@llblab/pi-telegram 0.52.2 → 0.53.0

package/lib/bus.ts

@@ -5,28 +5,27 @@
  * cross-instance forwarding helpers, and the live follower registry model.
  */
 
-import { execFileSync } from "node:child_process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import {
   chmodSync,
   existsSync,
   lstatSync,
   mkdirSync,
-  readFileSync,
   readlinkSync,
   renameSync,
   symlinkSync,
   unlinkSync,
 } from "node:fs";
+import { createRequire } from "node:module";
 import {
   createConnection,
   createServer,
   type Server,
   type Socket,
 } from "node:net";
-import { createRequire } from "node:module";
 import { platform as getPlatform, tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 import {
   classifyTelegramBusTransportError,
@@ -37,28 +36,33 @@ import {
   getTelegramBusLeaderEndpoint,
   getTelegramBusPipePath,
   getTelegramBusTransportRetryPolicy,
-  type TelegramBusEndpointLayout,
-  TELEGRAM_BUS_MAX_DIRECT_UNIX_ENDPOINT_BYTES,
-  isTelegramBusPipePath,
   isRetryableTelegramBusTransportError,
+  isTelegramBusPipePath,
   probeTelegramBusEndpoint,
+  TELEGRAM_BUS_MAX_DIRECT_UNIX_ENDPOINT_BYTES,
+  type TelegramBusEndpointLayout,
   type TelegramBusTransportEventRecorder,
   type TelegramBusTransportRetryPolicy,
 } from "./bus-transport.ts";
+import type { TelegramThreadDisplayMode } from "./config.ts";
+import { TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS } from "./locks.ts";
+import { resolveAgentDir } from "./paths.ts";
+import { getTelegramProcessBirthIdentity } from "./process-identity.ts";
 import {
   parseTelegramQueueHandoffPayload,
   TELEGRAM_QUEUE_HANDOFF_PAYLOAD_MAX_BYTES,
   type TelegramQueueHandoffPayload,
 } from "./queue.ts";
-import type { TelegramTarget } from "./target.ts";
-import type { TelegramThreadDisplayMode } from "./config.ts";
-import { isProcessAlive } from "./locks.ts";
-import { isWireRecord as isRecord } from "./wire.ts";
-import { resolveAgentDir } from "./paths.ts";
+import {
+  areTelegramTargetsEqual,
+  parseTelegramTarget as parseTarget,
+  type TelegramTarget,
+} from "./target.ts";
 import {
   normalizeTelegramSessionReplacementIntent,
   type TelegramSessionReplacementIntent,
 } from "./threads.ts";
+import { hasOnlyWireKeys, isWireRecord as isRecord } from "./wire.ts";
 
 interface TelegramBusProcessRuntime {
   instanceId: string;
@@ -69,113 +73,6 @@ interface TelegramBusProcessRuntime {
   getFollowerSocketPath: () => string;
 }
 
