@llblab/pi-telegram 0.52.2 → 0.53.0

package/dist/lib/bus-follower.js

@@ -5,17 +5,20 @@
  * heartbeat, forwarded-update receiving, and follower-routed API calls.
  * It must not spawn Pi processes or create hidden Telegram-originated instances.
  */
+import { createHash } from "node:crypto";
 import { basename } from "node:path";
 import { isDeepStrictEqual } from "node:util";
+import { getTelegramBusTransportRetryPolicy, TELEGRAM_BUS_REGISTRATION_RETRY, } from "./bus-transport.js";
+import { createTelegramBusFollowerDeliveryIdentity, createTelegramBusForeignOwnedUpdateForwarder, createTelegramBusLocalServer, createTelegramBusRequestIdFactory, createUnauthorizedBusAck, rejectTelegramBusRequest, getTelegramBusProtocolCompatibility, getTelegramBusSocketPath, hasTelegramBusCapability, isTelegramBusEnvelopeAuthorized, parseTelegramBusEnvelope, resolveTelegramBusSocketPath, sendTelegramBusLocalEnvelope, TELEGRAM_BUS_CAPABILITY_DIRECTORY_DISPLAY_FORMAT, TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY, TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET, TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE, TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE, TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY, TELEGRAM_BUS_CAPABILITY_SESSION_REPLACEMENT_INTENT, TELEGRAM_BUS_CAPABILITY_THREAD_DISPLAY_MODE, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE, TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME, TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES, TELEGRAM_BUS_LIVE_REBIND_CAPABILITIES, TelegramBusLocalAuthorityError, } from "./bus.js";
+import { parseTelegramUpdateJournalQueueOwner, } from "./journal.js";
+import { TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS, } from "./locks.js";
+import { isPiStaleContextError } from "./pi.js";
+import { parseTelegramTarget as parseTarget, } from "./target.js";
+import { isTelegramApiMethodRetrySafe, TelegramApiAuthorityError, TelegramApiCommitUnknownError, TelegramApiStaleTargetError, } from "./telegram-api.js";
 import * as Threads from "./threads.js";
-import * as WorkspaceIdentity from "./workspace-identity.js";
 import { isWireRecord as isRecord } from "./wire.js";
-import { parseTelegramUpdateJournalQueueOwner } from "./journal.js";
-import { TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS, } from "./locks.js";
-import { isTelegramApiMethodRetrySafe, TelegramApiCommitUnknownError, TelegramApiStaleTargetError, } from "./telegram-api.js";
-import { createTelegramBusFollowerDeliveryIdentity, createTelegramBusForeignOwnedUpdateForwarder, createTelegramBusLocalServer, createTelegramBusRequestIdFactory, createUnauthorizedBusAck, getTelegramBusProtocolCompatibility, getTelegramBusSocketPath, hasTelegramBusCapability, isTelegramBusEnvelopeAuthorized, resolveTelegramBusSocketPath, sendTelegramBusLocalEnvelope, TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME, TELEGRAM_BUS_CAPABILITY_THREAD_DISPLAY_MODE, TELEGRAM_BUS_CAPABILITY_DIRECTORY_DISPLAY_FORMAT, TELEGRAM_BUS_CAPABILITY_SESSION_REPLACEMENT_INTENT, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE, } from "./bus.js";
-import { getTelegramBusTransportRetryPolicy, TELEGRAM_BUS_REGISTRATION_RETRY, } from "./bus-transport.js";
 import { createTelegramWorkspaceAdmissionOperationId, runWithTelegramWorkspaceAdmissionsAsync, } from "./workspace-admission.js";
+import * as WorkspaceIdentity from "./workspace-identity.js";
 const TELEGRAM_BUS_FOLLOWER_PROMOTION_GRACE_MS = 2_500;
 const TELEGRAM_FOLLOWER_SESSION_HANDOFF_TTL_MS = 30_000;
 const TELEGRAM_BUS_FOLLOWER_CLIENT_TIMEOUT_MS = 30_000;
@@ -86,17 +89,16 @@ export function createTelegramBusFollowerPromotionHandler(input) {
     return (ctx, binding, election) => runTelegramBusFollowerWorkspaceMutation(input, "workspace.promote-follower", async () => {
         let promotedRecord;
         const promoted = await input.startLeader(ctx, election, async () => {
-            promotedRecord =
-                await Threads.promoteTelegramFollowerBindingToLeader({
-                    store: input.topicTargetStore,
-                    instanceId: input.instanceId,
-                    cwd: ctx.cwd,
-                    sessionId: input.getSessionId?.(ctx),
-                    telegramProfile: input.getActiveProfileName(),
-                    target: binding.target,
-                    slot: binding.slot,
-                    threadName: binding.threadName,
-                });
+            promotedRecord = await Threads.promoteTelegramFollowerBindingToLeader({
+                store: input.topicTargetStore,
+                instanceId: input.instanceId,
+                cwd: ctx.cwd,
+                sessionId: input.getSessionId?.(ctx),
+                telegramProfile: input.getActiveProfileName(),
+                target: binding.target,
+                slot: binding.slot,
+                threadName: binding.threadName,
+            });
             if (!promotedRecord && typeof binding.target?.threadId === "number") {
                 throw new Error("Telegram follower promotion slot authority is unavailable.");
             }
@@ -148,18 +150,23 @@ export function createTelegramBusFollowerRuntimeAssembly(ports) {
     const isReadyContext = (ctx) => Boolean(readyContext &&
         (ctx === undefined || readyContext.ctx === ctx) &&
         ports.registrationState.getGeneration() === readyContext.generation &&
-        ports.registration.getSessionGeneration?.() === readyContext.sessionGeneration &&
-        ports.registration.getSessionId?.(readyContext.ctx) === readyContext.sessionId &&
+        ports.registration.getSessionGeneration?.() ===
+            readyContext.sessionGeneration &&
+        ports.registration.getSessionId?.(readyContext.ctx) ===
+            readyContext.sessionId &&
         ports.registration.isContextActive?.(readyContext.ctx) !== false);
     const prepareContext = async (ctx) => {
         const generation = ports.registrationState.getGeneration();
         const sessionGeneration = ports.registration.getSessionGeneration?.();
         const sessionId = ports.registration.getSessionId?.(ctx);
         readyContext = undefined;
-        if (!generation || (sessionId !== undefined && ports.registrationState.getSessionId(sessionId) !== sessionId))
+        if (!generation ||
+            (sessionId !== undefined &&
+                ports.registrationState.getSessionId(sessionId) !== sessionId))
             throw new Error("Telegram follower session change requires acknowledged leader registration.");
         await ports.registration.onRegistered?.(ctx);
-        if (generation && ports.registrationState.getGeneration() === generation &&
+        if (generation &&
+            ports.registrationState.getGeneration() === generation &&
             ports.registration.getSessionGeneration?.() === sessionGeneration &&
             ports.registration.getSessionId?.(ctx) === sessionId &&
             ports.registration.isContextActive?.(ctx) !== false)
@@ -208,7 +215,11 @@ export function createTelegramBusFollowerRuntimeAssembly(ports) {
                 await prepareContext(ctx);
         },
     };
-    return { receiver, registration, getReadySessionId: () => isReadyContext() ? readyContext?.sessionId : undefined };
+    return {
+        receiver,
+        registration,
+        getReadySessionId: () => isReadyContext() ? readyContext?.sessionId : undefined,
+    };
 }
 /** Binds Restore to real Pi lifetime and the current authenticated transport owner, not request fields. */
 export function createTelegramBusFollowerRestoreContextGetter(deps) {
@@ -218,42 +229,105 @@ export function createTelegramBusFollowerRestoreContextGetter(deps) {
         const leader = deps.getLeaderState();
         const secret = deps.getAuthenticatedSecret();
         const leaderProtocol = deps.getLeaderProtocol();
-        if (!leaderProtocol || !hasTelegramBusCapability(leaderProtocol, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE))
+        if (!leaderProtocol ||
+            !hasTelegramBusCapability(leaderProtocol, deps.capability ?? TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE))
             return undefined;
-        if (leader.kind !== "active-elsewhere" || !secret || leader.lock.busSecret !== secret ||
-            !leader.lock.instanceId || leader.lock.leaderEpoch === undefined)
+        if (leader.kind !== "active-elsewhere" ||
+            !secret ||
+            leader.lock.busSecret !== secret ||
+            !leader.lock.instanceId ||
+            leader.lock.leaderEpoch === undefined)
             return undefined;
         const profileBindingKey = deps.getProfileBindingKey();
         const operatorUserId = deps.getOperatorUserId();
         const sessionId = deps.getSessionId(ctx);
         const cwd = deps.getCwd(ctx);
         const generation = deps.getGeneration();
-        if (!profileBindingKey || !sessionId || !cwd || typeof operatorUserId !== "number" ||
-            !Number.isSafeInteger(operatorUserId) || operatorUserId <= 0 ||
-            !Number.isSafeInteger(generation) || generation < 0 || !deps.isContextCurrent(ctx))
+        if (!profileBindingKey ||
+            !sessionId ||
+            !cwd ||
+            typeof operatorUserId !== "number" ||
+            !Number.isSafeInteger(operatorUserId) ||
+            operatorUserId <= 0 ||
+            !Number.isSafeInteger(generation) ||
+            generation < 0 ||
+            !deps.isContextCurrent(ctx))
             return undefined;
-        return { executor: { instanceId: leader.lock.instanceId, leaderEpoch: String(leader.lock.leaderEpoch) },
-            profileBindingKey, operatorUserId, sessionId, cwd, generation, leaderProtocol: structuredClone(leaderProtocol) };
+        return {
+            executor: {
+                instanceId: leader.lock.instanceId,
+                leaderEpoch: String(leader.lock.leaderEpoch),
+            },
+            profileBindingKey,
+            operatorUserId,
+            sessionId,
+            cwd,
+            generation,
+            leaderProtocol: structuredClone(leaderProtocol),
+        };
     };
 }
-/** Prepared receiver: its caller authenticates the envelope; no canonical writes, dispatch or cleanup. */
+/** Shared canonical/local target owner and scoped live-carrier hooks; caller authenticates transport, no canonical writes or cleanup. */
 export function createTelegramBusFollowerWorkspaceRestoreHandler(deps) {
-    return async (input, ctx) => {
+    const handler = async (input, ctx) => {
+        const scope = input.liveRebind, ports = scope && {
+            isCurrent: scope.isCurrent,
+            release: scope.release,
+            observeWork: scope.observeWork,
+        };
+        const suppliedTarget = scope?.expectedTarget, expectedTarget = suppliedTarget && { ...suppliedTarget };
+        const sourceUpdateIds = scope && [...scope.sourceUpdateIds].sort((a, b) => a - b);
+        const liveCurrent = scope && ports.isCurrent.bind(scope), release = scope && ports.release?.bind(scope), workObserver = scope && ports.observeWork?.bind(scope);
         const captured = deps.getContextAuthority(ctx);
         if (!captured)
             throw new Error("Stale Telegram follower Restore context.");
         const authority = structuredClone(captured);
-        const request = structuredClone(input);
-        if (!authority.profileBindingKey || !authority.sessionId || !authority.cwd ||
-            !authority.executor?.instanceId || !authority.executor.leaderEpoch ||
-            !(typeof authority.generation === "string" ? authority.generation.length > 0 :
-                Number.isSafeInteger(authority.generation) && authority.generation >= 0) ||
-            !Number.isSafeInteger(authority.operatorUserId) || authority.operatorUserId <= 0 ||
-            !request.operationId || !request.registrationGeneration || !["apply", "inspect"].includes(request.mode))
+        const request = structuredClone({
+            operationId: input.operationId,
+            registrationGeneration: input.registrationGeneration,
+            mode: input.mode,
+        });
+        const readIntent = () => liveCurrent
+            ? deps.readLiveRebindIntent?.(request.operationId, authority.profileBindingKey)
+            : deps.readRestoreIntent(request.operationId, authority.profileBindingKey);
+        let sampleWork;
+        if (suppliedTarget !== undefined && !expectedTarget)
+            throw new Error("Invalid prepared live-rebind target.");
+        if (expectedTarget &&
+            (!Number.isSafeInteger(expectedTarget.chatId) ||
+                expectedTarget.chatId !== authority.operatorUserId ||
+                !Number.isSafeInteger(expectedTarget.threadId) ||
+                expectedTarget.threadId <= 0))
+            throw new Error("Invalid prepared live-rebind target.");
+        if ((release || workObserver) &&
