@llblab/pi-telegram 0.51.6 → 0.52.1

package/lib/journal.ts

@@ -22,6 +22,7 @@ import {
   readFileSync,
   readdirSync,
   rmdirSync,
+  rmSync,
   statSync,
   unlinkSync,
   writeFileSync,
@@ -39,6 +40,7 @@ import {
   type TelegramProcessLiveness,
 } from "./bus.ts";
 import {
+  decodeTelegramSessionDirectoryName,
   getTelegramProfilePathSuffix,
   TELEGRAM_DEFAULT_PROFILE_NAME,
 } from "./paths.ts";
@@ -47,22 +49,28 @@ import {
   type TelegramWorkspaceAdmissionLedger,
   type TelegramWorkspaceAdmissionScope,
 } from "./workspace-admission.ts";
+import {
+  isWireRecord as isRecord,
+  hasOnlyWireKeys as hasOnlyKeys,
+  isNonNegativeWireInteger as isSafeNonNegativeInteger,
+  isNonEmptyWireString as isNonEmptyString,
+} from "./wire.ts";
 
 export const TELEGRAM_UPDATE_JOURNAL_VERSION = 1 as const;
 export const TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION = 2 as const;
 export const TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION = 3 as const;
 // Receipt and binding identities survive storage-schema upgrades.
 const TELEGRAM_UPDATE_JOURNAL_IDENTITY_VERSION = 1 as const;
-export const TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES = 10_000;
-export const TELEGRAM_UPDATE_JOURNAL_MAX_BYTES = 32 * 1024 * 1024;
-export const TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH = 128;
+const TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES = 10_000;
+const TELEGRAM_UPDATE_JOURNAL_MAX_BYTES = 32 * 1024 * 1024;
+const TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH = 128;
 export const TELEGRAM_UPDATE_JOURNAL_QUEUE_OWNER_ID_MAX_LENGTH = 256;
-export const TELEGRAM_UPDATE_JOURNAL_INPUT_BINDING_MAX_LENGTH = 256;
+const TELEGRAM_UPDATE_JOURNAL_INPUT_BINDING_MAX_LENGTH = 256;
 const TELEGRAM_UPDATE_JOURNAL_INPUT_PROJECTION_HEADROOM_BYTES = 4 * 1024;
 const TELEGRAM_UPDATE_JOURNAL_INPUT_TRANSITION_HEADROOM_BYTES = 64;
-export const TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_ID_MAX_LENGTH = 128;
-export const TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MIN_LENGTH = 32;
-export const TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MAX_LENGTH = 256;
+const TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_ID_MAX_LENGTH = 128;
+const TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MIN_LENGTH = 32;
+const TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_TOKEN_MAX_LENGTH = 256;
 export const TELEGRAM_UPDATE_JOURNAL_FAILURE_CLASS_MAX_LENGTH = 128;
 export const TELEGRAM_UPDATE_JOURNAL_FAILURE_SUMMARY_MAX_LENGTH = 512;
 
@@ -115,7 +123,78 @@ export function discoverTelegramFollowerJournalPaths(input: {
   }
   return { paths: Array.from(paths).sort(), complete };
 }
-export const TELEGRAM_UPDATE_JOURNAL_TERMINAL_REASON_MAX_LENGTH = 256;
+
+/** Bounded read-only session-family discovery, not writer closure or deletion authority. */
+export function discoverTelegramSessionJournalPaths(input: {
+  directory: string;
+  profileName?: string;
+  maxDirectoryEntries?: number;
+}): TelegramFollowerJournalDiscovery {
+  const maxEntries = input.maxDirectoryEntries ?? 10_000;
+  if (!Number.isSafeInteger(maxEntries) || maxEntries < 1) return { paths: [], complete: false };
+  const root = join(input.directory, "sessions");
+  const suffix = getTelegramProfilePathSuffix(input.profileName);
+  const paths = new Set<string>();
+  let remaining = maxEntries;
+  let complete = true;
+  const scan = (directory: string): Dirent[] => {
+    const entries: Dirent[] = [];
+    const handle = opendirSync(directory);
+    try {
+      for (;;) {
+        const entry = handle.readSync();
+        if (!entry) break;
+        if (--remaining < 0) { complete = false; break; }
+        entries.push(entry);
+      }
+    } finally { handle.closeSync(); }
+    return entries;
+  };
+  try {
+    const stat = lstatSync(root);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return { paths: [], complete: false };
+  } catch (error) {
+    return { paths: [], complete: (error as NodeJS.ErrnoException).code === "ENOENT" };
+  }
+  try {
+    for (const session of scan(root)) {
+      if (!complete) break;
+      if (!session.isDirectory() || decodeTelegramSessionDirectoryName(session.name) === undefined) {
+        complete = false; break;
+      }
+      const directory = join(root, session.name);
+      const sessionStat = lstatSync(directory);
+      if (!sessionStat.isDirectory() || sessionStat.isSymbolicLink()) { complete = false; break; }
+      for (const entry of scan(directory)) {
+        if (!complete) break;
+        // The leader polling journal and legacy recovery folders are not recipient custody.
+        if (entry.name === "recovery" || /^inbox(?:\.[a-zA-Z0-9._-]+)?\.json(?:\.segments|\.retained)?$/u.test(entry.name)) continue;
+        const match = /^journal\.([a-f0-9]{16})(\.[a-zA-Z0-9._-]+)?\.json(\.segments|\.retained)?$/u.exec(entry.name);
+        if (!match) { complete = false; break; }
+        const stat = lstatSync(join(directory, entry.name));
+        if (stat.isSymbolicLink() || (match[3] ? !stat.isDirectory() : !stat.isFile())) {
+          complete = false; break;
+        }
+        if ((match[2] ?? "") !== suffix) continue;
+        paths.add(join(directory, entry.name.replace(/\.(?:segments|retained)$/u, "")));
+      }
+    }
+  } catch { complete = false; }
+  return { paths: Array.from(paths).sort(), complete };
+}
+
+/** Transitional discovery covers both retained flat recipients and session-owned families. */
+export function discoverTelegramRecipientJournalPaths(input: {
+  directory: string;
+  profileName?: string;
+}): TelegramFollowerJournalDiscovery {
+  const legacy = discoverTelegramFollowerJournalPaths(input);
+  const sessions = discoverTelegramSessionJournalPaths(input);
+  return { paths: Array.from(new Set([...legacy.paths, ...sessions.paths])).sort(),
+    complete: legacy.complete && sessions.complete };
+}
+
+const TELEGRAM_UPDATE_JOURNAL_TERMINAL_REASON_MAX_LENGTH = 256;
 export const TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_COUNT = 256;
 export const TELEGRAM_UPDATE_JOURNAL_COMPACTION_SEGMENT_BYTES = 4 * 1024 * 1024;
 
@@ -329,7 +408,7 @@ export interface TelegramUpdateJournalLegacyCustodyCandidate {
   evidenceSha256: string;
 }
 
-export function listTelegramUpdateJournalLegacyCustodyCandidates(
+function listTelegramUpdateJournalLegacyCustodyCandidates(
   snapshot: Pick<TelegramUpdateJournalSnapshot, "entries">,
 ): TelegramUpdateJournalLegacyCustodyCandidate[] {
   return snapshot.entries.flatMap(entry => {
@@ -409,12 +488,23 @@ export type TelegramUpdateJournalOperatorDisposition =
   | TelegramUpdateJournalTerminalOperatorDisposition
   | TelegramUpdateJournalLegacyCustodyDisposition;
 
+export const TELEGRAM_ROUTING_INPUT_TTL_MS = 60 * 60 * 1000;
+
+/** A source-only choice deadline, never a queue lease or a Thread deletion grant. */
+export interface TelegramUpdateJournalRoutingInput {
+  operatorUserId: number;
+  publishedAtMs: number;
+  expiresAtMs: number;
+  phase: "waiting" | "selected";
+}
+
 export interface TelegramUpdateJournalEntry {
   updateId: number;
   update: TelegramJournaledUpdate;
   /** Mandatory in v2/v3; immutable veto, never sender authorization. Absent only in legacy v1. */
   preApprovalExcluded?: boolean;
   admittedAtMs: number;
+  routingInput?: TelegramUpdateJournalRoutingInput;
   state: TelegramUpdateJournalEntryState;
   queueKind?: TelegramUpdateJournalQueueKind;
   queueReceiptId?: string;
@@ -429,6 +519,19 @@ export interface TelegramUpdateJournalEntry {
   terminalFailureId?: string;
 }
 
+/** Exact parsed journal entry identity, checked inside the source owner's mutation transaction. */
+export interface TelegramUpdateJournalEntryDigest {
+  updateId: number;
+  sourceSha256: string;
+}
+/** Journal-owned removal ACK bound to an opaque, immutable caller acceptance scope. */
+export interface TelegramUpdateJournalSourceCompletion extends TelegramUpdateJournalEntryDigest {
+  completionSha256: string;
+}
+export function createTelegramUpdateJournalEntryDigest(entry: TelegramUpdateJournalEntry): TelegramUpdateJournalEntryDigest {
+  return { updateId: entry.updateId, sourceSha256: createHash("sha256").update(JSON.stringify(entry)).digest("hex") };
+}
+
 export interface TelegramUpdateJournalFile {
   version: typeof TELEGRAM_UPDATE_JOURNAL_VERSION | typeof TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION | typeof TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION;
   revision?: number;
@@ -437,6 +540,7 @@ export interface TelegramUpdateJournalFile {
   botIdentity: TelegramUpdateJournalBotIdentity;
   entries: TelegramUpdateJournalEntry[];
   operatorDispositions?: TelegramUpdateJournalOperatorDisposition[];
+  sourceCompletions?: TelegramUpdateJournalSourceCompletion[];
 }
 
 export interface TelegramUpdateJournalSnapshot
@@ -455,6 +559,7 @@ export interface TelegramUpdateJournalAppendResult {
 }
 
 export interface TelegramUpdateJournalRemoveResult {
+  sourceCompletions?: TelegramUpdateJournalSourceCompletion[];
   removedUpdateIds: number[];
   entryCount: number;
   serializedBytes: number;
@@ -475,6 +580,12 @@ export interface TelegramUpdateJournalQueueResult {
   serializedBytes: number;
 }
 
+export interface TelegramUpdateJournalQueuedReceiptEvidence {
+  receipt: TelegramUpdateJournalQueuedCompletion;
+  sources: TelegramUpdateJournalEntryDigest[];
+  queueOwnerSha256: string;
+}
+
 export interface TelegramUpdateJournalQueuedCompletion {
   queueKind: TelegramUpdateJournalQueueKind;
   receiptId: string;
@@ -593,8 +704,94 @@ export interface TelegramUpdateJournalOperatorDispositionResult {
   serializedBytes: number;
 }
 
+export interface TelegramUpdateJournalPendingAbandonmentInput {
+  journalBindingKey: string;
+  entry: TelegramUpdateJournalEntry;
+  operatorAuthorityId: string;
+  /** Caller proves owner authorization and excludes live chooser/worker dispatch through publication. */
+  isCurrent: () => boolean;
+}
+
+export interface TelegramUpdateJournalPendingAbandonmentResult {
+  disposition: TelegramUpdateJournalLegacyCustodyDisposition;
+  retainedPath: string;
+  duplicate: boolean;
+  entryCount: number;
+  serializedBytes: number;
+}
+
+/** Private evidence copy, not execution authority or proof that abandonment committed. */
+export interface TelegramUpdateJournalRetainedInput {
+  version: 1;
+  kind: "pending-input-retention";
+  journalBindingKey: string;
+  entry: TelegramUpdateJournalEntry;
+  requestedDisposition: TelegramUpdateJournalLegacyCustodyDisposition;
+}
+
+export interface TelegramUpdateJournalPendingRetentionEvidence {
+  journalBindingKey: string;
+  retainedPath: string;
+  requestedDisposition: TelegramUpdateJournalLegacyCustodyDisposition;
+}
+
+/** Durable proof that an owner abandoned this exact pending source; never delivery or completion proof. */
+export interface TelegramUpdateJournalAbandonedPendingEvidence {
+  journalBindingKey: string;
+  updateId: number;
+  retainedPath: string;
+  operatorAuthorityId: string;
+}
+
+export interface TelegramRoutingInputAuthority {
+  journalBindingKey: string;
+  entries: readonly TelegramUpdateJournalEntry[];
+  operatorUserId: number;
+  isCurrent(): boolean;
+}
+
+/** Expiry drops a donor attempt without retaining its body or claiming recipient execution/cancellation. */
+export type TelegramRoutingInputExpiryResult = Omit<TelegramUpdateJournalPendingAbandonmentResult, "retainedPath">;
+export type TelegramRoutingInputExpiryEvidence = Omit<TelegramUpdateJournalAbandonedPendingEvidence, "retainedPath">;
+
+function inspectRoutingInputExpiry(file: TelegramUpdateJournalFile, journalBindingKey: string, updateId: number): TelegramRoutingInputExpiryEvidence | undefined {
+  const disposition = file.operatorDispositions?.find(value => value.updateId === updateId &&
+    "dispositionKind" in value && value.dispositionKind === "legacy-custody" && value.action === "discard" &&
+    value.failureId === `routing-expiry:${value.evidenceSha256}`);
+  if (!disposition || !("operatorAuthorityId" in disposition) || file.entries.some(entry => entry.updateId === updateId)) return undefined;
+  return { journalBindingKey, updateId, operatorAuthorityId: disposition.operatorAuthorityId };
+}
+
+function inspectRoutingGroupExpiry(file: TelegramUpdateJournalFile, journalBindingKey: string, updateIds: readonly number[]): TelegramRoutingInputExpiryEvidence[] | undefined {
+  if (!Array.isArray(updateIds) || !updateIds.length || updateIds.length > TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES ||
+      updateIds.some((id, index) => !isSafeNonNegativeInteger(id) || (index > 0 && id <= updateIds[index - 1]!))) return undefined;
+  if (file.entries.some(entry => updateIds.includes(entry.updateId))) return undefined;
+  const expired = updateIds.map(id => inspectRoutingInputExpiry(file, journalBindingKey, id)).filter(value => value !== undefined);
+  if (!expired.length || expired.some(value => value.operatorAuthorityId !== expired[0]!.operatorAuthorityId)) return undefined;
+  // Some members may have been acknowledged earlier. Whole donor absence plus one exact expiry ends this known cohort,
+  // not recipient custody; fresh Thread protection still independently gates deletion.
+  return updateIds.map(updateId => ({ journalBindingKey, updateId, operatorAuthorityId: expired[0]!.operatorAuthorityId }));
+}
+
+/** Package-private v1 capability; raw input custody does not expose it. */
+export interface TelegramRoutingInputJournal {
+  arm(input: TelegramRoutingInputAuthority & { publishedAtMs: number }): TelegramUpdateJournalEntry[];
+  select(input: TelegramRoutingInputAuthority): { issued: boolean; entries: TelegramUpdateJournalEntry[] };
+  expire(input: Omit<TelegramRoutingInputAuthority, "entries"> & { entry: TelegramUpdateJournalEntry }): TelegramRoutingInputExpiryResult;
+  inspectExpiry(updateId: number): TelegramRoutingInputExpiryEvidence | undefined;
+  inspectGroupExpiry(updateIds: readonly number[]): TelegramRoutingInputExpiryEvidence[] | undefined;
+}
+
 export interface TelegramUpdateJournalStore {
+  routingInputs?: TelegramRoutingInputJournal;
   read(): TelegramUpdateJournalSnapshot;
+  /** Read-only: the committed abandonment tombstone plus its matching private retention, or undefined. */
+  inspectAbandonedPending(updateId: number): TelegramUpdateJournalAbandonedPendingEvidence | undefined;
+  /** Read-only protection evidence for this snapshot entry, never commit/execution authority. */
+  inspectPendingRetention(entry: TelegramUpdateJournalEntry): TelegramUpdateJournalPendingRetentionEvidence | undefined;
+  abandonPending(
+    input: TelegramUpdateJournalPendingAbandonmentInput,
+  ): TelegramUpdateJournalPendingAbandonmentResult;
   appendBatch<TUpdate extends TelegramUpdateJournalInput>(
     updates: readonly TUpdate[],
     acceptedThroughUpdateId?: number,
@@ -623,6 +820,11 @@ export interface TelegramUpdateJournalStore {
   completeQueued(
     receipts: readonly TelegramUpdateJournalQueuedCompletion[],
   ): TelegramUpdateJournalRemoveResult;
+  /** Strict v1 whole-receipt disposal co-publishes caller-scoped ACKs; never a readiness grant. */
+  completeQueuedExact(
+    receipts: readonly TelegramUpdateJournalQueuedCompletion[],
+    completions: readonly TelegramUpdateJournalSourceCompletion[],
+  ): TelegramUpdateJournalRemoveResult;
   discardQueued(
     input: TelegramUpdateJournalQueueDiscardInput,
   ): TelegramUpdateJournalQueueDiscardResult;
@@ -632,6 +834,15 @@ export interface TelegramUpdateJournalStore {
   removeCompleted(
     updateIds: readonly number[],
   ): TelegramUpdateJournalRemoveResult;
+  /** Guarded completion; every supplied source must still match, and absence is a conflict, not an ACK. */
+  removeCompletedExact(updateIds: readonly number[], expectedSources: readonly TelegramUpdateJournalEntryDigest[],
+    completions?: readonly TelegramUpdateJournalSourceCompletion[]): TelegramUpdateJournalRemoveResult;
+  /** Strict read-only observation; neither source absence nor a different scope is completion evidence. */
+  inspectSourceCompletion(expected: TelegramUpdateJournalSourceCompletion): TelegramUpdateJournalSourceCompletion | undefined;
+  /** Complete strict observation of a retained, unoffered v1 queue receipt; never acquires readiness. */
+  inspectQueuedReceipt(expected: TelegramUpdateJournalQueuedCompletion): TelegramUpdateJournalQueuedReceiptEvidence | undefined;
+  isQueueReceiptCurrent?: (receipt: Pick<TelegramUpdateJournalQueuedCompletion, "queueKind" | "receiptId" | "sourceUpdateIds"> &
+    { journalBindingKey?: string }, owner: TelegramUpdateJournalQueueOwner) => boolean;
 }
 
