined);
+            }
+            else
+                removed = deps.journal.removeCompleted(updateIds);
+            if (scoped.length > 0) {
+                const afterCommit = checkAuthority(expectedOwner, updateIds.at(-1));
+                if (afterCommit)
+                    return afterCommit;
+                if (deps.isContextCurrent?.(expectedOwner.ctx) === false || !isQueueOwnerIdentityCurrent(expectedOwner) ||
+                    deps.getJournalBindingKey?.() !== journalBindingKey)
+                    throw new Error("Telegram source completion ACK authority changed.");
+                if (!isDeepStrictEqual(removed.sourceCompletions, scoped))
+                    throw new Error("Telegram source completion ACK was not confirmed.");
+                for (const completion of scoped) {
+                    if (!isDeepStrictEqual(inspectCompletion({ ...completion }), completion))
+                        throw new Error("Telegram source completion ACK was not retained.");
+                    const afterRead = checkAuthority(expectedOwner, completion.updateId);
+                    if (afterRead)
+                        return afterRead;
+                    if (deps.isContextCurrent?.(expectedOwner.ctx) === false || !isQueueOwnerIdentityCurrent(expectedOwner) ||
+                        deps.getJournalBindingKey?.() !== journalBindingKey)
+                        throw new Error("Telegram source completion ACK authority changed.");
+                }
+            }
             const removedIds = new Set(removed.removedUpdateIds);
             if (updateIds.some((updateId) => !removedIds.has(updateId))) {
                 throw new Error("Telegram update batch changed before completion commit.");
@@ -1389,12 +1669,16 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             return blockWithFailure("journal-write", "completion-commit", error, updateIds[updateIds.length - 1]);
         }
         const completedAtMs = getNowMs();
-        for (const updateId of updateIds) {
+        for (const { updateId, spent } of completions) {
             claims.delete(updateId);
+            deferredSources.delete(updateId);
+            // Spending is disposition, not completion: no task, cleanup or session observer runs.
+            if (spent)
+                continue;
             state.lastCompletedUpdateId = updateId;
             state.lastCompletedAtMs = completedAtMs;
             try {
-                deps.onUpdateCompleted?.(updateId, expectedOwner.ctx);
+                deps.onUpdateCompleted?.(updateId, expectedOwner.ctx, journalBindingKey);
             }
             catch (error) {
                 recordRuntimeEvent(error, {
@@ -1405,6 +1689,122 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         }
         return undefined;
     };
+    const clearRoutingTimer = () => {
+        if (routingTimer !== undefined)
+            cancelRetry(routingTimer);
+        routingTimer = undefined;
+        routingTimerToken = undefined;
+    };
+    const reconcileRoutingInputs = async (snapshot, expectedOwner) => {
+        clearRoutingTimer();
+        if (!isTelegramUpdateJournalLegacyFamilyVersion(snapshot.version) || !expireRouting || !expireRoutingObserver)
+            return false;
+        let nextAtMs, changed = false;
+        const binding = deps.getJournalBindingKey?.(), snapshotIds = new Set(snapshot.entries.map(entry => entry.updateId));
+        // Lost expiry ACKs reconcile the exact held original against its body-free discard tombstone.
+        const candidates = [...snapshot.entries, ...[...deferredSources.values()]
+                .filter(source => source.journalBindingKey === binding && !snapshotIds.has(source.entry.updateId))
+                .map(source => source.entry)];
+        for (const entry of candidates) {
+            const lifetime = entry.routingInput;
+            if (!lifetime || entry.state !== "pending" || !binding || claims.get(entry.updateId) === "queued" ||
+                unsettledExecutionsByUpdateId.get(entry.updateId)?.size)
+                continue;
+            // Classify the first startup snapshot before constructing any historical expiry carrier.
+            if (expectedOwner.startupUpdateIds?.has(entry.updateId) && !claims.has(entry.updateId) && deps.shouldReviewHistoricalInput) {
+                nextAtMs = Math.min(nextAtMs ?? Infinity, Math.max(getNowMs() + 1, lifetime.expiresAtMs));
+                continue;
+            }
+            if (getNowMs() < lifetime.expiresAtMs) {
+                nextAtMs = Math.min(nextAtMs ?? Infinity, lifetime.expiresAtMs);
+                continue;
+            }
+            const existing = deferredSources.get(entry.updateId);
+            if (existing && !isDeepStrictEqual(existing.entry, entry)) {
+                // Lost clock/selection ACKs may leave only this immutable metadata behind its exact source; reconciliation grants expiry, never another dispatch.
+                const previous = existing.entry.routingInput;
+                if (!isDeepStrictEqual({ ...existing.entry, routingInput: lifetime }, entry) ||
+                    (previous && (!isDeepStrictEqual({ ...previous, phase: lifetime.phase }, lifetime) ||
+                        (previous.phase === "selected" && lifetime.phase !== "selected"))))
+                    continue;
+                existing.entry = structuredClone(entry);
+            }
+            const source = existing ?? { entry: structuredClone(entry), journalBindingKey: binding, historical: true };
+            deferredSources.set(entry.updateId, source);
+            if (!claims.has(entry.updateId))
+                claims.set(entry.updateId, "historical");
+            const current = () => owner === expectedOwner && !expectedOwner.controller.signal.aborted &&
+                deps.isContextCurrent?.(expectedOwner.ctx) !== false && deps.getJournalBindingKey?.() === binding &&
+                deps.hasAuthority(expectedOwner.ctx) && isQueueOwnerIdentityCurrent(expectedOwner) && deferredSources.get(entry.updateId) === source &&
+                isDeepStrictEqual(source.entry, entry) && claims.get(entry.updateId) !== "queued";
+            let committed;
+            try {
+                if (current())
+                    await expireRoutingObserver({ original: structuredClone(entry), journalBindingKey: binding, isCurrent: current,
+                        expire() {
+                            if (!current())
+                                return undefined;
+                            if (committed)
+                                return { ...committed, duplicate: true };
+                            claims.set(entry.updateId, "abandoning");
+                            committed = expireRouting({ entry: source.entry, journalBindingKey: binding, operatorUserId: lifetime.operatorUserId, isCurrent: current });
+                            // Source expiry is terminal before chooser/cleanup awaits; later failures must not retain a deferred/retry source.