-interface TelegramProcessBirthIdentityOptions {
-  platform?: NodeJS.Platform;
-  readProcStat?: (pid: number) => string;
-  readDarwinProcessStart?: (pid: number) => string;
-}
-
-type TelegramProcessBirthProof =
-  | { status: "proven"; identity: string }
-  | { status: "unverifiable" };
-
-export type TelegramProcessLiveness = "alive" | "dead" | "unverifiable";
-
-interface TelegramProcessLivenessOptions
-  extends TelegramProcessBirthIdentityOptions {
-  isProcessAlive?: (pid: number) => boolean;
-}
-
-function readDarwinProcessStart(pid: number): string {
-  return execFileSync(
-    "/bin/ps",
-    ["-o", "lstart=", "-p", String(pid)],
-    {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    },
-  ).trim();
-}
-
-function getTelegramProcessBirthProof(
-  pid: number,
-  options: TelegramProcessBirthIdentityOptions = {},
-): TelegramProcessBirthProof {
-  if (pid <= 0) return { status: "unverifiable" };
-  const platform = options.platform ?? getPlatform();
-  if (platform === "linux") {
-    try {
-      const stat = (options.readProcStat ?? ((targetPid) =>
-        readFileSync(`/proc/${targetPid}/stat`, "utf8")))(pid);
-      const closeParen = stat.lastIndexOf(")");
-      const fields = stat
-        .slice(closeParen + 2)
-        .trim()
-        .split(/\s+/u);
-      const startTicks = fields[19];
-      if (startTicks) {
-        return { status: "proven", identity: `${pid}:start:${startTicks}` };
-      }
-    } catch {
-      /* inaccessible process metadata */
-    }
-  } else if (platform === "darwin") {
-    try {
-      const startedAt = (
-        options.readDarwinProcessStart ?? readDarwinProcessStart
-      )(pid);
-      if (startedAt) {
-        const fingerprint = createHash("sha256")
-          .update(startedAt)
-          .digest("hex")
-          .slice(0, 16);
-        return { status: "proven", identity: `${pid}:start:${fingerprint}` };
-      }
-    } catch {
-      /* inaccessible process metadata */
-    }
-  }
-  return { status: "unverifiable" };
-}
-
-export function getTelegramProcessBirthIdentity(
-  pid: number,
-  fallbackGeneration: number | string,
-  options: TelegramProcessBirthIdentityOptions = {},
-): string {
-  const proof = getTelegramProcessBirthProof(pid, options);
-  return proof.status === "proven"
-    ? proof.identity
-    : `${pid}:generation:${fallbackGeneration}`;
-}
-
-export function getTelegramProcessLiveness(
-  owner: { processId: number; processBirthId: string },
-  options: TelegramProcessLivenessOptions = {},
-): TelegramProcessLiveness {
-  const processAlive = options.isProcessAlive ?? isProcessAlive;
-  if (!processAlive(owner.processId)) return "dead";
-  const proof = getTelegramProcessBirthProof(owner.processId, options);
-  if (proof.status === "unverifiable") return "unverifiable";
-  return proof.identity === owner.processBirthId ? "alive" : "dead";
-}
-
-export function getTelegramProcessBirthIdentityLiveness(
-  processBirthId: string,
-  options: TelegramProcessLivenessOptions = {},
-): TelegramProcessLiveness {
-  const match = /^(\d+):(start|generation):(.+)$/u.exec(processBirthId);
-  if (!match) return "unverifiable";
-  const processId = Number(match[1]);
-  if (!Number.isSafeInteger(processId) || processId <= 0) return "unverifiable";
-  const processAlive = options.isProcessAlive ?? isProcessAlive;
-  if (!processAlive(processId)) return "dead";
-  if (match[2] === "generation") return "unverifiable";
-  const proof = getTelegramProcessBirthProof(processId, options);
-  if (proof.status === "unverifiable") return "unverifiable";
-  return proof.identity === processBirthId ? "alive" : "dead";
-}
-
 export function createCurrentTelegramBusProcessRuntime(input: {
   getActiveProfileName: () => string | undefined;
   endpointLayout?: TelegramBusEndpointLayout;
@@ -200,7 +97,8 @@ export function createTelegramBusProcessRuntime(input: {
   parentProcessIdentity?: string;
   createdAtMs: number;
 }): TelegramBusProcessRuntime {
-  const getActiveProfileName = input.getActiveProfileName, endpointLayout = input.endpointLayout;
+  const getActiveProfileName = input.getActiveProfileName,
+    endpointLayout = input.endpointLayout;
   const instanceId = `${input.pid}:${input.createdAtMs}`;
   const ownerPid = input.parentPid || input.pid;
   const manualFollowerOwnerId =
@@ -242,18 +140,254 @@ export const TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE =
   "input-custody-reference-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_THREAD_RENAME =
   "workspace-thread-rename-v1" as const;
-export const TELEGRAM_BUS_CAPABILITY_THREAD_DISPLAY_MODE = "thread-display-mode-v1" as const;
+export const TELEGRAM_BUS_CAPABILITY_THREAD_DISPLAY_MODE =
+  "thread-display-mode-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_DIRECTORY_DISPLAY_FORMAT =
   "directory-display-format-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_FOLLOWER_AUTO_CONNECT =
   "workspace-follower-auto-connect-v1" as const;
 export const TELEGRAM_BUS_CAPABILITY_SESSION_REPLACEMENT_INTENT =
   "session-replacement-intent-v1" as const;
-export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE = "workspace-restore-v1" as const;
+export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE =
+  "workspace-restore-v1" as const;
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE =
+  "live-thread-rebind-save-v1" as const;
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY =
+  "live-thread-rebind-apply-v1" as const;
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE =
+  "live-thread-rebind-settle-v1" as const;
+/** Restricted recipient text/menu delivery; negotiated identity and captured effect authority remain required. */
+export const TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY =
+  "selected-menu-delivery-v1" as const;
+/** Versioned held-command set; syntax is shared, while the captured recipient Commands registry owns supported plans. */
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET =
+  "live-thread-rebind-command-set-v1" as const;
+/** Every live rebinding needs the save/apply/settle trio; held command selections additionally need these two. */
+export const TELEGRAM_BUS_LIVE_REBIND_CAPABILITIES = [
+  TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE,
+  TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY,
+  TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE,
+] as const;
+export const TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES = [
+  TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET,
+  TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
+] as const;
+
+export interface TelegramBusSelectedCommandInput {
+  name: string;
+  target: TelegramTarget & { threadId: number };
+}
+
+function parseSelectedCommandInput(
+  value: unknown,
+): TelegramBusSelectedCommandInput | undefined {
+  if (
+    !isRecord(value) ||
+    !hasOnlyWireKeys(value, ["name", "target"]) ||
+    typeof value.name !== "string" ||
+    !/^[a-z0-9_]{1,32}$/u.test(value.name) ||
+    !isRecord(value.target) ||
+    !hasOnlyWireKeys(value.target, ["chatId", "threadId"])
+  )
+    return undefined;
+  const target = parseThreadTarget(value.target);
+  return target &&
+    Number.isSafeInteger(target.chatId) &&
+    target.chatId > 0 &&
+    Number.isSafeInteger(target.threadId) &&
+    target.threadId > 0
+    ? { name: value.name, target }
+    : undefined;
+}
+
+export type TelegramBusSelectedMenuTextEffect = {
+  text: string;
+  parseMode?: "HTML";
+  replyMarkup?: {
+    inline_keyboard: { text: string; callback_data: string }[][];
+  };
+} & (
+  | { kind: "send-text"; replyToMessageId?: number }
+  | { kind: "edit-text"; messageId: number }
+);
+
+/** Serializable identity/effect description, never a process-local callback or standalone delivery grant. */
+export interface TelegramBusSelectedMenuDelivery {
+  kind: "follower.deliverSelectedMenu";
+  requestId: string;
+  instanceId: string;
+  registrationGeneration: string;
+  operationId: string;
+  recipient: {
+    sessionId: string;
+    sessionGeneration: number;
+    processId: number;
+    processBirthId: string;
+    profileKey: string;
+    journalBindingKey: string;
+    target: TelegramTarget & { threadId: number };
+  };
+  executor: { instanceId: string; leaderEpoch: string };
+  operatorUserId: number;
+  effect: TelegramBusSelectedMenuTextEffect;
+  sentAtMs: number;
+}
+
+export interface TelegramBusSelectedMenuDeliveryObservation {
+  operationId: string;
+  recipient: TelegramBusSelectedMenuDelivery["recipient"];
+  registrationGeneration: string;
+  effect: TelegramBusSelectedMenuTextEffect["kind"];
+  messageId: number;
+}
+
+/** Closed wire projection of prepared recipient source; independent of journal implementation and never a removal grant. */
+export interface TelegramBusPreparedCommandSource {
+  journalBindingKey: string;
+  updateId: number;
+  sourceSha256: string;
+}
+
+/** Pure live-rebind recipient/operation identity shared by prepare/apply/settle envelopes. */
+function parseLiveRebindRecipient(value: Record<string, unknown>):
+  | {
+      recipientInstanceId: string;
+      recipientRegistrationGeneration: string;
+      recipientSessionId: string;
+      recipientBindingKey: string;
+      operationId: string;
+    }
+  | undefined {
+  const {
+    recipientInstanceId,
+    recipientRegistrationGeneration,
+    recipientSessionId,
+    recipientBindingKey,
+    operationId,
+  } = value;
+  return typeof recipientInstanceId === "string" &&
+    recipientInstanceId &&
+    typeof recipientRegistrationGeneration === "string" &&
+    recipientRegistrationGeneration &&
+    typeof recipientSessionId === "string" &&
+    recipientSessionId &&
+    typeof recipientBindingKey === "string" &&
+    recipientBindingKey &&
+    typeof operationId === "string" &&
+    operationId.length > 0 &&
+    operationId.length <= 128
+    ? {
+        recipientInstanceId,
+        recipientRegistrationGeneration,
+        recipientSessionId,
+        recipientBindingKey,
+        operationId,
+      }
+    : undefined;
+}
+
+/** Non-empty, duplicate-free, non-negative safe-integer Telegram update ids. */
+function isUniqueSourceUpdateIds(value: unknown): value is number[] {
+  return (
+    Array.isArray(value) &&
+    value.length > 0 &&
+    value.every((id) => Number.isSafeInteger(id) && (id as number) >= 0) &&
+    new Set(value).size === value.length
+  );
+}
+
+function parsePreparedCommandSource(
+  value: unknown,
+): TelegramBusPreparedCommandSource | undefined {
+  if (
+    !isRecord(value) ||
+    !hasOnlyWireKeys(value, [
+      "journalBindingKey",
+      "updateId",
+      "sourceSha256",
+    ]) ||
+    typeof value.journalBindingKey !== "string" ||
+    !value.journalBindingKey ||
+    !Number.isSafeInteger(value.updateId) ||
+    (value.updateId as number) < 0 ||
+    typeof value.sourceSha256 !== "string" ||
+    !/^[a-f0-9]{64}$/u.test(value.sourceSha256)
+  )
+    return undefined;
+  return {
+    journalBindingKey: value.journalBindingKey,
+    updateId: value.updateId as number,
+    sourceSha256: value.sourceSha256,
+  };
+}
+
+export interface TelegramBusLiveRebindSaveObservation {
+  operationId: string;
+  recipient: {
+    instanceId: string;
+    sessionId: string;
+    generation: string;
+    bindingKey: string;
+  };
+  sourceUpdateIds: number[];
+  selectedCommand?: TelegramBusSelectedCommandInput;
+  preparedSource?: TelegramBusPreparedCommandSource;
+  status: "saved";
+}
+
+/** Read-only warm observation; semantic completion and exact source ACK are distinct from detached delivery. */
+export interface TelegramBusLiveRebindCommandObservation extends Omit<
+  TelegramBusLiveRebindSaveObservation,
+  "status" | "preparedSource" | "selectedCommand"
+> {
+  status: "command-observed";
+  selectedCommand: TelegramBusSelectedCommandInput;
+  preparedSource: TelegramBusPreparedCommandSource;
+  command: "completed" | "unknown" | "not-issued";
+  sourceAck?: TelegramBusPreparedCommandSource;
+}
+
+export interface TelegramBusLiveRebindWorkState {
+  sessionBusy: boolean;
+  targetWork: boolean;
+  deliveryPending: boolean;
+  unknown: boolean;
+}
+
+export interface TelegramBusLiveRebindWorkObservation extends Omit<
+  TelegramBusLiveRebindSaveObservation,
+  "status"
+> {
+  status: "observed";
+  oldTarget: TelegramTarget & { threadId: number };
+  work: TelegramBusLiveRebindWorkState;
+}
+
+export interface TelegramBusLiveRebindSettlementObservation extends Omit<
+  TelegramBusLiveRebindSaveObservation,
+  "status"
+> {
+  action: "release" | "discard";
+  status: "released" | "discarded" | "protected" | "unknown";
+}
+
+export interface TelegramBusLiveRebindApplyObservation extends Omit<
+  TelegramBusLiveRebindSaveObservation,
+  "status"
+> {
+  status: "saved" | "applied";
+  target: TelegramTarget & { threadId: number };
+  slot: string;
+}
 
 export interface TelegramBusWorkspaceRestoreObservation {
   operationId: string;
-  recipient: { kind: "follower"; instanceId: string; sessionId: string; generation: string };
+  recipient: {
+    kind: "follower";
+    instanceId: string;
+    sessionId: string;
+    generation: string;
+  };
   target: TelegramTarget & { threadId: number };
   slot: string;
   ready: boolean;
@@ -284,8 +418,7 @@ export function createTelegramBusProtocolIdentity(input: {
     capabilities.length > 32 ||
     capabilities.some(
       (capability) =>
-        capability.length > 128 ||
-        !/^[a-z0-9][a-z0-9._-]*$/u.test(capability),
+        capability.length > 128 || !/^[a-z0-9][a-z0-9._-]*$/u.test(capability),
     )
   ) {
     throw new Error("Telegram bus capabilities must be canonical identifiers.");
@@ -320,18 +453,42 @@ export function hasTelegramBusCapability(
 }
 
 export function getTelegramInputCustodyPeerReadiness(
-  followers: readonly Pick<TelegramBusFollowerView,
-    "registrationGeneration" | "protocol">[],
+  followers: readonly Pick<
+    TelegramBusFollowerView,
+    "registrationGeneration" | "protocol"
+  >[],
 ): ("ready" | "legacy" | "unknown")[] {
-  return followers.map(follower => {
-    if (!follower.registrationGeneration || !follower.protocol) return "unknown";
-    return hasTelegramBusCapability(follower.protocol,
-      TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION) &&
-      hasTelegramBusCapability(follower.protocol,
-        TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE) ? "ready" : "legacy";
+  return followers.map((follower) => {
+    if (!follower.registrationGeneration || !follower.protocol)
+      return "unknown";
+    return hasTelegramBusCapability(
+      follower.protocol,
+      TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION,
+    ) &&
+      hasTelegramBusCapability(
+        follower.protocol,
+        TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE,
+      )
+      ? "ready"
+      : "legacy";
   });
 }
 