 export type TelegramUpdateJournalPublicationBoundary =
@@ -642,7 +853,8 @@ export interface TelegramUpdateJournalRecoveryEvent {
   kind: "repaired" | "reset";
   path: string;
   revision?: number;
-  quarantinePath?: string;
+  /** Damaged snapshot/segment paths deleted or atomically replaced; nothing is retained for recovery. */
+  deletedPaths?: string[];
   reason: string;
 }
 
@@ -831,6 +1043,7 @@ interface JournalSourceAcquisition {
   evidence: ReturnType<typeof inspectTelegramUpdateJournalFamily>;
   snapshotRevision: number;
   segments: { name: string; bytes: number; work: number; botId?: number }[];
+  retainedInputs?: TelegramUpdateJournalRetentionInspection["retainedInputs"];
 }
 
 export interface TelegramUpdateJournalSegment {
@@ -843,6 +1056,7 @@ export interface TelegramUpdateJournalSegment {
   upsertedEntries: TelegramUpdateJournalEntry[];
   removedUpdateIds: number[];
   operatorDispositions?: TelegramUpdateJournalOperatorDisposition[];
+  sourceCompletions?: TelegramUpdateJournalSourceCompletion[];
 }
 
 export interface TelegramUpdateJournalSegmentPublicationResult {
@@ -865,30 +1079,10 @@ function createJournalError(
   );
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-
-function hasOnlyKeys(
-  value: Record<string, unknown>,
-  allowedKeys: readonly string[],
-): boolean {
-  const allowed = new Set(allowedKeys);
-  return Object.keys(value).every((key) => allowed.has(key));
-}
-
-function isSafeNonNegativeInteger(value: unknown): value is number {
-  return Number.isSafeInteger(value) && (value as number) >= 0;
-}
-
 function isSafePositiveInteger(value: unknown): value is number {
   return Number.isSafeInteger(value) && (value as number) > 0;
 }
 
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.length > 0;
-}
-
 function isBoundedString(
   value: unknown,
   maxLength: number,
@@ -1255,8 +1449,16 @@ function validateJournalOperatorDisposition(
 }
 
 function journalRequiresExclusion(version: TelegramUpdateJournalFile["version"]): boolean {
-  return version === TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION ||
-    version === TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION;
+  return version === TELEGRAM_UPDATE_JOURNAL_EXCLUSION_VERSION || journalHasCustodyFields(version);
+}
+
+function journalHasCustodyFields(version: TelegramUpdateJournalFile["version"]): boolean {
+  return version === TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION;
+}
+
+/** Only legacy v1 carries routing-lifetime, scoped-ACK and pairing-free queue-receipt semantics. */
+export function isTelegramUpdateJournalLegacyFamilyVersion(version: unknown): boolean {
+  return version === TELEGRAM_UPDATE_JOURNAL_VERSION;
 }
 
 function validateJournalInputClaim(
@@ -1328,6 +1530,7 @@ function validateJournalEntry(
       "updateId",
       "update",
       "admittedAtMs",
+      ...(isTelegramUpdateJournalLegacyFamilyVersion(version) ? ["routingInput"] : []),
       "state",
       "queueKind",
       "queueReceiptId",
@@ -1339,7 +1542,7 @@ function validateJournalEntry(
       "terminalReason",
       "terminalFailureId",
       ...(journalRequiresExclusion(version) ? ["preApprovalExcluded"] : []),
-      ...(version === TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION
+      ...(journalHasCustodyFields(version)
         ? ["inputClaim", "inputProvenance"] : []),
     ]) ||
     !isSafeNonNegativeInteger(value.updateId) ||
@@ -1359,6 +1562,20 @@ function validateJournalEntry(
       "contains an entry/update id mismatch",
     );
   }
+  let routingInput: TelegramUpdateJournalRoutingInput | undefined;
+  if (value.routingInput !== undefined) {
+    const routing = value.routingInput;
+    if (!isRecord(routing) || !hasOnlyKeys(routing, ["operatorUserId", "publishedAtMs", "expiresAtMs", "phase"]) ||
+        !isSafePositiveInteger(routing.operatorUserId) || !isSafeNonNegativeInteger(routing.publishedAtMs) ||
+        routing.publishedAtMs < value.admittedAtMs || !isSafeNonNegativeInteger(routing.expiresAtMs) ||
+        routing.expiresAtMs !== routing.publishedAtMs + TELEGRAM_ROUTING_INPUT_TTL_MS ||
+        (routing.phase !== "waiting" && routing.phase !== "selected") ||
+        (routing.phase === "waiting" && value.state === "queued")) {
+      throw createJournalError("invalid", path, "contains invalid routing input lifetime");
+    }
+    routingInput = { operatorUserId: routing.operatorUserId, publishedAtMs: routing.publishedAtMs,
+      expiresAtMs: routing.expiresAtMs, phase: routing.phase };
+  }
   const queueKind = value.queueKind;
   const queueReceiptId = value.queueReceiptId;
   const hasQueueMetadata =
@@ -1474,6 +1691,7 @@ function validateJournalEntry(
     ...(inputClaim ? { inputClaim } : {}),
     ...(inputProvenance ? { inputProvenance } : {}),
     admittedAtMs: value.admittedAtMs,
+    ...(routingInput ? { routingInput } : {}),
     state: value.state,
     ...(queueKind === "prompt" || queueKind === "control"
       ? { queueKind }
@@ -1522,6 +1740,32 @@ function assertSupportedJournalVersion(
   }
 }
 
+function validateJournalSourceCompletion(value: unknown, path: string): TelegramUpdateJournalSourceCompletion {
+  if (!isRecord(value) || !hasOnlyKeys(value, ["updateId", "sourceSha256", "completionSha256"]) ||
+      !isSafeNonNegativeInteger(value.updateId) || typeof value.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(value.sourceSha256) ||
+      typeof value.completionSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(value.completionSha256)) {
+    throw createJournalError("invalid", path, "has invalid source completion evidence");
+  }
+  return { updateId: value.updateId, sourceSha256: value.sourceSha256, completionSha256: value.completionSha256 };
+}
+
+function validateJournalSourceCompletions(value: unknown, path: string, version: TelegramUpdateJournalFile["version"],
+  allowEmpty = false): TelegramUpdateJournalSourceCompletion[] {
+  if (!isTelegramUpdateJournalLegacyFamilyVersion(version) || !Array.isArray(value) || !allowEmpty && !value.length) {
+    throw createJournalError("invalid", path, "has invalid source completion collection");
+  }
+  const completions = value.map(item => validateJournalSourceCompletion(item, path));
+  const scopes = new Set<string>();
+  for (let index = 0; index < completions.length; index++) {
+    const completion = completions[index]!;
+    if ((index > 0 && completions[index - 1]!.updateId >= completion.updateId) || scopes.has(completion.completionSha256)) {
+      throw createJournalError("invalid", path, "has duplicate or unordered source completion evidence");
+    }
+    scopes.add(completion.completionSha256);
+  }
+  return completions;
+}
+
 function parseJournalFile(
   value: unknown,
   path: string,
@@ -1542,6 +1786,7 @@ function parseJournalFile(
       "botIdentity",
       "entries",
       "operatorDispositions",
+      "sourceCompletions",
     ]) ||
     !Number.isSafeInteger(value.version) ||
     (value.revision !== undefined &&
@@ -1635,6 +1880,14 @@ function parseJournalFile(
   ).map((disposition) =>
     validateJournalOperatorDisposition(disposition, path),
   );
+  const sourceCompletions = value.sourceCompletions === undefined ? [] : validateJournalSourceCompletions(value.sourceCompletions, path, version);
+  const botIdentity = validateBotIdentity(value.botIdentity, path);
+  const activeIds = new Set(entries.map(entry => entry.updateId));
+  const discardedIds = new Set(operatorDispositions.filter(disposition => disposition.action === "discard").map(disposition => disposition.updateId));
+  if (sourceCompletions.some(completion => activeIds.has(completion.updateId) || discardedIds.has(completion.updateId) ||
+      value.acceptedThroughUpdateId !== undefined && completion.updateId > (value.acceptedThroughUpdateId as number))) {
+    throw createJournalError("invalid", path, "has contradictory source completion evidence");
+  }
   const dispositionFailureIds = new Set<string>();
   const entriesByUpdateId = new Map(
     entries.map((entry) => [entry.updateId, entry]),
@@ -1669,10 +1922,60 @@ function parseJournalFile(
       ? { acceptedThroughUpdateId: value.acceptedThroughUpdateId as number }
       : {}),
     profile: value.profile,
-    botIdentity: validateBotIdentity(value.botIdentity, path),
+    botIdentity,
     entries,
     ...(operatorDispositions.length > 0 ? { operatorDispositions } : {}),
+    ...(sourceCompletions.length > 0 ? { sourceCompletions } : {}),
+  };
+}
+
+function assertJournalRoutingInputContinuity(file: TelegramUpdateJournalFile, entries: readonly TelegramUpdateJournalEntry[], path: string): void {
+  const previous = new Map(file.entries.map(entry => [entry.updateId, entry.routingInput]));
+  for (const entry of entries) {
+    const retained = previous.get(entry.updateId), next = entry.routingInput;
+    if (retained && (!next || next.operatorUserId !== retained.operatorUserId || next.publishedAtMs !== retained.publishedAtMs ||
+        next.expiresAtMs !== retained.expiresAtMs || (retained.phase === "selected" && next.phase !== "selected"))) {
+      throw createJournalError("invalid", path, "regresses retained routing input lifetime");
+    }
+  }
+}
+
+function assertJournalSourceCompletionContinuity(file: TelegramUpdateJournalFile, segment: TelegramUpdateJournalSegment, path: string): void {
+  assertJournalRoutingInputContinuity(file, segment.upsertedEntries, path);
+  if (segment.sourceCompletions === undefined) return;
+  const previous = new Map((file.sourceCompletions ?? []).map(completion => [completion.updateId, completion]));
+  const next = new Map(segment.sourceCompletions.map(completion => [completion.updateId, completion]));
+  if ([...previous].some(([id, completion]) => !isDeepStrictEqual(completion, next.get(id)))) {
+    throw createJournalError("invalid", path, "regresses retained source completion evidence");
+  }
+  const entries = new Map(file.entries.map(entry => [entry.updateId, entry]));
+  const removed = new Set(segment.removedUpdateIds), upserted = new Set(segment.upsertedEntries.map(entry => entry.updateId));
+  const upsertedReceipts = new Set(segment.upsertedEntries.map(entry => entry.queueReceiptId));
+  // Grouped markers share one whole-receipt check rather than rescanning the group per source.
+  const queueGroups = new Map<string, TelegramUpdateJournalEntry[]>(), queueRemovals = new Map<string, boolean>();
+  for (const entry of file.entries) {
+    if (!entry.queueReceiptId) continue;
+    const group = queueGroups.get(entry.queueReceiptId) ?? [];
+    group.push(entry); queueGroups.set(entry.queueReceiptId, group);
+  }
+  const queueWasRemoved = (source: TelegramUpdateJournalEntry): boolean => {
+    const receiptId = source.queueReceiptId;
+    if (!receiptId || !source.queueOwner) return false;
+    if (queueRemovals.has(receiptId)) return queueRemovals.get(receiptId)!;
+    const group = queueGroups.get(receiptId);
+    const valid = !!group?.length && !upsertedReceipts.has(receiptId) && group.every(entry =>
+      removed.has(entry.updateId) && !upserted.has(entry.updateId) && entry.state === "queued" && entry.queueKind === source.queueKind &&
+      entry.queueHandoff === undefined && !!entry.queueOwner && areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, source.queueOwner!));
+    queueRemovals.set(receiptId, valid); return valid;
   };
+  for (const completion of segment.sourceCompletions) {
+    if (previous.has(completion.updateId)) continue;
+    const source = entries.get(completion.updateId);
+    if (!removed.has(completion.updateId) || !source || (source.state === "queued" && !queueWasRemoved(source)) || source.state === "failed" ||
+        createTelegramUpdateJournalEntryDigest(source).sourceSha256 !== completion.sourceSha256) {
+      throw createJournalError("invalid", path, "source completion does not match its removal revision");
+    }
+  }
 }
 
 function parseJournalSegment(
@@ -1697,6 +2000,7 @@ function parseJournalSegment(
       "upsertedEntries",
       "removedUpdateIds",
       "operatorDispositions",
+      "sourceCompletions",
     ]) ||
     value.version !== version ||
     !isSafePositiveInteger(value.revision) ||
@@ -1751,6 +2055,7 @@ function parseJournalSegment(
   ).map((disposition) =>
     validateJournalOperatorDisposition(disposition, path),
   );
+  const segmentBotIdentity = validateBotIdentity(value.botIdentity, path);
   return {
     version,
     revision: value.revision,
@@ -1759,12 +2064,13 @@ function parseJournalSegment(
       ? { acceptedThroughUpdateId: value.acceptedThroughUpdateId as number }
       : {}),
     profile: value.profile,
-    botIdentity: validateBotIdentity(value.botIdentity, path),
+    botIdentity: segmentBotIdentity,
     upsertedEntries,
     removedUpdateIds,
     ...(value.operatorDispositions !== undefined
       ? { operatorDispositions }
       : {}),
+    ...(value.sourceCompletions !== undefined ? { sourceCompletions: validateJournalSourceCompletions(value.sourceCompletions, path, version, true) } : {}),
   };
 }
 
@@ -1807,6 +2113,19 @@ export function inspectTelegramUpdateJournalFamily(input: {
   return acquireTelegramUpdateJournalFamily(input).evidence;
 }
 