+                            claims.delete(entry.updateId);
+                            deferredSources.delete(entry.updateId);
+                            state.journalEntryCount = committed.entryCount;
+                            state.journalSerializedBytes = committed.serializedBytes;
+                            updateClaimCounts();
+                            notifyStateChange();
+                            changed ||= !committed.duplicate;
+                            return committed;
+                        } }, expectedOwner.ctx, expectedOwner.controller.signal);
+            }
+            catch (error) {
+                recordRuntimeEvent(error, { phase: "routing-input-expiry", updateId: entry.updateId });
+            }
+            if (!committed)
+                nextAtMs = Math.min(nextAtMs ?? Infinity, getNowMs() + 60_000);
+        }
+        if (nextAtMs !== undefined && owner === expectedOwner && !expectedOwner.controller.signal.aborted) {
+            const token = {};
+            routingTimerToken = token;
+            routingTimer = scheduleRetry(() => {
+                if (routingTimerToken !== token || owner !== expectedOwner || expectedOwner.controller.signal.aborted)
+                    return;
+                routingTimer = undefined;
+                routingTimerToken = undefined;
+                pendingSignal = true;
+                launchDrain();
+            }, Math.max(1, nextAtMs - getNowMs()));
+        }
+        return changed;
+    };
+    const mutateRoutingSource = (input, select) => {
+        const expectedOwner = owner, ids = [...input.sourceUpdateIds];
+        if (!ids.length || !ids.includes(input.updateId) || new Set(ids).size !== ids.length || ids.some(id => !Number.isSafeInteger(id) || id < 0))
+            return undefined;
+        const sources = ids.map(id => deferredSources.get(id)), binding = sources[0]?.journalBindingKey;
+        const current = () => !!expectedOwner && owner === expectedOwner && expectedOwner.controller.signal === input.signal && !input.signal.aborted &&
+            !!binding && sources.every((source, index) => !!source && deferredSources.get(ids[index]) === source && !source.historical &&
+            source.journalBindingKey === binding && claims.get(ids[index]) !== "queued" && claims.get(ids[index]) !== "abandoning") &&
+            deps.getJournalBindingKey?.() === binding && deps.isContextCurrent?.(expectedOwner.ctx) !== false &&
+            deps.hasAuthority(expectedOwner.ctx) && isQueueOwnerIdentityCurrent(expectedOwner);
+        if (!current() || !armRouting || !selectRouting || !expireRoutingObserver)
+            return undefined;
+        const authority = { journalBindingKey: binding, entries: sources.map(source => structuredClone(source.entry)), operatorUserId: input.operatorUserId, isCurrent: current };
+        const result = select ? selectRouting(authority) : { issued: false, entries: armRouting({ ...authority, publishedAtMs: getNowMs() }) };
+        if (result.entries.length !== ids.length || result.entries.some((entry, index) => entry.updateId !== ids[index] || !entry.routingInput) || !current()) {
+            throw new Error("Telegram routing input lifetime ACK was not confirmed.");
+        }
+        const retained = deps.journal.read().entries;
+        if (result.entries.some(entry => !isDeepStrictEqual(retained.find(value => value.updateId === entry.updateId), entry)) || !current()) {
+            throw new Error("Telegram routing input lifetime ACK was not retained.");
+        }
+        result.entries.forEach((entry, index) => { sources[index].entry = structuredClone(entry); });
+        pendingSignal = true;
+        launchDrain();
+        return { issued: result.issued, lifetime: { ...result.entries[0].routingInput } };
+    };
     const drain = async (expectedOwner) => {
         while (owner === expectedOwner && !expectedOwner.controller.signal.aborted) {
             const authorityResult = checkAuthority(expectedOwner);
@@ -1414,11 +1814,18 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             let scheduledRetryAtMs;
             try {
                 snapshot = deps.journal.read();
-                scheduledRetryAtMs = refreshJournalState(snapshot, expectedOwner);
+                scheduledRetryAtMs = await refreshJournalState(snapshot, expectedOwner);
+                // One complete validated baseline per generation, before batching or execution.
+                // Replayed v1 entries do not prove that a prior process never forwarded them.
+                expectedOwner.startupUpdateIds ??= new Set(snapshot.entries.map(entry => entry.updateId));
             }
             catch (error) {
                 return blockWithFailure("journal-read", "journal-read", error);
             }
+            if (await reconcileRoutingInputs(snapshot, expectedOwner))
+                continue;
+            if (owner !== expectedOwner || expectedOwner.controller.signal.aborted)
+                return "aborted";
             const nowMs = getNowMs();
             const entries = [];
             let hasMoreEntries = false;
@@ -1489,9 +1896,101 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     break;
                 }
                 if (entry.preApprovalExcluded === true) {
-                    completedUpdateIds.push(entry.updateId);
+                    completedUpdateIds.push({ updateId: entry.updateId });
                     continue;
                 }
+                if (isTelegramUpdateJournalLegacyFamilyVersion(snapshot.version) && entry.state === "pending" && deps.journal.inspectPendingRetention) {
+                    const authorityResult = checkAuthority(expectedOwner, entry.updateId);
+                    if (authorityResult)
+                        return authorityResult;
+                    let retained;
+                    let unverifiable = false;
+                    try {
+                        retained = deps.journal.inspectPendingRetention(entry);
+                    }
+                    catch (error) {
+                        unverifiable = true;
+                        recordRuntimeEvent(error, { phase: "pending-retention-inspection", updateId: entry.updateId });
+                    }
+                    if (retained || unverifiable) {
+                        // A copy is protection evidence only. A fresh owner must explicitly retry
+                        // cancellation; neither startup nor a malformed copy may dispatch the source.
+                        claims.set(entry.updateId, "abandoning");
+                        const journalBindingKey = retained?.journalBindingKey ?? deps.getJournalBindingKey?.();
+                        if (journalBindingKey)
+                            deferredSources.set(entry.updateId, { entry, journalBindingKey });
+                        transition("deferred", entry.updateId);
+                        continue;
+                    }
+                }
+                if (isTelegramUpdateJournalLegacyFamilyVersion(snapshot.version) && (entry.state === "pending" || entry.state === "retry-wait")) {
+                    const historical = expectedOwner.startupUpdateIds.has(entry.updateId);
+                    const journalBindingKey = deps.getJournalBindingKey?.();
+                    // Classifiers and handler projections receive no mutable alias to CAS evidence.
+                    if (journalBindingKey)
+                        deferredSources.set(entry.updateId, { entry: structuredClone(entry), journalBindingKey,
+                            ...(historical ? { historical: true } : {}) });
+                    const classifyPending = historical && entry.state === "pending" ? deps.shouldReviewHistoricalInput : deps.shouldHoldPendingInput;
+                    if (classifyPending) {
+                        const checkHistoricalAuthority = () => {
+                            if (owner !== expectedOwner || expectedOwner.controller.signal.aborted)
+                                return "aborted";
+                            if (deps.getJournalBindingKey?.() !== journalBindingKey || deps.isContextCurrent?.(expectedOwner.ctx) === false) {
+                                transition("blocked", entry.updateId, "authority-lost");
+                                return "blocked";
+                            }
+                            return checkAuthority(expectedOwner, entry.updateId);
+                        };
+                        const beforeClassification = checkHistoricalAuthority();
+                        if (beforeClassification)
+                            return beforeClassification;
+                        let review;
+                        try {
+                            review = await classifyPending(structuredClone(entry), expectedOwner.ctx, expectedOwner.controller.signal);
+                        }
+                        catch (error) {
+                            const authorityResult = checkHistoricalAuthority();
+                            if (authorityResult)
+                                return authorityResult;
+                            return blockWithFailure("execution", "historical-review-classification", error, entry.updateId);
+                        }
+                        const authorityResult = checkHistoricalAuthority();
+                        if (authorityResult)
+                            return authorityResult;
+                        if (typeof review !== "boolean" && !(historical && entry.state === "pending" && review === "retain"))
+                            return blockWithFailure("execution", "historical-review-classification", new TelegramUpdateAdmissionOutcomeError("Historical classification must return a boolean or retain verdict."), entry.updateId);
+                        // Classification may await a domain read; accepted/changed source evidence wins.