+/** Both peers advertise every required capability over a compatible protocol; reads only the two identities. */
+export function hasTelegramBusSharedCapabilities(
+  local: TelegramBusProtocolIdentity,
+  remote: TelegramBusProtocolIdentity | undefined,
+  required: readonly string[],
+): boolean {
+  return (
+    required.every(
+      (capability) =>
+        hasTelegramBusCapability(local, capability) &&
+        hasTelegramBusCapability(remote, capability),
+    ) && getTelegramBusProtocolCompatibility({ local, remote }).compatible
+  );
+}
+
 export function getTelegramBusProtocolCompatibility(input: {
   local: TelegramBusProtocolIdentity;
   remote?: TelegramBusProtocolIdentity;
@@ -372,7 +529,12 @@ export function getTelegramBusSocketPath(
   profileName?: string,
   layout?: TelegramBusEndpointLayout,
 ): string {
-  return getTelegramBusLeaderEndpoint({ agentDir, platform, profileName, layout });
+  return getTelegramBusLeaderEndpoint({
+    agentDir,
+    platform,
+    profileName,
+    layout,
+  });
 }
 
 export function getTelegramBusFollowerSocketPath(
@@ -413,6 +575,26 @@ export interface TelegramBusFollowerView extends TelegramBusInstanceRegistration
   lastHeartbeatMs: number;
 }
 
+/** Whether a live follower is still exactly the captured registration: identity, process, session, endpoint and negotiated protocol. */
+export function isSameTelegramBusFollowerRegistration(
+  live: TelegramBusInstanceRegistration,
+  captured: TelegramBusInstanceRegistration,
+): boolean {
+  return (
+    live.instanceId === captured.instanceId &&
+    live.profileKey === captured.profileKey &&
+    live.sessionId === captured.sessionId &&
+    live.registrationGeneration === captured.registrationGeneration &&
+    live.pid === captured.pid &&
+    live.processBirthId === captured.processBirthId &&
+    live.sessionGeneration === captured.sessionGeneration &&
+    live.cwd === captured.cwd &&
+    live.slot === captured.slot &&
+    live.busSocketPath === captured.busSocketPath &&
+    isDeepStrictEqual(live.protocol, captured.protocol)
+  );
+}
+
 export function getTelegramFollowerTargetOwnership(input: {
   target: TelegramTarget;
   followers: readonly TelegramBusFollowerView[];
@@ -424,12 +606,14 @@ export function getTelegramFollowerTargetOwnership(input: {
     target: TelegramTarget;
   }[];
   currentInstanceId?: string;
-}): {
-  instanceId: string;
-  ownerGeneration: string;
-  recipientBindingKey: string;
-  protocolIdentity: TelegramBusProtocolIdentity;
-} | undefined {
+}):
+  | {
+      instanceId: string;
+      ownerGeneration: string;
+      recipientBindingKey: string;
+      protocolIdentity: TelegramBusProtocolIdentity;
+    }
+  | undefined {
   const liveFollower = input.followers.find((follower) => {
     return (
       follower.target?.chatId === input.target.chatId &&
@@ -459,43 +643,32 @@ const TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD = "__piTelegramAggregateDelivery";
 const TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD =
   "__piTelegramCrossTargetDelivery";
 
-export function markTelegramBusAggregateDelivery<
-  T extends Record<string, unknown>,
->(body: T): T {
-  return {
-    ...body,
-    [TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD]: true,
-  };
-}
+type TelegramBusDeliveryMarker =
+  | typeof TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD
+  | typeof TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD;
 
-function isTelegramBusAggregateDelivery(body: unknown): boolean {
+function hasTelegramBusDeliveryMarker(
+  body: unknown,
+  marker: TelegramBusDeliveryMarker,
+): boolean {
   return Boolean(
     body &&
     typeof body === "object" &&
     !Array.isArray(body) &&
-    (body as Record<string, unknown>)[TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD] ===
-      true,
+    (body as Record<string, unknown>)[marker] === true,
   );
 }
 
-export function markTelegramBusCrossTargetDelivery<
+export function markTelegramBusAggregateDelivery<
   T extends Record<string, unknown>,
 >(body: T): T {
-  return {
-    ...body,
-    [TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD]: true,
-  };
+  return { ...body, [TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD]: true };
 }
 
-function isTelegramBusCrossTargetDelivery(body: unknown): boolean {
-  return Boolean(
-    body &&
-    typeof body === "object" &&
-    !Array.isArray(body) &&
-    (body as Record<string, unknown>)[
-      TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD
-    ] === true,
-  );
+export function markTelegramBusCrossTargetDelivery<
+  T extends Record<string, unknown>,
+>(body: T): T {
+  return { ...body, [TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD]: true };
 }
 
 export function stripTelegramBusApiMetadata<T extends Record<string, unknown>>(
@@ -567,8 +740,7 @@ export function isTelegramFollowerApiCallAllowed(input: {
       typeof threadId === "number" ? threadId : Number(threadId);
     return (
       Number.isInteger(parsedThreadId) &&
-      (target.threadId === undefined ||
-        !matchesId(threadId, target.threadId))
+      (target.threadId === undefined || !matchesId(threadId, target.threadId))
     );
   };
   const isTargetMessageScoped = (body: unknown): boolean => {
@@ -612,14 +784,20 @@ export function isTelegramFollowerApiCallAllowed(input: {
       return isTargetChatScoped(input.args[1]);
     if (
       apiMethod === "sendMessage" &&
-      isTelegramBusAggregateDelivery(input.args[1])
+      hasTelegramBusDeliveryMarker(
+        input.args[1],
+        TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD,
+      )
     ) {
       const body = input.args[1] as Record<string, unknown>;
       return body.message_thread_id === undefined && isTargetChatScoped(body);
     }
     if (
       (apiMethod === "sendMessage" || apiMethod === "sendRichMessage") &&
-      isTelegramBusCrossTargetDelivery(input.args[1])
+      hasTelegramBusDeliveryMarker(
+        input.args[1],
+        TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD,
+      )
     ) {
       return isDifferentTargetScoped(input.args[1]);
     }
@@ -744,8 +922,10 @@ export function createTelegramBusFollowerDeliveryIdentity(input: {
     !Number.isSafeInteger(input.sourceUpdateId) ||
     input.sourceUpdateId < 0 ||
     (input.sourceClaim !== undefined &&
-      (!input.sourceClaim.acquisitionId || input.sourceClaim.acquisitionId.length > 256 ||
-        !input.sourceClaim.handoffId || input.sourceClaim.handoffId.length > 256))
+      (!input.sourceClaim.acquisitionId ||
+        input.sourceClaim.acquisitionId.length > 256 ||
+        !input.sourceClaim.handoffId ||
+        input.sourceClaim.handoffId.length > 256))
   ) {
     throw new Error("Telegram follower delivery identity is incomplete.");
   }
@@ -763,7 +943,9 @@ export function createTelegramBusFollowerDeliveryIdentity(input: {
     deliveryId: `telegram-follower-v1-${deliveryId}`,
     sourceUpdateId: input.sourceUpdateId,
     recipientBindingKey: input.recipientBindingKey,
-    ...(input.sourceRecoveryKey ? { sourceRecoveryKey: input.sourceRecoveryKey } : {}),
+    ...(input.sourceRecoveryKey
+      ? { sourceRecoveryKey: input.sourceRecoveryKey }
+      : {}),
     ...(input.sourceClaim ? { sourceClaim: { ...input.sourceClaim } } : {}),
   };
 }
@@ -772,26 +954,46 @@ export function canUseTelegramBusInputCustodyReference(input: {
   local?: TelegramBusProtocolIdentity;
   remote?: TelegramBusProtocolIdentity;
 }): boolean {
-  return hasTelegramBusCapability(input.local, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE) &&
-    hasTelegramBusCapability(input.remote, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE);
+  return (
+    hasTelegramBusCapability(
+      input.local,
+      TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE,
+    ) &&
+    hasTelegramBusCapability(
+      input.remote,
+      TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE,
+    )
+  );
 }
 