+export interface TelegramUpdateJournalRetentionInspection {
+  evidence: ReturnType<typeof inspectTelegramUpdateJournalFamily>;
+  retainedInputs: { path: string; journalBindingKey: string; failureId: string; updateId: number; state: "committed" | "uncommitted" }[];
+}
+
+/** Classifies private originals against exact discard tombstones; never replay or deletion authority. */
+export function inspectTelegramUpdateJournalRetention(
+  input: Parameters<typeof inspectTelegramUpdateJournalFamily>[0],
+): TelegramUpdateJournalRetentionInspection {
+  const acquired = acquireTelegramUpdateJournalFamily(input, undefined, true);
+  return { evidence: acquired.evidence, retainedInputs: acquired.retainedInputs ?? [] };
+}
+
 /**
  * Read-only source evidence for cooperating writers serialized by the caller through
  * consumption; never readiness, recovery, or permission to publish. Ancestors retain
@@ -1821,7 +2140,7 @@ export function readTelegramUpdateJournalSource(
   input: Parameters<typeof inspectTelegramUpdateJournalFamily>[0] & { version: TelegramUpdateJournalFile["version"] },
 ): ReturnType<typeof inspectTelegramUpdateJournalFamily> {
   const version = input.version;
-  if (version !== 1 && version !== 2 && version !== 3) {
+  if (version !== 1 && version !== 2 && version !== 3 && version !== 4) {
     throw createJournalError("unsupported-version", input.path, "requires a selected source version");
   }
   return acquireTelegramUpdateJournalFamily({
@@ -1834,6 +2153,7 @@ export function readTelegramUpdateJournalSource(
 function acquireTelegramUpdateJournalFamily(
   input: Parameters<typeof inspectTelegramUpdateJournalFamily>[0],
   selectedVersion?: TelegramUpdateJournalFile["version"],
+  inspectRetention = false,
 ): JournalSourceAcquisition {
   const { path, limits } = input;
   const acquiredSegments: JournalSourceAcquisition["segments"] = [];
@@ -1878,7 +2198,7 @@ function acquireTelegramUpdateJournalFamily(
   };
   const charge = (value: unknown) => {
     if (!isRecord(value)) return;
-    for (const key of ["entries", "upsertedEntries", "removedUpdateIds", "operatorDispositions"]) {
+    for (const key of ["entries", "upsertedEntries", "removedUpdateIds", "operatorDispositions", "sourceCompletions"]) {
       const collection = value[key];
       if (!Array.isArray(collection)) continue;
       if (collection.length > limits.maxEntries || collection.length > limits.maxWork - work) capacity();
@@ -1910,15 +2230,15 @@ function acquireTelegramUpdateJournalFamily(
     } finally { closeSync(fd); }
   };
   const segmentDirectory = getTelegramUpdateJournalSegmentDirectory(path);
-  const enumerate = (): string[] => {
+  const enumerate = (target = segmentDirectory, pattern = /^\d{16}\.json$/u, usedFiles = files): string[] => {
     const names: string[] = [];
-    const directory = opendirSync(segmentDirectory, { bufferSize: 1 });
+    const directory = opendirSync(target, { bufferSize: 1 });
     try {
       for (;;) {
         const entry = directory.readSync();
         if (!entry) break;
-        if (names.length >= limits.maxFiles - files) capacity();
-        if (!/^\d{16}\.json$/u.test(entry.name) || !entry.isFile() || entry.isSymbolicLink()) fail("has an unexpected segment entry");
+        if (names.length >= limits.maxFiles - usedFiles) capacity();
+        if (!pattern.test(entry.name) || !entry.isFile() || entry.isSymbolicLink()) fail("has an unexpected journal evidence entry");
         names.push(entry.name);
       }
     } finally { directory.closeSync(); }
@@ -1976,6 +2296,7 @@ function acquireTelegramUpdateJournalFamily(
         if (segment.revision !== revision + 1 || segment.previousRevision !== revision) fail("has a newer revision gap");
         if (segment.acceptedThroughUpdateId !== undefined && file.acceptedThroughUpdateId !== undefined &&
             segment.acceptedThroughUpdateId < file.acceptedThroughUpdateId) fail("regresses the admission cursor");
+        assertJournalSourceCompletionContinuity(file, segment, target);
         const entries = new Map(file.entries.map(entry => [entry.updateId, entry]));
         for (const id of segment.removedUpdateIds) entries.delete(id);
         for (const entry of segment.upsertedEntries) {
@@ -1993,15 +2314,63 @@ function acquireTelegramUpdateJournalFamily(
           ...(segment.acceptedThroughUpdateId !== undefined ? { acceptedThroughUpdateId: segment.acceptedThroughUpdateId } : {}),
           entries: [...entries.values()].sort((a, b) => a.updateId - b.updateId),
           operatorDispositions: segment.operatorDispositions ?? file.operatorDispositions,
+          sourceCompletions: segment.sourceCompletions ?? file.sourceCompletions,
         };
         charge(next);
         file = parseJournalFile(next, target, file.version);
       }
     }
+    const retainedInputs: TelegramUpdateJournalRetentionInspection["retainedInputs"] = [];
+    const retentionDirectory = `${path}.retained`;
+    const retention = inspectRetention ? observe(retentionDirectory, true, true) : undefined;
+    const retentionPattern = /^abandon-[a-f0-9]{64}\.json$/u;
+    const retentionNames = retention ? enumerate(retentionDirectory, retentionPattern) : [];
+    if (retentionNames.length > limits.maxEntries) capacity();
+    if (retention) {
+      if (!file || file.version !== 1) fail("private retention requires its exact v1 journal snapshot");
+      const current = file!;
+      const bindingKeys = new Set([expected, current.botIdentity].map(botIdentity =>
+        createTelegramUpdateJournalBindingKey({ path, profileName: input.profile, botIdentity })));
+      const updateIds = new Set<number>();
+      for (const name of retentionNames) {
+        const target = join(retentionDirectory, name);
+        const before = observe(target, false)!;
+        if (before.nlink !== 1n) fail("has linked private retention evidence");
+        const raw = read(target, before);
+        files += 1;
+        if (limits.maxWork - work < 2) capacity();
+        work += 2;
+        if (!isRecord(raw)) throw createJournalError("invalid", target, "private retention is not an evidence record");
+        if (typeof raw.journalBindingKey !== "string" || !bindingKeys.has(raw.journalBindingKey))
+          throw createJournalError("invalid", target, "has foreign private retention evidence");
+        const entry = validateJournalEntry(raw.entry, target, 1);
+        const disposition = validateJournalOperatorDisposition(raw.requestedDisposition, target);
+        const digest = createHash("sha256").update(JSON.stringify({ journalBindingKey: raw.journalBindingKey, entry })).digest("hex");
+        if (!("dispositionKind" in disposition) || disposition.dispositionKind !== "legacy-custody" ||
+            disposition.action !== "discard" || entry.state !== "pending" || disposition.updateId !== entry.updateId ||
+            disposition.evidenceSha256 !== digest || disposition.failureId !== `abandon-${digest}` ||
+            name !== `${disposition.failureId}.json` || !isDeepStrictEqual(raw, { version: 1, kind: "pending-input-retention",
+              journalBindingKey: raw.journalBindingKey, entry, requestedDisposition: disposition })) fail("has inconsistent private retention evidence");
+        if (updateIds.has(entry.updateId)) fail("has duplicate private retention sources");
+        updateIds.add(entry.updateId);
+        const committed = current.operatorDispositions?.find(value => value.failureId === disposition.failureId || value.updateId === entry.updateId);
+        if (committed && (!isDeepStrictEqual(committed, disposition) || current.entries.some(value => value.updateId === entry.updateId)))
+          fail("private retention contradicts its journal disposition");
+        retainedInputs.push({ path: target, journalBindingKey: raw.journalBindingKey,
+          failureId: disposition.failureId, updateId: entry.updateId, state: committed ? "committed" : "uncommitted" });
+      }
+    }
+    if (inspectRetention && file?.operatorDispositions?.some(disposition =>
+      "dispositionKind" in disposition && disposition.dispositionKind === "legacy-custody" &&
+      disposition.action === "discard" && /^abandon-[a-f0-9]{64}$/u.test(disposition.failureId) &&
+      !retainedInputs.some(original => original.updateId === disposition.updateId && original.state === "committed")))
+      fail("committed abandonment lost its private original");
     // Re-enumeration has the same bound, rather than allocating an unbounded census.
     files = snapshot ? 1 : 0;
     if (segments && !isDeepStrictEqual(names, enumerate())) fail("changed segment namespace");
     files += names.length;
+    if (retention && !isDeepStrictEqual(retentionNames, enumerate(retentionDirectory, retentionPattern))) fail("changed private retention namespace");
+    files += retentionNames.length;
     for (const [target, before] of observed) {
       const after = status(target);
       const compare = selectedVersion !== undefined && ancestors.has(target) ? sameAncestor : same;
@@ -2023,6 +2392,7 @@ function acquireTelegramUpdateJournalFamily(
       evidence: file ? { kind: "present", file, ...(knownBotId !== undefined ? { knownBotId } : {}), accounting: { files, bytes, work } } : { kind: "absent" },
       snapshotRevision,
       segments: acquiredSegments,
+      ...(inspectRetention ? { retainedInputs } : {}),
     };
   } catch (error) {
     if (error instanceof TelegramUpdateJournalError) throw error;
@@ -2036,16 +2406,35 @@ function acquireTelegramUpdateJournalFamily(
  * Recensus detects observable changes, not hostile same-user path swaps; arbitrary
  * consumer references and archive consumption require separate audits.
  */
-export function inspectTelegramProfileJournalNamespace(input: {
+export interface TelegramJournalNamespaceInspectionInput {
   directory: string;
   profile: string;
   botIdentity: TelegramUpdateJournalBotIdentity;
   limits: { maxDirectoryEntries: number; maxFiles: number; maxBytes: number; maxEntries: number; maxWork: number };
-}): {
-  sources: { role: "polling" | "follower"; path: string; evidence: ReturnType<typeof inspectTelegramUpdateJournalFamily> }[];
+  /** Leader polling journal named by owners.json; defaults to the flat root `inbox`. */
+  pollingPath?: string;
+  /** Hold a participating consumer reference during each physical family read. */
+  withSourceReference?: <T>(path: string, operation: () => T) => T;
+}
+
+export interface TelegramJournalNamespaceInspection {
+  /** Original preservation facts only, never replay/deletion grants. */
+  retainedInputs?: (TelegramUpdateJournalRetentionInspection["retainedInputs"][number] & { journalPath: string })[];
+  sources: { role: "polling" | "follower" | "session"; path: string; evidence: ReturnType<typeof inspectTelegramUpdateJournalFamily> }[];
   accounting: { directoryEntries: number; files: number; bytes: number; work: number };
   knownBotId?: number;
-} {
+}
+
+export function inspectTelegramProfileJournalNamespace(input: TelegramJournalNamespaceInspectionInput): TelegramJournalNamespaceInspection {
+  return inspectTelegramJournalNamespace(input, false);
+}
+
+/** Read-only evidence over polling, retained flat recipients and role-neutral session journals. */
+export function inspectTelegramSessionJournalNamespace(input: TelegramJournalNamespaceInspectionInput): TelegramJournalNamespaceInspection {
+  return inspectTelegramJournalNamespace(input, true);
+}
+
+function inspectTelegramJournalNamespace(input: TelegramJournalNamespaceInspectionInput, includeSessions: boolean): TelegramJournalNamespaceInspection {
   const { directory, profile, limits } = input;
   const fail = (message: string): never => { throw createJournalError("invalid", directory, message); };
   const capacity = (): never => { throw createJournalError("capacity", directory, "exceeds namespace inspection resource limits"); };
@@ -2062,46 +2451,99 @@ export function inspectTelegramProfileJournalNamespace(input: {
       size: value.size, mtimeNs: value.mtimeNs, ctimeNs: value.ctimeNs };
   };
   const suffix = profile === "default" ? "" : `.${profile}`;
-  const polling = `inbox${suffix}.json`;
+  const pollingPath = input.pollingPath ?? join(directory, `inbox${suffix}.json`);
+  const polling = relative(directory, pollingPath);
+  {
+    const parts = polling.split(sep);
+    if (!isAbsolute(pollingPath) || resolve(pollingPath) !== pollingPath || parts.at(-1) !== `inbox${suffix}.json` ||
+        !(parts.length === 1 || (parts.length === 3 && parts[0] === "sessions" &&
+          decodeTelegramSessionDirectoryName(parts[1]!) !== undefined))) fail("requires a canonical polling journal path");
+  }
   try {
     const root = lstatSync(directory);
     if (!root.isDirectory() || root.isSymbolicLink() || realpathSync(directory) !== directory) fail("requires a canonical directory anchor");
     const beforeRoot = metadata(directory);
     const census = () => {
       const entries = new Map<string, ReturnType<typeof metadata>>();
-      const followers = new Set<string>();
-      const handle = opendirSync(directory, { bufferSize: 1 });
-      try {
-        for (;;) {
-          const entry = handle.readSync();
-          if (!entry) break;
-          if (entries.size >= limits.maxDirectoryEntries) capacity();
-          if (entry.name.toLowerCase() === "recovery") fail("retains unclassified recovery storage");
-          const target = join(directory, entry.name);
-          entries.set(entry.name, metadata(target));
-          if (!/inbox/iu.test(entry.name)) continue;
-          const match = /^(inbox|follower-inbox-[a-f0-9]{16})(?:\.([a-z0-9]{1,32}))?\.json(\.segments)?$/u.exec(entry.name);
-          if (!match || match[2] === "default") fail("has a noncanonical journal-like entry");
-          const value = lstatSync(target);
-          if (value.isSymbolicLink() || !(match![3] ? value.isDirectory() : value.isFile())) fail("has a linked or unexpected journal type");
-          if ((match![2] ?? "default") !== profile) continue;
-          if (match![1] !== "inbox") followers.add(entry.name.replace(/\.segments$/u, ""));
+      const families = new Map<string, "follower" | "session">(), profiles = new Set<string>();
+      const scan = (parent: string, visit: (name: string, target: string) => void): void => {
+        const handle = opendirSync(parent, { bufferSize: 1 });
+        try {
+          for (;;) {
+            const entry = handle.readSync();
+            if (!entry) break;
+            if (entries.size >= limits.maxDirectoryEntries) capacity();
+            const target = join(parent, entry.name);
+            const key = relative(directory, target);
+            if (entries.has(key)) fail("repeated an observed namespace entry");
+            entries.set(key, metadata(target));
+            visit(entry.name, target);
+          }
+        } finally { handle.closeSync(); }
+      };
+      const requireType = (target: string, isDirectory: boolean): void => {
+        const value = lstatSync(target);
+        if (value.isSymbolicLink() || !(isDirectory ? value.isDirectory() : value.isFile()) ||
+            (!isDirectory && value.nlink !== 1)) fail("has a linked or unexpected journal type");
+      };
+      const evidenceDirectory = (target: string, retained: boolean): void => scan(target, (name, path) => {
+        if (!(retained ? /^abandon-[a-f0-9]{64}\.json$/u : /^\d{16}\.json$/u).test(name)) fail("has an unclassified journal evidence entry");
+        requireType(path, false);
+      });
+      const session = (target: string): void => scan(target, (name, path) => {
+        if (name === "recovery") return;
+        const match = /^(?:journal\.[a-f0-9]{16}|inbox)(?:\.([a-z0-9]{1,32}))?\.json(\.(?:segments|retained))?$/u.exec(name);
+        if (!match || match[1] === "default") fail("has an unclassified session journal entry");
+        requireType(path, !!match![2]);
+        if (match![2]) evidenceDirectory(path, match![2] === ".retained");
+        const base = path.replace(/\.(?:segments|retained)$/u, ""), familyProfile = match![1] ?? "default";
+        profiles.add(familyProfile);
+        if (familyProfile === profile && base !== pollingPath) families.set(base, "session");
+      });
+      scan(directory, (name, target) => {
+        // Legacy quarantine folders are disposable housekeeping, never journal authority.
+        if (name.toLowerCase() === "recovery") return;
+        if (name.toLowerCase() === "sessions") {
+          if (!includeSessions) fail("requires session-qualified namespace inspection");
+          if (name !== "sessions") fail("has a noncanonical session root");
+          requireType(target, true);
+          scan(target, (sessionName, sessionPath) => {
+            if (decodeTelegramSessionDirectoryName(sessionName) === undefined) fail("has a noncanonical session directory");
+            requireType(sessionPath, true);
+            session(sessionPath);
+          });
+          return;
         }
-      } finally { handle.closeSync(); }
-      return { entries: [...entries].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0), followers: [...followers].sort() };
+        if (includeSessions && /^journal\./iu.test(name)) fail("has a misplaced session journal");
+        if (!/inbox/iu.test(name)) return;
+        const match = /^(inbox|follower-inbox-[a-f0-9]{16})(?:\.([a-z0-9]{1,32}))?\.json(\.(?:segments|retained))?$/u.exec(name);
+        if (!match || match[2] === "default" || (!includeSessions && match[3] === ".retained")) fail("has a noncanonical journal-like entry");
+        requireType(target, !!match![3]);
+        if (includeSessions && match![3]) evidenceDirectory(target, match![3] === ".retained");
+        const base = target.replace(/\.(?:segments|retained)$/u, ""), familyProfile = match![2] ?? "default";
+        profiles.add(familyProfile);
+        if (familyProfile === profile && base !== pollingPath)
+          families.set(base, match![1] === "inbox" ? "session" : "follower");
+      });
+      return { entries: [...entries].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0),
+        families: [...families].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0), profiles: [...profiles].sort() };
     };
     const before = census();
-    const sources: { role: "polling" | "follower"; path: string; evidence: ReturnType<typeof inspectTelegramUpdateJournalFamily> }[] = [];
+    const sourceInventory = [[pollingPath, "polling"], ...before.families] as const;
+    const sources: TelegramJournalNamespaceInspection["sources"] = [];
+    const retainedInputs: NonNullable<TelegramJournalNamespaceInspection["retainedInputs"]> = [];
     const accounting = { directoryEntries: before.entries.length, files: 0, bytes: 0, work: 0 };
     let knownBotId = expected.botId;
-    for (const name of [polling, ...before.followers]) {
+    for (const [path, role] of sourceInventory) {
       const remaining = { maxFiles: limits.maxFiles - accounting.files, maxBytes: limits.maxBytes - accounting.bytes,
         maxWork: limits.maxWork - accounting.work, maxEntries: limits.maxEntries };
       if (remaining.maxFiles <= 0 || remaining.maxBytes <= 0 || remaining.maxWork <= 0) capacity();
-      const path = join(directory, name);
-      const evidence = inspectTelegramUpdateJournalFamily({ directory, path, profile,
-        botIdentity: { ...expected, ...(knownBotId !== undefined ? { botId: knownBotId } : {}) }, limits: remaining });
-      if (evidence.kind === "absent" && (name !== polling || before.entries.some(([entry]) => entry === polling || entry === `${polling}.segments`))) {
+      const acquire = () => acquireTelegramUpdateJournalFamily({ directory, path, profile,
+        botIdentity: { ...expected, ...(knownBotId !== undefined ? { botId: knownBotId } : {}) }, limits: remaining }, undefined, includeSessions);
+      const acquired = input.withSourceReference ? input.withSourceReference(path, acquire) : acquire();
+      const evidence = acquired.evidence;
+      retainedInputs.push(...(acquired.retainedInputs ?? []).map(original => ({ ...original, journalPath: path })));
+      if (evidence.kind === "absent" && (role !== "polling" || before.entries.some(([entry]) => entry === polling || entry === `${polling}.segments`))) {
         fail("lost a discovered journal family");
       }
       if (evidence.kind === "present") {
@@ -2110,16 +2552,46 @@ export function inspectTelegramProfileJournalNamespace(input: {
         accounting.bytes += evidence.accounting.bytes;
       }
       accounting.work += evidence.kind === "present" ? Math.max(1, evidence.accounting.work) : 1;
-      sources.push({ role: name === polling ? "polling" : "follower", path, evidence });
+      sources.push({ role, path, evidence });
     }
-    if (!isDeepStrictEqual(before, census()) || !isDeepStrictEqual(beforeRoot, metadata(directory))) fail("changed observed root namespace or identity");
-    return { sources, accounting, ...(knownBotId !== undefined ? { knownBotId } : {}) };
+    const namespaceCurrent = (): boolean => {
+      try { return isDeepStrictEqual(beforeRoot, metadata(directory)) && isDeepStrictEqual(before, census()) &&
+        isDeepStrictEqual(beforeRoot, metadata(directory)); }
+      catch { return false; }
+    };
+    if (!namespaceCurrent()) fail("changed observed root namespace or identity");
+    return { sources, accounting, ...(includeSessions ? { retainedInputs } : {}), ...(knownBotId !== undefined ? { knownBotId } : {}) };
   } catch (error) {
     if (error instanceof TelegramUpdateJournalError) throw error;
     throw createJournalError("io", directory, "could not establish canonical namespace evidence", error);
   }
 }
 