+                        try {
+                            const current = deps.journal.read();
+                            if (current.version !== snapshot.version || JSON.stringify(current.entries.find(candidate => candidate.updateId === entry.updateId)) !== JSON.stringify(entry)) {
+                                snapshotInvalidated = true;
+                                break;
+                            }
+                        }
+                        catch (error) {
+                            return blockWithFailure("journal-read", "historical-source-recheck", error, entry.updateId);
+                        }
+                        if (review === "retain") {
+                            claims.set(entry.updateId, "retained");
+                            transition("deferred", entry.updateId);
+                            continue;
+                        }
+                        if (review && historical && spendHistorical && !entry.routingInput && classifyPending === deps.shouldReviewHistoricalInput) {
+                            completedUpdateIds.push({ updateId: entry.updateId, spent: true });
+                            continue;
+                        }
+                        if (review) {
+                            claims.set(entry.updateId, "historical");
+                            transition("deferred", entry.updateId);
+                            continue;
+                        }
+                    }
+                    if (entry.state === "pending" && entry.routingInput) {
+                        claims.set(entry.updateId, "historical");
+                        transition("deferred", entry.updateId);
+                        continue;
+                    }
+                }
                 clearRetryTimer();
                 transition("executing", entry.updateId);
                 const execution = await executeWithinOwner(expectedOwner, entry.update);
@@ -1532,7 +2031,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                         for (const sourceUpdateId of receipt.sourceUpdateIds)
                             claims.set(sourceUpdateId, "queued");
                         try {
-                            publishCommittedQueueReceipt(receipt, outcome.queueReceipt.queueOwner, expectedOwner.ctx);
+                            await publishCommittedQueueReceipt(receipt, outcome.queueReceipt.queueOwner, expectedOwner);
                         }
                         catch (error) {
                             return blockWithFailure("invalid-outcome", "queue-receipt-publish", error, entry.updateId);
@@ -1547,7 +2046,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     return postExecutionAuthority;
                 const claimableUpdateIds = new Set([
                     entry.updateId,
-                    ...claims.keys(),
+                    ...[...claims].filter(([, claim]) => claim !== "abandoning" && claim !== "historical" && claim !== "retained").map(([id]) => id),
                 ]);
                 let outcome;
                 try {
@@ -1557,7 +2056,10 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     return blockWithFailure("invalid-outcome", "invalid-outcome", error, entry.updateId);
                 }
                 if (outcome.kind === "deferred") {
-                    claims.set(entry.updateId, "deferred");
+                    if (outcome.routingReview && !deferredSources.get(entry.updateId)?.historical) {
+                        return blockWithFailure("invalid-outcome", "historical-review-source", new TelegramUpdateAdmissionOutcomeError("Historical review needs an exact startup source."), entry.updateId);
+                    }
+                    claims.set(entry.updateId, outcome.routingReview ? "historical" : "deferred");
                     transition("deferred", entry.updateId);
                     continue;
                 }
@@ -1565,7 +2067,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     const completionResult = commitCompletedBatch(expectedOwner, completedUpdateIds);
                     if (completionResult)
                         return completionResult;
-                    const queuedResult = commitQueuedOutcome(expectedOwner, entry.updateId, outcome);
+                    const queuedResult = await commitQueuedOutcome(expectedOwner, entry.updateId, outcome);
                     if (queuedResult === "blocked" || queuedResult === "aborted") {
                         return queuedResult;
                     }
@@ -1573,7 +2075,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     snapshotInvalidated = true;
                     break;
                 }
-                completedUpdateIds.push(entry.updateId);
+                completedUpdateIds.push({ updateId: entry.updateId, ...(outcome.expectedSource ? { expectedSource: outcome.expectedSource } : {}) });
             }
             const completionResult = commitCompletedBatch(expectedOwner, completedUpdateIds);
             if (completionResult)
@@ -1592,6 +2094,14 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         const expectedOwner = owner;
         if (!expectedOwner || drainPromise)
             return;
+        let startupKey;
+        if (onHeldSourcesPrepared) {
+            try {
+                startupKey = deps.getJournalBindingKey?.();
+            }
+            catch { /* Missing startup identity grants no notification. */ }
+        }
+        let lastResult;
         const run = async () => {
             while (pendingSignal &&
                 owner === expectedOwner &&
@@ -1599,7 +2109,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 pendingSignal = false;
                 // Keep newer wakes in this run so waitForDrain also covers them. A failure
                 // observed after signal() still keeps its latch; this loop never clears it.
-                await drain(expectedOwner);
+                lastResult = await drain(expectedOwner);
             }
         };
         const operation = run();
@@ -1610,6 +2120,32 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 if (pendingSignal && !expectedOwner.controller.signal.aborted) {
                     launchDrain();
                 }
+                else if (lastResult === "idle" && startupKey && onHeldSourcesPrepared && !expectedOwner.heldSourcesPreparedIssued) {
+                    try {
+                        const ctx = expectedOwner.ctx, key = startupKey;
+                        const isCurrent = () => owner === expectedOwner && !blocked && !expectedOwner.controller.signal.aborted &&
+                            deps.getJournalBindingKey?.() === key && deps.isContextCurrent?.(ctx) !== false && deps.hasAuthority(ctx);
+                        if (!isCurrent())
+                            return;
+                        expectedOwner.heldSourcesPreparedIssued = true;
+                        // Do not couple lifecycle/stop or the worker drain to a held controller/API reply.
+                        void Promise.resolve().then(() => isCurrent() ? onHeldSourcesPrepared({ ctx,
+                            journalBindingKey: key, signal: expectedOwner.controller.signal, isCurrent,
+                            routingSourceIds: [...deferredSources].filter(([, source]) => source.journalBindingKey === key && !!source.entry.routingInput)
+                                .map(([id]) => id) }) : undefined).catch(error => {
+                            try {
+                                deps.recordRuntimeEvent?.("inbound-worker", error, { phase: "held-source-preparation" });
+                            }
+                            catch { /* Diagnostic only. */ }
+                        });
+                    }
+                    catch (error) {
+                        try {
+                            deps.recordRuntimeEvent?.("inbound-worker", error, { phase: "held-source-preparation" });
+                        }
+                        catch { /* Diagnostic only. */ }
+                    }
+                }
             }
         };
         tracked = operation.then(() => finish(), (error) => {
@@ -1621,6 +2157,76 @@ export function createTelegramUpdateWorkerRuntime(deps) {
         });
         drainPromise = tracked;
     };
+    const abandonSource = (input, historicalSource) => {
+        const expectedOwner = owner;
+        const source = deferredSources.get(input.updateId);
+        const abandonPending = deps.journal.abandonPending;
+        const isCurrent = () => {
+            if (!expectedOwner || owner !== expectedOwner || input.signal.aborted ||
+                expectedOwner.controller.signal !== input.signal || !source ||
+                source.entry.routingInput?.phase === "selected" || (source.historical && historicalSource !== source) ||
+                (claims.get(input.updateId) !== "deferred" && claims.get(input.updateId) !== "abandoning" &&
+                    !(claims.get(input.updateId) === "historical" && historicalSource === source)))
+                return false;
+            return input.isCurrent() && deps.isContextCurrent?.(expectedOwner.ctx) !== false &&
+                deps.getJournalBindingKey?.() === source.journalBindingKey && deps.hasAuthority(expectedOwner.ctx);
+        };
+        if (!source || !abandonPending || !isCurrent())
+            return undefined;
+        // Retain this claim on failure, including unknown commit: never reopen dispatch.