+            !hasTelegramBusCapability(authority.leaderProtocol, TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE))
+            throw new Error("Live-rebind settlement capability is unavailable.");
+        if (liveCurrent &&
+            !hasTelegramBusCapability(authority.leaderProtocol, TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY))
+            throw new Error("Live-rebind apply capability is unavailable.");
+        if (!authority.profileBindingKey ||
+            !authority.sessionId ||
+            !authority.cwd ||
+            !authority.executor?.instanceId ||
+            !authority.executor.leaderEpoch ||
+            !(typeof authority.generation === "string"
+                ? authority.generation.length > 0
+                : Number.isSafeInteger(authority.generation) &&
+                    authority.generation >= 0) ||
+            !Number.isSafeInteger(authority.operatorUserId) ||
+            authority.operatorUserId <= 0 ||
+            !request.operationId ||
+            !request.registrationGeneration ||
+            !["apply", "inspect"].includes(request.mode))
             throw new Error("Invalid Telegram follower Restore authority.");
         const assertCurrent = () => {
             if (!isDeepStrictEqual(deps.getContextAuthority(ctx), authority) ||
-                deps.registrationState.getGeneration() !== request.registrationGeneration)
+                liveCurrent?.() === false ||
+                (scope &&
+                    (input.liveRebind !== scope ||
+                        Object.entries(ports).some(([key, value]) => Reflect.get(scope, key) !== value))) ||
+                deps.registrationState.getGeneration() !==
+                    request.registrationGeneration)
                 throw new Error("Stale Telegram follower Restore authority.");
         };
         assertCurrent();
@@ -261,35 +335,61 @@ export function createTelegramBusFollowerWorkspaceRestoreHandler(deps) {
             throw new Error("Telegram Workspace admission authority is unavailable.");
         const result = await runTelegramBusFollowerWorkspaceMutation(deps, "workspace.restore-follower-target", async () => {
             assertCurrent();
-            const intent = deps.readRestoreIntent(request.operationId, authority.profileBindingKey);
+            const intent = readIntent();
             assertCurrent();
-            if (!intent || intent.request.operationId !== request.operationId ||
-                (intent.phase !== "recipient-issued" && intent.phase !== "ready") ||
+            if (!intent ||
+                intent.request.operationId !== request.operationId ||
+                (liveCurrent
+                    ? !("kind" in intent) ||
+                        intent.kind !== "live-rebind" ||
+                        !isDeepStrictEqual([...intent.request.source.updateIds].sort((a, b) => a - b), sourceUpdateIds) ||
+                        (request.mode === "apply"
+                            ? intent.phase !== "rebound"
+                            : !["rebound", "released", "finished"].includes(intent.phase))
+                    : "kind" in intent ||
+                        (intent.phase !== "recipient-issued" &&
+                            intent.phase !== "ready")) ||
+                (expectedTarget &&
+                    !isDeepStrictEqual(intent.request.target, expectedTarget)) ||
                 !isDeepStrictEqual(intent.executor, authority.executor) ||
-                intent.operatorUserId !== authority.operatorUserId || !intent.recipient ||
-                (request.mode === "apply" && (intent.recipient.kind !== "follower" || intent.recipient.instanceId !== deps.instanceId ||
-                    intent.recipient.generation !== request.registrationGeneration)) ||
-                intent.recipient.sessionId !== authority.sessionId || intent.request.binding.sessionId !== authority.sessionId ||
-                intent.request.binding.cwd !== WorkspaceIdentity.normalizeTelegramWorkspacePath(authority.cwd))
+                intent.operatorUserId !== authority.operatorUserId ||
+                !intent.recipient ||
+                ((request.mode === "apply" || liveCurrent) &&
+                    (intent.recipient.kind !== "follower" ||
+                        intent.recipient.instanceId !== deps.instanceId ||
+                        intent.recipient.generation !==
+                            request.registrationGeneration)) ||
+                intent.recipient.sessionId !== authority.sessionId ||
+                intent.request.binding.sessionId !== authority.sessionId ||
+                intent.request.binding.cwd !==
+                    WorkspaceIdentity.normalizeTelegramWorkspacePath(authority.cwd))
                 throw new Error("Telegram follower Restore intent does not match this recipient.");
             const expected = structuredClone(intent);
             await deps.topicTargetStore.load();
             assertCurrent();
             const observe = (canonical) => {
-                if (!isDeepStrictEqual(deps.readRestoreIntent(request.operationId, authority.profileBindingKey), expected))
+                if (!isDeepStrictEqual(readIntent(), expected))
                     throw new Error("Telegram follower Restore intent changed.");
                 assertCurrent();
                 const { binding, target } = expected.request;
-                const bindings = (canonical.workspaceBindings ?? []).filter(value => value.bindingKey === binding.bindingKey);
+                const bindings = (canonical.workspaceBindings ?? []).filter((value) => value.bindingKey === binding.bindingKey);
                 const snapshot = canonical.threads;
-                const records = snapshot.filter(value => value.instanceId === deps.instanceId);
-                const owners = snapshot.filter(value => value.status === "active" &&
-                    (value.slot === binding.slot || isDeepStrictEqual(value.target, target)));
-                if (bindings.length !== 1 || records.length !== 1 || owners.length !== 1 || bindings[0]?.cwd !== binding.cwd ||
-                    bindings[0]?.sessionId !== binding.sessionId || bindings[0]?.slot !== binding.slot || bindings[0]?.inactiveSinceMs !== undefined ||
-                    !isDeepStrictEqual(bindings[0]?.target, target) || records[0]?.status !== "active" ||
+                const records = snapshot.filter((value) => value.instanceId === deps.instanceId);
+                const owners = snapshot.filter((value) => value.status === "active" &&
+                    (value.slot === binding.slot ||
+                        isDeepStrictEqual(value.target, target)));
+                if (bindings.length !== 1 ||
+                    records.length !== 1 ||
+                    owners.length !== 1 ||
+                    bindings[0]?.cwd !== binding.cwd ||
+                    bindings[0]?.sessionId !== binding.sessionId ||
+                    bindings[0]?.slot !== binding.slot ||
+                    bindings[0]?.inactiveSinceMs !== undefined ||
+                    !isDeepStrictEqual(bindings[0]?.target, target) ||
+                    records[0]?.status !== "active" ||
                     records[0]?.owner?.kind !== "manual-follower" ||
-                    records[0]?.slot !== binding.slot || !isDeepStrictEqual(records[0]?.target, target) ||
+                    records[0]?.slot !== binding.slot ||
+                    !isDeepStrictEqual(records[0]?.target, target) ||
                     deps.registrationState.getSlot() !== binding.slot)
                     throw new Error("Telegram follower Restore canonical binding is not committed.");
                 const localTarget = deps.registrationState.getTarget();
@@ -298,33 +398,223 @@ export function createTelegramBusFollowerWorkspaceRestoreHandler(deps) {
                     throw new Error("Telegram follower Restore local target changed.");
                 assertCurrent();
                 if (!alreadyReady && request.mode === "apply") {
-                    if (expected.phase !== "recipient-issued")
+                    if (expected.phase !== (liveCurrent ? "rebound" : "recipient-issued"))
                         throw new Error("Telegram follower Restore readiness regressed.");
-                    deps.registrationState.setRegistered(true, target, { slot: binding.slot,
-                        threadName: records[0]?.threadName, generation: request.registrationGeneration,
-                        leaderProtocol: deps.registrationState.getLeaderProtocol() });
+                    deps.registrationState.setRegistered(true, target, {
+                        slot: binding.slot,
+                        threadName: records[0]?.threadName,
+                        generation: request.registrationGeneration,
+                        leaderProtocol: deps.registrationState.getLeaderProtocol(),
+                    });
                 }
                 assertCurrent();
                 const observedTarget = deps.registrationState.getTarget();
-                if (!observedTarget || (!isDeepStrictEqual(observedTarget, target) && !isDeepStrictEqual(observedTarget, binding.target)))
+                if (!observedTarget ||
+                    (!isDeepStrictEqual(observedTarget, target) &&
+                        !isDeepStrictEqual(observedTarget, binding.target)))
                     throw new Error("Telegram follower Restore local target changed.");
                 const ready = isDeepStrictEqual(observedTarget, target);
                 assertCurrent();
-                return { operationId: request.operationId, recipient: { kind: "follower", instanceId: deps.instanceId,
-                        sessionId: authority.sessionId, generation: request.registrationGeneration },
-                    target: { chatId: observedTarget.chatId, threadId: observedTarget.threadId }, slot: binding.slot, ready };
+                return {
+                    operationId: request.operationId,
+                    recipient: {
+                        kind: "follower",
+                        instanceId: deps.instanceId,
+                        sessionId: authority.sessionId,
+                        generation: request.registrationGeneration,
+                    },
+                    target: {
+                        chatId: observedTarget.chatId,
+                        threadId: observedTarget.threadId,
+                    },
+                    slot: binding.slot,
+                    ready,
+                };
             };
             let result;
-            deps.topicTargetStore.withWorkspaceRestoreSnapshot(expected, snapshot => { result = observe(snapshot); });
+            deps.topicTargetStore.withWorkspaceRestoreSnapshot(expected, (snapshot) => {
+                result = observe(snapshot);
+            });
             if (!result)
                 throw new Error("Telegram follower Restore observation was not completed.");
+            if (release || workObserver) {
+                if (!("kind" in expected) ||
+                    expected.kind !== "live-rebind" ||
+                    expected.phase !== "released" ||
+                    !result.ready ||
+                    request.mode !== "inspect")
+                    throw new Error("Live-rebind dispatch has no canonical released/local-applied grant.");
+                // Journal reads stay outside the canonical transaction; each barrier check reobserves only Workspace authority.
+                if (workObserver)
+                    sampleWork = () => {
+                        deps.topicTargetStore.withWorkspaceRestoreSnapshot(expected, (snapshot) => {
+                            if (!observe(snapshot).ready)
+                                throw new Error("Live-rebind work observation lost local target application.");
+                            workObserver(expected.request.binding.target);
+                            assertCurrent();
+                        });
+                    };
+                release?.(() => {
+                    assertCurrent();
+                    let ready = false;
+                    deps.topicTargetStore.withWorkspaceRestoreSnapshot(expected, (snapshot) => {
+                        ready = observe(snapshot).ready;
+                    });
+                    assertCurrent();
+                    return ready;
+                });
+            }
             return result;
         });
         assertCurrent();
-        if (!isDeepStrictEqual(deps.registrationState.getTarget(), result.target) || deps.registrationState.getSlot() !== result.slot)
+        if (!isDeepStrictEqual(deps.registrationState.getTarget(), result.target) ||
+            deps.registrationState.getSlot() !== result.slot)
             throw new Error("Telegram follower Restore local registration changed after admission release.");
+        // Work can change while admission releases; sample only after that await under a fresh canonical snapshot.