+/** Complete-empty protection only; caller holds source serialization through consumption. Never deletion authority. */
+export function isTelegramThreadCleanupJournalNamespaceClear(input: TelegramJournalNamespaceInspectionInput & {
+  requiredJournalBindingKeys: readonly string[];
+  withSourceReference: NonNullable<TelegramJournalNamespaceInspectionInput["withSourceReference"]>;
+}): boolean {
+  if (!input.requiredJournalBindingKeys.length || input.requiredJournalBindingKeys.length > input.limits.maxDirectoryEntries)
+    throw new Error("Telegram temporary cleanup requires bounded exact journal references.");
+  const requiredPaths = new Set<string>();
+  for (const key of input.requiredJournalBindingKeys) {
+    const path = getTelegramUpdateJournalBindingPath(key);
+    const identities = [input.botIdentity, { tokenSha256: input.botIdentity.tokenSha256 }];
+    if (!path || !identities.some(botIdentity => key === createTelegramUpdateJournalBindingKey({
+      path, profileName: input.profile, botIdentity,
+    }))) throw new Error("Telegram temporary cleanup has foreign or malformed journal references.");
+    requiredPaths.add(path);
+  }
+  const namespace = inspectTelegramSessionJournalNamespace(input);
+  if (namespace.sources.filter(source => source.role === "polling").length !== 1 ||
+      namespace.retainedInputs?.some(original => original.state !== "committed") ||
+      [...requiredPaths].some(path => !namespace.sources.some(source => source.path === path && source.evidence.kind === "present")))
+    return false;
+  // Original Telegram targets do not certify execution ownership. No nonempty family gets a source exemption.
+  return namespace.sources.every(source => source.evidence.kind === "absent" || source.evidence.file.entries.length === 0);
+}
+
 function cloneEntry(entry: TelegramUpdateJournalEntry): TelegramUpdateJournalEntry {
   return {
     ...entry,
@@ -2134,6 +2606,7 @@ function cloneEntry(entry: TelegramUpdateJournalEntry): TelegramUpdateJournalEnt
       ? { queueHandoff: cloneJournalQueueHandoff(entry.queueHandoff) }
       : {}),
     ...(entry.failure ? { failure: { ...entry.failure } } : {}),
+    ...(entry.routingInput ? { routingInput: { ...entry.routingInput } } : {}),
   };
 }
 
@@ -2147,6 +2620,7 @@ function cloneFile(file: TelegramUpdateJournalFile): TelegramUpdateJournalFile {
     profile: file.profile,
     botIdentity: { ...file.botIdentity },
     entries: file.entries.map(cloneEntry),
+    ...(file.sourceCompletions?.length ? { sourceCompletions: file.sourceCompletions.map(completion => ({ ...completion })) } : {}),
     ...(file.operatorDispositions?.length
       ? {
           operatorDispositions: file.operatorDispositions.map(
@@ -2288,6 +2762,46 @@ function mergeBotIdentity(
   };
 }
 
+function createPendingRetentionReference(input: {
+  path: string;
+  journalBindingKey: string;
+  entry: TelegramUpdateJournalEntry;
+  maxBytes: number;
+}) {
+  const { path, journalBindingKey, entry, maxBytes } = input;
+  const evidenceSha256 = createHash("sha256").update(JSON.stringify({ journalBindingKey, entry })).digest("hex");
+  const failureId = `abandon-${evidenceSha256}`;
+  const retainedDirectory = `${path}.retained`;
+  const retainedPath = join(retainedDirectory, `${failureId}.json`);
+  const read = (): TelegramUpdateJournalRetainedInput | undefined => {
+    let directory;
+    try { directory = lstatSync(retainedDirectory); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; throw error; }
+    if (!directory.isDirectory() || directory.isSymbolicLink()) {
+      throw createJournalError("invalid", retainedDirectory, "retention directory is not a regular directory");
+    }
+    let stat;
+    try { stat = lstatSync(retainedPath); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined; throw error; }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes + 4096) {
+      throw createJournalError("invalid", retainedPath, "retained input is not a bounded regular file");
+    }
+    const retained: unknown = JSON.parse(readFileSync(retainedPath, "utf8"));
+    if (!isRecord(retained)) throw createJournalError("invalid", retainedPath, "retained input is not an evidence record");
+    const disposition = validateJournalOperatorDisposition(retained.requestedDisposition, retainedPath);
+    if (!("dispositionKind" in disposition) || disposition.dispositionKind !== "legacy-custody" ||
+        disposition.failureId !== failureId || disposition.updateId !== entry.updateId ||
+        disposition.action !== "discard" || disposition.evidenceSha256 !== evidenceSha256 ||
+        !isDeepStrictEqual(retained, { version: 1, kind: "pending-input-retention", journalBindingKey,
+          entry, requestedDisposition: disposition })) {
+      throw createJournalError("conflict", retainedPath, "retained input does not match abandonment evidence");
+    }
+    return { version: 1, kind: "pending-input-retention", journalBindingKey, entry,
+      requestedDisposition: disposition };
+  };
+  return { evidenceSha256, failureId, retainedPath, read };
+}
+
 function writeJournalFile(
   path: string,
   serialized: string,
@@ -2428,7 +2942,7 @@ export interface TelegramUpdateJournalRuntimeBinding {
   runtimeKey: string;
   recoveryKey: string;
   journal: TelegramUpdateJournalStore;
-  readForProtection?: () => { entries: readonly TelegramUpdateJournalEntry[] };
+  readForProtection?: () => { entries: readonly TelegramUpdateJournalEntry[]; exists: boolean };
 }
 
 export interface TelegramUpdateJournalRuntimeBindingResolverDeps {
@@ -2438,11 +2952,14 @@ export interface TelegramUpdateJournalRuntimeBindingResolverDeps {
   getJournalPath: (profileName?: string) => string;
   getQueueRuntimeIdentity?: () => TelegramUpdateJournalQueueRuntimeIdentity;
   withWriterAdmission?: <T>(operation: () => T) => T;
+  withSourceSerialization?: TelegramUpdateJournalStoreOptions["withSourceSerialization"];
   getWorkspaceAdmission?: () => Pick<
     TelegramWorkspaceAdmissionLedger,
     "acquireAdmission" | "releaseAdmission"
   > | undefined;
   onRecovery?: (event: TelegramUpdateJournalRecoveryEvent) => void;
+  /** Strict no-follow source handles; defaults to platform support (absent on Windows). */
+  strictSourceAccess?: boolean;
 }
 
 export function createTelegramUpdateJournalRuntimeBindingResolver(
@@ -2460,6 +2977,26 @@ export function createTelegramUpdateJournalRuntimeBindingResolver(
     });
     const path = deps.getJournalPath(configuredProfileName);
     const workspaceAdmission = deps.getWorkspaceAdmission?.();
+    const sourceAccess = { directory: dirname(path), limits: {
+      maxFiles: 1024, maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
+      maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES, maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024,
+    } };
+    const options: TelegramUpdateJournalStoreOptions = { path, profileName, botIdentity,
+      ...(deps.getQueueRuntimeIdentity ? { queueRuntimeIdentity: deps.getQueueRuntimeIdentity() } : {}),
+      ...(workspaceAdmission ? { workspaceAdmission } : {}),
+      ...(deps.withWriterAdmission ? { withWriterAdmission: deps.withWriterAdmission } : {}),
+      ...(deps.withSourceSerialization ? { withSourceSerialization: deps.withSourceSerialization } : {}),
+      ...(deps.onRecovery ? { onRecovery: deps.onRecovery } : {}) };
+    const journal = createTelegramUpdateJournalStore(options);
+    // Scoped completion and receipt observation use strict private handles where the platform provides no-follow
+    // evidence; elsewhere (Windows) the same capabilities read through the ordinary journal so queue receipts still work.
+    const strict = deps.strictSourceAccess ?? Boolean(constants.O_NOFOLLOW && constants.O_NONBLOCK);
+    const completionJournal = deps.withSourceSerialization
+      ? createTelegramUpdateJournalStore({ ...options, ...(strict ? { sourceAccess } : {}) }) : undefined;
+    // Queue receipt readiness gates every ordinary prompt; without strict handles it uses the ordinary journal read.
+    const observeQueuedReceipt = (expected: TelegramUpdateJournalQueuedCompletion) => strict
+      ? completionJournal!.inspectQueuedReceipt(expected)
+      : inspectJournalQueuedReceipt(journal.read(), { ...expected, queueOwner: validateQueuedReceiptObservation(expected, path) }, path);
     return {
       runtimeKey: JSON.stringify({
         path,
@@ -2474,27 +3011,24 @@ export function createTelegramUpdateJournalRuntimeBindingResolver(
       readForProtection() {
         // Protection must never turn corruption/recovery into empty-work evidence.
         const evidence = inspectTelegramUpdateJournalFamily({
-          directory: dirname(path), path, profile: profileName, botIdentity,
-          limits: {
-            maxFiles: 1024,
-            maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
-            maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES,
-            maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024,
-          },
+          ...sourceAccess, path, profile: profileName, botIdentity,
         });
-        return { entries: evidence.kind === "present" ? evidence.file.entries : [] };
+        return { entries: evidence.kind === "present" ? evidence.file.entries : [], exists: evidence.kind === "present" };
       },
-      journal: createTelegramUpdateJournalStore({
-        path,
-        profileName,
-        botIdentity,
-        ...(deps.getQueueRuntimeIdentity
-          ? { queueRuntimeIdentity: deps.getQueueRuntimeIdentity() }
-          : {}),
-        ...(workspaceAdmission ? { workspaceAdmission } : {}),
-        ...(deps.withWriterAdmission ? { withWriterAdmission: deps.withWriterAdmission } : {}),
-        ...(deps.onRecovery ? { onRecovery: deps.onRecovery } : {}),
-      }),
+      journal: completionJournal ? { ...journal,
+        removeCompletedExact(updateIds, expectedSources, completions) {
+          return completions !== undefined ? completionJournal.removeCompletedExact(updateIds, expectedSources, completions)
+            : journal.removeCompletedExact(updateIds, expectedSources);
+        },
+        completeQueuedExact(receipts, completions) { return completionJournal.completeQueuedExact(receipts, completions); },
+        inspectSourceCompletion(expected) { return completionJournal.inspectSourceCompletion(expected); },
+        inspectQueuedReceipt: observeQueuedReceipt,
+        isQueueReceiptCurrent(receipt, owner) {
+          if (receipt.journalBindingKey !== createTelegramUpdateJournalBindingKey({ path, profileName, botIdentity })) return false;
+          return observeQueuedReceipt({ queueKind: receipt.queueKind, receiptId: receipt.receiptId,
+            sourceUpdateIds: [...receipt.sourceUpdateIds], queueOwner: { ...owner } }) !== undefined;
+        },
+      } : journal,
     };
   };
 }
@@ -2560,13 +3094,83 @@ export function withTelegramResolvedUpdateJournalReference<T>(input: {
     recoveryKey: binding.recoveryKey }, () => input.operation(binding));
 }
 