+        claims.set(input.updateId, "abandoning");
+        try {
+            const result = abandonPending({ ...input, entry: source.entry,
+                journalBindingKey: source.journalBindingKey, isCurrent });
+            claims.delete(input.updateId);
+            deferredSources.delete(input.updateId);
+            state.journalEntryCount = result.entryCount;
+            state.journalSerializedBytes = result.serializedBytes;
+            transition("idle");
+            pendingSignal = true;
+            launchDrain();
+            return result;
+        }
+        catch (error) {
+            recordRuntimeEvent(error, { phase: "pending-abandonment", updateId: input.updateId });
+            updateClaimCounts();
+            notifyStateChange();
+            throw error;
+        }
+    };
+    const inspectRecovery = (input, kind) => {
+        const expectedOwner = owner;
+        if (!expectedOwner)
+            return undefined;
+        const { signal, journalBindingKey, isCurrent: callerIsCurrent, afterUpdateId } = input;
+        const isOwnerCurrent = () => owner === expectedOwner && expectedOwner.controller.signal === signal && !signal.aborted;
+        const isCurrent = () => isOwnerCurrent() && callerIsCurrent() && deps.isContextCurrent?.(expectedOwner.ctx) !== false &&
+            deps.getJournalBindingKey?.() === journalBindingKey && deps.hasAuthority(expectedOwner.ctx);
+        if (!isCurrent() || !deps.journal.abandonPending || !deps.journal.inspectPendingRetention ||
+            (afterUpdateId !== undefined && (!Number.isSafeInteger(afterUpdateId) || afterUpdateId < 0)))
+            return undefined;
+        const matches = [...deferredSources].filter(([id, source]) => claims.get(id) === kind &&
+            source.journalBindingKey === journalBindingKey && (afterUpdateId === undefined || id > afterUpdateId))
+            .sort(([a], [b]) => a - b);
+        const sources = matches.slice(0, TELEGRAM_HELD_SOURCE_INSPECTION_LIMIT).map(([updateId, source]) => {
+            let committed;
+            return { original: structuredClone(source.entry), retry(authority) {
+                    const authorized = () => isOwnerCurrent() && authority.isCurrent() && isCurrent();
+                    if (!authorized())
+                        return undefined;
+                    if (committed)
+                        return { ...committed, duplicate: true };
+                    const stillProtected = () => authorized() && (claims.get(updateId) === kind || claims.get(updateId) === "abandoning") &&
+                        deferredSources.get(updateId) === source;
+                    if (!stillProtected())
+                        return undefined;
+                    committed = abandonSource({ ...authority, updateId, signal, isCurrent: stillProtected }, source);
+                    return committed;
+                } };
+        });
+        return isCurrent() ? { sources,
+            ...(matches.length > TELEGRAM_HELD_SOURCE_INSPECTION_LIMIT ? { nextAfterUpdateId: matches[TELEGRAM_HELD_SOURCE_INSPECTION_LIMIT - 1][0] } : {}) } : undefined;
+    };
     return {
         start(ctx) {
             if (owner) {
@@ -1631,6 +2237,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 return;
             }
             clearRetryTimer();
+            clearRoutingTimer();
             const nowMs = getNowMs();
             const generation = ++nextGeneration;
             const queueOwnerIdentity = resolveQueueOwnerIdentity(ctx, generation);
@@ -1641,6 +2248,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 queueOwnerIdentity,
             };
             claims.clear();
+            deferredSources.clear();
             committedQueueReceipts.clear();
             blocked = false;
             pendingSignal = true;
@@ -1653,6 +2261,8 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             state.journalSerializedBytes = 0;
             state.oldestAdmittedAtMs = undefined;
             state.deferredClaimCount = 0;
+            delete state.abandoningClaimCount;
+            delete state.historicalClaimCount;
             state.queuedClaimCount = 0;
             state.foreignQueuedCount = 0;
             delete state.foreignQueuedOwner;
@@ -1683,7 +2293,56 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             pendingSignal = true;
             launchDrain();
         },
-        settleDeferred(input) {
+        armRoutingInput(input) { return mutateRoutingSource(input, false)?.lifetime; },
+        selectRoutingInput(input) { return mutateRoutingSource(input, true)?.issued === true; },
+        isRoutingInputCurrent(input) {
+            return owner?.controller.signal === input.signal && !input.signal.aborted &&
+                deferredSources.has(input.updateId) && claims.get(input.updateId) !== "abandoning";
+        },
+        inspectDeferredSource(input) {
+            const expectedOwner = owner;
+            const source = deferredSources.get(input.updateId);
+            const current = () => {
+                if (!expectedOwner || owner !== expectedOwner || input.signal.aborted || expectedOwner.controller.signal !== input.signal ||
+                    !source || deferredSources.get(input.updateId) !== source || claims.get(input.updateId) !== "deferred" ||
+                    deps.getJournalBindingKey?.() !== source.journalBindingKey || deps.isContextCurrent?.(expectedOwner.ctx) === false ||
+                    !deps.hasAuthority(expectedOwner.ctx))
+                    return false;
+                return isQueueOwnerIdentityCurrent(expectedOwner);
+            };
+            if (!current())
+                return undefined;
+            const snapshot = deps.journal.read();
+            const entry = snapshot.entries.find(value => value.updateId === input.updateId);
+            if (!isTelegramUpdateJournalLegacyFamilyVersion(snapshot.version) || !entry ||
+                JSON.stringify(entry) !== JSON.stringify(source.entry) || !current())
+                return undefined;
+            return { journalBindingKey: source.journalBindingKey, ...createTelegramUpdateJournalEntryDigest(entry) };
+        },
+        isHistoricalSource(input) {
+            const source = deferredSources.get(input.updateId);
+            const isCurrent = () => owner?.controller.signal === input.signal && !input.signal.aborted &&
+                source?.historical === true && deferredSources.get(input.updateId) === source;
+            if (!isCurrent())
+                return false;
+            // Domain eligibility observes original evidence, never mutable handler projections.
+            return (!input.matchesOriginal || input.matchesOriginal(structuredClone(source.entry)) === true) && isCurrent();
+        },
+        supportsDeferredAbandonment(input) {
+            const expectedOwner = owner;
+            const source = deferredSources.get(input.updateId);
+            if (!expectedOwner || input.signal.aborted || expectedOwner.controller.signal !== input.signal ||
+                !source || source.historical || input.journalBindingKey !== source.journalBindingKey ||
+                !deps.journal.abandonPending || !deps.journal.inspectPendingRetention ||
+                claims.get(input.updateId) === "queued")
+                return false;
+            return deps.isContextCurrent?.(expectedOwner.ctx) !== false &&
+                deps.getJournalBindingKey?.() === source.journalBindingKey && deps.hasAuthority(expectedOwner.ctx);
+        },
+        abandonDeferred(input) { return abandonSource(input); },
+        inspectAbandoning(input) { return inspectRecovery(input, "abandoning"); },
+        inspectHistorical(input) { return inspectRecovery(input, "historical"); },
+        async settleDeferred(input) {
             const expectedOwner = owner;
             if (!expectedOwner ||
                 expectedOwner.controller.signal !== input.signal ||
@@ -1700,11 +2359,25 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 return;
             }
             const claim = claims.get(input.updateId);
+            if (claim === "abandoning" || claim === "historical" || claim === "retained" ||
+                (!claim && routingJournal?.inspectExpiry(input.updateId)))
+                return;
             if (input.outcome.kind === "complete") {
                 // Expiry may retire only a still-deferred source, never accepted queue work.