+        sampleWork?.();
+        assertCurrent();
         return result;
     };
+    return Object.assign(handler, {
+        /** Capture availability only; asserting current recipient requires canonical released/local-applied ownership. */
+        prepareLiveCommandRecipient(input, ctx) {
+            const expected = structuredClone(input), getAuthority = deps.getContextAuthority, read = deps.readLiveRebindIntent, store = deps.topicTargetStore;
+            const snapshot = store.withWorkspaceLiveRebindSnapshot, state = deps.registrationState;
+            const statePorts = {
+                getTarget: state.getTarget,
+                getSlot: state.getSlot,
+                getGeneration: state.getGeneration,
+                getLeaderProtocol: state.getLeaderProtocol,
+            };
+            const instanceId = deps.instanceId, authority = structuredClone(getAuthority.call(deps, ctx)), oldTarget = structuredClone(state.getTarget()), slot = state.getSlot();
+            if (!authority ||
+                !read ||
+                !snapshot ||
+                !instanceId ||
+                !slot ||
+                !expected.operationId?.trim() ||
+                !expected.registrationGeneration?.trim() ||
+                expected.sessionId !== authority.sessionId ||
+                expected.sourceUpdateIds.length !== 1 ||
+                !Number.isSafeInteger(expected.sourceUpdateIds[0]) ||
+                expected.sourceUpdateIds[0] < 0 ||
+                typeof authority.generation !== "number" ||
+                !Number.isSafeInteger(authority.generation) ||
+                authority.generation < 0 ||
+                !authority.profileBindingKey?.trim() ||
+                !authority.cwd?.trim() ||
+                !authority.executor?.instanceId?.trim() ||
+                !authority.executor.leaderEpoch?.trim() ||
+                !Number.isSafeInteger(authority.operatorUserId) ||
+                authority.operatorUserId <= 0 ||
+                expected.target.chatId !== authority.operatorUserId ||
+                !Number.isSafeInteger(expected.target.threadId) ||
+                expected.target.threadId <= 0 ||
+                !oldTarget ||
+                oldTarget.chatId !== expected.target.chatId ||
+                !Number.isSafeInteger(oldTarget.threadId) ||
+                oldTarget.threadId <= 0)
+                return undefined;
+            const portsCurrent = () => deps.instanceId === instanceId &&
+                deps.getContextAuthority === getAuthority &&
+                deps.readLiveRebindIntent === read &&
+                deps.topicTargetStore === store &&
+                store.withWorkspaceLiveRebindSnapshot === snapshot &&
+                deps.registrationState === state &&
+                Object.entries(statePorts).every(([key, value]) => Reflect.get(state, key) === value);
+            const isCurrent = () => {
+                try {
+                    if (!portsCurrent() ||
+                        !isDeepStrictEqual(getAuthority.call(deps, ctx), authority) ||
+                        state.getGeneration() !== expected.registrationGeneration ||
+                        state.getSlot() !== slot ||
+                        !isDeepStrictEqual(state.getLeaderProtocol(), authority.leaderProtocol) ||
+                        ![
+                            ...TELEGRAM_BUS_LIVE_REBIND_CAPABILITIES,
+                            ...TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES,
+                        ].every((cap) => hasTelegramBusCapability(authority.leaderProtocol, cap)) ||
+                        ![oldTarget, expected.target].some((target) => isDeepStrictEqual(state.getTarget(), target)))
+                        return false;
+                    return (portsCurrent() &&
+                        isDeepStrictEqual(getAuthority.call(deps, ctx), authority) &&
+                        state.getGeneration() === expected.registrationGeneration &&
+                        state.getSlot() === slot &&
+                        isDeepStrictEqual(state.getLeaderProtocol(), authority.leaderProtocol) &&
+                        [oldTarget, expected.target].some((target) => isDeepStrictEqual(state.getTarget(), target)) &&
+                        portsCurrent());
+                }
+                catch {
+                    return false;
+                }
+            };
+            if (!isCurrent())
+                return undefined;
+            return {
+                isCurrent,
+                assertRecipientCurrent() {
+                    if (!isCurrent())
+                        throw new Error("Selected command recipient authority changed.");
+                    const value = read.call(deps, expected.operationId, authority.profileBindingKey);
+                    if (!value ||
+                        value.kind !== "live-rebind" ||
+                        value.phase !== "released" ||
+                        value.cleanup ||
+                        value.request.operationId !== expected.operationId ||
+                        value.recipient.kind !== "follower" ||
+                        value.recipient.instanceId !== instanceId ||
+                        value.recipient.sessionId !== expected.sessionId ||
+                        value.recipient.generation !== expected.registrationGeneration ||
+                        !isDeepStrictEqual(value.executor, authority.executor) ||
+                        value.operatorUserId !== authority.operatorUserId ||
+                        !isDeepStrictEqual(value.request.source.updateIds, expected.sourceUpdateIds) ||
+                        !isDeepStrictEqual(value.request.target, expected.target) ||
+                        !isDeepStrictEqual(value.request.binding.target, oldTarget) ||
+                        value.request.owner.instanceId !== instanceId ||
+                        value.request.owner.owner?.kind !== "manual-follower" ||
+                        value.request.owner.slot !== slot ||
+                        !isDeepStrictEqual(value.request.owner.target, oldTarget) ||
+                        value.request.binding.cwd !==
+                            WorkspaceIdentity.normalizeTelegramWorkspacePath(authority.cwd) ||
+                        value.request.binding.sessionId !== expected.sessionId ||
+                        value.request.binding.slot !== slot ||
+                        !isCurrent())
+                        throw new Error("Selected command recipient has no exact released intent.");
+                    const intent = structuredClone(value);
+                    let confirmed = false;
+                    snapshot.call(store, intent, (canonical) => {
+                        if (!isCurrent() ||
+                            !isDeepStrictEqual(read.call(deps, expected.operationId, authority.profileBindingKey), intent))
+                            return;
+                        const bindings = (canonical.workspaceBindings ?? []).filter((row) => row.bindingKey === intent.request.binding.bindingKey);
+                        const owners = canonical.threads.filter((row) => row.status === "active" &&
+                            (row.slot === slot ||
+                                isDeepStrictEqual(row.target, expected.target)));
+                        const row = bindings[0], owner = owners[0];
+                        confirmed =
+                            bindings.length === 1 &&
+                                row?.sessionId === expected.sessionId &&
+                                row.cwd === intent.request.binding.cwd &&
+                                row.slot === slot &&
+                                row.workspaceKey === intent.request.binding.workspaceKey &&
+                                row.inactiveSinceMs === undefined &&
+                                isDeepStrictEqual(row.target, expected.target) &&
+                                owners.length === 1 &&
+                                owner?.instanceId === instanceId &&
+                                owner.owner?.kind === "manual-follower" &&
+                                owner.slot === slot &&
+                                owner.profileKey === intent.request.owner.profileKey &&
+                                isDeepStrictEqual(owner.owner, intent.request.owner.owner) &&
+                                isDeepStrictEqual(owner.target, expected.target) &&
+                                isDeepStrictEqual(state.getTarget(), expected.target) &&
+                                isCurrent() &&
+                                isDeepStrictEqual(read.call(deps, expected.operationId, authority.profileBindingKey), intent);
+                    });
+                    if (!confirmed || !isCurrent())
+                        throw new Error("Selected command canonical/local recipient changed.");
+                },
+            };
+        },
+    });
 }
 export function createTelegramBusFollowerClientRuntime(deps) {
     const createRequestId = createTelegramBusRequestIdFactory(deps.instanceId);
@@ -370,22 +660,14 @@ export function createTelegramBusFollowerQueueHandoffClient(deps) {
     return async (input) => {
         const registration = await resolveTelegramBusFollowerRegistration(deps, timeoutMs);
         const socketPath = resolveTelegramBusSocketPath(deps.socketPath);
-        const response = await sendTelegramBusLocalEnvelope({
-            socketPath,
-            timeoutMs: registration.remainingTimeoutMs,
-            retry: getTelegramBusTransportRetryPolicy({
-                endpoint: socketPath,
-                operation: "operation",
-            }),
-            envelope: {
-                kind: "follower.offerQueueHandoff",
-                requestId: deps.createRequestId(),
-                auth: deps.getAuthSecret?.(),
-                instanceId: deps.instanceId,
-                registrationGeneration: registration.generation,
-                ...input,
-                sentAtMs: getNowMs(),
-            },
+        const response = await sendTelegramBusOperation(socketPath, registration.remainingTimeoutMs, {
+            kind: "follower.offerQueueHandoff",
+            requestId: deps.createRequestId(),
+            auth: deps.getAuthSecret?.(),
+            instanceId: deps.instanceId,
+            registrationGeneration: registration.generation,
+            ...input,
+            sentAtMs: getNowMs(),
         });
         const queueOwner = response?.kind === "bus.ack" && isRecord(response.result)
             ? parseTelegramUpdateJournalQueueOwner(response.result.queueOwner)
@@ -402,7 +684,8 @@ export function createTelegramBusFollowerQueueHandoffClient(deps) {
                 input.payload.admissionReceipts[0]?.receiptId &&
             response.result.sourceUpdateIds.length ===
                 input.payload.admissionReceipts[0].sourceUpdateIds.length &&
-            response.result.sourceUpdateIds.every((updateId, index) => updateId === input.payload.admissionReceipts[0].sourceUpdateIds[index]) &&
+            response.result.sourceUpdateIds.every((updateId, index) => updateId ===
+                input.payload.admissionReceipts[0].sourceUpdateIds[index]) &&
             queueOwner) {
             return {
                 status: "staged",
@@ -412,7 +695,7 @@ export function createTelegramBusFollowerQueueHandoffClient(deps) {
             };
         }
         throw new Error(response?.kind === "bus.ack"
-            ? response.message ?? "Telegram queue handoff was rejected."
+            ? (response.message ?? "Telegram queue handoff was rejected.")
             : "Telegram queue handoff did not return an acknowledgement.");
     };
 }
@@ -421,19 +704,11 @@ function createTelegramBusAgentMessageClient(deps) {
     const timeoutMs = deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CLIENT_TIMEOUT_MS;
     const request = async (envelope, requestTimeoutMs = timeoutMs) => {
         const socketPath = resolveTelegramBusSocketPath(deps.socketPath);
-        const response = await sendTelegramBusLocalEnvelope({
-            socketPath,
-            timeoutMs: requestTimeoutMs,
-            retry: getTelegramBusTransportRetryPolicy({
-                endpoint: socketPath,
-                operation: "operation",
-            }),
-            envelope,
-        });
+        const response = await sendTelegramBusOperation(socketPath, requestTimeoutMs, envelope);
         if (response?.kind === "bus.ack" && response.ok)
             return response.result;
         throw new Error(response?.kind === "bus.ack"
-            ? response.message ?? "Telegram bus agent message failed."
+            ? (response.message ?? "Telegram bus agent message failed.")
             : "Telegram bus agent message did not return an acknowledgement.");
     };
     const registrationFields = async () => {
@@ -479,6 +754,151 @@ function createTelegramBusAgentMessageClient(deps) {
         },
     };
 }
+/** Private selected text-effect caller; not a guarded ordinary API adapter or follower command admission grant. */
+export function createTelegramBusFollowerSelectedMenuCaller(deps) {
+    return async (input) => {
+        let dispatched = false, method = "sendMessage";
+        try {
+            const client = { ...deps.client }, recipient = deps.recipient, ctx = input.ctx, assertAuthority = input.assertAuthority;
+            const getAuthority = recipient.getContextAuthority, getJournal = recipient.getJournalBindingKey, getProcess = recipient.getProcessIdentity;
+            const state = recipient.registrationState, statePorts = {
+                getTarget: state.getTarget,
+                getSlot: state.getSlot,
+                getGeneration: state.getGeneration,
+                getLeaderProtocol: state.getLeaderProtocol,
+            };
+            const authority = structuredClone(getAuthority.call(recipient, ctx));
+            const journalBindingKey = getJournal.call(recipient, ctx), process = structuredClone(getProcess.call(recipient)), target = structuredClone(state.getTarget()), slot = state.getSlot();
+            const protocol = structuredClone(deps.protocolIdentity), leaderProtocol = structuredClone(state.getLeaderProtocol()), auth = client.getAuthSecret?.();
+            const endpoint = resolveTelegramBusSocketPath(client.socketPath), timeoutMs = client.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CLIENT_TIMEOUT_MS;
+            if (!authority ||
+                typeof authority.generation !== "number" ||
+                typeof assertAuthority !== "function" ||
+                !slot ||
+                !auth ||
+                !Number.isFinite(timeoutMs) ||
+                timeoutMs <= 0)
+                throw new Error("Selected-menu local owner is unavailable.");
+            const decoded = parseTelegramBusEnvelope(JSON.stringify({
+                kind: "follower.deliverSelectedMenu",
+                requestId: client.createRequestId(),
+                auth,
+                instanceId: client.instanceId,
+                operationId: input.operationId,
+                registrationGeneration: input.registrationGeneration,
+                recipient: {
+                    sessionId: authority.sessionId,
+                    sessionGeneration: authority.generation,
+                    ...process,
+                    profileKey: authority.profileBindingKey,
+                    journalBindingKey,
+                    target,
+                },
+                executor: authority.executor,
+                operatorUserId: authority.operatorUserId,
+                effect: structuredClone(input.effect),
+                sentAtMs: (client.getNowMs ?? Date.now)(),
+            }));
+            if (decoded?.kind !== "follower.deliverSelectedMenu")
+                throw new Error("Selected-menu local description is invalid.");
+            const expected = decoded;
+            method =
+                expected.effect.kind === "send-text"
+                    ? "sendMessage"
+                    : "editMessageText";
+            const assertCurrent = (allowPending = false) => {
+                assertAuthority();
+                const local = getAuthority.call(recipient, ctx), currentGeneration = client.getRegistrationGeneration();
+                if (!isDeepStrictEqual(deps.client, client) ||