+function validateQueuedReceiptObservation(expected: TelegramUpdateJournalQueuedCompletion, path: string): TelegramUpdateJournalQueueOwner {
+  if (!isRecord(expected) || !hasOnlyKeys(expected, ["queueKind", "receiptId", "sourceUpdateIds", "queueOwner"]) || (expected.queueKind !== "prompt" && expected.queueKind !== "control") ||
+      !isNonEmptyString(expected.receiptId) ||
+      !Array.isArray(expected.sourceUpdateIds) || expected.sourceUpdateIds.length === 0 ||
+      expected.sourceUpdateIds.length > TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES ||
+      expected.sourceUpdateIds.some((id, index) => !isSafeNonNegativeInteger(id) || (index > 0 && id <= expected.sourceUpdateIds[index - 1]!))) {
+    throw createJournalError("invalid", path, "received invalid queue receipt observation authority");
+  }
+  return validateJournalQueueOwner(expected.queueOwner, path);
+}
+
+function inspectJournalQueuedReceipt(file: TelegramUpdateJournalFile, expected: TelegramUpdateJournalQueuedCompletion,
+  path: string): TelegramUpdateJournalQueuedReceiptEvidence | undefined {
+  if (!isTelegramUpdateJournalLegacyFamilyVersion(file.version)) throw createJournalError("invalid", path, "queue receipt observation requires an exact legacy v1 source handle");
+  const { queueOwner } = expected;
+  const entries = file.entries.filter(entry => entry.queueReceiptId === expected.receiptId);
+  if (entries.length !== expected.sourceUpdateIds.length || entries.some((entry, index) =>
+    entry.updateId !== expected.sourceUpdateIds[index] || entry.state !== "queued" || entry.queueKind !== expected.queueKind ||
+    entry.queueHandoff !== undefined || !isDeepStrictEqual(entry.queueOwner, queueOwner))) return undefined;
+  return { receipt: { queueKind: expected.queueKind, receiptId: expected.receiptId,
+    sourceUpdateIds: [...expected.sourceUpdateIds], queueOwner: { ...queueOwner } },
+    sources: entries.map(createTelegramUpdateJournalEntryDigest),
+    queueOwnerSha256: createHash("sha256").update(JSON.stringify(queueOwner)).digest("hex") };
+}
+
+function inspectJournalSourceCompletion(file: TelegramUpdateJournalFile, completion: TelegramUpdateJournalSourceCompletion,
+  path: string): TelegramUpdateJournalSourceCompletion | undefined {
+  if (!isTelegramUpdateJournalLegacyFamilyVersion(file.version)) throw createJournalError("invalid", path, "source completion requires a legacy v1 source");
+  const retained = file.sourceCompletions?.find(value => value.updateId === completion.updateId);
+  if (!retained) return undefined;
+  if (!isDeepStrictEqual(retained, completion)) throw createJournalError("conflict", path, "source completion belongs to another exact scope");
+  return { ...retained };
+}
+
+/** Operator-distinct authority: routing never treats it as an owner cancellation. */
+export const TELEGRAM_SESSION_ADOPTION_AUTHORITY_PREFIX = "session-successor:";
+
+export interface TelegramSessionPendingAdoptionInput {
+  recipientBindingKey: string;
+  predecessorSessionId: string;
+  successorSessionId: string;
+  /** Caller proves the successor registration is current and no predecessor worker runs. */
+  isCurrent: () => boolean;
+}
+
+export interface TelegramSessionPendingAdoptionResult {
+  adoptedUpdateIds: number[];
+  /** Already committed away by an earlier attempt; never re-appended, the private original remains. */
+  retainedUpdateIds: number[];
+}
+
+function isAdoptablePendingEntry(entry: TelegramUpdateJournalEntry): boolean {
+  return entry.state === "pending" && !entry.inputClaim && !entry.inputProvenance && !entry.routingInput &&
+    !entry.queueOwner && !entry.queueHandoff && !entry.queueReceiptId && !entry.queueKind && !entry.failure &&
+    entry.preApprovalExcluded !== true;
+}
+
 export interface TelegramUpdateJournalBindingRuntime {
   resolveLeader: () => TelegramUpdateJournalRuntimeBinding | undefined;
   resolveFollower: () => TelegramUpdateJournalRuntimeBinding | undefined;
   resolveActive: () => TelegramUpdateJournalRuntimeBinding | undefined;
   getActiveRecoveryKey: () => string | undefined;
+  /** Exact historical proof lookup; no store, admission, execution, recovery or mutation port. */
+  inspectSourceAbandonment: (journalBindingKey: string, updateId: number) => TelegramUpdateJournalAbandonedPendingEvidence | undefined;
+  inspectSourceGroupExpiry: (journalBindingKey: string, updateIds: readonly number[]) => TelegramRoutingInputExpiryEvidence[] | undefined;
+  inspectSourceCompletion: (journalBindingKey: string, expected: TelegramUpdateJournalSourceCompletion) => TelegramUpdateJournalSourceCompletion | undefined;
+  inspectQueuedReceipt: (journalBindingKey: string, expected: TelegramUpdateJournalQueuedCompletion) => TelegramUpdateJournalQueuedReceiptEvidence | undefined;
+  /** In-process `/new` succession: move unclaimed predecessor pending inputs into the successor session journal. */
+  adoptPredecessorPending: (input: TelegramSessionPendingAdoptionInput) => TelegramSessionPendingAdoptionResult;
+  /** Process-local: adopts from the previously prepared session of the same recipient key, then records the active one. */
+  prepareActiveFollowerSuccession: (isCurrent: () => boolean) => TelegramSessionPendingAdoptionResult | undefined;
   createRecipientResolver: (
     recipientBindingKey: string,
+    sessionId?: string,
+  ) => () => TelegramUpdateJournalRuntimeBinding | undefined;
+  createLegacyRecipientResolver: (
+    recipientBindingKey: string,
   ) => () => TelegramUpdateJournalRuntimeBinding | undefined;
   createPathResolver: (
     path: string,
@@ -2576,11 +3180,15 @@ export interface TelegramUpdateJournalBindingRuntime {
 export function createTelegramUpdateJournalBindingRuntime(deps: {
   base: Omit<TelegramUpdateJournalRuntimeBindingResolverDeps, "getJournalPath">;
   getLeaderJournalPath: (profileName?: string) => string;
+  /** Runtime root; defaults to the leader journal's directory for flat layouts. */
+  getRuntimeDir?: () => string;
   getFollowerJournalPath: (
     bindingKey: string,
     profileName?: string,
+    sessionId?: string,
   ) => string;
   getActiveFollowerBindingKey: () => string;
+  getActiveFollowerSessionId?: () => string | undefined;
   isFollowerRegistered: () => boolean;
 }): TelegramUpdateJournalBindingRuntime {
   const resolveLeader = createTelegramUpdateJournalRuntimeBindingResolver({
@@ -2590,8 +3198,12 @@ export function createTelegramUpdateJournalBindingRuntime(deps: {
   const createFollowerResolver = (
     bindingKey: string,
     includeQueueRuntimeIdentity: boolean,
-  ) =>
-    createTelegramUpdateJournalRuntimeBindingResolver({
+    sessionId?: string,
+    legacy = false,
+  ) => {
+    // Session-aware composition must not fall back to a process journal before preparation supplies its ID.
+    if (!legacy && deps.getActiveFollowerSessionId && !sessionId) return () => undefined;
+    return createTelegramUpdateJournalRuntimeBindingResolver({
       getProfileName: deps.base.getProfileName,
       getBotToken: deps.base.getBotToken,
       getBotId: deps.base.getBotId,
@@ -2600,25 +3212,132 @@ export function createTelegramUpdateJournalBindingRuntime(deps: {
         : {}),
       ...(deps.base.withWriterAdmission
         ? { withWriterAdmission: deps.base.withWriterAdmission } : {}),
+      // Follower journals need the same strict exact-receipt ports as the leader; without them queue publication cannot complete.
+      ...(deps.base.withSourceSerialization
+        ? { withSourceSerialization: deps.base.withSourceSerialization } : {}),
       ...(deps.base.getWorkspaceAdmission
         ? { getWorkspaceAdmission: deps.base.getWorkspaceAdmission }
         : {}),
       ...(deps.base.onRecovery ? { onRecovery: deps.base.onRecovery } : {}),
       getJournalPath(profileName) {
-        return deps.getFollowerJournalPath(bindingKey, profileName);
+        return deps.getFollowerJournalPath(bindingKey, profileName, sessionId);
       },
     });
+  };
   const resolveFollower = () =>
-    createFollowerResolver(deps.getActiveFollowerBindingKey(), true)();
+    createFollowerResolver(deps.getActiveFollowerBindingKey(), true, deps.getActiveFollowerSessionId?.())();
   const resolveActive = () =>
     deps.isFollowerRegistered() ? resolveFollower() : resolveLeader();
-  return {
+  const inspectHistoricalSource = <T>(journalBindingKey: string,
+    operation: (file: TelegramUpdateJournalFile, originals: TelegramUpdateJournalRetentionInspection["retainedInputs"], path: string) => T | undefined): T | undefined => {
+    const path = getTelegramUpdateJournalBindingPath(journalBindingKey);
+    const token = deps.base.getBotToken(), botId = deps.base.getBotId();
+    const profile = deps.base.getProfileName() ?? TELEGRAM_DEFAULT_PROFILE_NAME;
+    if (!path || !token) return undefined;
+    const botIdentity = createTelegramUpdateJournalBotIdentity({ botToken: token, botId });
+    const keys = [botIdentity, { tokenSha256: botIdentity.tokenSha256 }].map(identity =>
+      createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: identity }));
+    if (!keys.includes(journalBindingKey)) return undefined;
+    const getRoot = () => deps.getRuntimeDir?.() ?? dirname(deps.getLeaderJournalPath(profile));
+    const root = getRoot();
+    const parts = relative(root, path).split(sep);
+    const suffix = escapeTelegramJournalPathPattern(getTelegramProfilePathSuffix(profile));
+    const flat = new RegExp(`^(?:inbox|follower-inbox-[a-f0-9]{16})${suffix}\\.json$`, "u");
+    const session = new RegExp(`^(?:journal\\.[a-f0-9]{16}|inbox)${suffix}\\.json$`, "u");
+    if (!isAbsolute(root) || resolve(root) !== root || !isAbsolute(path) || resolve(path) !== path ||
+        !(parts.length === 1 && flat.test(parts[0]!) || parts.length === 3 && parts[0] === "sessions" &&
+          decodeTelegramSessionDirectoryName(parts[1]!) !== undefined && session.test(parts[2]!))) return undefined;
+    const current = () => deps.base.getBotToken() === token && deps.base.getBotId() === botId &&
+      (deps.base.getProfileName() ?? TELEGRAM_DEFAULT_PROFILE_NAME) === profile && getRoot() === root;
+    const inspect = () => {
+      if (!current()) return undefined;
+      const observed = inspectTelegramUpdateJournalRetention({ directory: root, path, profile, botIdentity,
+        limits: { maxFiles: 1024, maxBytes: TELEGRAM_UPDATE_JOURNAL_MAX_BYTES * 2,
+          maxEntries: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES, maxWork: TELEGRAM_UPDATE_JOURNAL_MAX_ENTRIES * 1024 } });
+      if (observed.evidence.kind !== "present" || !current()) return undefined;
+      return operation(observed.evidence.file, observed.retainedInputs, path);
+    };
+    const result = deps.base.withSourceSerialization ? deps.base.withSourceSerialization(inspect) : inspect();
+    return current() ? result : undefined;
+  };
+  let preparedFollower: { recipientBindingKey: string; sessionId: string } | undefined;
+  const runtime: TelegramUpdateJournalBindingRuntime = {
     resolveLeader,
     resolveFollower,
     resolveActive,
     getActiveRecoveryKey: () => resolveActive()?.recoveryKey,
-    createRecipientResolver: (bindingKey) =>
-      createFollowerResolver(bindingKey, false),
+    prepareActiveFollowerSuccession(isCurrent) {
+      const recipientBindingKey = deps.getActiveFollowerBindingKey();
+      const sessionId = deps.getActiveFollowerSessionId?.();
+      if (!sessionId) return undefined;
+      const previous = preparedFollower;
+      const result = previous && previous.recipientBindingKey === recipientBindingKey && previous.sessionId !== sessionId
+        ? runtime.adoptPredecessorPending({ recipientBindingKey, predecessorSessionId: previous.sessionId,
+          successorSessionId: sessionId, isCurrent })
+        : undefined;
+      // Only a completed adoption advances the predecessor; failures retry idempotently on the next preparation.
+      preparedFollower = { recipientBindingKey, sessionId };
+      return result;
+    },
+    inspectSourceAbandonment(journalBindingKey, updateId) {
+      if (!isSafeNonNegativeInteger(updateId)) throw new Error("Telegram abandonment proof requires an exact update ID.");
+      return inspectHistoricalSource(journalBindingKey, (file, originals) => {
+        const original = originals.find(value => value.updateId === updateId && value.state === "committed" &&
+          value.journalBindingKey === journalBindingKey);
+        if (!original) return undefined;
+        const disposition = file.operatorDispositions?.find(value => value.failureId === original.failureId);
+        if (!disposition || !("dispositionKind" in disposition) || disposition.dispositionKind !== "legacy-custody") return undefined;
+        return { journalBindingKey, updateId, retainedPath: original.path, operatorAuthorityId: disposition.operatorAuthorityId };
+      });
+    },
+    inspectSourceGroupExpiry(journalBindingKey, updateIds) {
+      return inspectHistoricalSource(journalBindingKey, file => inspectRoutingGroupExpiry(file, journalBindingKey, updateIds));
+    },
+    inspectSourceCompletion(journalBindingKey, expected) {
+      const completion = validateJournalSourceCompletion(expected, getTelegramUpdateJournalBindingPath(journalBindingKey) ?? "journal");
+      return inspectHistoricalSource(journalBindingKey, (file, _originals, path) => inspectJournalSourceCompletion(file, completion, path));
+    },
+    inspectQueuedReceipt(journalBindingKey, expected) {
+      const queueOwner = validateQueuedReceiptObservation(expected, getTelegramUpdateJournalBindingPath(journalBindingKey) ?? "journal");
+      return inspectHistoricalSource(journalBindingKey, (file, _originals, path) => inspectJournalQueuedReceipt(file, { ...expected, queueOwner }, path));
+    },
+    adoptPredecessorPending(input) {
+      const { recipientBindingKey, predecessorSessionId, successorSessionId, isCurrent } = input;
+      if (!recipientBindingKey || !predecessorSessionId || !successorSessionId ||
+          predecessorSessionId === successorSessionId || typeof isCurrent !== "function") {
+        throw new Error("Telegram session adoption requires distinct exact session identities.");
+      }
+      const assertCurrent = () => {
+        if (!isCurrent()) throw new Error("Telegram session adoption lost successor authority.");
+      };
+      assertCurrent();
+      const predecessor = createFollowerResolver(recipientBindingKey, false, predecessorSessionId)();
+      const successor = createFollowerResolver(recipientBindingKey, false, successorSessionId)();
+      if (!predecessor?.readForProtection || !successor || predecessor.recoveryKey === successor.recoveryKey) {
+        throw new Error("Telegram session adoption requires exact predecessor and successor journals.");
+      }
+      const result: TelegramSessionPendingAdoptionResult = { adoptedUpdateIds: [], retainedUpdateIds: [] };
+      // Non-repairing selection; the abandonment CAS rechecks each exact entry under the source lock.
+      const candidates = predecessor.readForProtection().entries.filter(isAdoptablePendingEntry)
+        .sort((left, right) => left.updateId - right.updateId);
+      for (const entry of candidates) {
+        assertCurrent();
+        // Commit away first: a crash afterwards preserves the private original instead of duplicating execution.
+        const committed = predecessor.journal.abandonPending({ journalBindingKey: predecessor.recoveryKey, entry,
+          operatorAuthorityId: `${TELEGRAM_SESSION_ADOPTION_AUTHORITY_PREFIX}${successorSessionId}`, isCurrent });
+        if (committed.duplicate) {
+          result.retainedUpdateIds.push(entry.updateId);
+          continue;
+        }
+        assertCurrent();
+        successor.journal.appendBatch([entry.update]);
+        result.adoptedUpdateIds.push(entry.updateId);
+      }
+      return result;
+    },
+    createRecipientResolver: (bindingKey, sessionId) =>
+      createFollowerResolver(bindingKey, false, sessionId),
+    createLegacyRecipientResolver: (bindingKey) => createFollowerResolver(bindingKey, false, undefined, true),
     createPathResolver: (path) =>
       createTelegramUpdateJournalRuntimeBindingResolver({
         getProfileName: deps.base.getProfileName,
@@ -2626,6 +3345,8 @@ export function createTelegramUpdateJournalBindingRuntime(deps: {
         getBotId: deps.base.getBotId,
         ...(deps.base.withWriterAdmission
           ? { withWriterAdmission: deps.base.withWriterAdmission } : {}),
+        ...(deps.base.withSourceSerialization
+          ? { withSourceSerialization: deps.base.withSourceSerialization } : {}),
         ...(deps.base.getWorkspaceAdmission
           ? { getWorkspaceAdmission: deps.base.getWorkspaceAdmission }
           : {}),
@@ -2633,6 +3354,7 @@ export function createTelegramUpdateJournalBindingRuntime(deps: {
         getJournalPath: () => path,
       }),
   };
+  return runtime;
 }
 