                 if (claim !== "deferred")
                     return;
-                const result = commitCompletedBatch(expectedOwner, [input.updateId]);
+                let completion;
+                try {
+                    completion = validateTelegramUpdateAdmissionOutcome(input.outcome, input.updateId, new Set([input.updateId]));
+                }
+                catch (error) {
+                    blockWithFailure("invalid-outcome", "late-invalid-completion", error, input.updateId);
+                    return;
+                }
+                if (completion.kind !== "complete")
+                    return;
+                const result = commitCompletedBatch(expectedOwner, [{ updateId: input.updateId,
+                        ...(completion.expectedSource ? { expectedSource: completion.expectedSource } : {}) }]);
                 if (!result)
                     transition("idle", input.updateId);
                 return;
@@ -1721,7 +2394,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             }
             let outcome;
             try {
-                outcome = validateTelegramUpdateAdmissionOutcome(input.outcome, input.updateId, new Set([input.updateId, ...claims.keys()]));
+                outcome = validateTelegramUpdateAdmissionOutcome(input.outcome, input.updateId, new Set([input.updateId, ...[...claims].filter(([, claim]) => claim !== "abandoning" && claim !== "historical" && claim !== "retained").map(([id]) => id)]));
             }
             catch (error) {
                 blockWithFailure("invalid-outcome", "late-invalid-outcome", error, input.updateId);
@@ -1737,7 +2410,8 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 releaseDeferredClaims(outcome.sourceUpdateIds);
                 return;
             }
-            const result = commitQueuedOutcome(expectedOwner, input.updateId, outcome);
+            const publication = commitQueuedOutcome(expectedOwner, input.updateId, outcome);
+            const result = typeof publication === "string" ? publication : await publication;
             if (result === "blocked") {
                 releaseDeferredClaims(outcome.sourceUpdateIds);
                 return;
@@ -1746,7 +2420,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 return;
             transition("queued", input.updateId);
         },
-        settleCustodied(input) {
+        async settleCustodied(input) {
             const expectedOwner = owner;
             if (!expectedOwner || expectedOwner.controller.signal !== input.signal || input.signal.aborted)
                 return;
@@ -1791,7 +2465,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             for (const sourceUpdateId of receipt.sourceUpdateIds)
                 claims.set(sourceUpdateId, "queued");
             try {
-                publishCommittedQueueReceipt(receipt, input.result.queueReceipt.queueOwner, expectedOwner.ctx);
+                await publishCommittedQueueReceipt(receipt, input.result.queueReceipt.queueOwner, expectedOwner);
             }
             catch (error) {
                 blockWithFailure("invalid-outcome", "queue-receipt-publish", error, input.updateId);
@@ -1804,16 +2478,32 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             const committed = getCurrentQueueReceipt(receipt);
             return committed ? { ...committed.queueOwner } : undefined;
         },
-        completeQueueReceipts(input) {
+        getQueueReceiptSettlementOwner(receipt, ctx, reason) {
+            const expectedOwner = owner, committed = committedQueueReceipts.get(receipt.receiptId);
+            if (!expectedOwner || expectedOwner.controller.signal.aborted ||
+                !(deps.isContextCurrent?.(ctx) ?? expectedOwner.ctx === ctx) || !isQueueOwnerIdentityCurrent(expectedOwner) ||
+                !committed || !areTelegramQueueAdmissionReceiptsEqual(committed.receipt, normalizeQueueReceipt(receipt)) ||
+                (deps.getJournalBindingKey && committed.receipt.journalBindingKey !== deps.getJournalBindingKey()) ||
+                !isTelegramUpdateJournalQueueOwnerProcess(committed.queueOwner, expectedOwner.queueOwnerIdentity))
+                return undefined;
+            const attempt = scopedQueueCompletionAttempts.get(receipt.receiptId);
+            if (attempt ? attempt.owner !== expectedOwner || attempt.reason !== reason || attempt.journalBindingKey !== deps.getJournalBindingKey?.()
+                : !getCurrentQueueReceipt(receipt))
+                return undefined;
+            return { ...committed.queueOwner };
+        },
+        completeQueueReceipts: function completeQueueReceipts(input) {
             const expectedOwner = owner;
             if (!expectedOwner ||
                 expectedOwner.controller.signal.aborted ||
                 !(deps.isContextCurrent?.(input.ctx) ?? expectedOwner.ctx === input.ctx)) {
                 return false;
             }
-            if (input.receipts.length === 0)
-                return true;
-            const normalizedReceipts = input.receipts.map(normalizeQueueReceipt);
+            // An ACK permits only local completion reconciliation, never execution readiness.
+            const receipts = input.sourceCompletions === undefined ? input.receipts.filter(receipt => !isQueueReceiptCompletionAcknowledged(receipt)) : input.receipts;
+            if (receipts.length === 0)
+                return input.sourceCompletions === undefined;
+            const normalizedReceipts = receipts.map(normalizeQueueReceipt);
             const receiptIds = new Set();
             const sourceUpdateIds = new Set();
             const queuedCompletions = [];
@@ -1837,9 +2527,91 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                     sourceUpdateIds.add(updateId);
                 }
             }
+            const completionBinding = deps.getJournalBindingKey?.();
+            const ordinaryObserverBound = normalizedReceipts.every(receipt => committedQueueReceipts.get(receipt.receiptId).receipt.journalBindingKey === completionBinding);
+            const ordinaryCompletionCurrent = () => ordinaryObserverBound && owner === expectedOwner &&
+                !expectedOwner.controller.signal.aborted && (deps.isContextCurrent?.(input.ctx) ?? expectedOwner.ctx === input.ctx) &&
+                isQueueOwnerIdentityCurrent(expectedOwner) && deps.getJournalBindingKey?.() === completionBinding;
             let removedUpdateIds;
+            let scopedCompletionCurrent;
             try {
-                removedUpdateIds = deps.journal.completeQueued(queuedCompletions).removedUpdateIds;
+                const prepared = normalizedReceipts.flatMap(receipt => committedQueueReceipts.get(receipt.receiptId).sourceCompletions ?? []);
+                const sourceCompletions = input.sourceCompletions === undefined ? (prepared.length ? prepared : undefined) : input.sourceCompletions;
+                if (input.sourceCompletions !== undefined && prepared.some(expected => !input.sourceCompletions.some(value => isDeepStrictEqual(value, expected)))) {
+                    throw new Error("Telegram queued completion conflicts with its prepared source scopes.");
+                }
+                if (input.sourceCompletions === undefined && prepared.length && receipts.some(receipt => !requiredScopedQueueReceipts.has(receipt.receiptId))) {
+                    const scoped = receipts.filter(receipt => requiredScopedQueueReceipts.has(receipt.receiptId));
+                    const ordinary = receipts.filter(receipt => !requiredScopedQueueReceipts.has(receipt.receiptId));
+                    if (!scoped.length || !ordinary.length)
+                        throw new Error("Telegram mixed queue completion has incomplete scoped authority.");
+                    const binding = deps.getJournalBindingKey?.();
+                    const current = () => owner === expectedOwner && !expectedOwner.controller.signal.aborted &&
+                        (deps.isContextCurrent?.(input.ctx) ?? expectedOwner.ctx === input.ctx) && isQueueOwnerIdentityCurrent(expectedOwner) &&
+                        !!binding && deps.getJournalBindingKey?.() === binding;
+                    // Independent whole receipts need independent ACKs. Ordinary siblings must not acquire invented scopes.
+                    if (!current() || !completeQueueReceipts({ receipts: scoped, ctx: input.ctx, reason: input.reason }) || !current())
+                        return false;
+                    return completeQueueReceipts({ receipts: ordinary, ctx: input.ctx, reason: input.reason });
+                }
+                if (sourceCompletions === undefined) {
+                    if (queuedCompletions.some(receipt => requiredScopedQueueReceipts.has(receipt.receiptId))) {
+                        throw new Error("Telegram scoped queue completion cannot downgrade required source scopes.");
+                    }
+                    removedUpdateIds = deps.journal.completeQueued(queuedCompletions).removedUpdateIds;
+                }
+                else {
+                    for (const receipt of queuedCompletions)
+                        requiredScopedQueueReceipts.add(receipt.receiptId);
+                    queuedCompletions.sort((a, b) => a.receiptId < b.receiptId ? -1 : a.receiptId > b.receiptId ? 1 : 0);
+                    const journalBindingKey = deps.getJournalBindingKey?.();
+                    const current = () => owner === expectedOwner && !expectedOwner.controller.signal.aborted &&
+                        (deps.isContextCurrent?.(input.ctx) ?? expectedOwner.ctx === input.ctx) && isQueueOwnerIdentityCurrent(expectedOwner) &&
+                        deps.getJournalBindingKey?.() === journalBindingKey;
+                    if (!journalBindingKey || !current() || !completeQueuedExact || !inspectCompletion ||
+                        !Array.isArray(sourceCompletions) || input.sourceCompletions !== undefined && sourceCompletions.length !== sourceUpdateIds.size) {
+                        throw new Error("Telegram scoped queue completion requires full current source authority.");
+                    }
+                    scopedCompletionCurrent = current;
+                    const completions = normalizeTelegramQueueSourceCompletions(sourceCompletions, sourceUpdateIds, journalBindingKey, input.sourceCompletions !== undefined)
+                        .map(({ journalBindingKey: _binding, ...completion }) => completion);
+                    if (queuedCompletions.some(receipt => !completions.some(scope => receipt.sourceUpdateIds.includes(scope.updateId)))) {
+                        throw new Error("Telegram scoped queue completion requires a proven origin for every whole receipt.");
+                    }
+                    const previous = queuedCompletions.map(receipt => scopedQueueCompletionAttempts.get(receipt.receiptId));
+                    const retained = previous.find(attempt => attempt !== undefined);
+                    if (retained && (previous.some(attempt => attempt !== retained) || retained.owner !== expectedOwner ||
+                        retained.journalBindingKey !== journalBindingKey || retained.reason !== input.reason ||
+                        !isDeepStrictEqual(retained.receipts, queuedCompletions) || !isDeepStrictEqual(retained.completions, completions))) {
+                        throw new Error("Telegram scoped queue completion has conflicting issued authority.");
+                    }
+                    if (!retained) {
+                        const attempt = { owner: expectedOwner, journalBindingKey, reason: input.reason,
+                            receipts: queuedCompletions.map(receipt => ({ ...receipt, sourceUpdateIds: [...receipt.sourceUpdateIds], queueOwner: { ...receipt.queueOwner } })),
+                            completions: completions.map(completion => ({ ...completion })) };
+                        if (!current())
+                            throw new Error("Telegram scoped queue completion authority changed before disposal.");
+                        // Mark before issuance: an exception may follow a committed rename, and cannot license another disposal.