 export function createTelegramBusFollowerSourceReferenceDeliveryIdentity(input: {
-  kind: "leader.forwardCallback" | "leader.forwardReaction" |
-    "leader.forwardMessage" | "leader.forwardEditedMessage" | "leader.wakeInputCustody";
+  kind:
+    | "leader.forwardCallback"
+    | "leader.forwardReaction"
+    | "leader.forwardMessage"
+    | "leader.forwardEditedMessage"
+    | "leader.wakeInputCustody";
   recipientBindingKey: string;
   sourceRecoveryKey: string;
-  source: { updateId: number; owner: { acquisitionId: string; handoffId?: string } };
+  source: {
+    updateId: number;
+    owner: { acquisitionId: string; handoffId?: string };
+  };
 }): TelegramBusFollowerDeliveryIdentity {
-  if (!input.sourceRecoveryKey || !input.source.owner.handoffId) throw new Error(
-    "Telegram follower source-reference delivery requires an accepted handoff.",
-  );
-  return createTelegramBusFollowerDeliveryIdentity({ kind: input.kind,
+  if (!input.sourceRecoveryKey || !input.source.owner.handoffId)
+    throw new Error(
+      "Telegram follower source-reference delivery requires an accepted handoff.",
+    );
+  return createTelegramBusFollowerDeliveryIdentity({
+    kind: input.kind,
     recipientBindingKey: input.recipientBindingKey,
     sourceUpdateId: input.source.updateId,
     sourceRecoveryKey: input.sourceRecoveryKey,
-    sourceClaim: { acquisitionId: input.source.owner.acquisitionId,
-      handoffId: input.source.owner.handoffId } });
+    sourceClaim: {
+      acquisitionId: input.source.owner.acquisitionId,
+      handoffId: input.source.owner.handoffId,
+    },
+  });
 }
 
 export type TelegramBusEnvelope = (
@@ -897,7 +1099,11 @@ export type TelegramBusEnvelope = (
       recipientRegistrationGeneration: string;
       recipientBindingKey: string;
       sourceRecoveryKey: string;
-      source: { journalBindingKey: string; tokenSha256: string; updateId: number };
+      source: {
+        journalBindingKey: string;
+        tokenSha256: string;
+        updateId: number;
+      };
       handoffId: string;
       sentAtMs: number;
     }
@@ -909,6 +1115,47 @@ export type TelegramBusEnvelope = (
       delivery: TelegramBusFollowerDeliveryIdentity;
       sentAtMs: number;
     }
+  | {
+      kind: "leader.prepareLiveRebind";
+      requestId: string;
+      recipientInstanceId: string;
+      recipientRegistrationGeneration: string;
+      recipientSessionId: string;
+      recipientBindingKey: string;
+      operationId: string;
+      updates: ({ update_id: number } & Record<string, unknown>)[];
+      selectedCommand?: TelegramBusSelectedCommandInput;
+      sentAtMs: number;
+    }
+  | {
+      kind: "leader.applyLiveRebind";
+      requestId: string;
+      recipientInstanceId: string;
+      recipientRegistrationGeneration: string;
+      recipientSessionId: string;
+      recipientBindingKey: string;
+      operationId: string;
+      sourceUpdateIds: number[];
+      mode: "apply" | "inspect";
+      preparedSource?: TelegramBusPreparedCommandSource;
+      selectedCommand?: TelegramBusSelectedCommandInput;
+      sentAtMs: number;
+    }
+  | {
+      kind: "leader.settleLiveRebind";
+      requestId: string;
+      recipientInstanceId: string;
+      recipientRegistrationGeneration: string;
+      recipientSessionId: string;
+      recipientBindingKey: string;
+      operationId: string;
+      sourceUpdateIds: number[];
+      mode: "release" | "discard" | "observe" | "observe-command";
+      oldTarget?: TelegramTarget & { threadId: number };
+      preparedSource?: TelegramBusPreparedCommandSource;
+      selectedCommand?: TelegramBusSelectedCommandInput;
+      sentAtMs: number;
+    }
   | {
       kind: "leader.workspaceRestore";
       requestId: string;
@@ -965,6 +1212,7 @@ export type TelegramBusEnvelope = (
       message: TelegramBusAgentMessage;
       sentAtMs: number;
     }
+  | TelegramBusSelectedMenuDelivery
   | {
       kind: "follower.callApi";
       requestId: string;
@@ -996,10 +1244,25 @@ export type TelegramBusEnvelope = (
     }
 ) & { auth?: string };
 
+/** Follower-staged queue handoff offer before the follower adds its own request and registration framing. */
+export type TelegramBusFollowerQueueHandoffOffer = Omit<
+  Extract<TelegramBusEnvelope, { kind: "follower.offerQueueHandoff" }>,
+  | "kind"
+  | "requestId"
+  | "instanceId"
+  | "registrationGeneration"
+  | "sentAtMs"
+  | "auth"
+>;
+
+/** Leader-routed queue handoff offer as donors and leaders exchange it before envelope framing. */
+export type TelegramBusLeaderQueueHandoffOffer = Omit<
+  Extract<TelegramBusEnvelope, { kind: "leader.offerQueueHandoff" }>,
+  "kind"
+>;
+
 type TelegramBusEnvelopeTrafficClass =
-  | "bootstrap"
-  | "generation-fenced"
-  | "response";
+  "bootstrap" | "generation-fenced" | "response";
 