 export function createTelegramUpdateJournalStore(
@@ -2720,7 +3442,6 @@ function createJournalStoreCore(
   };
   const getQueueProcessLiveness =
     options.getQueueProcessLiveness ?? getTelegramProcessLiveness;
-
   const validateQueueHandoffInput = (
     input: TelegramUpdateJournalQueueHandoffInput,
     operation: "offer" | "accept" | "cancel",
@@ -2841,6 +3562,9 @@ function createJournalStoreCore(
         `exceeds its ${maxEntries}-operator-disposition limit`,
       );
     }
+    if ((file.sourceCompletions?.length ?? 0) > maxEntries) {
+      throw createJournalError("capacity", path, `exceeds its ${maxEntries}-source-completion limit`);
+    }
     const serializedBytes = Buffer.byteLength(serialized);
     if (serializedBytes > maxBytes) {
       throw createJournalError(
@@ -2859,7 +3583,7 @@ function createJournalStoreCore(
     entries: [],
   });
 
-  const readCurrentStrict = (): ReadTelegramUpdateJournalResult => {
+  const readCurrentStrict = (allowReconciliation = true): ReadTelegramUpdateJournalResult => {
     let source: string;
     let recoveringMissingSnapshot = false;
     try {
@@ -2893,6 +3617,7 @@ function createJournalStoreCore(
           );
         }
         if (orphanedSegmentNames.length > 0) {
+          if (!allowReconciliation) throw createJournalError("invalid", path, "requires explicit missing-snapshot reconciliation");
           if (withPairingAdmission) throw createJournalError("pairing-evidence", path, "requires explicit missing-snapshot reconciliation");
           recoveringMissingSnapshot = true;
           source = serializeJournalFile(emptyFile());
@@ -3001,6 +3726,7 @@ function createJournalStoreCore(
           "belongs to another journal identity",
         );
       }
+      assertJournalSourceCompletionContinuity(file, segment, segmentPath);
       const entriesById = new Map(
         file.entries.map((entry) => [entry.updateId, entry]),
       );
@@ -3040,6 +3766,8 @@ function createJournalStoreCore(
             : file.operatorDispositions?.length
               ? { operatorDispositions: file.operatorDispositions }
               : {}),
+          ...(segment.sourceCompletions !== undefined ? { sourceCompletions: segment.sourceCompletions }
+            : file.sourceCompletions?.length ? { sourceCompletions: file.sourceCompletions } : {}),
         },
         segmentPath,
         version,
@@ -3049,9 +3777,9 @@ function createJournalStoreCore(
     const identityChanged =
       storedProfile !== profile ||
       !identitiesMatch(file.botIdentity, expectedIdentity) ||
-      (withPairingAdmission && file.botIdentity.tokenSha256 !== expectedIdentity.tokenSha256);
+      ((withPairingAdmission || !!file.sourceCompletions?.length) && file.botIdentity.tokenSha256 !== expectedIdentity.tokenSha256);
     if (identityChanged) {
-      if (file.entries.length > 0 || withPairingAdmission) {
+      if (file.entries.length > 0 || file.sourceCompletions?.length || withPairingAdmission || !allowReconciliation) {
         throw createJournalError(
           "identity-mismatch",
           path,
@@ -3205,66 +3933,35 @@ function createJournalStoreCore(
         }
       }
 
-      const recoveryDirectory = join(
-        dirname(path),
-        "recovery",
-        `${getNowMs()}-${process.pid}-${randomUUID()}`,
-      );
-      mkdirSync(recoveryDirectory, { recursive: true, mode: 0o700 });
-      const snapshotQuarantinePath = join(recoveryDirectory, basename(path));
-      const segmentQuarantinePath = join(
-        recoveryDirectory,
-        basename(segmentDirectory),
-      );
-      if (
-        snapshotExists &&
-        !renameTelegramPathWithRetry(path, snapshotQuarantinePath)
-      ) {
-        throw createJournalError(
-          "io",
-          path,
-          "could not quarantine an unrecoverable journal snapshot",
-          error,
-        );
-      }
-      if (!renameTelegramPathWithRetry(segmentDirectory, segmentQuarantinePath)) {
-        if (snapshotExists) {
-          renameTelegramPathWithRetry(snapshotQuarantinePath, path);
+      // Approved corruption policy: delete damaged evidence instead of quarantining it under recovery/.
+      // Segments go first so a fresh revisionless snapshot can never replay them; a crash repeats the reset.
+      const deletedPaths: string[] = [];
+      const deleteDamaged = (target: string, label: string): void => {
+        try {
+          lstatSync(target);
+        } catch (statError) {
+          if ((statError as NodeJS.ErrnoException).code === "ENOENT") return;
+          throw createJournalError("io", target, `could not inspect an unrecoverable ${label}`, statError);
         }
-        throw createJournalError(
-          "io",
-          segmentDirectory,
-          "could not quarantine an unrecoverable journal segment history",
-          error,
-        );
-      }
+        try {
+          rmSync(target, { recursive: true, force: true });
+        } catch (removeError) {
+          throw createJournalError("io", target, `could not delete an unrecoverable ${label}`, removeError);
+        }
+        deletedPaths.push(target);
+      };
+      deleteDamaged(segmentDirectory, "journal segment history");
+      // A regular snapshot is replaced atomically below; anything else cannot be a rename target.
+      if (snapshotExists && !lstatSync(path).isFile()) deleteDamaged(path, "journal snapshot");
       const reset = emptyFile();
       const serialized = serializeJournalFile(reset);
       const serializedBytes = assertCapacity(reset, serialized);
-      try {
-        writeJournalFile(path, serialized, onPublicationBoundary);
-      } catch (publicationError) {
-        const segmentsRestored = renameTelegramPathWithRetry(
-          segmentQuarantinePath,
-          segmentDirectory,
-        );
-        const snapshotRestored =
-          !snapshotExists ||
-          renameTelegramPathWithRetry(snapshotQuarantinePath, path);
-        if (!segmentsRestored || !snapshotRestored) {
-          throw createJournalError(
-            "io",
-            path,
-            "reset publication failed after journal evidence was quarantined",
-            publicationError,
-          );
-        }
-        throw publicationError;
-      }
+      writeJournalFile(path, serialized, onPublicationBoundary);
+      if (snapshotExists && !deletedPaths.includes(path)) deletedPaths.push(path);
       notifyRecovery({
         kind: "reset",
         path,
-        quarantinePath: recoveryDirectory,
+        deletedPaths,
         reason: error.message,
       });
       return { file: reset, exists: true, serializedBytes };
@@ -3315,7 +4012,7 @@ function createJournalStoreCore(
   const inputBindingHeadroomText = "\0".repeat(TELEGRAM_UPDATE_JOURNAL_INPUT_BINDING_MAX_LENGTH);
   const inputHandoffHeadroomText = "\0".repeat(TELEGRAM_UPDATE_JOURNAL_QUEUE_HANDOFF_ID_MAX_LENGTH);
   const getFileWork = (file: TelegramUpdateJournalFile): number =>
-    file.entries.length + (file.operatorDispositions?.length ?? 0);
+    file.entries.length + (file.operatorDispositions?.length ?? 0) + (file.sourceCompletions?.length ?? 0);
   const advanceInputHeadroomState = (state: InputHeadroomState,
     entries: TelegramUpdateJournalEntry[], projectionSlack: number): InputHeadroomState => {
     const revision = (state.file.revision ?? 0) + 1;
@@ -3491,7 +4188,7 @@ function createJournalStoreCore(
   ): TelegramUpdateJournalSegment => {
     const previousEntries = new Map(previous.entries.map(entry => [entry.updateId, entry]));
     const nextEntries = new Map(next.entries.map(entry => [entry.updateId, entry]));
-    return { version: TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION,
+    return { version,
       revision: next.revision!, previousRevision: next.revision! - 1,
       profile: next.profile, botIdentity: next.botIdentity,
       upsertedEntries: next.entries.filter(entry =>
@@ -3521,7 +4218,7 @@ function createJournalStoreCore(
       : { files: 1, bytes: publishedBytes, work: getFileWork(publishedFile) };
     if (publishedSegment) {
       const segmentWork = publishedSegment.upsertedEntries.length + publishedSegment.removedUpdateIds.length +
-        (publishedSegment.operatorDispositions?.length ?? 0);
+        (publishedSegment.operatorDispositions?.length ?? 0) + (publishedSegment.sourceCompletions?.length ?? 0);
       const segmentBytes = Buffer.byteLength(`${JSON.stringify(publishedSegment, null, 2)}\n`);
       baseRetainedCount += 1;
       baseRetainedBytes += segmentBytes;
@@ -3580,9 +4277,10 @@ function createJournalStoreCore(
     const segmentText = `${JSON.stringify(segment, null, 2)}\n`;
     const segmentBytes = Buffer.byteLength(segmentText);
     const collections = [segment.upsertedEntries.length, segment.removedUpdateIds.length,
-      segment.operatorDispositions?.length ?? 0, file.entries.length, file.operatorDispositions?.length ?? 0];
-    const segmentWork = collections[0]! + collections[1]! + collections[2]!;
-    const fileWork = collections[3]! + collections[4]!;
+      segment.operatorDispositions?.length ?? 0, file.entries.length, file.operatorDispositions?.length ?? 0,
+      segment.sourceCompletions?.length ?? 0, file.sourceCompletions?.length ?? 0];
+    const segmentWork = collections[0]! + collections[1]! + collections[2]! + collections[5]!;
+    const fileWork = collections[3]! + collections[4]! + collections[6]!;
     const accounting = source.evidence.accounting;
     // Both the segment-first state and snapshot-first cleanup residue must fit.
     assertSourceResources(accounting.files + 1, accounting.bytes + segmentBytes,
@@ -3625,7 +4323,8 @@ function createJournalStoreCore(
     acceptedThroughUpdateId = current.file.acceptedThroughUpdateId,
     publicationBoundary = onPublicationBoundary,
     inputHeadroom: number | readonly number[] | "all" | false =
-      version === TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION ? "all" : false,
+      journalHasCustodyFields(version) ? "all" : false,
+    sourceCompletions = current.file.sourceCompletions,
   ): { file: TelegramUpdateJournalFile; serializedBytes: number } => {
     const botIdentity = current.source ? current.file.botIdentity : mergeBotIdentity(
       current.file.botIdentity,
@@ -3638,7 +4337,8 @@ function createJournalStoreCore(
         current.file.operatorDispositions ?? [],
         operatorDispositions ?? [],
       ) &&
-      current.file.acceptedThroughUpdateId === acceptedThroughUpdateId
+      current.file.acceptedThroughUpdateId === acceptedThroughUpdateId &&
+      isDeepStrictEqual(current.file.sourceCompletions ?? [], sourceCompletions ?? [])
     ) {
       return { file: current.file, serializedBytes: current.serializedBytes };
     }
@@ -3653,21 +4353,24 @@ function createJournalStoreCore(
       ...(operatorDispositions?.length
         ? { operatorDispositions }
         : {}),
+      ...(sourceCompletions?.length ? { sourceCompletions } : {}),
     };
+    assertJournalRoutingInputContinuity(current.file, entries, path);
     if (withPairingAdmission || current.source) parseJournalFile(file, path, version);
     const serialized = serializeJournalFile(file);
     const serializedBytes = assertCapacity(file, serialized);
     const changed =
       contentChanged ||
       current.file.acceptedThroughUpdateId !== acceptedThroughUpdateId ||
-      !isDeepStrictEqual(current.file.botIdentity, file.botIdentity);
+      !isDeepStrictEqual(current.file.botIdentity, file.botIdentity) ||
+      !isDeepStrictEqual(current.file.sourceCompletions ?? [], sourceCompletions ?? []);
     if (!changed) {
       return { file, serializedBytes: current.serializedBytes };
     }
     if (!current.exists) {
       if (current.source) {
-        const collections = [file.entries.length, file.operatorDispositions?.length ?? 0];
-        assertSourceResources(1, serializedBytes, collections[0]! + collections[1]!, collections);
+        const collections = [file.entries.length, file.operatorDispositions?.length ?? 0, file.sourceCompletions?.length ?? 0];
+        assertSourceResources(1, serializedBytes, collections[0]! + collections[1]! + collections[2]!, collections);
       }
       if (inputHeadroom !== false) assertInputProgressHeadroom(current, file, inputHeadroom);
       writeJournalFile(path, serialized, publicationBoundary);
@@ -3709,13 +4412,14 @@ function createJournalStoreCore(
       )
         ? { operatorDispositions: operatorDispositions ?? [] }
         : {}),
+      ...(!isDeepStrictEqual(current.file.sourceCompletions ?? [], sourceCompletions ?? []) ? { sourceCompletions: sourceCompletions ?? [] } : {}),
     };
     if (current.source) {
       if (!isSafePositiveInteger(revision)) throw createJournalError("capacity", path, "exhausted source revisions");
       const revisedFile = { ...file, revision };
       if (inputHeadroom !== false) assertInputProgressHeadroom(current, revisedFile, inputHeadroom, segment);
       return publishSourceSegment(current, file, segment, publicationBoundary,
-        version === TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION);
+        journalHasCustodyFields(version));
     }
     publishTelegramUpdateJournalSegmentUnlocked(path, segment, publicationBoundary);
     const revisedFile: TelegramUpdateJournalFile = { ...file, revision };
@@ -3768,6 +4472,160 @@ function createJournalStoreCore(
     return { file: revisedFile, serializedBytes };
   };
 