+                        for (const receipt of queuedCompletions)
+                            scopedQueueCompletionAttempts.set(receipt.receiptId, attempt);
+                        const result = completeQueuedExact(queuedCompletions.map(receipt => ({ ...receipt, sourceUpdateIds: [...receipt.sourceUpdateIds], queueOwner: { ...receipt.queueOwner } })), completions.map(completion => ({ ...completion })));
+                        if (!current() || !isDeepStrictEqual(result.sourceCompletions, completions)) {
+                            throw new Error("Telegram scoped queue completion ACK was not confirmed.");
+                        }
+                        const removed = new Set(result.removedUpdateIds);
+                        if (removed.size !== sourceUpdateIds.size || [...sourceUpdateIds].some(id => !removed.has(id))) {
+                            throw new Error("Telegram scoped queue completion did not remove every source.");
+                        }
+                    }
+                    for (const completion of completions) {
+                        if (!current() || !isDeepStrictEqual(inspectCompletion({ ...completion }), completion) || !current()) {
+                            throw new Error("Telegram scoped queue completion ACK was not retained under current authority.");
+                        }
+                    }
+                    // Every immutable whole receipt has a scoped queued-origin witness; native queued ACK continuity proves its complete removal.
+                    // Unscoped siblings receive only receipt acknowledgement, never a source marker or absence-based proof.
+                    removedUpdateIds = [...sourceUpdateIds];
+                }
             }
             catch (error) {
                 blockWithFailure("journal-write", "queue-receipt-completion", error);
@@ -1851,13 +2623,15 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 blockWithFailure("journal-write", "queue-receipt-completion", new Error(`Telegram ${input.reason} did not complete every receipt source.`));
                 return false;
             }
-            input.receipts.forEach((receipt, index) => {
+            receipts.forEach((receipt, index) => {
                 acknowledgedQueueReceiptCompletions.set(receipt, normalizedReceipts[index]);
             });
             for (const updateId of sourceUpdateIds)
                 claims.delete(updateId);
             for (const receiptId of receiptIds) {
                 committedQueueReceipts.delete(receiptId);
+                requiredScopedQueueReceipts.delete(receiptId);
+                scopedQueueCompletionAttempts.delete(receiptId);
             }
             const completedUpdateIds = [...sourceUpdateIds];
             state.lastCompletedUpdateId = Math.max(state.lastCompletedUpdateId ?? -1, ...completedUpdateIds);
@@ -1865,8 +2639,33 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             state.journalEntryCount = Math.max(0, state.journalEntryCount - completedUpdateIds.length);
             updateClaimCounts();
             notifyStateChange();
-            pendingSignal = true;
-            launchDrain();
+            if (scopedCompletionCurrent)
+                for (const receipt of normalizedReceipts) {
+                    if (!scopedCompletionCurrent())
+                        break;
+                    try {
+                        observeQueuedCompletion?.(normalizeQueueReceipt(receipt), input.ctx);
+                    }
+                    catch (error) {
+                        recordRuntimeEvent(error, { phase: "queue-receipt-completion-observer", receiptId: receipt.receiptId });
+                    }
+                }
+            // Ordinary queued disposal is source completion too; notify only after a whole positive ACK and fresh origin authority.
+            if (!scopedCompletionCurrent)
+                for (const updateId of completedUpdateIds) {
+                    try {
+                        if (!ordinaryCompletionCurrent())
+                            break;
+                        deps.onUpdateCompleted?.(updateId, input.ctx, completionBinding);
+                    }
+                    catch (error) {
+                        recordRuntimeEvent(error, { phase: "queue-source-completion-observer", updateId });
+                    }
+                }
+            if (!scopedCompletionCurrent || scopedCompletionCurrent()) {
+                pendingSignal = true;
+                launchDrain();
+            }
             return true;
         },
         async stop() {
@@ -1875,6 +2674,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
                 return;
             pendingSignal = false;
             clearRetryTimer();
+            clearRoutingTimer();
             expectedOwner.controller.abort();
             await drainPromise?.catch(() => undefined);
             if (owner !== expectedOwner)
@@ -1882,6 +2682,7 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             owner = undefined;
             drainPromise = undefined;
             claims.clear();
+            deferredSources.clear();
             committedQueueReceipts.clear();
             blocked = false;
             state.phase = "stopped";
@@ -1889,6 +2690,8 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             state.currentUpdateId = undefined;
             state.blockedReason = undefined;
             state.deferredClaimCount = 0;
+            delete state.abandoningClaimCount;
+            delete state.historicalClaimCount;
             state.queuedClaimCount = 0;
             state.foreignQueuedCount = 0;
             delete state.foreignQueuedOwner;
@@ -1907,8 +2710,9 @@ export function createTelegramUpdateWorkerRuntime(deps) {
             state.unsettledExecutionCount = unsettledExecutions.size;
             notifyStateChange();
         },
-        waitForDrain() {
-            return drainPromise ?? Promise.resolve();
+        async waitForDrain() {
+            await (drainPromise ?? Promise.resolve());
+            await Promise.allSettled([...pendingQueuePublications.values()].map(value => value.task));
         },
         getState() {
             return getTelegramUpdateWorkerStateSnapshot(state);
@@ -2019,8 +2823,21 @@ function mergeTelegramReportedAdmissionOutcome(current, next, updateId) {
         return next;
     if (next.kind === "deferred")
         return current;
-    if (current.kind === "complete" && next.kind === "complete")
-        return current;
+    if (current.kind === "complete" && next.kind === "complete") {
+        if (!current.expectedSource)
+            return next;
+        if (!next.expectedSource)
+            return current;
+        if (current.expectedSource.updateId === next.expectedSource.updateId &&
+            current.expectedSource.journalBindingKey === next.expectedSource.journalBindingKey &&
+            current.expectedSource.sourceSha256 === next.expectedSource.sourceSha256) {
+            if (!current.expectedSource.completionSha256)
+                return next;
+            if (!next.expectedSource.completionSha256 || current.expectedSource.completionSha256 === next.expectedSource.completionSha256)
+                return current;
+        }
+        throw new TelegramUpdateAdmissionOutcomeError(`Telegram update ${updateId} reported conflicting completion sources.`);
+    }
     if (current.kind === "queued" && next.kind === "queued" &&
         areTelegramQueueAdmissionReceiptsEqual(current, next))
         return current;
@@ -2736,13 +3553,22 @@ export function createTelegramUpdateAdmissionHandle(deps) {
     let nextExecutionGeneration = 0;
     return async (update, ctx, signal) => {
         const generation = ++nextExecutionGeneration;
+        let suspended = false;
+        let routingClaims = 0;
+        let abandoned;
+        let routingLifetime;
+        let routingSourceIds;
+        let routingClockUnknown = false;
+        let routingSelectionAttempted = false;
+        let routingSelectionConfirmed = false;
         const execution = {