+                    deps.recipient !== recipient ||
+                    recipient.getContextAuthority !== getAuthority ||
+                    recipient.getJournalBindingKey !== getJournal ||
+                    recipient.getProcessIdentity !== getProcess ||
+                    recipient.registrationState !== state ||
+                    !Object.entries(statePorts).every(([key, value]) => state[key] === value) ||
+                    !isDeepStrictEqual(local, authority) ||
+                    getJournal.call(recipient, ctx) !== journalBindingKey ||
+                    !isDeepStrictEqual(getProcess.call(recipient), process) ||
+                    !isDeepStrictEqual(state.getTarget(), target) ||
+                    state.getSlot() !== slot ||
+                    state.getGeneration() !== expected.registrationGeneration ||
+                    (!allowPending &&
+                        currentGeneration !== expected.registrationGeneration) ||
+                    (currentGeneration !== undefined &&
+                        currentGeneration !== expected.registrationGeneration) ||
+                    client.getAuthSecret?.() !== auth ||
+                    resolveTelegramBusSocketPath(client.socketPath) !== endpoint ||
+                    !isDeepStrictEqual(deps.protocolIdentity, protocol) ||
+                    !isDeepStrictEqual(state.getLeaderProtocol(), leaderProtocol) ||
+                    !getTelegramBusProtocolCompatibility({
+                        local: protocol,
+                        remote: leaderProtocol,
+                    }).compatible ||
+                    !hasTelegramBusCapability(protocol, TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY) ||
+                    !hasTelegramBusCapability(leaderProtocol, TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY))
+                    throw new Error("Selected-menu local authority changed.");
+                if (!isDeepStrictEqual(getAuthority.call(recipient, ctx), authority))
+                    throw new Error("Selected-menu context changed after local observations.");
+                assertAuthority();
+            };
+            assertCurrent(true);
+            const registration = await resolveTelegramBusFollowerRegistration(client, timeoutMs);
+            if (registration.generation !== expected.registrationGeneration)
+                throw new Error("Selected-menu registration changed.");
+            assertCurrent();
+            dispatched = true;
+            const response = await sendTelegramBusLocalEnvelope({
+                socketPath: endpoint,
+                envelope: expected,
+                timeoutMs: registration.remainingTimeoutMs,
+                retry: { attempts: 1, delayMs: 0 },
+                assertAuthority: () => assertCurrent(),
+            });
+            assertCurrent();
+            if (response?.kind !== "bus.ack" ||
+                response.requestId !== expected.requestId ||
+                !response.ok ||
+                response.error !== undefined ||
+                (response.protocol !== undefined &&
+                    !isDeepStrictEqual(response.protocol, leaderProtocol)) ||
+                !isRecord(response.result))
+                throw new Error("Selected-menu acknowledgement is unconfirmed.");
+            const result = response.result;
+            if (!isDeepStrictEqual(Object.keys(result).sort(), [
+                "effect",
+                "messageId",
+                "operationId",
+                "recipient",
+                "registrationGeneration",
+            ]) ||
+                result.operationId !== expected.operationId ||
+                result.registrationGeneration !== expected.registrationGeneration ||
+                result.effect !== expected.effect.kind ||
+                !isDeepStrictEqual(result.recipient, expected.recipient) ||
+                typeof result.messageId !== "number" ||
+                !Number.isSafeInteger(result.messageId) ||
+                result.messageId <= 0 ||
+                (expected.effect.kind === "edit-text" &&
+                    result.messageId !== expected.effect.messageId))
+                throw new Error("Selected-menu recipient/result is unconfirmed.");
+            assertCurrent();
+            return {
+                operationId: expected.operationId,
+                recipient: structuredClone(expected.recipient),
+                registrationGeneration: expected.registrationGeneration,
+                effect: expected.effect.kind,
+                messageId: result.messageId,
+            };
+        }
+        catch (error) {
+            if (!dispatched ||
+                (error instanceof TelegramBusLocalAuthorityError &&
+                    !error.requestIssued))
+                throw new TelegramApiAuthorityError(false);
+            throw new TelegramApiCommitUnknownError(method, error);
+        }
+    };
+}
 export function createTelegramBusFollowerApiCaller(deps) {
     const getNowMs = deps.getNowMs ?? Date.now;
     const timeoutMs = deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CLIENT_TIMEOUT_MS;
@@ -487,23 +907,15 @@ export function createTelegramBusFollowerApiCaller(deps) {
         const socketPath = resolveTelegramBusSocketPath(deps.socketPath);
         let response;
         try {
-            response = await sendTelegramBusLocalEnvelope({
-                socketPath,
-                timeoutMs: registration.remainingTimeoutMs,
-                retry: getTelegramBusTransportRetryPolicy({
-                    endpoint: socketPath,
-                    operation: "operation",
-                }),
-                envelope: {
-                    kind: "follower.callApi",
-                    requestId: deps.createRequestId(),
-                    auth: deps.getAuthSecret?.(),
-                    instanceId: deps.instanceId,
-                    registrationGeneration: registration.generation,
-                    method,
-                    args,
-                    sentAtMs: getNowMs(),
-                },
+            response = await sendTelegramBusOperation(socketPath, registration.remainingTimeoutMs, {
+                kind: "follower.callApi",
+                requestId: deps.createRequestId(),
+                auth: deps.getAuthSecret?.(),
+                instanceId: deps.instanceId,
+                registrationGeneration: registration.generation,
+                method,
+                args,
+                sentAtMs: getNowMs(),
             });
         }
         catch (error) {
@@ -550,11 +962,6 @@ async function resolveTelegramBusFollowerRegistration(deps, timeoutMs) {
     }
     throw new Error("Telegram bus follower is not registered.");
 }
-function isTelegramStaleContextError(error) {
-    return (error instanceof Error &&
-        (error.message.includes("stale after session") ||
-            error.message.includes("stale ctx")));
-}
 export function createTelegramBusFollowerSessionReplacementSuspender(deps) {
     const getNowMs = deps.getNowMs ?? Date.now;
     const getPid = deps.getPid ?? (() => process.pid);
@@ -661,7 +1068,9 @@ export function createTelegramBusFollowerSessionRefreshHook(deps) {
             await deps.registrationRuntime.setContext(ctx);
         }
         catch (error) {
-            deps.recordRuntimeEvent("bus", error, { phase: "follower-session-refresh" });
+            deps.recordRuntimeEvent("bus", error, {
+                phase: "follower-session-refresh",
+            });
             return;
         }
         if (deps.isSessionActive && !deps.isSessionActive(ctx))
@@ -710,14 +1119,20 @@ export function createTelegramBusFollowerRegistrationState(options = {}) {
         getThreadName: () => threadName,
         getDisplayTitle: () => displayTitle,
         setDisplayTitle(title, expectedGeneration) {
-            if (!registered || !generation || expectedGeneration !== generation ||
-                !title.trim() || title.length > 128 || displayTitle === title)
+            if (!registered ||
+                !generation ||
+                expectedGeneration !== generation ||
+                !title.trim() ||
+                title.length > 128 ||
+                displayTitle === title)
                 return false;
             displayTitle = title;
             return true;
         },
         getGeneration: () => generation,
-        getSessionId: currentSessionId => registered && generation && currentSessionId === sessionId ? sessionId : undefined,
+        getSessionId: (currentSessionId) => registered && generation && currentSessionId === sessionId
+            ? sessionId
+            : undefined,
         beginRecovery: () => {
             if (activeRecoveryEpoch !== undefined)
                 return activeRecoveryEpoch;
@@ -757,21 +1172,31 @@ export function createTelegramBusFollowerRegistrationState(options = {}) {
             eligibleElectionSlots = Array.from(new Set(slots.filter((slot) => /^[A-Z]$/.test(slot)))).sort();
         },
         setRegistered: (next, nextTarget, metadata) => {
-            const retainedDisplayTitle = next && registered &&
+            const retainedDisplayTitle = next &&
+                registered &&
                 generation === metadata?.generation &&
-                target?.chatId === nextTarget?.chatId && target?.threadId === nextTarget?.threadId
-                ? displayTitle : undefined;
-            const retainedSessionId = next && registered && generation === metadata?.generation ? sessionId : undefined;
+                target?.chatId === nextTarget?.chatId &&
+                target?.threadId === nextTarget?.threadId
+                ? displayTitle
+                : undefined;
+            const retainedSessionId = next && registered && generation === metadata?.generation
+                ? sessionId
+                : undefined;
             const availabilityChanged = registered !== next;
             registered = next;
             target = next ? (nextTarget ? { ...nextTarget } : undefined) : undefined;
             slot = next ? metadata?.slot : undefined;
             threadName = next ? metadata?.threadName : undefined;
-            displayTitle = next && nextTarget && metadata?.generation &&
-                metadata.displayTitle?.trim() && metadata.displayTitle.length <= 128
-                ? metadata.displayTitle : retainedDisplayTitle;
+            displayTitle =
+                next &&
+                    nextTarget &&
+                    metadata?.generation &&
+                    metadata.displayTitle?.trim() &&
+                    metadata.displayTitle.length <= 128
+                    ? metadata.displayTitle
+                    : retainedDisplayTitle;
             generation = next ? metadata?.generation : undefined;
-            sessionId = next ? metadata?.sessionId ?? retainedSessionId : undefined;
+            sessionId = next ? (metadata?.sessionId ?? retainedSessionId) : undefined;
             leaderProtocol =
                 next && metadata?.leaderProtocol
                     ? {
@@ -803,7 +1228,7 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
             deps.updateStatus(ctx);
         }
         catch (error) {
-            if (!isTelegramStaleContextError(error))
+            if (!isPiStaleContextError(error))
                 throw error;
             deps.recordRuntimeEvent("bus", error, {
                 phase: "follower-stale-context-status",
@@ -950,7 +1375,7 @@ export function createTelegramBusFollowerHeartbeatRecoveryHandler(deps) {
         catch (promotionError) {
             deps.setLifecyclePhase(undefined);
             safeUpdateStatus(ctx);
-            if (isTelegramStaleContextError(promotionError)) {
+            if (isPiStaleContextError(promotionError)) {
                 deps.recordRuntimeEvent("bus", promotionError, {
                     phase: "follower-heartbeat-stale-context",
                 });
@@ -990,6 +1415,11 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
     let lastKnownTarget;
     let lastKnownSlot;
     let lastKnownThreadName;
+    // A leader result is accepted only for the same endpoint and registration generation that issued the request.
+    const isLeaderSessionCurrent = (socketPath, generation) => activeLeaderSocketPath === socketPath &&
+        activeRegistrationGeneration === generation &&
+        (!deps.registrationState ||
+            deps.registrationState.getGeneration() === generation);
     const stopHeartbeat = () => {
         if (!heartbeatInterval)
             return;
@@ -1031,21 +1461,13 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             activeRegistrationGeneration === registrationGeneration &&
             activeContext === heartbeatContext;
         try {
-            const response = await sendTelegramBusLocalEnvelope({
-                socketPath: leaderSocketPath,
-                timeoutMs: heartbeatTimeoutMs,
-                retry: getTelegramBusTransportRetryPolicy({
-                    endpoint: leaderSocketPath,
-                    operation: "operation",
-                }),
-                envelope: {
-                    kind: "follower.heartbeat",
-                    requestId: deps.createRequestId(),
-                    auth: activeAuthSecret,
-                    instanceId: deps.instanceId,
-                    registrationGeneration,
-                    sentAtMs: getNowMs(),
-                },
+            const response = await sendTelegramBusOperation(leaderSocketPath, heartbeatTimeoutMs, {
+                kind: "follower.heartbeat",
+                requestId: deps.createRequestId(),
+                auth: activeAuthSecret,
+                instanceId: deps.instanceId,
+                registrationGeneration,
+                sentAtMs: getNowMs(),
             });
             if (!isCurrentHeartbeat())
                 return;
@@ -1133,7 +1555,8 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             const attempt = { ctx, sessionGeneration, sessionId };
             registrationAttempt = attempt;
             const isCurrentRequest = () => registrationAttempt === attempt &&
-                deps.getSessionGeneration?.() === sessionGeneration && deps.getSessionId?.(ctx) === sessionId &&
+                deps.getSessionGeneration?.() === sessionGeneration &&
+                deps.getSessionId?.(ctx) === sessionId &&
                 deps.isContextActive?.(ctx) !== false;
             const abandonOwnedRequest = async () => {
                 if (registrationAttempt !== attempt)
@@ -1148,6 +1571,17 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                 deps.setActiveAuthSecret?.(undefined);
                 await deps.stopReceiving?.();
             };
+            // Failed registration releases its leader session but keeps the attempt owner for caller-visible errors.
+            const failRegistration = async (clearGeneration = false) => {
+                stopHeartbeat();
+                activeLeaderSocketPath = undefined;
+                activeAuthSecret = undefined;
+                if (clearGeneration)
+                    activeRegistrationGeneration = undefined;
+                deps.registrationState?.setRegistered(false);
+                deps.setActiveAuthSecret?.(undefined);
+                await deps.stopReceiving?.();
+            };
             const pendingHandoff = options
                 ? undefined
                 : getTelegramFollowerSessionHandoff();
@@ -1232,12 +1666,7 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                     await abandonOwnedRequest();
                     return false;
                 }
-                stopHeartbeat();
-                activeLeaderSocketPath = undefined;
-                activeAuthSecret = undefined;
-                deps.registrationState?.setRegistered(false);
-                deps.setActiveAuthSecret?.(undefined);
-                await deps.stopReceiving?.();
+                await failRegistration();
                 throw error;
             }
             if (!isCurrentRequest()) {
@@ -1249,23 +1678,15 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                 remote: response?.kind === "bus.ack" ? response.protocol : undefined,
             });
             // An identity-less error ACK is a rejection/transport failure, not evidence of an incompatible leader.