+  const removeCompleted = (updateIds: readonly number[], expectedSources?: readonly TelegramUpdateJournalEntryDigest[], exact = false,
+    completionInput?: readonly TelegramUpdateJournalSourceCompletion[]): TelegramUpdateJournalRemoveResult =>
+    runMutation((readCurrent) => {
+      const current = exact && !sourceAccess ? readCurrentStrict(false) : readCurrent();
+      if (completionInput !== undefined && !sourceAccess) throw createJournalError("invalid", path, "source completion requires an exact source handle");
+      const completions = completionInput === undefined ? undefined : validateJournalSourceCompletions(completionInput, path, version);
+      if (exact && expectedSources === undefined) throw createJournalError("invalid", path, "received no exact completion sources");
+      const requestedIds = new Set<number>();
+      for (const updateId of updateIds) {
+        if (!isSafeNonNegativeInteger(updateId)) throw createJournalError("invalid", path, "received an invalid removal update id");
+        requestedIds.add(updateId);
+      }
+      if (expectedSources !== undefined) {
+        if (!Array.isArray(expectedSources) || !expectedSources.length) throw createJournalError("invalid", path, "received no exact completion sources");
+        const expectedIds = new Set<number>();
+        for (const expected of expectedSources) {
+          if (!isRecord(expected) || Object.keys(expected).some(key => !["updateId", "sourceSha256"].includes(key)) ||
+              !isSafeNonNegativeInteger(expected.updateId) || !requestedIds.has(expected.updateId) || expectedIds.has(expected.updateId) ||
+              typeof expected.sourceSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(expected.sourceSha256)) {
+            throw createJournalError("invalid", path, "received an invalid exact completion source");
+          }
+          expectedIds.add(expected.updateId);
+          const entry = current.file.entries.find(value => value.updateId === expected.updateId);
+          if (!entry || createTelegramUpdateJournalEntryDigest(entry).sourceSha256 !== expected.sourceSha256) {
+            throw createJournalError("conflict", path, "exact completion source changed or disappeared");
+          }
+        }
+      }
+      if (completions) {
+        const guards = new Map((expectedSources ?? []).map(source => [source.updateId, source.sourceSha256]));
+        if (completions.some(completion => guards.get(completion.updateId) !== completion.sourceSha256)) {
+          throw createJournalError("invalid", path, "source completion has no matching exact guard");
+        }
+      }
+      const requestedEntries = current.file.entries.filter(entry => requestedIds.has(entry.updateId));
+      const protectedEntry = requestedEntries.find(entry => entry.state === "failed" || entry.state === "queued");
+      if (protectedEntry) throw createJournalError("conflict", path, protectedEntry.state === "failed"
+        ? `cannot complete terminal update ${protectedEntry.updateId} without an operator disposition`
+        : `cannot complete queued update ${protectedEntry.updateId} without its exact owner receipt`);
+      const removedUpdateIds = requestedEntries.map(entry => entry.updateId);
+      const sourceCompletions = completions
+        ? [...(current.file.sourceCompletions ?? []), ...completions].sort((a, b) => a.updateId - b.updateId) : current.file.sourceCompletions;
+      if (sourceCompletions?.length) validateJournalSourceCompletions(sourceCompletions, path, version);
+      const published = publishMutation(current, current.file.entries.filter(entry => !requestedIds.has(entry.updateId)), removedUpdateIds.length > 0,
+        current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, false, sourceCompletions);
+      return { removedUpdateIds, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes,
+        ...(completions ? { sourceCompletions: completions.map(completion => ({ ...completion })) } : {}) };
+    });
+  const completeQueued = (receipts: readonly TelegramUpdateJournalQueuedCompletion[],
+    completionInput?: readonly TelegramUpdateJournalSourceCompletion[], exact = false): TelegramUpdateJournalRemoveResult =>
+    runMutation((readCurrent) => {
+      if (exact && !sourceAccess) throw createJournalError("invalid", path, "source completion requires an exact source handle");
+      const completions = exact ? validateJournalSourceCompletions(completionInput, path, version) : undefined;
+      if (!Array.isArray(receipts) || receipts.length === 0) throw createJournalError("invalid", path, "received no queued receipts to complete");
+      const current = readCurrent();
+      const receiptIds = new Set<string>(), requestedUpdateIds = new Set<number>();
+      for (const receipt of receipts) {
+        if ((receipt.queueKind !== "prompt" && receipt.queueKind !== "control") || !isNonEmptyString(receipt.receiptId) ||
+            receiptIds.has(receipt.receiptId) || !Array.isArray(receipt.sourceUpdateIds) || receipt.sourceUpdateIds.length === 0) {
+          throw createJournalError("invalid", path, "received an invalid queued completion receipt");
+        }
+        receiptIds.add(receipt.receiptId);
+        const queueOwner = validateJournalQueueOwner(receipt.queueOwner, path);
+        if (queueRuntimeIdentity && (queueOwner.instanceId !== queueRuntimeIdentity.instanceId || queueOwner.processId !== queueRuntimeIdentity.processId ||
+            queueOwner.processBirthId !== queueRuntimeIdentity.processBirthId)) {
+          throw createJournalError("conflict", path, `cannot complete foreign queue receipt ${receipt.receiptId}`);
+        }
+        const sourceUpdateIds = new Set<number>();
+        for (const updateId of receipt.sourceUpdateIds) {
+          if (!isSafeNonNegativeInteger(updateId) || sourceUpdateIds.has(updateId) || requestedUpdateIds.has(updateId)) {
+            throw createJournalError("invalid", path, "received overlapping queued completion update ids");
+          }
+          sourceUpdateIds.add(updateId); requestedUpdateIds.add(updateId);
+        }
+        const persistedReceiptEntries = current.file.entries.filter(entry => entry.queueReceiptId === receipt.receiptId);
+        if (persistedReceiptEntries.length !== sourceUpdateIds.size || persistedReceiptEntries.some(entry =>
+          !sourceUpdateIds.has(entry.updateId) || entry.state !== "queued" || entry.queueKind !== receipt.queueKind || !entry.queueOwner ||
+          entry.queueHandoff !== undefined || !areTelegramUpdateJournalQueueOwnersEqual(entry.queueOwner, queueOwner))) {
+          throw createJournalError("conflict", path, `cannot complete stale or foreign queue receipt ${receipt.receiptId}`);
+        }
+      }
+      const removedEntries = current.file.entries.filter(entry => requestedUpdateIds.has(entry.updateId));
+      const removedUpdateIds = removedEntries.map(entry => entry.updateId);
+      if (removedUpdateIds.length !== requestedUpdateIds.size) throw createJournalError("conflict", path, "queued completion did not resolve every source update");
+      if (completions) {
+        const sources = new Map(removedEntries.map(entry => [entry.updateId, createTelegramUpdateJournalEntryDigest(entry).sourceSha256]));
+        if (completions.some(completion => sources.get(completion.updateId) !== completion.sourceSha256)) {
+          throw createJournalError("conflict", path, "queued completion source changed or belongs to another receipt");
+        }
+      }
+      const sourceCompletions = completions ? [...(current.file.sourceCompletions ?? []), ...completions].sort((a, b) => a.updateId - b.updateId)
+        : current.file.sourceCompletions;
+      if (sourceCompletions?.length) validateJournalSourceCompletions(sourceCompletions, path, version);
+      const published = publishMutation(current, current.file.entries.filter(entry => !requestedUpdateIds.has(entry.updateId)), true,
+        current.file.operatorDispositions, current.file.acceptedThroughUpdateId, onPublicationBoundary, exact ? false : undefined, sourceCompletions);
+      return { removedUpdateIds, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes,
+        ...(completions ? { sourceCompletions: completions.map(completion => ({ ...completion })) } : {}) };
+    });
+  const mutateRoutingInputs = (input: TelegramRoutingInputAuthority, select: boolean, publishedAtMs?: number) => runMutation(readCurrent => {
+    if (!isTelegramUpdateJournalLegacyFamilyVersion(version)) throw createJournalError("unsupported-version", path, "routing input lifetime requires a private v1 source");
+    const binding = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+    if (input.journalBindingKey !== binding || !isSafePositiveInteger(input.operatorUserId) ||
+        typeof input.isCurrent !== "function" || !Array.isArray(input.entries) || !input.entries.length || input.entries.length > maxEntries) {
+      throw createJournalError("invalid", path, "invalid routing input lifetime authority");
+    }
+    const assertCurrent = () => { if (!input.isCurrent()) throw createJournalError("conflict", path, "routing input lifetime authority ended"); };
+    assertCurrent();
+    const expected = input.entries.map(entry => validateJournalEntry(entry, path, version));
+    if (new Set(expected.map(entry => entry.updateId)).size !== expected.length) throw createJournalError("invalid", path, "duplicate routing input sources");
+    const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
+    const nowMs = select ? getNowMs() : publishedAtMs;
+    if (!isSafeNonNegativeInteger(nowMs) || !Number.isSafeInteger(nowMs + TELEGRAM_ROUTING_INPUT_TTL_MS) || (!select && nowMs > getNowMs())) throw createJournalError("invalid", path, "invalid routing input lifetime clock");
+    let issued = false;
+    const changed = new Map<number, TelegramUpdateJournalEntry>();
+    const result = expected.map(original => {
+      const entry = current.file.entries.find(value => value.updateId === original.updateId);
+      if (!entry || entry.state !== "pending" || original.state !== "pending" || entry.inputClaim || entry.inputProvenance || entry.queueOwner) {
+        throw createJournalError("conflict", path, "routing input source is not unclaimed pending work");
+      }
+      const withoutLifetime = (value: TelegramUpdateJournalEntry) => { const copy = cloneEntry(value); delete copy.routingInput; return copy; };
+      if (!isDeepStrictEqual(entry, original) && (!isDeepStrictEqual(withoutLifetime(entry), withoutLifetime(original)) ||
+          (original.routingInput && !isDeepStrictEqual(original.routingInput, entry.routingInput)))) {
+        throw createJournalError("conflict", path, "routing input source changed");
+      }
+      const lifetime = entry.routingInput;
+      if (lifetime && lifetime.operatorUserId !== input.operatorUserId) throw createJournalError("conflict", path, "routing input belongs to another operator");
+      if (createPendingRetentionReference({ path, journalBindingKey: binding, entry, maxBytes }).read()) {
+        throw createJournalError("conflict", path, "routing input has protected retention");
+      }
+      if (select) {
+        if (!lifetime || (lifetime.phase === "waiting" && nowMs >= lifetime.expiresAtMs)) throw createJournalError("conflict", path, "routing input choice expired or was not armed");
+        if (lifetime.phase === "selected") return cloneEntry(entry);
+        issued = true;
+        const selected = { ...cloneEntry(entry), routingInput: { ...lifetime, phase: "selected" as const } };
+        changed.set(entry.updateId, selected); return cloneEntry(selected);
+      }
+      if (lifetime) {
+        if (lifetime.phase !== "waiting") throw createJournalError("conflict", path, "selected routing input cannot renew its choice");
+        return cloneEntry(entry);
+      }
+      if (nowMs < entry.admittedAtMs) throw createJournalError("conflict", path, "routing input publication predates admission");
+      issued = true;
+      const armed = { ...cloneEntry(entry), routingInput: { operatorUserId: input.operatorUserId,
+        publishedAtMs: nowMs, expiresAtMs: nowMs + TELEGRAM_ROUTING_INPUT_TTL_MS, phase: "waiting" as const } };
+      changed.set(entry.updateId, armed); return cloneEntry(armed);
+    });
+    assertCurrent();
+    if (select && issued && result.some(entry => !changed.has(entry.updateId))) throw createJournalError("conflict", path, "routing input selection has mixed prior phases");
+    if (changed.size) publishMutation(current, current.file.entries.map(entry => changed.get(entry.updateId) ?? entry), true,
+      current.file.operatorDispositions, current.file.acceptedThroughUpdateId,
+      (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
+    assertCurrent();
+    return { issued, entries: result };
+  });
   const journal: TelegramUpdateJournalStore = {
     read() {
       return runMutation((readCurrent) => {
@@ -3815,11 +4673,12 @@ function createJournalStoreCore(
         );
         const previousAcceptedThroughUpdateId =
           current.file.acceptedThroughUpdateId;
-        const discardedUpdateIds = new Set(
-          (current.file.operatorDispositions ?? [])
+        const discardedUpdateIds = new Set([
+          ...(current.file.operatorDispositions ?? [])
             .filter((disposition) => disposition.action === "discard")
             .map((disposition) => disposition.updateId),
-        );
+          ...(current.file.sourceCompletions ?? []).map(completion => completion.updateId),
+        ]);
         let admittedAtMs: number | undefined;
         const addedUpdateIds: number[] = [];
         const duplicateUpdateIds: number[] = [];
@@ -4069,6 +4928,7 @@ function createJournalStoreCore(
             update: entry.update,
             admittedAtMs: entry.admittedAtMs,
             ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
+            ...(entry.routingInput ? { routingInput: { ...entry.routingInput } } : {}),
             state: "queued",
             queueKind: receipt.queueKind,
             queueReceiptId: receipt.receiptId,
@@ -4193,6 +5053,7 @@ function createJournalStoreCore(
           updateId: entry.updateId,
           update: entry.update,
           admittedAtMs: entry.admittedAtMs,
+          ...(entry.routingInput ? { routingInput: { ...entry.routingInput } } : {}),
           ...(entry.preApprovalExcluded !== undefined ? { preApprovalExcluded: entry.preApprovalExcluded } : {}),
           state: input.disposition,
           failure,
@@ -4328,9 +5189,9 @@ function createJournalStoreCore(
     applyLegacyCustodyDisposition(authority) {
       return runMutation((readCurrent) => {
         const current = readCurrent();
-        if (current.file.version !== TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION)
+        if (!journalHasCustodyFields(current.file.version))
           throw createJournalError("conflict", path,
-            "legacy custody disposition requires a v3 journal");
+            "legacy custody disposition requires a custody journal");
         const existing = current.file.operatorDispositions?.find(
           candidate => candidate.failureId === authority.dispositionId);
         if (existing) {
@@ -4647,116 +5508,8 @@ function createJournalStoreCore(
         };
       });
     },
-    completeQueued(receipts) {
-      return runMutation((readCurrent) => {
-        if (!Array.isArray(receipts) || receipts.length === 0) {
-          throw createJournalError(
-            "invalid",
-            path,
-            "received no queued receipts to complete",
-          );
-        }
-        const current = readCurrent();
-        const receiptIds = new Set<string>();
-        const requestedUpdateIds = new Set<number>();
-        for (const receipt of receipts) {
-          if (
-            (receipt.queueKind !== "prompt" &&
-              receipt.queueKind !== "control") ||
-            !isNonEmptyString(receipt.receiptId) ||
-            receiptIds.has(receipt.receiptId) ||
-            !Array.isArray(receipt.sourceUpdateIds) ||
-            receipt.sourceUpdateIds.length === 0
-          ) {
-            throw createJournalError(
-              "invalid",
-              path,
-              "received an invalid queued completion receipt",
-            );
-          }
-          receiptIds.add(receipt.receiptId);
-          const queueOwner = validateJournalQueueOwner(
-            receipt.queueOwner,
-            path,
-          );
-          if (
-            queueRuntimeIdentity &&
-            (queueOwner.instanceId !== queueRuntimeIdentity.instanceId ||
-              queueOwner.processId !== queueRuntimeIdentity.processId ||
-              queueOwner.processBirthId !==
-                queueRuntimeIdentity.processBirthId)
-          ) {
-            throw createJournalError(
-              "conflict",
-              path,
-              `cannot complete foreign queue receipt ${receipt.receiptId}`,
-            );
-          }
-          const sourceUpdateIds = new Set<number>();
-          for (const updateId of receipt.sourceUpdateIds) {
-            if (
-              !isSafeNonNegativeInteger(updateId) ||
-              sourceUpdateIds.has(updateId) ||
-              requestedUpdateIds.has(updateId)
-            ) {
-              throw createJournalError(
-                "invalid",
-                path,
-                "received overlapping queued completion update ids",
-              );
-            }
-            sourceUpdateIds.add(updateId);
-            requestedUpdateIds.add(updateId);
-          }
-          const persistedReceiptEntries = current.file.entries.filter(
-            (entry) => entry.queueReceiptId === receipt.receiptId,
-          );
-          if (
-            persistedReceiptEntries.length !== sourceUpdateIds.size ||
-            persistedReceiptEntries.some(
-              (entry) =>
-                !sourceUpdateIds.has(entry.updateId) ||
-                entry.state !== "queued" ||
-                entry.queueKind !== receipt.queueKind ||
-                !entry.queueOwner ||
-                entry.queueHandoff !== undefined ||
-                !areTelegramUpdateJournalQueueOwnersEqual(
-                  entry.queueOwner,
-                  queueOwner,