             generation,
             updateId: update.update_id,
             signal,
-            isCurrent: () => !signal.aborted,
+            isCurrent: () => !signal.aborted && !suspended && ((!routingLifetime && !routingClockUnknown) || immediate || settlementReported ||
+                deps.isRoutingInputCurrent?.({ updateId: update.update_id, signal }) !== false),
             assertCurrent() {
-                if (signal.aborted) {
+                if (!execution.isCurrent()) {
                     throw signal.reason ?? new DOMException("Aborted", "AbortError");
                 }
             },
@@ -2753,8 +3579,19 @@ export function createTelegramUpdateAdmissionHandle(deps) {
         if (verdict === "consume")
             return { kind: "complete" };
         let immediate = true;
+        let settlementReported = false;
         let outcome;
         const boundUpdate = bindTelegramUpdateExecutionFence(bindTelegramUpdateAdmissionSource(update, (next) => {
+            if (!execution.isCurrent())
+                return;
+            if (next.kind === "deferred" && next.routingReview) {
+                if (!immediate || settlementReported || routingClaims > 0 || !deps.isHistoricalSource?.({ updateId: update.update_id, signal })) {
+                    throw new TelegramUpdateAdmissionOutcomeError("Historical review cannot override accepted or selected work.");
+                }
+                suspended = true;
+            }
+            if (next.kind !== "deferred")
+                settlementReported = true;
             if (immediate) {
                 outcome = mergeTelegramReportedAdmissionOutcome(outcome, next, update.update_id);
                 return;
@@ -2763,11 +3600,15 @@ export function createTelegramUpdateAdmissionHandle(deps) {
                 throw new TelegramUpdateAdmissionOutcomeError(`Telegram update ${update.update_id} reported a late outcome without an owner.`);
             }
             void Promise.resolve()
-                .then(() => deps.onLateOutcome(next, {
-                updateId: update.update_id,
-                ctx,
-                signal,
-            }))
+                .then(() => {
+                if (!execution.isCurrent())
+                    return;
+                return deps.onLateOutcome(next, {
+                    updateId: update.update_id,
+                    ctx,
+                    signal,
+                });
+            })
                 .catch((error) => {
                 try {
                     deps.onLateOutcomeError?.(error, update.update_id);
@@ -2776,11 +3617,81 @@ export function createTelegramUpdateAdmissionHandle(deps) {
                     // Diagnostic sinks must not create an unhandled late Promise.
                 }
             });
-        }), execution);
+        }, { abandon: (authority) => {
+                const isCurrent = () => !signal.aborted && routingClaims === 0 && !settlementReported && authority.isCurrent();
+                if (immediate || outcome?.kind !== "deferred" || !deps.abandonDeferred || !isCurrent())
+                    return undefined;
+                if (abandoned)
+                    return { ...abandoned, duplicate: true };
+                const wasSuspended = suspended;
+                suspended = true;
+                // Failed/unknown publication keeps dispatch suspended for exact cancellation retry.
+                // An ineligible request that attempted no publication remains inert.
+                const result = deps.abandonDeferred({ ...authority, updateId: update.update_id, signal, isCurrent });
+                if (result)
+                    abandoned = result;
+                else
+                    suspended = wasSuspended;
+                return result;
+            }, inspectAbandoning: request => execution.isCurrent()
+                ? deps.inspectAbandoning?.({ ...request, signal }) : undefined,
+            inspectHistorical: request => execution.isCurrent() ? deps.inspectHistorical?.({ ...request, signal }) : undefined,
+            inspectSource: () => execution.isCurrent() && !immediate && !settlementReported
+                ? deps.inspectDeferredSource?.({ updateId: update.update_id, signal }) : undefined,
+            isHistorical: matchesOriginal => !signal.aborted && deps.isHistoricalSource?.({ updateId: update.update_id, signal,
+                ...(matchesOriginal ? { matchesOriginal } : {}) }) === true,
+            isHistoricalReviewHeld: () => !signal.aborted && suspended && outcome?.kind === "deferred" && outcome.routingReview === true,
+            supportsAbandonment: journalBindingKey => !signal.aborted && !settlementReported &&
+                deps.supportsDeferredAbandonment?.({ updateId: update.update_id, signal, journalBindingKey }) === true,
+            armRoutingInput: (operatorUserId, sourceUpdateIds) => {
+                execution.assertCurrent();
+                if (settlementReported || routingClaims || suspended)
+                    return undefined;
+                if (routingClockUnknown)
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram routing input clock publication is unconfirmed.");
+                const ids = [...sourceUpdateIds];
+                if (routingSourceIds && !isDeepStrictEqual(ids, routingSourceIds))
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram routing input source membership changed.");
+                try {
+                    routingLifetime = deps.armRoutingInput?.({ updateId: update.update_id, signal, operatorUserId, sourceUpdateIds: ids });
+                }
+                catch (error) {
+                    routingClockUnknown = true;
+                    throw error;
+                }
+                if (routingLifetime)
+                    routingSourceIds = ids;
+                return routingLifetime ? { ...routingLifetime } : undefined;
+            },
+            acquireRouting: (select = false, sourceUpdateIds) => {
+                execution.assertCurrent();
+                if (select && routingClockUnknown)
+                    throw new TelegramUpdateAdmissionOutcomeError("Telegram routing input clock publication is unconfirmed; selection is protected.");
+                if (select && routingLifetime && !routingSelectionConfirmed) {
+                    if (routingSelectionAttempted)
+                        throw new TelegramUpdateAdmissionOutcomeError("Telegram routing selection is unconfirmed; no replay is permitted.");
+                    if (!isDeepStrictEqual(sourceUpdateIds ?? [update.update_id], routingSourceIds))
+                        throw new TelegramUpdateAdmissionOutcomeError("Telegram routing input selection changed its source membership.");
+                    routingSelectionAttempted = true;
+                    routingSelectionConfirmed = deps.selectRoutingInput?.({ updateId: update.update_id, signal,
+                        operatorUserId: routingLifetime.operatorUserId, sourceUpdateIds: routingSourceIds }) === true;
+                    if (!routingSelectionConfirmed)
+                        throw new TelegramUpdateAdmissionOutcomeError("Telegram routing input choice is expired or unavailable.");
+                }
+                routingClaims += 1;
+                let released = false;
+                return () => {
+                    if (released)
+                        return;
+                    released = true;
+                    routingClaims -= 1;
+                };
+            } }), execution);
         try {
             execution.assertCurrent();
             await deps.defaultHandle(boundUpdate, ctx, execution);
-            execution.assertCurrent();
+            if (outcome?.kind !== "deferred" || !outcome.routingReview || signal.aborted)
+                execution.assertCurrent();
         }
         finally {
             immediate = false;
@@ -2813,17 +3724,21 @@ export function createTelegramQueueAdmissionSettlementMuxRuntime(runtimes) {
     // Plan the whole request before mutation; unready is not an acknowledgement of completion.