 export function getTelegramBusEnvelopeTrafficClass(
   envelope: TelegramBusEnvelope,
@@ -1007,7 +1270,8 @@ export function getTelegramBusEnvelopeTrafficClass(
   if (
     envelope.kind === "follower.register" ||
     envelope.kind === "follower.restoreWorkspace"
-  ) return "bootstrap";
+  )
+    return "bootstrap";
   if (envelope.kind === "bus.ack") return "response";
   return "generation-fenced";
 }
@@ -1057,18 +1321,25 @@ export function parseTelegramBusEnvelope(
       envelope = parseRegisterEnvelope(value, requestId, kind);
       break;
     case "follower.heartbeat":
-      envelope = parseHeartbeatEnvelope(value, requestId);
-      break;
     case "follower.disconnect":
-      envelope = parseDisconnectEnvelope(value, requestId);
+      envelope = parseFollowerPresenceEnvelope(value, requestId, kind);
       break;
     case "follower.setThreadDisplayMode":
-      if (typeof value.instanceId === "string" &&
-          typeof value.registrationGeneration === "string" &&
-          (value.mode === "letters" || value.mode === "names" ||
-      value.mode === "directory-snake" || value.mode === "directory-title")) {
-        envelope = { kind, requestId, instanceId: value.instanceId,
-          registrationGeneration: value.registrationGeneration, mode: value.mode };
+      if (
+        typeof value.instanceId === "string" &&
+        typeof value.registrationGeneration === "string" &&
+        (value.mode === "letters" ||
+          value.mode === "names" ||
+          value.mode === "directory-snake" ||
+          value.mode === "directory-title")
+      ) {
+        envelope = {
+          kind,
+          requestId,
+          instanceId: value.instanceId,
+          registrationGeneration: value.registrationGeneration,
+          mode: value.mode,
+        };
       }
       break;
     case "follower.renameThread":
@@ -1076,10 +1347,12 @@ export function parseTelegramBusEnvelope(
       break;
     case "follower.resetThreadName": {
       const target = parseTarget(value.target);
-      if (typeof value.instanceId === "string" &&
-          typeof value.registrationGeneration === "string" &&
-          typeof value.sentAtMs === "number" &&
-          target?.threadId !== undefined) {
+      if (
+        typeof value.instanceId === "string" &&
+        typeof value.registrationGeneration === "string" &&
+        typeof value.sentAtMs === "number" &&
+        target?.threadId !== undefined
+      ) {
         envelope = {
           kind,
           requestId,
@@ -1094,9 +1367,12 @@ export function parseTelegramBusEnvelope(
     case "follower.publishSessionReplacement":
     case "follower.settleSessionReplacement": {
       const intent = normalizeTelegramSessionReplacementIntent(value.intent);
-      if (typeof value.instanceId === "string" &&
-          typeof value.registrationGeneration === "string" &&
-          typeof value.sentAtMs === "number" && intent) {
+      if (
+        typeof value.instanceId === "string" &&
+        typeof value.registrationGeneration === "string" &&
+        typeof value.sentAtMs === "number" &&
+        intent
+      ) {
         envelope = {
           kind,
           requestId,
@@ -1134,15 +1410,147 @@ export function parseTelegramBusEnvelope(
         "leader.forwardEditedMessage",
       );
       break;
+    case "leader.prepareLiveRebind": {
+      const selectedCommand = parseSelectedCommandInput(value.selectedCommand);
+      if (
+        !hasOnlyWireKeys(value, [
+          "kind",
+          "requestId",
+          "auth",
+          "recipientInstanceId",
+          "recipientRegistrationGeneration",
+          "recipientSessionId",
+          "recipientBindingKey",
+          "operationId",
+          "updates",
+          "selectedCommand",
+          "sentAtMs",
+        ]) ||
+        (Object.hasOwn(value, "selectedCommand") &&
+          (!selectedCommand ||
+            !Array.isArray(value.updates) ||
+            value.updates.length !== 1))
+      )
+        break;
+      const recipient = parseLiveRebindRecipient(value);
+      if (
+        recipient &&
+        Array.isArray(value.updates) &&
+        value.updates.every(isRecord) &&
+        isUniqueSourceUpdateIds(
+          value.updates.map((update) => update.update_id),
+        ) &&
+        typeof value.sentAtMs === "number" &&
+        Number.isFinite(value.sentAtMs)
+      ) {
+        envelope = {
+          kind: "leader.prepareLiveRebind",
+          requestId,
+          ...recipient,
+          updates: value.updates as ({ update_id: number } & Record<
+            string,
+            unknown
+          >)[],
+          sentAtMs: value.sentAtMs,
+          ...(selectedCommand ? { selectedCommand } : {}),
+        };
+      }
+      break;
+    }
+    case "leader.applyLiveRebind":
+    case "leader.settleLiveRebind": {
+      const selectedCommand = parseSelectedCommandInput(value.selectedCommand),
+        preparedSource = parsePreparedCommandSource(value.preparedSource);
+      if (
+        !hasOnlyWireKeys(value, [
+          "kind",
+          "requestId",
+          "auth",
+          "recipientInstanceId",
+          "recipientRegistrationGeneration",
+          "recipientSessionId",
+          "recipientBindingKey",
+          "operationId",
+          "sourceUpdateIds",
+          "mode",
+          "oldTarget",
+          "selectedCommand",
+          "preparedSource",
+          "sentAtMs",
+        ]) ||
+        (Object.hasOwn(value, "preparedSource") && !selectedCommand) ||
+        (value.mode === "observe-command" &&
+          (!selectedCommand || Object.hasOwn(value, "oldTarget")))
+      )
+        break;
+      if (
+        Object.hasOwn(value, "selectedCommand") &&
+        (!selectedCommand ||
+          !Array.isArray(value.sourceUpdateIds) ||
+          value.sourceUpdateIds.length !== 1 ||
+          !preparedSource ||
+          preparedSource.updateId !== value.sourceUpdateIds[0] ||
+          preparedSource.journalBindingKey !== value.recipientBindingKey)
+      )
+        break;
+      const recipient = parseLiveRebindRecipient(value);
+      if (
+        recipient &&
+        (value.kind === "leader.applyLiveRebind"
+          ? value.mode === "apply" || value.mode === "inspect"
+          : value.mode === "release" ||
+            value.mode === "discard" ||
+            value.mode === "observe-command" ||
+            (value.mode === "observe" &&
+              !!parseThreadTarget(value.oldTarget))) &&
+        isUniqueSourceUpdateIds(value.sourceUpdateIds) &&
+        typeof value.sentAtMs === "number" &&
+        Number.isFinite(value.sentAtMs)
+      ) {
+        envelope = {
+          kind: value.kind,
+          requestId,
+          ...recipient,
+          sourceUpdateIds: value.sourceUpdateIds,
+          mode: value.mode as
+            | "apply"
+            | "inspect"
+            | "release"
+            | "discard"
+            | "observe"
+            | "observe-command",
+          sentAtMs: value.sentAtMs,
+          ...(value.mode === "observe"
+            ? { oldTarget: parseThreadTarget(value.oldTarget)! }
+            : {}),
+          ...(selectedCommand ? { selectedCommand, preparedSource } : {}),
+        } as TelegramBusEnvelope;
+      }
+      break;
+    }
     case "leader.workspaceRestore":
-      if (typeof value.recipientInstanceId === "string" && value.recipientInstanceId &&
-          typeof value.recipientRegistrationGeneration === "string" && value.recipientRegistrationGeneration &&
-          typeof value.operationId === "string" && value.operationId.length > 0 && value.operationId.length <= 128 &&
-          (value.mode === "apply" || value.mode === "inspect") &&
-          typeof value.sentAtMs === "number" && Number.isFinite(value.sentAtMs)) {
-        envelope = { kind: "leader.workspaceRestore", requestId, recipientInstanceId: value.recipientInstanceId,
-          recipientRegistrationGeneration: value.recipientRegistrationGeneration, operationId: value.operationId,
-          mode: value.mode, sentAtMs: value.sentAtMs };
+      if (
+        typeof value.recipientInstanceId === "string" &&
+        value.recipientInstanceId &&
+        typeof value.recipientRegistrationGeneration === "string" &&
+        value.recipientRegistrationGeneration &&
+        typeof value.operationId === "string" &&
+        value.operationId.length > 0 &&
+        value.operationId.length <= 128 &&
+        (value.mode === "apply" || value.mode === "inspect") &&
+        typeof value.sentAtMs === "number" &&
+        Number.isFinite(value.sentAtMs)
+      ) {
+        envelope = {
+          kind: "leader.workspaceRestore",
+          requestId,
+          recipientInstanceId: value.recipientInstanceId,
+          recipientRegistrationGeneration:
+            value.recipientRegistrationGeneration,
+          operationId: value.operationId,
+          mode: value.mode,
+          sentAtMs: value.sentAtMs,
+        };
       }
       break;
     case "leader.offerQueueHandoff":
@@ -1165,6 +1573,9 @@ export function parseTelegramBusEnvelope(
     case "follower.routeAgentMessage":
       envelope = parseRouteAgentMessageEnvelope(value, requestId);
       break;
+    case "follower.deliverSelectedMenu":
+      envelope = parseSelectedMenuDeliveryEnvelope(value, requestId);
+      break;
     case "follower.callApi":
       envelope = parseCallApiEnvelope(value, requestId);
       break;
@@ -1192,7 +1603,10 @@ type TelegramBusServerGlobal = typeof globalThis & {
   [TELEGRAM_ACTIVE_LOCAL_SERVERS]?: Map<string, TelegramBusLocalServer>;
 };
 
-function getActiveTelegramBusLocalServers(): Map<string, TelegramBusLocalServer> {
+function getActiveTelegramBusLocalServers(): Map<
+  string,
+  TelegramBusLocalServer
+> {
   const root = globalThis as TelegramBusServerGlobal;
   return (root[TELEGRAM_ACTIVE_LOCAL_SERVERS] ??= new Map());
 }
@@ -1247,7 +1661,22 @@ interface TelegramBusLocalServerDeps {
   ) => boolean;
 }
 
+/** Local IPC issuance proof only: this callback/error never enters the envelope or certifies a remote API effect. */
+export class TelegramBusLocalAuthorityError extends Error {
+  readonly requestIssued: boolean;
+  constructor(requestIssued: boolean, reason?: string) {
+    super(
+      reason
+        ? `Telegram bus local authority is unavailable: ${reason}`
+        : "Telegram bus local authority is unavailable.",
+    );
+    this.name = "TelegramBusLocalAuthorityError";
+    this.requestIssued = requestIssued;
+  }
+}
+
 interface TelegramBusLocalClientOptions {
+  assertAuthority?: () => void;
   socketPath: string;
   envelope: TelegramBusEnvelope;
   timeoutMs?: number;
@@ -1265,13 +1694,21 @@ interface TelegramBusForeignOwnedForwarderDeps<TMessage = unknown> {
     message: TMessage,
   ) => "comment" | "forward" | undefined;
   localProtocolIdentity?: TelegramBusProtocolIdentity;
-  validateForwardOwnership?: (ownership: TelegramBusForwardOwnership) => boolean;
+  validateForwardOwnership?: (
+    ownership: TelegramBusForwardOwnership,
+  ) => boolean;
   resolveInputCustodyReference?: (input: {
     sourceUpdateId: number;
     recipientBindingKey: string;
-  }) => { sourceRecoveryKey: string; source: {
-    updateId: number; owner: { acquisitionId: string; handoffId?: string };
-  } } | undefined;
+  }) =>
+    | {
+        sourceRecoveryKey: string;
+        source: {
+          updateId: number;
+          owner: { acquisitionId: string; handoffId?: string };
+        };
+      }
+    | undefined;
   recordRuntimeEvent?: (
     category: string,
     error: unknown,
@@ -1290,10 +1727,14 @@ export function isTelegramBusForwardOwnershipCurrent(
   expected: TelegramBusForwardOwnership,
   current: TelegramBusForwardOwnership | undefined,
 ): boolean {
-  return Boolean(current && current.instanceId === expected.instanceId &&
+  return Boolean(
+    current &&
+    current.instanceId === expected.instanceId &&
     current.ownerGeneration === expected.ownerGeneration &&
     current.recipientBindingKey === expected.recipientBindingKey &&
-    JSON.stringify(current.protocolIdentity) === JSON.stringify(expected.protocolIdentity));
+    JSON.stringify(current.protocolIdentity) ===
+      JSON.stringify(expected.protocolIdentity),
+  );
 }
 
 type TelegramBusDurableForwardEnvelope = Extract<
@@ -1337,6 +1778,13 @@ function createTelegramBusForwardDelivery(
   });
 }
 