-            const unidentifiedRejection = response?.kind === "bus.ack" && !response.ok && response.protocol === undefined;
+            const unidentifiedRejection = response?.kind === "bus.ack" &&
+                !response.ok &&
+                response.protocol === undefined;
             if (!compatibility.compatible && !unidentifiedRejection) {
-                stopHeartbeat();
-                activeLeaderSocketPath = undefined;
-                activeAuthSecret = undefined;
-                deps.registrationState?.setRegistered(false);
-                deps.setActiveAuthSecret?.(undefined);
-                await deps.stopReceiving?.();
+                await failRegistration();
                 throw new Error(`Incompatible Telegram bus leader protocol: ${compatibility.reason}.`);
             }
             if (response?.kind === "bus.ack" && !response.ok) {
-                stopHeartbeat();
-                activeLeaderSocketPath = undefined;
-                activeAuthSecret = undefined;
-                deps.registrationState?.setRegistered(false);
-                deps.setActiveAuthSecret?.(undefined);
-                await deps.stopReceiving?.();
+                await failRegistration();
                 if (registrationOptions?.restoreWorkspace &&
                     response.error?.code === "workspace-binding-unavailable") {
                     deps.recordRuntimeEvent?.("bus", "Telegram follower auto-connect refused by leader: Workspace binding unavailable.", {
@@ -1283,9 +1704,7 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                     ...registrationResult,
                     generation: registrationGeneration,
                     sessionId,
-                    ...(response.protocol
-                        ? { leaderProtocol: response.protocol }
-                        : {}),
+                    ...(response.protocol ? { leaderProtocol: response.protocol } : {}),
                 });
                 lastKnownTarget = registrationResult.target;
                 lastKnownSlot = registrationResult.slot;
@@ -1301,13 +1720,7 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                         await abandonOwnedRequest();
                         return false;
                     }
-                    stopHeartbeat();
-                    activeLeaderSocketPath = undefined;
-                    activeAuthSecret = undefined;
-                    activeRegistrationGeneration = undefined;
-                    deps.registrationState?.setRegistered(false);
-                    deps.setActiveAuthSecret?.(undefined);
-                    await deps.stopReceiving?.();
+                    await failRegistration(true);
                     throw error;
                 }
                 if (!isCurrentRequest()) {
@@ -1327,18 +1740,15 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
                 }
                 return true;
             }
-            stopHeartbeat();
-            activeLeaderSocketPath = undefined;
-            activeAuthSecret = undefined;
-            deps.registrationState?.setRegistered(false);
-            deps.setActiveAuthSecret?.(undefined);
-            await deps.stopReceiving?.();
+            await failRegistration();
             return false;
         },
         setContext(ctx) {
-            if (registrationAttempt && (registrationAttempt.ctx !== ctx ||
-                registrationAttempt.sessionGeneration !== deps.getSessionGeneration?.() ||
-                registrationAttempt.sessionId !== deps.getSessionId?.(ctx)))
+            if (registrationAttempt &&
+                (registrationAttempt.ctx !== ctx ||
+                    registrationAttempt.sessionGeneration !==
+                        deps.getSessionGeneration?.() ||
+                    registrationAttempt.sessionId !== deps.getSessionId?.(ctx)))
                 registrationAttempt = undefined;
             activeContext = ctx;
         },
@@ -1346,7 +1756,9 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             const socketPath = activeLeaderSocketPath;
             const generation = activeRegistrationGeneration;
             const auth = activeAuthSecret;
-            if (!socketPath || !generation || !deps.registrationState?.isRegistered()) {
+            if (!socketPath ||
+                !generation ||
+                !deps.registrationState?.isRegistered()) {
                 throw new Error("Telegram follower is not registered with the leader.");
             }
             const requiredCapability = mode === "directory-snake" || mode === "directory-title"
@@ -1358,20 +1770,31 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             }
             const requestId = deps.createRequestId();
             const response = await sendTelegramBusLocalEnvelope({
-                socketPath, timeoutMs: registrationTimeoutMs,
+                socketPath,
+                timeoutMs: registrationTimeoutMs,
                 envelope: {
-                    kind: "follower.setThreadDisplayMode", requestId, auth,
-                    instanceId: deps.instanceId, registrationGeneration: generation, mode,
+                    kind: "follower.setThreadDisplayMode",
+                    requestId,
+                    auth,
+                    instanceId: deps.instanceId,
+                    registrationGeneration: generation,
+                    mode,
                 },
             });
-            if (activeLeaderSocketPath !== socketPath || activeRegistrationGeneration !== generation ||
-                activeAuthSecret !== auth || deps.registrationState.getGeneration() !== generation) {
+            if (activeLeaderSocketPath !== socketPath ||
+                activeRegistrationGeneration !== generation ||
+                activeAuthSecret !== auth ||
+                deps.registrationState.getGeneration() !== generation) {
                 throw new Error("Telegram Thread display setting completed for a stale registration.");
             }
-            if (response?.kind !== "bus.ack" || !response.ok || response.requestId !== requestId ||
-                !isRecord(response.result) || response.result.mode !== mode) {
+            if (response?.kind !== "bus.ack" ||
+                !response.ok ||
+                response.requestId !== requestId ||
+                !isRecord(response.result) ||
+                response.result.mode !== mode) {
                 throw new Error(response?.kind === "bus.ack"
-                    ? response.message ?? "Telegram Thread display setting was rejected."
+                    ? (response.message ??
+                        "Telegram Thread display setting was rejected.")
                     : "Telegram Thread display setting was not acknowledged.");
             }
         },
@@ -1386,34 +1809,23 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             const expectedLeaderSocketPath = activeLeaderSocketPath;
             const expectedRegistrationGeneration = activeRegistrationGeneration;
             const expectedAuthSecret = activeAuthSecret;
-            const response = await sendTelegramBusLocalEnvelope({
-                socketPath: expectedLeaderSocketPath,
-                timeoutMs: registrationTimeoutMs,
-                retry: getTelegramBusTransportRetryPolicy({
-                    endpoint: expectedLeaderSocketPath,
-                    operation: "operation",
-                }),
-                envelope: {
-                    kind: "follower.renameThread",
-                    requestId: deps.createRequestId(),
-                    auth: expectedAuthSecret,
-                    instanceId: deps.instanceId,
-                    registrationGeneration: expectedRegistrationGeneration,
-                    target,
-                    threadName,
-                    sentAtMs: getNowMs(),
-                },
+            const response = await sendTelegramBusOperation(expectedLeaderSocketPath, registrationTimeoutMs, {
+                kind: "follower.renameThread",
+                requestId: deps.createRequestId(),
+                auth: expectedAuthSecret,
+                instanceId: deps.instanceId,
+                registrationGeneration: expectedRegistrationGeneration,
+                target,
+                threadName,
+                sentAtMs: getNowMs(),
             });
             if (response?.kind !== "bus.ack" || !response.ok) {
                 throw new Error(response?.kind === "bus.ack"
-                    ? (response.message ?? "Telegram Workspace Thread rename was rejected.")
+                    ? (response.message ??
+                        "Telegram Workspace Thread rename was rejected.")
                     : "Telegram Workspace Thread rename was not acknowledged.");
             }
-            if (activeLeaderSocketPath !== expectedLeaderSocketPath ||
-                activeRegistrationGeneration !== expectedRegistrationGeneration ||
-                (deps.registrationState &&
-                    deps.registrationState.getGeneration() !==
-                        expectedRegistrationGeneration)) {
+            if (!isLeaderSessionCurrent(expectedLeaderSocketPath, expectedRegistrationGeneration)) {
                 throw new Error("Telegram Workspace Thread rename completed for a stale follower registration.");
             }
             const renamedThreadName = response.result &&
@@ -1437,42 +1849,36 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             if (!activeLeaderSocketPath || !activeRegistrationGeneration) {
                 throw new Error("Telegram follower is not registered with the leader.");
             }
-            if (deps.registrationState && !hasTelegramBusCapability(deps.registrationState.getLeaderProtocol(), TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME)) {
+            if (deps.registrationState &&
+                !hasTelegramBusCapability(deps.registrationState.getLeaderProtocol(), TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME)) {
                 throw new Error("The active Telegram leader does not support Workspace Thread reset. Update or restart that Pi instance.");
             }
             const expectedLeaderSocketPath = activeLeaderSocketPath;
             const expectedRegistrationGeneration = activeRegistrationGeneration;
-            const response = await sendTelegramBusLocalEnvelope({
-                socketPath: expectedLeaderSocketPath,
-                timeoutMs: registrationTimeoutMs,
-                retry: getTelegramBusTransportRetryPolicy({
-                    endpoint: expectedLeaderSocketPath,
-                    operation: "operation",
-                }),
-                envelope: {
-                    kind: "follower.resetThreadName",
-                    requestId: deps.createRequestId(),
-                    auth: activeAuthSecret,
-                    instanceId: deps.instanceId,
-                    registrationGeneration: expectedRegistrationGeneration,
-                    target,
-                    sentAtMs: getNowMs(),
-                },
+            const response = await sendTelegramBusOperation(expectedLeaderSocketPath, registrationTimeoutMs, {
+                kind: "follower.resetThreadName",
+                requestId: deps.createRequestId(),
+                auth: activeAuthSecret,
+                instanceId: deps.instanceId,
+                registrationGeneration: expectedRegistrationGeneration,
+                target,
+                sentAtMs: getNowMs(),
             });
-            const resetName = response?.kind === "bus.ack" && response.ok &&
-                response.result && typeof response.result === "object" &&
+            const resetName = response?.kind === "bus.ack" &&
+                response.ok &&
+                response.result &&
+                typeof response.result === "object" &&
                 "threadName" in response.result &&
                 typeof response.result.threadName === "string"
-                ? response.result.threadName : undefined;
+                ? response.result.threadName
+                : undefined;
             if (!resetName) {
                 throw new Error(response?.kind === "bus.ack"
-                    ? response.message ?? "Telegram Workspace Thread reset was rejected."
+                    ? (response.message ??
+                        "Telegram Workspace Thread reset was rejected.")
                     : "Telegram Workspace Thread reset was not acknowledged.");
             }
-            if (activeLeaderSocketPath !== expectedLeaderSocketPath ||
-                activeRegistrationGeneration !== expectedRegistrationGeneration ||
-                (deps.registrationState && deps.registrationState.getGeneration() !==
-                    expectedRegistrationGeneration)) {
+            if (!isLeaderSessionCurrent(expectedLeaderSocketPath, expectedRegistrationGeneration)) {
                 throw new Error("Telegram Workspace Thread reset completed for a stale follower registration.");
             }
             const registrationTarget = deps.registrationState?.getTarget();
@@ -1498,38 +1904,28 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             const expectedRegistrationGeneration = activeRegistrationGeneration;
             const expectedAuthSecret = activeAuthSecret;
             const requestId = deps.createRequestId();
-            const response = await sendTelegramBusLocalEnvelope({
-                socketPath: expectedLeaderSocketPath,
-                timeoutMs: registrationTimeoutMs,
-                retry: getTelegramBusTransportRetryPolicy({
-                    endpoint: expectedLeaderSocketPath,
-                    operation: "operation",
-                }),
-                envelope: {
-                    kind: operation === "publish"
-                        ? "follower.publishSessionReplacement"
-                        : "follower.settleSessionReplacement",
-                    requestId,
-                    auth: expectedAuthSecret,
-                    instanceId: deps.instanceId,
-                    registrationGeneration: expectedRegistrationGeneration,
-                    intent,
-                    sentAtMs: getNowMs(),
-                },
+            const response = await sendTelegramBusOperation(expectedLeaderSocketPath, registrationTimeoutMs, {
+                kind: operation === "publish"
+                    ? "follower.publishSessionReplacement"
+                    : "follower.settleSessionReplacement",
+                requestId,
+                auth: expectedAuthSecret,
+                instanceId: deps.instanceId,
+                registrationGeneration: expectedRegistrationGeneration,
+                intent,
+                sentAtMs: getNowMs(),
             });
-            if (response?.kind !== "bus.ack" || !response.ok ||
+            if (response?.kind !== "bus.ack" ||
+                !response.ok ||
                 response.requestId !== requestId ||
-                !isRecord(response.result) || response.result.committed !== true) {
+                !isRecord(response.result) ||
+                response.result.committed !== true) {
                 throw new Error(response?.kind === "bus.ack"
                     ? (response.message ?? "Telegram session replacement was rejected.")