     const complete = (items, ctx, kind) => {
         const plan = new Map();
+        const reason = kind === "prompt" ? "prompt-handoff" : kind === "control" ? "control-settlement" : "discard";
+        const settlementOwner = (runtime, receipt) => runtime.getQueueReceiptSettlementOwner ? runtime.getQueueReceiptSettlementOwner(receipt, ctx, reason) :
+            runtime.isItemReady({ admissionReceipts: [receipt] }) ? runtime.getQueueReceiptOwner(receipt) : undefined;
         for (const receipt of items.flatMap(item => item.admissionReceipts ?? [])) {
-            if (kind === "discard" && isQueueReceiptCompletionAcknowledged(receipt))
+            if (isQueueReceiptCompletionAcknowledged(receipt))
                 continue;
-            const candidates = runtimes.filter(runtime => runtime.isItemReady({ admissionReceipts: [receipt] }));
+            const candidates = runtimes.filter(runtime => runtime.getQueueReceiptSettlementOwner ? !!settlementOwner(runtime, receipt)
+                : runtime.isItemReady({ admissionReceipts: [receipt] }));
             const selected = candidates[0];
             if (!selected)
                 return false;
             if (candidates.length > 1) {
-                const owner = selected.getQueueReceiptOwner(receipt);
+                const owner = settlementOwner(selected, receipt);
                 if (!owner || candidates.some(runtime => {
-                    const candidate = runtime.getQueueReceiptOwner(receipt);
+                    const candidate = settlementOwner(runtime, receipt);
                     return !candidate || !areTelegramUpdateJournalQueueOwnersEqual(owner, candidate);
                 }))
                     return false;
@@ -2868,7 +3783,7 @@ export function createTelegramQueueAdmissionSettlementRuntime(worker) {
         const receipts = [];
         for (const item of items) {
             for (const receipt of item.admissionReceipts ?? []) {
-                if (reason !== "discard" || !isQueueReceiptCompletionAcknowledged(receipt))
+                if (!isQueueReceiptCompletionAcknowledged(receipt))
                     receipts.push(receipt);
             }
         }
@@ -2877,6 +3792,7 @@ export function createTelegramQueueAdmissionSettlementRuntime(worker) {
     return {
         isItemReady: (item) => (item.admissionReceipts ?? []).every(worker.isQueueReceiptCommitted),
         getQueueReceiptOwner: worker.getQueueReceiptOwner,
+        ...(worker.getQueueReceiptSettlementOwner ? { getQueueReceiptSettlementOwner: worker.getQueueReceiptSettlementOwner } : {}),
         onPromptHandedOff: (item, ctx) => complete([item], ctx, "prompt-handoff"),
         onControlSettled: (item, ctx) => complete([item], ctx, "control-settlement"),
         onItemsDiscarded: (items, ctx) => complete(items, ctx, "discard"),
@@ -3048,9 +3964,9 @@ export function createTelegramQueueHandoffReconciliationRuntimeAssembly(deps) {
         canHandoffWithLeader: deps.canHandoffWithLeader,
         listFollowers: deps.listFollowers,
         createRecipientJournalBindingKey(recipient) {
-            if (!recipient.profileKey)
+            if (!recipient.profileKey || !recipient.sessionId)
                 return undefined;
-            return deps.createRecipientJournalResolver(recipient.profileKey)()
+            return deps.createRecipientJournalResolver(recipient.profileKey, recipient.sessionId)()
                 ?.recoveryKey;
         },
         getQueuedItems: deps.queueStore.getQueuedItems,
@@ -3228,17 +4144,18 @@ export function createTelegramUpdateWorkerOwnerRuntime(deps) {
                 sessionGeneration: deps.getSessionGeneration(),
             };
         },
-        onQueueReceiptCommitted(_receipt, ctx) {
+        onQueueReceiptCommitted(receipt, ctx) {
             if (!deps.isContextCurrent(ctx))
                 return;
+            deps.afterQueueReceiptCommitted?.(receipt, ctx);
             deps.dispatchNext(ctx);
             deps.requestQueueHandoffReconciliation(ctx);
         },
-        onUpdateCompleted(updateId, ctx) {
+        onUpdateCompleted(updateId, ctx, journalBindingKey) {
             if (!deps.isContextCurrent(ctx))
                 return;
             deps.dispatchNext(ctx);
-            deps.afterUpdateCompleted?.(updateId);
+            deps.afterUpdateCompleted?.(updateId, ctx, journalBindingKey);
         },
     };
 }
@@ -3247,6 +4164,7 @@ export function createTelegramUpdateAdmissionRuntimeBinding(deps) {
     let follower;
     let settlement;
     let inputCustodyBus;
+    const getActive = () => deps.isFollowerRegistered() ? follower : leader;
     return {
         bind(input) {
             leader = input.leader;
@@ -3259,7 +4177,7 @@ export function createTelegramUpdateAdmissionRuntimeBinding(deps) {
         },
         getLeader: () => leader,
         getFollower: () => follower,
-        getActive: () => (deps.isFollowerRegistered() ? follower : leader),
+        getActive,
         getSettlement: () => settlement,
         getInputCustodyBus: () => inputCustodyBus,
         getLifecycleForJournalBinding(journalBindingKey) {
@@ -3358,6 +4276,7 @@ export function createTelegramUpdateAdmissionLifecycleRuntime(deps) {
                 binding.recoveryKey !== recoveryKey) {
                 throw new Error("Telegram update source binding changed during startup.");
             }
+            deps.prepareBinding?.(binding);
             const release = deps.acquireSourceReference?.(binding);
             const inputCustody = binding.journal.inputCustody;
             try {
@@ -3580,6 +4499,15 @@ export function createTelegramUpdateAdmissionWorkerRuntime(deps) {
     const executeUpdate = createTelegramUpdateAdmissionHandle({
         defaultHandle: deps.defaultHandle,
         registry: deps.registry,
+        abandonDeferred: input => worker?.abandonDeferred?.(input),
+        armRoutingInput: input => worker?.armRoutingInput?.(input),
+        selectRoutingInput: input => worker?.selectRoutingInput?.(input) === true,
+        isRoutingInputCurrent: input => worker?.isRoutingInputCurrent?.(input) !== false,
+        supportsDeferredAbandonment: input => worker?.supportsDeferredAbandonment?.(input) === true,
+        inspectAbandoning: input => worker?.inspectAbandoning?.(input),
+        inspectHistorical: input => worker?.inspectHistorical?.(input),
+        inspectDeferredSource: input => worker?.inspectDeferredSource?.(input),
+        isHistoricalSource: input => worker?.isHistoricalSource?.(input) === true,
         onLateOutcome(outcome, details) {
             worker?.settleDeferred({
                 updateId: details.updateId,
@@ -3647,6 +4575,7 @@ export function createTelegramUpdateAdmissionLifecycleAssembly(deps) {
     const follower = createTelegramUpdateAdmissionLifecycleRuntime({
         getQueueOwnerIdentity: deps.worker.getQueueOwnerIdentity,
         ...(deps.acquireSourceReference ? { acquireSourceReference: binding => deps.acquireSourceReference("follower", binding) } : {}),
+        ...(deps.follower.prepareBinding ? { prepareBinding: deps.follower.prepareBinding } : {}),
         resolveBinding() {
             const generation = deps.follower.getGeneration();
             if (!deps.follower.isRegistered() || !generation)
@@ -3671,6 +4600,11 @@ export function createTelegramUpdateAdmissionLifecycleAssembly(deps) {
                 getJournalBindingKey: () => binding.recoveryKey,
                 getRecipientBindingKey: () => binding.recipientBindingKey,
                 hasAuthority: () => binding.hasAuthority?.() ?? false,
+                // Recipient custody is not an orphaned direct-bot source.
+                shouldReviewHistoricalInput: undefined,
+                shouldHoldPendingInput: undefined,
+                spendHistoricalInput: undefined,
+                onHeldSourcesPrepared: undefined,
                 prepareUpdateForExecution: deps.follower.prepareUpdateForExecution,
             });
         },