-                ),
-            )
-          ) {
-            throw createJournalError(
-              "conflict",
-              path,
-              `cannot complete stale or foreign queue receipt ${receipt.receiptId}`,
-            );
-          }
-        }
-        const removedUpdateIds = current.file.entries
-          .filter((entry) => requestedUpdateIds.has(entry.updateId))
-          .map((entry) => entry.updateId);
-        if (removedUpdateIds.length !== requestedUpdateIds.size) {
-          throw createJournalError(
-            "conflict",
-            path,
-            "queued completion did not resolve every source update",
-          );
-        }
-        const published = publishMutation(
-          current,
-          current.file.entries.filter(
-            (entry) => !requestedUpdateIds.has(entry.updateId),
-          ),
-          true,
-        );
-        return {
-          removedUpdateIds,
-          entryCount: published.file.entries.length,
-          serializedBytes: published.serializedBytes,
-        };
-      });
-    },
+    completeQueued(receipts) { return completeQueued(receipts); },
+    completeQueuedExact(receipts, completions) { return completeQueued(receipts, completions, true); },
     discardQueued(input) {
       return runMutation((readCurrent) => {
         if (
@@ -4957,50 +5710,222 @@ function createJournalStoreCore(
         };
       });
     },
-    removeCompleted(updateIds) {
+    inspectAbandonedPending(updateId) {
       return runMutation((readCurrent) => {
-        const current = readCurrent();
-        const requestedIds = new Set<number>();
-        for (const updateId of updateIds) {
-          if (!isSafeNonNegativeInteger(updateId)) {
-            throw createJournalError(
-              "invalid",
-              path,
-              "received an invalid removal update id",
-            );
+        if (!isTelegramUpdateJournalLegacyFamilyVersion(version)) {
+          throw createJournalError("unsupported-version", path, "abandonment inspection requires the legacy v1 source");
+        }
+        if (!isSafeNonNegativeInteger(updateId)) throw createJournalError("invalid", path, "invalid abandonment update id");
+        // Inspection never repairs or quarantines source evidence.
+        const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
+        const matches = (current.file.operatorDispositions ?? []).filter(item => item.updateId === updateId);
+        const disposition = matches[0];
+        if (matches.length !== 1 || !disposition || !("dispositionKind" in disposition) ||
+            disposition.dispositionKind !== "legacy-custody" || disposition.action !== "discard" ||
+            disposition.failureId !== `abandon-${disposition.evidenceSha256}` ||
+            current.file.entries.some(entry => entry.updateId === updateId)) return undefined;
+        const journalBindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+        const retainedPath = join(`${path}.retained`, `${disposition.failureId}.json`);
+        let stat;
+        try { stat = lstatSync(retainedPath); }
+        catch (error) {
+          if ((error as NodeJS.ErrnoException).code === "ENOENT") throw createJournalError("conflict", retainedPath, "committed abandonment lost its retained input");
+          throw error;
+        }
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes + 4096) {
+          throw createJournalError("invalid", retainedPath, "retained input is not a bounded regular file");
+        }
+        const parsed: unknown = JSON.parse(readFileSync(retainedPath, "utf8"));
+        if (!isRecord(parsed)) throw createJournalError("invalid", retainedPath, "retained input is not an evidence record");
+        const entry = validateJournalEntry(parsed.entry, retainedPath, version);
+        const reference = createPendingRetentionReference({ path, journalBindingKey, entry, maxBytes });
+        const retained = reference.read();
+        if (entry.updateId !== updateId || reference.retainedPath !== retainedPath ||
+            !isDeepStrictEqual(retained?.requestedDisposition, disposition)) {
+          throw createJournalError("conflict", retainedPath, "retained input does not match committed abandonment");
+        }
+        return { journalBindingKey, updateId, retainedPath, operatorAuthorityId: disposition.operatorAuthorityId };
+      });
+    },
+    inspectPendingRetention(entry) {
+      return runMutation(() => {
+        if (!isTelegramUpdateJournalLegacyFamilyVersion(version)) {
+          throw createJournalError("unsupported-version", path, "pending retention requires the legacy v1 source");
+        }
+        const expected = validateJournalEntry(entry, path, version);
+        if (expected.state !== "pending") throw createJournalError("conflict", path, "retention inspection requires a pending source");
+        const journalBindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+        const reference = createPendingRetentionReference({ path, journalBindingKey, entry: expected, maxBytes });
+        const retained = reference.read();
+        return retained ? { journalBindingKey, retainedPath: reference.retainedPath,
+          requestedDisposition: retained.requestedDisposition } : undefined;
+      });
+    },
+    abandonPending(input) {
+      return runMutation((readCurrent) => {
+        if (!isTelegramUpdateJournalLegacyFamilyVersion(version)) {
+          throw createJournalError("unsupported-version", path, "pending abandonment requires the legacy v1 source");
+        }
+        const journalBindingKey = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+        if (input.journalBindingKey !== journalBindingKey) {
+          throw createJournalError("identity-mismatch", path, "pending abandonment belongs to another source");
+        }
+        if (!isBoundedString(input.operatorAuthorityId, TELEGRAM_UPDATE_JOURNAL_FAILURE_ID_MAX_LENGTH) ||
+            !input.operatorAuthorityId.trim() || typeof input.isCurrent !== "function") {
+          throw createJournalError("invalid", path, "pending abandonment requires explicit operator authority");
+        }
+        const assertCurrent = () => {
+          if (!input.isCurrent()) throw createJournalError("conflict", path, "pending abandonment lost authority");
+        };
+        assertCurrent();
+        const expected = validateJournalEntry(input.entry, path, version);
+        if (expected.state !== "pending" || expected.inputClaim || expected.inputProvenance ||
+            expected.queueOwner || expected.queueHandoff || expected.queueReceiptId || expected.failure) {
+          throw createJournalError("conflict", path, "only an exact unclaimed pending source may be abandoned");
+        }
+        // Never repair/quarantine source evidence while deciding an operator cancellation.
+        const readStrict = sourceAccess ? readCurrent : () => readCurrentStrict(false);
+        const current = readStrict();
+        const { evidenceSha256, failureId, retainedPath, read: readRetention } =
+          createPendingRetentionReference({ path, journalBindingKey, entry: expected, maxBytes });
+        const existing = current.file.operatorDispositions?.find(item =>
+          item.failureId === failureId || item.updateId === expected.updateId);
+        const currentEntry = current.file.entries.find(entry => entry.updateId === expected.updateId);
+        const assertRetention = (retained: TelegramUpdateJournalRetainedInput | undefined,
+          disposition: TelegramUpdateJournalLegacyCustodyDisposition): void => {
+          if (!retained || !isDeepStrictEqual(retained.requestedDisposition, disposition)) {
+            throw createJournalError("conflict", retainedPath, "retained input does not match abandonment evidence");
           }
-          requestedIds.add(updateId);
+        };
+        if (existing) {
+          if (currentEntry || !("dispositionKind" in existing) || existing.dispositionKind !== "legacy-custody" ||
+              existing.failureId !== failureId || existing.action !== "discard" || existing.evidenceSha256 !== evidenceSha256) {
+            throw createJournalError("conflict", path, "pending source already has another disposition");
+          }
+          assertRetention(readRetention(), existing);
+          assertCurrent();
+          return { disposition: existing, retainedPath, duplicate: true,
+            entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
         }
-        const requestedEntries = current.file.entries.filter((entry) =>
-          requestedIds.has(entry.updateId),
-        );
-        const protectedEntry = requestedEntries.find(
-          (entry) => entry.state === "failed" || entry.state === "queued",
-        );
-        if (protectedEntry) {
-          throw createJournalError(
-            "conflict",
-            path,
-            protectedEntry.state === "failed"
-              ? `cannot complete terminal update ${protectedEntry.updateId} without an operator disposition`
-              : `cannot complete queued update ${protectedEntry.updateId} without its exact owner receipt`,
-          );
+        if (!currentEntry || !isDeepStrictEqual(currentEntry, expected)) {
+          throw createJournalError("conflict", path, "pending source changed before abandonment");
         }
-        const removedUpdateIds = requestedEntries.map(
-          (entry) => entry.updateId,
-        );
-        const published = publishMutation(
-          current,
-          current.file.entries.filter(
-            (entry) => !requestedIds.has(entry.updateId),
-          ),
-          removedUpdateIds.length > 0,
-        );
-        return {
-          removedUpdateIds,
-          entryCount: published.file.entries.length,
-          serializedBytes: published.serializedBytes,
+        const nowMs = getNowMs();
+        if (!isSafeNonNegativeInteger(nowMs)) throw createJournalError("invalid", path, "invalid abandonment timestamp");
+        const retained = readRetention();
+        let disposition: TelegramUpdateJournalLegacyCustodyDisposition;
+        if (retained) {
+          disposition = retained.requestedDisposition;
+        } else {
+          // Reuse the existing legacy discard tombstone so older v1 readers also refuse replay.
+          // This is an operator disposition, not a fabricated execution failure or completion.
+          disposition = { dispositionKind: "legacy-custody", failureId, updateId: expected.updateId,
+            action: "discard", committedAtMs: nowMs, evidenceSha256,
+            operatorAuthorityId: input.operatorAuthorityId, authorizedAtMs: nowMs };
+          const copy: TelegramUpdateJournalRetainedInput = { version: 1, kind: "pending-input-retention",
+            journalBindingKey, entry: expected, requestedDisposition: disposition };
+          writeJournalFile(retainedPath, `${JSON.stringify(copy)}\n`, (boundary, target) => {
+            onPublicationBoundary?.(boundary, target);
+            assertCurrent();
+          });
+        }
+        assertCurrent();
+        assertRetention(readRetention(), disposition);
+        const committed = (snapshot: ReadTelegramUpdateJournalResult) =>
+          !snapshot.file.entries.some(entry => entry.updateId === expected.updateId) &&
+          snapshot.file.operatorDispositions?.some(item => isDeepStrictEqual(item, disposition));
+        try {
+          const published = publishMutation(current,
+            current.file.entries.filter(entry => entry.updateId !== expected.updateId), true,
+            [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId,
+            (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
+          return { disposition, retainedPath, duplicate: false,
+            entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
+        } catch (error) {
+          // A segment may be durable even if later snapshot compaction failed.
+          // Only exact read-back can turn that unknown acknowledgement into success.
+          let observed: ReadTelegramUpdateJournalResult;
+          try { observed = readStrict(); } catch { throw error; }
+          if (!committed(observed)) throw error;
+          assertRetention(readRetention(), disposition);
+          return { disposition, retainedPath, duplicate: false,
+            entryCount: observed.file.entries.length, serializedBytes: observed.serializedBytes };
+        }
+      });
+    },
+    removeCompleted(updateIds) { return removeCompleted(updateIds); },
+    removeCompletedExact(updateIds, expectedSources, completions) { return removeCompleted(updateIds, expectedSources, true, completions); },
+    inspectQueuedReceipt(expected) {
+      return runMutationCore(readCurrent => {
+        if (!sourceAccess || !isTelegramUpdateJournalLegacyFamilyVersion(version)) {
+          throw createJournalError("invalid", path, "queue receipt observation requires an exact legacy v1 source handle");
+        }
+        const queueOwner = validateQueuedReceiptObservation(expected, path);
+        const current = readCurrent();
+        return inspectJournalQueuedReceipt(current.file, { ...expected, queueOwner }, path);
+      });
+    },
+    inspectSourceCompletion(expected) {
+      return runMutation(readCurrent => {
+        if (!sourceAccess) throw createJournalError("invalid", path, "source completion requires an exact source handle");
+        const completion = validateJournalSourceCompletion(expected, path);
+        const current = readCurrent();
+        return inspectJournalSourceCompletion(current.file, completion, path);
+      });
+    },
+  };
+  if (isTelegramUpdateJournalLegacyFamilyVersion(version)) journal.routingInputs = {
+    arm(input) { return mutateRoutingInputs(input, false, input.publishedAtMs).entries; },
+    select(input) { return mutateRoutingInputs(input, true); },
+    inspectExpiry(updateId) {
+      return runMutation(readCurrent => {
+        if (!isSafeNonNegativeInteger(updateId)) throw createJournalError("invalid", path, "invalid routing expiry update ID");
+        return inspectRoutingInputExpiry(readCurrent().file,
+          createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity }), updateId);
+      });
+    },
+    inspectGroupExpiry(updateIds) {
+      return runMutation(readCurrent => inspectRoutingGroupExpiry(readCurrent().file,
+        createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity }), updateIds));
+    },
+    expire(input) {
+      return runMutation(readCurrent => {
+        const original = validateJournalEntry(input.entry, path, version), lifetime = original.routingInput;
+        const binding = createTelegramUpdateJournalBindingKey({ path, profileName: profile, botIdentity: expectedIdentity });
+        if (!lifetime || original.state !== "pending" || original.inputClaim || original.inputProvenance || original.queueOwner ||
+            original.queueReceiptId || original.queueHandoff || original.failure || input.journalBindingKey !== binding ||
+            lifetime.operatorUserId !== input.operatorUserId || !isSafePositiveInteger(input.operatorUserId) || typeof input.isCurrent !== "function") {
+          throw createJournalError("conflict", path, "routing expiry requires an exact unclaimed chooser source");
+        }
+        const assertCurrent = () => {
+          const now = getNowMs();
+          if (!isSafeNonNegativeInteger(now) || now < lifetime.expiresAtMs || !input.isCurrent())
+            throw createJournalError("conflict", path, "routing source has not expired under current authority");
         };
+        assertCurrent();
+        const current = sourceAccess ? readCurrent() : readCurrentStrict(false);
+        const evidenceSha256 = createHash("sha256").update(JSON.stringify(original)).digest("hex");
+        const failureId = `routing-expiry:${evidenceSha256}`;
+        const existing = current.file.operatorDispositions?.find(value => value.updateId === original.updateId);
+        const entry = current.file.entries.find(value => value.updateId === original.updateId);
+        if (existing) {
+          if (entry || !("dispositionKind" in existing) || existing.dispositionKind !== "legacy-custody" || existing.action !== "discard" ||
+              existing.failureId !== failureId || existing.evidenceSha256 !== evidenceSha256 || existing.operatorAuthorityId !== `telegram-owner:${input.operatorUserId}`)
+            throw createJournalError("conflict", path, "routing source has contradictory expiry evidence");
+          assertCurrent();
+          return { disposition: existing, duplicate: true, entryCount: current.file.entries.length, serializedBytes: current.serializedBytes };
+        }
+        if (!entry || !isDeepStrictEqual(entry, original)) throw createJournalError("conflict", path, "routing source changed before expiry");
+        // A discard tombstone prevents old readers and delayed reports from replaying; no prompt-body archive is written.
+        const now = getNowMs();
+        const disposition: TelegramUpdateJournalLegacyCustodyDisposition = { dispositionKind: "legacy-custody", failureId,
+          updateId: original.updateId, action: "discard", committedAtMs: now, authorizedAtMs: now, evidenceSha256,
+          operatorAuthorityId: `telegram-owner:${input.operatorUserId}` };
+        const published = publishMutation(current, current.file.entries.filter(value => value.updateId !== original.updateId), true,
+          [...(current.file.operatorDispositions ?? []), disposition], current.file.acceptedThroughUpdateId,
+          (boundary, target) => { onPublicationBoundary?.(boundary, target); assertCurrent(); });
+        assertCurrent();
+        return { disposition, duplicate: false, entryCount: published.file.entries.length, serializedBytes: published.serializedBytes };
       });
     },
   };
@@ -5178,7 +6103,7 @@ function createJournalStoreCore(
       const evidence = readTelegramUpdateJournalSource({
         directory: sourceAccess.directory, path, profile,
         botIdentity: expectedIdentity, limits: sourceAccess.limits,
-        version: TELEGRAM_UPDATE_JOURNAL_CUSTODY_VERSION,
+        version,
       });
       return evidence.kind === "present"
         ? listTelegramUpdateJournalLegacyCustodyCandidates(evidence.file) : [];