+/**
+ * Leader-to-follower forwards and control replies share the stale-liveness window: a follower doing journal work or stalled
+ * by an ordinary multi-second Pi/TUI turn, or a slower Windows named pipe, is not a lost recipient.
+ */
+const TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS =
+  TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS;
+
 export function createTelegramBusForeignOwnedUpdateForwarder<
   TContext,
   TReactionUpdate,
@@ -1392,14 +1840,16 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
       envelopeKind: input.envelopeKind,
       recipientInstanceId: input.ownership.instanceId,
       deliveryId: input.delivery?.deliveryId,
-      sourceUpdateId:
-        input.delivery?.sourceUpdateId ?? input.sourceUpdateId,
+      sourceUpdateId: input.delivery?.sourceUpdateId ?? input.sourceUpdateId,
     });
     return settlement;
   };
   const prepare = (
-    kind: "leader.forwardCallback" | "leader.forwardReaction" |
-      "leader.forwardMessage" | "leader.forwardEditedMessage",
+    kind:
+      | "leader.forwardCallback"
+      | "leader.forwardReaction"
+      | "leader.forwardMessage"
+      | "leader.forwardEditedMessage",
     value: unknown,
     ownership: TelegramBusForwardOwnership,
   ):
@@ -1434,27 +1884,48 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
       };
     }
     const sourceReference = canUseTelegramBusInputCustodyReference({
-      local: deps.localProtocolIdentity, remote: ownership.protocolIdentity });
-    const reference = sourceReference ? deps.resolveInputCustodyReference?.({
-      sourceUpdateId, recipientBindingKey: ownership.recipientBindingKey }) : undefined;
-    if (sourceReference && !reference) return { settlement: reject({
-      status: "retryable", failureClass: "source-reference-missing",
-      message: "Forwarded Telegram update has no exact custody reference.",
-      envelopeKind: kind, ownership, sourceUpdateId }) };
-    const delivery = reference
-      ? createTelegramBusFollowerSourceReferenceDeliveryIdentity({
-          kind: "leader.wakeInputCustody", recipientBindingKey: ownership.recipientBindingKey,
-          sourceRecoveryKey: reference.sourceRecoveryKey, source: reference.source })
-      : createTelegramBusForwardDelivery(kind, sourceUpdateId, ownership.recipientBindingKey);
-    if (!ownership.ownerGeneration) {
+      local: deps.localProtocolIdentity,
+      remote: ownership.protocolIdentity,
+    });
+    const reference = sourceReference
+      ? deps.resolveInputCustodyReference?.({
+          sourceUpdateId,
+          recipientBindingKey: ownership.recipientBindingKey,
+        })
+      : undefined;
+    if (sourceReference && !reference)
       return {
         settlement: reject({
           status: "retryable",
-          failureClass: "recipient-generation-missing",
-          message: "Forwarded Telegram update has no live recipient generation.",
+          failureClass: "source-reference-missing",
+          message: "Forwarded Telegram update has no exact custody reference.",
           envelopeKind: kind,
           ownership,
-          delivery,
+          sourceUpdateId,
+        }),
+      };
+    const delivery = reference
+      ? createTelegramBusFollowerSourceReferenceDeliveryIdentity({
+          kind: "leader.wakeInputCustody",
+          recipientBindingKey: ownership.recipientBindingKey,
+          sourceRecoveryKey: reference.sourceRecoveryKey,
+          source: reference.source,
+        })
+      : createTelegramBusForwardDelivery(
+          kind,
+          sourceUpdateId,
+          ownership.recipientBindingKey,
+        );
+    if (!ownership.ownerGeneration) {
+      return {
+        settlement: reject({
+          status: "retryable",
+          failureClass: "recipient-generation-missing",
+          message:
+            "Forwarded Telegram update has no live recipient generation.",
+          envelopeKind: kind,
+          ownership,
+          delivery,
         }),
       };
     }
@@ -1468,10 +1939,18 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
     envelope: TelegramBusDurableForwardEnvelope,
     ownership: TelegramBusForwardOwnership,
   ): Promise<TelegramBusForeignUpdateSettlement> => {
-    if (deps.validateForwardOwnership && !deps.validateForwardOwnership(ownership)) return reject({
-      status: "retryable", failureClass: "recipient-ownership-stale",
-      message: "Telegram follower ownership changed before forwarding.",
-      envelopeKind: envelope.kind, ownership, delivery: envelope.delivery });
+    if (
+      deps.validateForwardOwnership &&
+      !deps.validateForwardOwnership(ownership)
+    )
+      return reject({
+        status: "retryable",
+        failureClass: "recipient-ownership-stale",
+        message: "Telegram follower ownership changed before forwarding.",
+        envelopeKind: envelope.kind,
+        ownership,
+        delivery: envelope.delivery,
+      });
     if (deps.getAuthSecret) envelope.auth = deps.getAuthSecret();
     const socketPath = resolveTelegramBusSocketPath(deps.socketPath);
     let response: TelegramBusEnvelope | undefined;
@@ -1479,7 +1958,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
       response = await sendTelegramBusLocalEnvelope({
         socketPath,
         envelope,
-        timeoutMs: deps.timeoutMs,
+        timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
         retry: getTelegramBusTransportRetryPolicy({
           endpoint: socketPath,
           operation: "operation",
@@ -1551,7 +2030,8 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
       return reject({
         status: "terminal-rejected",
         failureClass: "durable-receipt-mismatched",
-        message: "Follower acknowledgement returned a mismatched durable receipt.",
+        message:
+          "Follower acknowledgement returned a mismatched durable receipt.",
         envelopeKind: envelope.kind,
         ownership,
         delivery: envelope.delivery,
@@ -1559,105 +2039,88 @@ export function createTelegramBusForeignOwnedUpdateForwarder<
     }
     return { status: "accepted", delivery: envelope.delivery };
   };
+  type ForwardKind = Parameters<typeof prepare>[0];
+  type ForwardBase = Pick<
+    Extract<
+      TelegramBusDurableForwardEnvelope,
+      { kind: "leader.wakeInputCustody" }
+    >,
+    | "requestId"
+    | "recipientInstanceId"
+    | "recipientRegistrationGeneration"
+    | "delivery"
+  >;
+  // A recipient already holding the source reference is only woken; it never receives a second payload copy.
+  const forward = (
+    kind: ForwardKind,
+    value: unknown,
+    ownership: TelegramBusForwardOwnership,
+    build: (
+      base: ForwardBase,
+      sentAtMs: number,
+    ) => TelegramBusDurableForwardEnvelope,
+  ): Promise<TelegramBusForeignUpdateSettlement> => {
+    const prepared = prepare(kind, value, ownership);
+    if ("settlement" in prepared) return Promise.resolve(prepared.settlement);
+    const base = {
+      requestId: deps.createRequestId(),
+      recipientInstanceId: ownership.instanceId,
+      recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
+      delivery: prepared.delivery,
+    };
+    return send(
+      prepared.sourceReference
+        ? { kind: "leader.wakeInputCustody", ...base, sentAtMs: getNowMs() }
+        : build(base, getNowMs()),
+      ownership,
+    );
+  };
   return {
-    forwardCallback: ({ query, ownership }) => {
-      const prepared = prepare("leader.forwardCallback", query, ownership);
-      if ("settlement" in prepared) return Promise.resolve(prepared.settlement);
-      if (prepared.sourceReference) return send({ kind: "leader.wakeInputCustody",
-        requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-        recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-        delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-      return send(
-        {
-          kind: "leader.forwardCallback",
-          requestId: deps.createRequestId(),
-          recipientInstanceId: ownership.instanceId,
-          recipientRegistrationGeneration:
-            prepared.recipientRegistrationGeneration,
-          delivery: prepared.delivery,
-          query,
-          sentAtMs: getNowMs(),
-        },
-        ownership,
-      );
-    },
-    forwardReaction: ({ reactionUpdate, ownership }) => {
-      const prepared = prepare(
+    forwardCallback: ({ query, ownership }) =>
+      forward("leader.forwardCallback", query, ownership, (base, sentAtMs) => ({
+        kind: "leader.forwardCallback",
+        ...base,
+        query,
+        sentAtMs,
+      })),
+    forwardReaction: ({ reactionUpdate, ownership }) =>
+      forward(
         "leader.forwardReaction",
         reactionUpdate,
         ownership,
-      );
-      if ("settlement" in prepared) return Promise.resolve(prepared.settlement);
-      if (prepared.sourceReference) return send({ kind: "leader.wakeInputCustody",
-        requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-        recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-        delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-      return send(
-        {
+        (base, sentAtMs) => ({
           kind: "leader.forwardReaction",
-          requestId: deps.createRequestId(),
-          recipientInstanceId: ownership.instanceId,
-          recipientRegistrationGeneration:
-            prepared.recipientRegistrationGeneration,
-          delivery: prepared.delivery,
+          ...base,
           reactionUpdate,
-          sentAtMs: getNowMs(),
-        },
-        ownership,
-      );
-    },
-    forwardMessage: ({ message, ownership }) => {
-      const prepared = prepare("leader.forwardMessage", message, ownership);
-      if ("settlement" in prepared) return Promise.resolve(prepared.settlement);
-      if (prepared.sourceReference) return send({ kind: "leader.wakeInputCustody",
-        requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-        recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-        delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-      return send(
-        {
+          sentAtMs,
+        }),
+      ),
+    forwardMessage: ({ message, ownership }) =>
+      forward("leader.forwardMessage", message, ownership, (base, sentAtMs) => {
+        const forwardCommentBatchPosition =
+          deps.getForwardCommentBatchPosition?.(message);
+        return {
           kind: "leader.forwardMessage",
-          requestId: deps.createRequestId(),
-          recipientInstanceId: ownership.instanceId,
-          recipientRegistrationGeneration:
-            prepared.recipientRegistrationGeneration,
-          delivery: prepared.delivery,
+          ...base,
           message,
-          ...(deps.getForwardCommentBatchPosition?.(message) !== undefined
-            ? {
-                forwardCommentBatchPosition:
-                  deps.getForwardCommentBatchPosition(message),
-              }
+          ...(forwardCommentBatchPosition !== undefined
+            ? { forwardCommentBatchPosition }
             : {}),
-          sentAtMs: getNowMs(),
-        },
-        ownership,
-      );
-    },
-    forwardEditedMessage: ({ message, ownership }) => {
-      const prepared = prepare(
+          sentAtMs,
+        };
+      }),
+    forwardEditedMessage: ({ message, ownership }) =>
+      forward(
         "leader.forwardEditedMessage",
         message,
         ownership,
-      );
-      if ("settlement" in prepared) return Promise.resolve(prepared.settlement);
-      if (prepared.sourceReference) return send({ kind: "leader.wakeInputCustody",
-        requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-        recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-        delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-      return send(
-        {
+        (base, sentAtMs) => ({
           kind: "leader.forwardEditedMessage",
-          requestId: deps.createRequestId(),
-          recipientInstanceId: ownership.instanceId,
-          recipientRegistrationGeneration:
-            prepared.recipientRegistrationGeneration,
-          delivery: prepared.delivery,
+          ...base,
           message,
-          sentAtMs: getNowMs(),
-        },
-        ownership,
-      );
-    },
+          sentAtMs,
+        }),
+      ),
   };
 }
 