                     : "Telegram session replacement was not acknowledged.");
             }
-            if (activeLeaderSocketPath !== expectedLeaderSocketPath ||
-                activeRegistrationGeneration !== expectedRegistrationGeneration ||
-                activeAuthSecret !== expectedAuthSecret ||
-                (deps.registrationState &&
-                    deps.registrationState.getGeneration() !==
-                        expectedRegistrationGeneration)) {
+            if (!isLeaderSessionCurrent(expectedLeaderSocketPath, expectedRegistrationGeneration) ||
+                activeAuthSecret !== expectedAuthSecret) {
                 throw new Error("Telegram session replacement completed for a stale follower registration.");
             }
             return true;
@@ -1538,21 +1934,13 @@ export function createTelegramBusFollowerRegistrationRuntime(deps) {
             if (!activeLeaderSocketPath || !activeRegistrationGeneration) {
                 return false;
             }
-            const response = await sendTelegramBusLocalEnvelope({
-                socketPath: activeLeaderSocketPath,
-                timeoutMs: registrationTimeoutMs,
-                retry: getTelegramBusTransportRetryPolicy({
-                    endpoint: activeLeaderSocketPath,
-                    operation: "operation",
-                }),
-                envelope: {
-                    kind: "follower.disconnect",
-                    requestId: deps.createRequestId(),
-                    auth: activeAuthSecret,
-                    instanceId: deps.instanceId,
-                    registrationGeneration: activeRegistrationGeneration,
-                    sentAtMs: getNowMs(),
-                },
+            const response = await sendTelegramBusOperation(activeLeaderSocketPath, registrationTimeoutMs, {
+                kind: "follower.disconnect",
+                requestId: deps.createRequestId(),
+                auth: activeAuthSecret,
+                instanceId: deps.instanceId,
+                registrationGeneration: activeRegistrationGeneration,
+                sentAtMs: getNowMs(),
             });
             if (response?.kind === "bus.ack" && response.ok)
                 return true;
@@ -1570,29 +1958,50 @@ export function createTelegramBusFollowerPairedAdmission(deps) {
         if (updates.length !== 1)
             return { admitted: false };
         const update = updates[0];
-        const keys = Object.keys(update).filter((key) => key !== "update_id" && key !== TELEGRAM_FOLLOWER_FORWARD_BATCH_POSITION_FIELD);
+        const keys = Object.keys(update).filter((key) => key !== "update_id" &&
+            key !== TELEGRAM_FOLLOWER_FORWARD_BATCH_POSITION_FIELD);
         if (keys.length !== 1)
             return { admitted: false };
         const kind = keys[0];
-        if (kind !== "message" && kind !== "edited_message" &&
-            kind !== "callback_query" && kind !== "message_reaction")
+        if (kind !== "message" &&
+            kind !== "edited_message" &&
+            kind !== "callback_query" &&
+            kind !== "message_reaction")
             return { admitted: false };
         const position = update[TELEGRAM_FOLLOWER_FORWARD_BATCH_POSITION_FIELD];
-        if (position !== undefined && (kind !== "message" ||
-            (position !== "comment" && position !== "forward")))
+        if (position !== undefined &&
+            (kind !== "message" || (position !== "comment" && position !== "forward")))
             return { admitted: false };
         const carrier = update[kind];
-        if (!Number.isSafeInteger(update.update_id) || update.update_id < 0 ||
-            !isRecord(carrier) || carrier.pi_telegram_source_update_id !== update.update_id ||
-            carrier.sender_chat !== undefined || carrier.actor_chat !== undefined)
+        if (!Number.isSafeInteger(update.update_id) ||
+            update.update_id < 0 ||
+            !isRecord(carrier) ||
+            carrier.pi_telegram_source_update_id !== update.update_id ||
+            carrier.sender_chat !== undefined ||
+            carrier.actor_chat !== undefined)
             return { admitted: false };
         const sender = kind === "message_reaction" ? carrier.user : carrier.from;
-        if (!isRecord(sender) || typeof sender.id !== "number" || !Number.isSafeInteger(sender.id) ||
-            sender.id <= 0 || sender.is_bot !== false)
+        if (!isRecord(sender) ||
+            typeof sender.id !== "number" ||
+            !Number.isSafeInteger(sender.id) ||
+            sender.id <= 0 ||
+            sender.is_bot !== false)
             return { admitted: false };
         return deps.configStore.withPairedUserAdmission(deps.profileName, deps.tokenSha256, sender.id, publish, deps.assertExecutionCurrent);
     };
 }
+/** One authenticated local operation request with the shared operation retry policy; no replay semantics. */
+function sendTelegramBusOperation(socketPath, timeoutMs, envelope) {
+    return sendTelegramBusLocalEnvelope({
+        socketPath,
+        timeoutMs,
+        envelope,
+        retry: getTelegramBusTransportRetryPolicy({
+            endpoint: socketPath,
+            operation: "operation",
+        }),
+    });
+}
 export function prepareTelegramBusFollowerJournaledUpdateForExecution(update, prepareForwardedMessage) {
     const position = update[TELEGRAM_FOLLOWER_FORWARD_BATCH_POSITION_FIELD];
     if (update.message !== undefined &&
@@ -1605,14 +2014,475 @@ export function prepareTelegramBusFollowerJournaledUpdateForExecution(update, pr
     delete prepared[TELEGRAM_FOLLOWER_FORWARD_BATCH_POSITION_FIELD];
     return prepared;
 }
+/** Copy the captured command target for the native owner; ordinary input supplies no target constraint. */
+function copyLiveRebindCommandTarget(saved) {
+    return saved.selectedCommand
+        ? { expectedTarget: { ...saved.selectedCommand.target } }
+        : {};
+}
+/** Exact operation/recipient/source agreement between a retained save and a later request; identity only, never currency. */
+function matchesLiveRebindCarrier(saved, envelope) {
+    return (saved.operationId === envelope.operationId &&
+        saved.recipient.instanceId === envelope.recipientInstanceId &&
+        saved.recipient.sessionId === envelope.recipientSessionId &&
+        saved.recipient.generation === envelope.recipientRegistrationGeneration &&
+        saved.recipient.bindingKey === envelope.recipientBindingKey &&
+        isDeepStrictEqual(saved.sourceUpdateIds, [...envelope.sourceUpdateIds].sort((a, b) => a - b)));
+}
+/** Exact branch agreement: a command record requires its saved proof; ordinary input refuses any proof. */
+function matchesLiveRebindBranch(saved, status, envelope) {
+    return (isDeepStrictEqual(saved.selectedCommand, envelope.selectedCommand) &&
+        (status
+            ? isDeepStrictEqual(saved.preparedSource, envelope.preparedSource)
+            : envelope.preparedSource === undefined));
+}
+/** One current warm preparation, not a prompt queue or restart recovery record. */
+export function createTelegramBusFollowerLiveRebindRuntime(deps) {
+    let retained;
+    const runtime = {
+        save(envelope, ctx, isCurrent) {
+            const captured = structuredClone(envelope), selectedCommand = captured.selectedCommand;
+            const heldMarker = selectedCommand, getCommandOwner = heldMarker ? deps.getCommandOwner : undefined, applyOwner = deps.applyTarget;
+            if (heldMarker !== undefined &&
+                (!getCommandOwner || !applyOwner || captured.updates.length !== 1))
+                throw new Error("Selected command native consumption is unavailable.");
+            const admission = deps.getAdmission(ctx), prepareInput = admission?.prepareLiveInput, append = admission?.appendBatch;
+            let status = retained?.operationId === captured.operationId
+                ? retained.status
+                : undefined;
+            const current = () => isCurrent() &&
+                deps.getAdmission(ctx) === admission &&
+                admission?.getJournalBindingKey() === captured.recipientBindingKey &&
+                (!heldMarker ||
+                    (deps.getCommandOwner === getCommandOwner &&
+                        deps.applyTarget === applyOwner &&
+                        admission?.prepareLiveInput === prepareInput &&
+                        admission?.appendBatch === append &&
+                        !!status?.current()));
+            if (retained?.status &&
+                retained.operationId !== captured.operationId &&
+                retained.outcome?.status === "released" &&
+                (retained.status.result !== "completed" ||
+                    !retained.status.ports?.inspectCompletion.call(retained.status.plan)))
+                throw new Error("Released held command is unconfirmed; no carrier replacement.");
+            if (heldMarker && !status) {
+                const { recipientInstanceId, recipientRegistrationGeneration, recipientSessionId, recipientBindingKey, operationId, updates, } = captured;
+                const owner = getCommandOwner(structuredClone({
+                    recipientInstanceId,
+                    recipientRegistrationGeneration,
+                    recipientSessionId,
+                    recipientBindingKey,
+                    operationId,
+                    updates,
+                    selectedCommand,
+                }), ctx);
+                if (!owner ||
+                    typeof owner.isCurrent !== "function" ||
+                    typeof owner.prepare !== "function" ||
+                    typeof owner.assertRecipientCurrent !== "function")
+                    throw new Error("Selected command preparation owner is unavailable.");
+                const ports = {
+                    isCurrent: owner.isCurrent,
+                    prepare: owner.prepare,
+                    assertRecipientCurrent: owner.assertRecipientCurrent,
+                };
+                status = {
+                    owner,
+                    current: () => Object.entries(ports).every(([key, value]) => Reflect.get(owner, key) === value) &&
+                        (!status?.plan ||
+                            Object.entries(status.ports).every(([key, value]) => Reflect.get(status.plan, key) === value)) &&
+                        ports.isCurrent.call(owner),
+                    prepare: ports.prepare,
+                    recipient: ports.assertRecipientCurrent,
+                };
+            }
+            if (!admission?.prepareLiveInput || !current())
+                throw new Error("Live-rebind recipient admission is unavailable.");
+            const digest = createHash("sha256")
+                .update(JSON.stringify(captured.updates))
+                .digest("hex");
+            if (retained?.status && !retained.current())
+                throw new Error("Prepared command authority changed; no replacement adoption.");
+            if (retained &&
+                (!retained.current() ||
+                    (retained.operationId !== envelope.operationId &&
+                        (retained.outcome?.status === "released" ||
+                            retained.outcome?.status === "discarded"))))
+                retained = undefined;
+            if (heldMarker &&
+                retained &&
+                (retained.ctx !== ctx ||
+                    retained.observation.recipient.instanceId !==
+                        captured.recipientInstanceId ||
+                    retained.observation.recipient.sessionId !==
+                        captured.recipientSessionId ||
+                    retained.observation.recipient.generation !==
+                        captured.recipientRegistrationGeneration ||
+                    retained.observation.recipient.bindingKey !==
+                        captured.recipientBindingKey))
+                throw new Error("Selected command saved recipient changed.");
+            if (retained &&
+                (retained.operationId !== captured.operationId ||
+                    retained.digest !== digest ||
+                    !isDeepStrictEqual(retained.observation.selectedCommand, selectedCommand)))
+                throw new Error("Another live-rebind input or branch is already prepared.");
+            if (!retained) {
+                const held = admission.prepareLiveInput(ctx, captured.updates.map((update) => update.update_id), current);
+                if (!held)
+                    throw new Error("Live-rebind recipient input cannot be prepared.");
+                if (heldMarker && !held.canPrepareStatusConsumption?.()) {
+                    held.cancelEmpty();
+                    throw new Error("Selected command native consumption is unavailable.");
+                }
+                retained = {
+                    operationId: captured.operationId,
+                    digest,
+                    current,
+                    held,
+                    ctx,
+                    ...(status ? { status } : {}),
+                    observation: {
+                        operationId: captured.operationId,
+                        recipient: {
+                            instanceId: captured.recipientInstanceId,
+                            sessionId: captured.recipientSessionId,
+                            generation: captured.recipientRegistrationGeneration,
+                            bindingKey: captured.recipientBindingKey,
+                        },
+                        sourceUpdateIds: [...held.sourceUpdateIds].sort((a, b) => a - b),
+                        ...(selectedCommand
+                            ? { selectedCommand: structuredClone(selectedCommand) }
+                            : {}),
+                        status: "saved",
+                    },
+                };
+                try {
+                    admission.appendBatch(captured.updates);
+                }
+                catch (error) {
+                    if (!held.confirmSaved())
+                        throw error;
+                }
+            }
+            if (!current() || !retained.held.confirmSaved())
+                throw new Error("Live-rebind recipient save is unconfirmed.");
+            if (status && !status.plan) {
+                if (status.attempted)
+                    throw new Error("Selected command preparation is unconfirmed; no replay.");
+                status.attempted = true;
+                const record = retained, readiness = record.held.prepareSourceCompletion?.();
+                const assertSourceCurrent = () => {
+                    if (retained !== record ||
+                        !record.current() ||
+                        !record.held.isOwnerCurrent())
+                        throw new Error("Selected command source owner changed.");
+                };
+                const plan = readiness &&
+                    status.prepare.call(status.owner, readiness, ctx, {
+                        target: { ...heldMarker.target },
+                        assertSourceCurrent,
+                        assertRecipientCurrent: status.recipient,
+                    });
+                if (!plan ||
+                    !current() ||
+                    !record.held.confirmSaved() ||
+                    !isDeepStrictEqual(plan.source, readiness.snapshot.source) ||
+                    [plan.bindCarrier, plan.execute, plan.inspectCompletion].some((port) => typeof port !== "function"))
+                    throw new Error("Selected command plan is unavailable.");
+                status.plan = plan;
+                status.ports = {
+                    bindCarrier: plan.bindCarrier,
+                    execute: plan.execute,
+                    inspectCompletion: plan.inspectCompletion,
+                };
+                const continuation = {
+                    source: plan.source,
+                    assertCurrent() {
+                        assertSourceCurrent();
+                        if (record.outcome?.status !== "released")
+                            throw new Error("Selected command has no confirmed peer release.");
+                        status.recipient.call(status.owner);
+                    },
+                    bindCarrier: status.ports.bindCarrier.bind(plan),
+                    async execute() {
+                        status.result = "unknown";
+                        const completed = await status.ports.execute.call(plan);
+                        if (completed && record.current() && record.held.isOwnerCurrent())
+                            status.result = "completed";
+                        return completed;
+                    },
+                };
+                if (!record.held.prepareStatusConsumption?.(continuation) ||
+                    !current()) {
+                    delete status.plan;
+                    delete status.ports;
+                    throw new Error("Selected command consumption is unconfirmed.");
+                }
+                record.observation.preparedSource = { ...plan.source };
+            }
+            return structuredClone(retained.observation);
+        },
+        async apply(envelope, ctx, isCurrent) {
+            const record = retained;
+            if (envelope.selectedCommand !== undefined && !record?.status?.plan)
+                throw new Error("Selected command native consumption is unavailable.");
+            const current = () => retained === record &&
+                !!record &&
+                record.ctx === ctx &&
+                record.current() &&
+                isCurrent() &&
+                record.held.isCurrent() &&
+                matchesLiveRebindBranch(record.observation, !!record.status, envelope);
+            if (!record ||
+                !current() ||
+                !record.held.confirmSaved() ||
+                !deps.applyTarget ||
+                record.applying ||
+                record.settling ||
+                !matchesLiveRebindCarrier(record.observation, envelope))
+                throw new Error("Live-rebind apply has no exact current saved carrier.");
+            const mode = envelope.mode === "apply" && !record.applyIssued ? "apply" : "inspect";
+            if (mode === "apply")
+                record.applyIssued = true;
+            record.applying = true;
+            try {
+                const observation = await deps.applyTarget({
+                    operationId: record.operationId,
+                    registrationGeneration: envelope.recipientRegistrationGeneration,
+                    mode,
+                    liveRebind: {
+                        sourceUpdateIds: record.observation.sourceUpdateIds,
+                        isCurrent: current,
+                        ...copyLiveRebindCommandTarget(record.observation),
+                    },
+                }, ctx);
+                if (!current() ||
+                    !record.held.confirmSaved() ||
+                    observation.operationId !== record.operationId ||
+                    observation.recipient.instanceId !== envelope.recipientInstanceId ||
+                    observation.recipient.sessionId !== envelope.recipientSessionId ||
+                    observation.recipient.generation !==
+                        envelope.recipientRegistrationGeneration)
+                    throw new Error("Live-rebind apply observation changed.");
+                return {
+                    ...structuredClone(record.observation),
+                    target: { ...observation.target },
+                    slot: observation.slot,
+                    status: observation.ready ? "applied" : "saved",
+                };
+            }
+            finally {
+                delete record.applying;
+            }
+        },
+        async settle(envelope, ctx, isCurrent) {
+            if (envelope.mode === "observe-command")
+                return inspectCommandCompletion(envelope, ctx, isCurrent);
+            const record = retained, status = record?.status, plan = status?.plan;
+            if (envelope.selectedCommand !== undefined && !plan)
+                throw new Error("Selected command native consumption is unavailable.");
+            // Only the marked read-only held work sample may outlive the source worker, through the captured recipient owner.