@@ -1683,50 +2146,573 @@ export function createTelegramBusWorkspaceRestoreController(deps: {
   getAuthSecret: () => string | undefined;
   timeoutMs?: number;
 }) {
-  return async (input: { operationId: string; instanceId: string; sessionId: string; slot: string;
-    target: TelegramTarget & { threadId: number }; oldTarget: TelegramTarget & { threadId: number };
-    mode: "apply" | "inspect"; isCurrent: () => boolean }): Promise<TelegramBusWorkspaceRestoreObservation | undefined> => {
+  return async (input: {
+    operationId: string;
+    instanceId: string;
+    sessionId: string;
+    slot: string;
+    target: TelegramTarget & { threadId: number };
+    oldTarget: TelegramTarget & { threadId: number };
+    mode: "apply" | "inspect";
+    isCurrent: () => boolean;
+  }): Promise<TelegramBusWorkspaceRestoreObservation | undefined> => {
     const isCurrent = input.isCurrent.bind(input);
     if (!isCurrent()) return undefined;
     const follower = deps.getFollower(input.instanceId);
     const secret = deps.getAuthSecret();
-    if (!secret || !follower?.registrationGeneration || !follower.busSocketPath ||
-        follower.sessionId !== input.sessionId || follower.slot !== input.slot ||
-        !hasTelegramBusCapability(deps.localProtocolIdentity, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) ||
-        !hasTelegramBusCapability(follower.protocol, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) ||
-        !getTelegramBusProtocolCompatibility({ local: deps.localProtocolIdentity, remote: follower.protocol }).compatible) return undefined;
+    if (
+      !secret ||
+      !follower?.registrationGeneration ||
+      !follower.busSocketPath ||
+      follower.sessionId !== input.sessionId ||
+      follower.slot !== input.slot ||
+      !hasTelegramBusSharedCapabilities(
+        deps.localProtocolIdentity,
+        follower.protocol,
+        [TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE],
+      )
+    )
+      return undefined;
     const captured = structuredClone(follower);
-    const expected = { operationId: input.operationId, sessionId: input.sessionId, slot: input.slot,
-      target: { ...input.target }, oldTarget: { ...input.oldTarget }, mode: input.mode };
+    const expected = {
+      operationId: input.operationId,
+      sessionId: input.sessionId,
+      slot: input.slot,
+      target: { ...input.target },
+      oldTarget: { ...input.oldTarget },
+      mode: input.mode,
+    };
     const current = (): boolean => {
-      if (!isCurrent() || deps.getAuthSecret() !== secret ||
-          !hasTelegramBusCapability(deps.localProtocolIdentity, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE)) return false;
+      if (
+        !isCurrent() ||
+        deps.getAuthSecret() !== secret ||
+        !hasTelegramBusCapability(
+          deps.localProtocolIdentity,
+          TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE,
+        )
+      )
+        return false;
       const live = deps.getFollower(captured.instanceId);
-      return !!live && live.registrationGeneration === captured.registrationGeneration &&
-        live.sessionId === captured.sessionId && live.cwd === captured.cwd && live.slot === captured.slot &&
-        live.busSocketPath === captured.busSocketPath && live.target?.chatId === captured.target?.chatId &&
+      return (
+        !!live &&
+        live.registrationGeneration === captured.registrationGeneration &&
+        live.sessionId === captured.sessionId &&
+        live.cwd === captured.cwd &&
+        live.slot === captured.slot &&
+        live.busSocketPath === captured.busSocketPath &&
+        live.target?.chatId === captured.target?.chatId &&
         live.target?.threadId === captured.target?.threadId &&
-        hasTelegramBusCapability(live.protocol, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) &&
-        getTelegramBusProtocolCompatibility({ local: deps.localProtocolIdentity, remote: live.protocol }).compatible;
+        hasTelegramBusCapability(
+          live.protocol,
+          TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE,
+        ) &&
+        getTelegramBusProtocolCompatibility({
+          local: deps.localProtocolIdentity,
+          remote: live.protocol,
+        }).compatible
+      );
     };
     if (!current()) return undefined;
     const requestId = deps.createRequestId();
-    const response = await sendTelegramBusLocalEnvelope({ socketPath: captured.busSocketPath!, timeoutMs: deps.timeoutMs,
-      retry: { attempts: 1, delayMs: 0 }, envelope: { kind: "leader.workspaceRestore", requestId,
-        recipientInstanceId: captured.instanceId, recipientRegistrationGeneration: captured.registrationGeneration!,
-        operationId: expected.operationId, mode: expected.mode, auth: secret, sentAtMs: Date.now() } });
-    if (!current() || response?.kind !== "bus.ack" || response.requestId !== requestId || response.ok !== true ||
-        !response.result || typeof response.result !== "object") return undefined;
+    const response = await sendTelegramBusLocalEnvelope({
+      socketPath: captured.busSocketPath!,
+      timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
+      retry: { attempts: 1, delayMs: 0 },
+      envelope: {
+        kind: "leader.workspaceRestore",
+        requestId,
+        recipientInstanceId: captured.instanceId,
+        recipientRegistrationGeneration: captured.registrationGeneration!,
+        operationId: expected.operationId,
+        mode: expected.mode,
+        auth: secret,
+        sentAtMs: Date.now(),
+      },
+    });
+    if (
+      !current() ||
+      response?.kind !== "bus.ack" ||
+      response.requestId !== requestId ||
+      response.ok !== true ||
+      !response.result ||
+      typeof response.result !== "object"
+    )
+      return undefined;
     const result = response.result as Record<string, unknown>;
     const recipient = result.recipient as Record<string, unknown> | undefined;
     const target = parseThreadTarget(result.target);
     const wanted = result.ready === true ? expected.target : expected.oldTarget;
-    if (result.operationId !== expected.operationId || typeof result.ready !== "boolean" || result.slot !== expected.slot ||
-        !target || target.chatId !== wanted.chatId || target.threadId !== wanted.threadId ||
-        recipient?.kind !== "follower" || recipient.instanceId !== captured.instanceId ||
-        recipient.sessionId !== expected.sessionId || recipient.generation !== captured.registrationGeneration) return undefined;
-    return { operationId: expected.operationId, recipient: { kind: "follower", instanceId: captured.instanceId,
-      sessionId: expected.sessionId, generation: captured.registrationGeneration! }, target, slot: expected.slot, ready: result.ready };
+    if (
+      result.operationId !== expected.operationId ||
+      typeof result.ready !== "boolean" ||
+      result.slot !== expected.slot ||
+      !target ||
+      target.chatId !== wanted.chatId ||
+      target.threadId !== wanted.threadId ||
+      recipient?.kind !== "follower" ||
+      recipient.instanceId !== captured.instanceId ||
+      recipient.sessionId !== expected.sessionId ||
+      recipient.generation !== captured.registrationGeneration
+    )
+      return undefined;
+    return {
+      operationId: expected.operationId,
+      recipient: {
+        kind: "follower",
+        instanceId: captured.instanceId,
+        sessionId: expected.sessionId,
+        generation: captured.registrationGeneration!,
+      },
+      target,
+      slot: expected.slot,
+      ready: result.ready,
+    };
+  };
+}
+
+/** Each capability has its own effect boundary; transport retries never replay save/dispatch/disposal. */
+export function createTelegramBusLiveRebindController(deps: {
+  getFollower(instanceId: string): TelegramBusFollowerView | undefined;
+  localProtocolIdentity: TelegramBusProtocolIdentity;
+  createRequestId(): string;
+  getAuthSecret(): string | undefined;
+  timeoutMs?: number;
+}) {
+  return async (
+    input: {
+      operationId: string;
+      instanceId: string;
+      sessionId: string;
+      recipientBindingKey: string;
+      isCurrent(): boolean;
+      selectedCommand?: TelegramBusSelectedCommandInput;