+            const commandWork = envelope.mode === "observe" && envelope.selectedCommand !== undefined;
+            const recipientCurrent = () => {
+                if (record?.status !== status ||
+                    status?.plan !== plan ||
+                    !status?.current())
+                    return false;
+                try {
+                    status.recipient.call(status.owner);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            };
+            const current = () => retained === record &&
+                !!record &&
+                record.ctx === ctx &&
+                record.current() &&
+                isCurrent() &&
+                (commandWork ? recipientCurrent() : record.held.isOwnerCurrent()) &&
+                matchesLiveRebindBranch(record.observation, !!record.status, envelope);
+            if (!record ||
+                !current() ||
+                record.applying ||
+                record.settling ||
+                !matchesLiveRebindCarrier(record.observation, envelope))
+                throw new Error("Live-rebind settlement has no exact current carrier.");
+            if (envelope.mode === "observe") {
+                if (record.outcome?.status !== "released" ||
+                    !deps.applyTarget ||
+                    !deps.observeWork ||
+                    !envelope.oldTarget)
+                    throw new Error("Live-rebind work observation has no released carrier or observer.");
+                const oldTarget = { ...envelope.oldTarget };
+                let work;
+                record.settling = true;
+                try {
+                    await deps.applyTarget({
+                        operationId: record.operationId,
+                        registrationGeneration: envelope.recipientRegistrationGeneration,
+                        mode: "inspect",
+                        liveRebind: {
+                            sourceUpdateIds: record.observation.sourceUpdateIds,
+                            isCurrent: current,
+                            ...copyLiveRebindCommandTarget(record.observation),
+                            observeWork(canonicalOldTarget) {
+                                if (!current() ||
+                                    !isDeepStrictEqual(canonicalOldTarget, oldTarget))
+                                    throw new Error("Live-rebind old work target changed.");
+                                work = structuredClone(deps.observeWork(canonicalOldTarget, ctx));
+                                if (!current() ||
+                                    !isDeepStrictEqual(canonicalOldTarget, oldTarget))
+                                    throw new Error("Live-rebind work observer authority or target changed.");
+                            },
+                        },
+                    }, ctx);
+                    if (!current() || !work)
+                        throw new Error("Live-rebind work observation is unconfirmed.");
+                    // Unfinished or unconfirmed selected execution stays unknown; later settled delivery cannot clear it.
+                    if (commandWork && status.result !== "completed")
+                        work.unknown = true;
+                    if (!current())
+                        throw new Error("Live-rebind work observer authority changed.");
+                    return {
+                        ...structuredClone(record.observation),
+                        status: "observed",
+                        oldTarget,
+                        work,
+                    };
+                }
+                finally {
+                    delete record.settling;
+                }
+            }
+            const action = envelope.mode;
+            if (record.outcome) {
+                if (record.outcome.action !== envelope.mode)
+                    throw new Error("Live-rebind input already has another disposition.");
+                return structuredClone(record.outcome);
+            }
+            record.settling = true;
+            const observation = (status) => ({
+                ...structuredClone(record.observation),
+                action,
+                status,
+            });
+            try {
+                if (envelope.mode === "discard") {
+                    record.outcome = observation("unknown");
+                    const status = record.held.discardSaved(current);
+                    record.outcome =
+                        status === "protected" ? undefined : observation(status);
+                    if (!current())
+                        throw new Error("Live-rebind disposal authority changed.");
+                    return observation(status);
+                }
+                if (!record.held.isCurrent() ||
+                    !record.held.confirmSaved() ||
+                    !deps.applyTarget)
+                    throw new Error("Live-rebind input cannot be released.");
+                await deps.applyTarget({
+                    operationId: record.operationId,
+                    registrationGeneration: envelope.recipientRegistrationGeneration,
+                    mode: "inspect",
+                    liveRebind: {
+                        sourceUpdateIds: record.observation.sourceUpdateIds,
+                        isCurrent: current,
+                        ...copyLiveRebindCommandTarget(record.observation),
+                        release(canRelease) {
+                            record.outcome = observation("unknown");
+                            record.outcome = record.held.release(() => current() && canRelease())
+                                ? observation("released")
+                                : undefined;
+                        },
+                    },
+                }, ctx);
+                if (!current())
+                    throw new Error("Live-rebind release authority changed.");
+                return structuredClone(record.outcome ?? observation("protected"));
+            }
+            finally {
+                delete record.settling;
+            }
+        },
+    };
+    async function inspectCommandCompletion(envelope, ctx, isCurrent) {
+        const record = retained;
+        const current = () => retained === record &&
+            !!record?.status?.plan &&
+            record.ctx === ctx &&
+            record.current() &&
+            record.held.isOwnerCurrent() &&
+            isCurrent() &&
+            matchesLiveRebindBranch(record.observation, true, envelope);
+        if (!record?.status?.plan ||
+            !deps.applyTarget ||
+            !current() ||
+            record.outcome?.status !== "released" ||
+            record.applying ||
+            record.settling ||
+            !matchesLiveRebindCarrier(record.observation, envelope))
+            throw new Error("Selected command completion has no exact released carrier.");
+        record.settling = true;
+        try {
+            const assertRecipient = () => {
+                record.status.recipient.call(record.status.owner);
+                if (!current())
+                    throw new Error("Selected command completion recipient changed.");
+            };
+            assertRecipient();
+            const observed = await deps.applyTarget({
+                operationId: record.operationId,
+                registrationGeneration: record.observation.recipient.generation,
+                mode: "inspect",
+                liveRebind: {
+                    sourceUpdateIds: record.observation.sourceUpdateIds,
+                    expectedTarget: { ...record.observation.selectedCommand.target },
+                    isCurrent: current,
+                },
+            }, ctx);
+            if (!observed.ready || !current())
+                throw new Error("Selected command completion target is unconfirmed.");
+            assertRecipient();
+            const sourceAck = record.status.ports.inspectCompletion.call(record.status.plan);
+            assertRecipient();
+            if (sourceAck &&
+                !isDeepStrictEqual(sourceAck, record.observation.preparedSource))
+                throw new Error("Selected command completion exact ACK changed.");
+            const settled = {
+                preparedSource: { ...record.observation.preparedSource },
+                command: record.status.result ?? "not-issued",
+                ...(sourceAck ? { sourceAck: { ...sourceAck } } : {}),
+            };
+            const { selectedCommand } = record.observation;
+            if (envelope.mode !== "observe-command" || !selectedCommand)
+                throw new Error("Held completion mode does not match its marker.");
+            return {
+                ...structuredClone(record.observation),
+                status: "command-observed",
+                selectedCommand: structuredClone(selectedCommand),
+                ...settled,
+            };
+        }
+        finally {
+            delete record.settling;
+        }
+    }
+    return runtime;
+}
 export function createTelegramBusFollowerDurableAdmissionRuntime(deps) {
     // The journal forgets a delivery once its worker completes; this window absorbs a leader retry after a lost ACK.
     const recentDeliveries = new Map();
     const getNowMs = deps.getNowMs ?? Date.now;
-    const limit = deps.recentDeliveryLimit ?? { maxAgeMs: 24 * 60 * 60 * 1000, maxEntries: 4096 };
+    const limit = deps.recentDeliveryLimit ?? {
+        maxAgeMs: 24 * 60 * 60 * 1000,
+        maxEntries: 4096,
+    };
     const pruneRecentDeliveries = (nowMs) => {
         for (const [deliveryId, admittedAtMs] of recentDeliveries) {
-            if (recentDeliveries.size <= limit.maxEntries && nowMs - admittedAtMs < limit.maxAgeMs)
+            if (recentDeliveries.size <= limit.maxEntries &&
+                nowMs - admittedAtMs < limit.maxAgeMs)
                 break;
             recentDeliveries.delete(deliveryId);
         }
@@ -1683,12 +2553,17 @@ export function createTelegramBusFollowerInputCustodyPorts(deps) {
     return {
         isSourceReferenceAdmissionEnabled: () => Boolean(deps.getInputCustodyBus()),
         handleInputCustodyHandoff(envelope, ctx) {
-            return getRequired().acceptHandoff({ sourceRecoveryKey: envelope.sourceRecoveryKey,
+            return getRequired().acceptHandoff({
+                sourceRecoveryKey: envelope.sourceRecoveryKey,
                 recipientBindingKey: envelope.recipientBindingKey,
-                source: envelope.source, handoffId: envelope.handoffId }, ctx);
+                source: envelope.source,
+                handoffId: envelope.handoffId,
+            }, ctx);
         },
         sourceReferenceAdmission: createTelegramBusFollowerSourceReferenceAdmissionRuntime({
-            wakeSource(input, ctx) { getRequired().wakeSource(input, ctx); },
+            wakeSource(input, ctx) {
+                getRequired().wakeSource(input, ctx);
+            },
         }),
         resolveInputCustodyReference(input) {
             return deps.getInputCustodyBus()?.resolveForwardReference(input);
@@ -1705,23 +2580,35 @@ export function createTelegramBusFollowerSourceReferenceAdmissionRuntime(deps) {
                 throw new Error("Telegram follower source-reference admission requires a recovery key.");
             if (!delivery.sourceClaim)
                 throw new Error("Telegram follower source-reference admission requires exact claim evidence.");
-            const expected = createTelegramBusFollowerDeliveryIdentity({ kind: envelope.kind,
+            const expected = createTelegramBusFollowerDeliveryIdentity({
+                kind: envelope.kind,
                 recipientBindingKey: delivery.recipientBindingKey,
-                sourceUpdateId: delivery.sourceUpdateId });
+                sourceUpdateId: delivery.sourceUpdateId,
+            });
             if (expected.deliveryId !== delivery.deliveryId)
                 throw new Error("Invalid Telegram follower source-reference delivery id.");
-            const carrier = envelope.kind === "leader.wakeInputCustody" ? undefined
-                : envelope.kind === "leader.forwardCallback" ? envelope.query
-                    : envelope.kind === "leader.forwardReaction" ? envelope.reactionUpdate : envelope.message;
+            const carrier = envelope.kind === "leader.wakeInputCustody"
+                ? undefined
+                : envelope.kind === "leader.forwardCallback"
+                    ? envelope.query
+                    : envelope.kind === "leader.forwardReaction"
+                        ? envelope.reactionUpdate
+                        : envelope.message;
             if (envelope.kind !== "leader.wakeInputCustody" &&
-                (!isRecord(carrier) || carrier.pi_telegram_source_update_id !== delivery.sourceUpdateId))
+                (!isRecord(carrier) ||
+                    carrier.pi_telegram_source_update_id !== delivery.sourceUpdateId))
                 throw new Error("Telegram follower source-reference update id mismatch.");
-            await deps.wakeSource({ deliveryId: delivery.deliveryId,
+            await deps.wakeSource({
+                deliveryId: delivery.deliveryId,
                 sourceUpdateId: delivery.sourceUpdateId,
                 recipientBindingKey: delivery.recipientBindingKey,
                 sourceRecoveryKey: delivery.sourceRecoveryKey,
-                sourceClaim: { ...delivery.sourceClaim } }, ctx);
-            return { deliveryId: delivery.deliveryId, sourceUpdateId: delivery.sourceUpdateId };
+                sourceClaim: { ...delivery.sourceClaim },
+            }, ctx);
+            return {
+                deliveryId: delivery.deliveryId,
+                sourceUpdateId: delivery.sourceUpdateId,
+            };
         },
     };
 }
@@ -1747,71 +2634,153 @@ export function createTelegramBusForwardedUpdateReceiverRuntime(deps) {
                 envelope.kind !== "leader.wakeInputCustody" &&
                 envelope.kind !== "leader.offerInputCustodyHandoff" &&
                 envelope.kind !== "leader.workspaceRestore" &&
+                envelope.kind !== "leader.prepareLiveRebind" &&
+                envelope.kind !== "leader.applyLiveRebind" &&
+                envelope.kind !== "leader.settleLiveRebind" &&
                 envelope.kind !== "leader.offerQueueHandoff") ||
                 envelope.recipientInstanceId !== deps.instanceId) {
-                return {
-                    kind: "bus.ack",
-                    requestId: envelope.requestId,
-                    ok: false,
-                    message: "Telegram bus receiver cannot handle this envelope.",
-                };
+                return rejectTelegramBusRequest(envelope.requestId, "Telegram bus receiver cannot handle this envelope.");
             }
             const registrationGeneration = deps.getRegistrationGeneration();
             if (!registrationGeneration ||
                 envelope.recipientRegistrationGeneration !== registrationGeneration) {
-                return {
-                    kind: "bus.ack",
-                    requestId: envelope.requestId,
-                    ok: false,
-                    message: "Stale Telegram bus follower registration generation.",
-                };
+                return rejectTelegramBusRequest(envelope.requestId, "Stale Telegram bus follower registration generation.");
             }
-            if (envelope.kind === "leader.workspaceRestore") {
-                const ctx = deps.getContext();
-                if (!authSecret || !ctx || !deps.isWorkspaceRestoreEnabled?.() || !deps.handleWorkspaceRestore)
+            if (envelope.kind === "leader.prepareLiveRebind" ||
+                envelope.kind === "leader.applyLiveRebind" ||
+                envelope.kind === "leader.settleLiveRebind") {
+                const apply = envelope.kind !== "leader.prepareLiveRebind", settle = envelope.kind === "leader.settleLiveRebind";
+                const commandInput = envelope.selectedCommand, commandEnabled = deps.isLiveRebindCommandSetEnabled;
+                const required = [
+                    TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE,
+                    ...(apply ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY] : []),
+                    ...(settle ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE] : []),
+                    ...(commandInput
+                        ? [
+                            TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY,
+                            TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE,
+                            TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET,
+                            TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
+                        ]
+                        : []),
+                ];
+                const ctx = deps.getContext(), sessionId = deps.getSessionId?.(), bindingKey = deps.getLiveRebindJournalBindingKey?.();
+                const protocol = structuredClone(deps.getLeaderProtocol?.()), localProtocol = structuredClone(deps.getLocalProtocol?.());
+                const current = () => !!authSecret &&
+                    deps.getAuthSecret?.() === authSecret &&
+                    deps.getContext() === ctx &&
+                    deps.getRegistrationGeneration() === registrationGeneration &&
+                    deps.getSessionId?.() === sessionId &&
+                    deps.getLiveRebindJournalBindingKey?.() === bindingKey &&
+                    deps.isLiveRebindSaveEnabled?.() === true &&
+                    (!apply || deps.isLiveRebindApplyEnabled?.() === true) &&
+                    (!settle || deps.isLiveRebindSettleEnabled?.() === true) &&
+                    (!commandInput ||
+                        (typeof commandEnabled === "function" &&
+                            deps.isLiveRebindCommandSetEnabled === commandEnabled &&
+                            commandEnabled())) &&
+                    isDeepStrictEqual(deps.getLeaderProtocol?.(), protocol) &&
+                    isDeepStrictEqual(deps.getLocalProtocol?.(), localProtocol);
+                if (!authSecret ||
+                    !ctx ||
+                    !bindingKey ||
+                    sessionId !== envelope.recipientSessionId ||
+                    bindingKey !== envelope.recipientBindingKey ||
+                    !required.every((cap) => hasTelegramBusCapability(protocol, cap) &&
+                        hasTelegramBusCapability(localProtocol, cap)) ||
+                    !localProtocol ||
+                    !getTelegramBusProtocolCompatibility({
+                        local: localProtocol,
+                        remote: protocol,
+                    }).compatible ||
+                    !current() ||
+                    (settle
+                        ? !deps.handleLiveRebindSettle
+                        : apply
+                            ? !deps.handleLiveRebindApply
+                            : !deps.handleLiveRebindSave))
+                    return rejectTelegramBusRequest(envelope.requestId, "Live-rebind capability or recipient authority is unavailable.");
+                try {
+                    const result = envelope.kind === "leader.settleLiveRebind"
+                        ? await deps.handleLiveRebindSettle(envelope, ctx, current)
+                        : envelope.kind === "leader.applyLiveRebind"
+                            ? await deps.handleLiveRebindApply(envelope, ctx, current)
+                            : await deps.handleLiveRebindSave(envelope, ctx, current);
+                    if (!current())
+                        throw new Error("Live-rebind receiver authority changed.");
                     return {
-                        kind: "bus.ack", requestId: envelope.requestId, ok: false, message: "Workspace Restore capability is unavailable.",
+                        kind: "bus.ack",
+                        requestId: envelope.requestId,
+                        ok: true,
+                        result,
                     };
+                }
+                catch (error) {
+                    deps.recordRuntimeEvent?.("bus", error, {
+                        phase: "follower-live-rebind-control",
+                    });
+                    return {
+                        kind: "bus.ack",
+                        requestId: envelope.requestId,
+                        ok: false,
+                        message: error instanceof Error
+                            ? error.message
+                            : "Live-rebind request failed.",
+                    };
+                }
+            }
+            if (envelope.kind === "leader.workspaceRestore") {
+                const ctx = deps.getContext();
+                if (!authSecret ||
+                    !ctx ||
+                    !deps.isWorkspaceRestoreEnabled?.() ||
+                    !deps.handleWorkspaceRestore)
+                    return rejectTelegramBusRequest(envelope.requestId, "Workspace Restore capability is unavailable.");
                 try {
-                    const result = await deps.handleWorkspaceRestore({ operationId: envelope.operationId,
-                        registrationGeneration, mode: envelope.mode }, ctx);
-                    if (deps.getAuthSecret?.() !== authSecret || deps.getRegistrationGeneration() !== registrationGeneration ||
-                        deps.getContext() !== ctx || !deps.isWorkspaceRestoreEnabled())
+                    const result = await deps.handleWorkspaceRestore({
+                        operationId: envelope.operationId,
+                        registrationGeneration,
+                        mode: envelope.mode,
+                    }, ctx);
+                    if (deps.getAuthSecret?.() !== authSecret ||
+                        deps.getRegistrationGeneration() !== registrationGeneration ||
+                        deps.getContext() !== ctx ||
+                        !deps.isWorkspaceRestoreEnabled())
                         throw new Error("Workspace Restore receiver authority changed.");
-                    return { kind: "bus.ack", requestId: envelope.requestId, ok: true, result };
+                    return {
+                        kind: "bus.ack",
+                        requestId: envelope.requestId,
+                        ok: true,
+                        result,
+                    };
                 }
                 catch (error) {
-                    deps.recordRuntimeEvent?.("bus", error, { phase: "follower-workspace-restore" });
-                    return { kind: "bus.ack", requestId: envelope.requestId, ok: false,
-                        message: error instanceof Error ? error.message : "Workspace Restore failed." };
+                    deps.recordRuntimeEvent?.("bus", error, {
+                        phase: "follower-workspace-restore",
+                    });
+                    return {
+                        kind: "bus.ack",
+                        requestId: envelope.requestId,
+                        ok: false,
+                        message: error instanceof Error
+                            ? error.message
+                            : "Workspace Restore failed.",
+                    };
                 }
             }
             if (envelope.kind === "leader.offerInputCustodyHandoff" &&
                 envelope.recipientBindingKey !== deps.getRecipientBindingKey())
-                return {
-                    kind: "bus.ack", requestId: envelope.requestId, ok: false,
-                    message: "Mismatched Telegram follower handoff recipient identity.",
-                };
+                return rejectTelegramBusRequest(envelope.requestId, "Mismatched Telegram follower handoff recipient identity.");
             if (envelope.kind !== "leader.offerQueueHandoff" &&
                 envelope.kind !== "leader.offerInputCustodyHandoff" &&
                 (!envelope.delivery ||
                     envelope.delivery.recipientBindingKey !==
                         deps.getRecipientBindingKey())) {
-                return {
-                    kind: "bus.ack",
-                    requestId: envelope.requestId,
-                    ok: false,
-                    message: "Mismatched Telegram follower delivery identity.",
-                };
+                return rejectTelegramBusRequest(envelope.requestId, "Mismatched Telegram follower delivery identity.");
             }
             const ctx = deps.getContext();
             if (!ctx) {
-                return {
-                    kind: "bus.ack",
-                    requestId: envelope.requestId,
-                    ok: false,
-                    message: "Telegram bus follower has no active context.",
-                };
+                return rejectTelegramBusRequest(envelope.requestId, "Telegram bus follower has no active context.");
             }
             try {
                 if (envelope.kind === "leader.offerInputCustodyHandoff") {
@@ -1822,7 +2791,12 @@ export function createTelegramBusForwardedUpdateReceiverRuntime(deps) {
                     if (!deps.handleInputCustodyHandoff)
                         throw new Error("Telegram input custody handoff acceptance is unavailable.");
                     const result = await deps.handleInputCustodyHandoff(envelope, ctx);
-                    return { kind: "bus.ack", requestId: envelope.requestId, ok: true, result };
+                    return {
+                        kind: "bus.ack",
+                        requestId: envelope.requestId,
+                        ok: true,
+                        result,
+                    };
                 }
                 if (envelope.kind !== "leader.offerQueueHandoff") {
                     const sourceReferenceEnabled = envelope.kind === "leader.wakeInputCustody" ||
@@ -1831,7 +2805,8 @@ export function createTelegramBusForwardedUpdateReceiverRuntime(deps) {
                         !deps.hasAuthenticatedSourceReferenceTransport?.())
                         throw new Error("Telegram follower source-reference admission requires authenticated transport.");
                     const admission = sourceReferenceEnabled
-                        ? deps.sourceReferenceAdmission : deps.durableAdmission;
+                        ? deps.sourceReferenceAdmission
+                        : deps.durableAdmission;
                     if (!admission)
                         throw new Error("Telegram follower source-reference admission is enabled without a wake authority.");
                     const receipt = await admission.admit(envelope, ctx);
@@ -1892,13 +2867,3 @@ function parseRegistrationResult(value) {
             : {}),
     };
 }
-function parseTarget(value) {
-    if (value === undefined)
-        return undefined;
-    if (!isRecord(value) || typeof value.chatId !== "number")
-        return undefined;
-    const target = { chatId: value.chatId };
-    if (typeof value.threadId === "number")
-        target.threadId = value.threadId;
-    return target;
-}