+      preparedSource?: TelegramBusPreparedCommandSource;
+    } & (
+      | { updates: ({ update_id: number } & Record<string, unknown>)[] }
+      | {
+          mode:
+            | "apply"
+            | "inspect"
+            | "release"
+            | "discard"
+            | "observe"
+            | "observe-command";
+          sourceUpdateIds: number[];
+          slot: string;
+          target: TelegramTarget & { threadId: number };
+          oldTarget: TelegramTarget & { threadId: number };
+        }
+    ),
+  ): Promise<
+    | TelegramBusLiveRebindSaveObservation
+    | TelegramBusLiveRebindApplyObservation
+    | TelegramBusLiveRebindSettlementObservation
+    | TelegramBusLiveRebindWorkObservation
+    | TelegramBusLiveRebindCommandObservation
+    | undefined
+  > => {
+    const isCurrent = input.isCurrent.bind(input),
+      localProtocol = structuredClone(deps.localProtocolIdentity);
+    const selectedCommand = parseSelectedCommandInput(input.selectedCommand),
+      held = selectedCommand,
+      preparedSource = parsePreparedCommandSource(input.preparedSource);
+    if (
+      !hasOnlyWireKeys(input, [
+        "operationId",
+        "instanceId",
+        "sessionId",
+        "recipientBindingKey",
+        "isCurrent",
+        "selectedCommand",
+        "preparedSource",
+        "updates",
+        "mode",
+        "sourceUpdateIds",
+        "slot",
+        "target",
+        "oldTarget",
+      ]) ||
+      ("mode" in input &&
+        (![
+          "apply",
+          "inspect",
+          "release",
+          "discard",
+          "observe",
+          "observe-command",
+        ].includes(input.mode) ||
+          (input.mode === "observe-command" && !selectedCommand)))
+    )
+      return undefined;
+    if (
+      (input.preparedSource !== undefined &&
+        (!held ||
+          !preparedSource ||
+          preparedSource.journalBindingKey !== input.recipientBindingKey ||
+          preparedSource.updateId !==
+            ("mode" in input
+              ? input.sourceUpdateIds[0]
+              : input.updates[0]?.update_id))) ||
+      (held && "mode" in input && !preparedSource)
+    )
+      return undefined;
+    if (
+      input.selectedCommand !== undefined &&
+      (!held ||
+        ("mode" in input
+          ? input.sourceUpdateIds.length !== 1 ||
+            !areTelegramTargetsEqual(input.target, held.target)
+          : input.updates.length !== 1))
+    )
+      return undefined;
+    const marker = selectedCommand ? { selectedCommand } : {};
+    const expected = structuredClone({
+      operationId: input.operationId,
+      instanceId: input.instanceId,
+      sessionId: input.sessionId,
+      recipientBindingKey: input.recipientBindingKey,
+      ...(held
+        ? { ...marker, ...(preparedSource ? { preparedSource } : {}) }
+        : {}),
+      ...("mode" in input
+        ? {
+            mode: input.mode,
+            sourceUpdateIds: input.sourceUpdateIds,
+            slot: input.slot,
+            target: input.target,
+            oldTarget: input.oldTarget,
+          }
+        : { updates: input.updates }),
+    });
+    const observing = "mode" in expected && expected.mode === "observe";
+    const commandObserving =
+      "mode" in expected && expected.mode === "observe-command";
+    const settling =
+      "mode" in expected &&
+      (expected.mode === "release" ||
+        expected.mode === "discard" ||
+        observing ||
+        commandObserving);
+    const required = [
+      TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE,
+      ...("mode" in expected || held
+        ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY]
+        : []),
+      ...(settling || held ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE] : []),
+      ...(held
+        ? [
+            TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET,
+            TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
+          ]
+        : []),
+    ];
+    const follower = deps.getFollower(expected.instanceId),
+      secret = deps.getAuthSecret();
+    if (
+      !isCurrent() ||
+      !secret ||
+      !follower?.registrationGeneration ||
+      !follower.busSocketPath ||
+      follower.sessionId !== expected.sessionId ||
+      !hasTelegramBusSharedCapabilities(
+        deps.localProtocolIdentity,
+        follower.protocol,
+        required,
+      )
+    )
+      return undefined;
+    const captured = structuredClone(follower);
+    /** The first failed authority condition, by fixed label; undefined while the captured recipient is current. */
+    const staleReason = (): string | undefined => {
+      if (!isCurrent()) return "caller authority";
+      if (deps.getAuthSecret() !== secret) return "auth secret";
+      if (
+        !isDeepStrictEqual(deps.localProtocolIdentity, localProtocol) ||
+        !required.every((cap) =>
+          hasTelegramBusCapability(deps.localProtocolIdentity, cap),
+        )
+      )
+        return "local protocol";
+      const live = deps.getFollower(expected.instanceId);
+      if (!live) return "follower registration";
+      if (
+        live.sessionId !== captured.sessionId ||
+        live.registrationGeneration !== captured.registrationGeneration ||
+        live.sessionGeneration !== captured.sessionGeneration
+      )
+        return "follower generation";
+      if (
+        live.pid !== captured.pid ||
+        live.processBirthId !== captured.processBirthId
+      )
+        return "follower process";
+      if (
+        live.busSocketPath !== captured.busSocketPath ||
+        live.slot !== captured.slot ||
+        live.cwd !== captured.cwd
+      )
+        return "follower endpoint";
+      if (
+        "mode" in expected
+          ? live.slot !== expected.slot ||
+            !live.target ||
+            (!areTelegramTargetsEqual(live.target, expected.target!) &&
+              !areTelegramTargetsEqual(live.target, expected.oldTarget!))
+          : !isDeepStrictEqual(live.target, captured.target)
+      )
+        return "follower target";
+      if (
+        !required.every((cap) =>
+          hasTelegramBusCapability(live.protocol, cap),
+        ) ||
+        !isDeepStrictEqual(live.protocol, captured.protocol) ||
+        !getTelegramBusProtocolCompatibility({
+          local: deps.localProtocolIdentity,
+          remote: live.protocol,
+        }).compatible
+      )
+        return "follower protocol";
+      return undefined;
+    };
+    const current = () => staleReason() === undefined;
+    if (!current()) return undefined;
+    const requestId = deps.createRequestId();
+    const response = await sendTelegramBusLocalEnvelope({
+      socketPath: captured.busSocketPath!,
+      timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
+      retry: { attempts: 1, delayMs: 0 },
+      ...(held
+        ? {
+            assertAuthority: () => {
+              const reason = staleReason();
+              if (reason)
+                throw new Error(
+                  `Selected held input sender authority changed (${reason}).`,
+                );
+            },
+          }
+        : {}),
+      envelope: {
+        requestId,
+        auth: secret,
+        ...(held
+          ? {
+              ...marker,
+              ...("mode" in expected
+                ? { preparedSource: expected.preparedSource }
+                : {}),
+            }
+          : {}),
+        recipientInstanceId: expected.instanceId,
+        recipientRegistrationGeneration: captured.registrationGeneration!,
+        recipientSessionId: expected.sessionId,
+        recipientBindingKey: expected.recipientBindingKey,
+        operationId: expected.operationId,
+        sentAtMs: Date.now(),
+        ...("mode" in expected
+          ? settling
+            ? {
+                kind: "leader.settleLiveRebind" as const,
+                mode: expected.mode as
+                  "release" | "discard" | "observe" | "observe-command",
+                sourceUpdateIds: expected.sourceUpdateIds!,
+                ...(observing ? { oldTarget: expected.oldTarget } : {}),
+              }
+            : {
+                kind: "leader.applyLiveRebind" as const,
+                mode: expected.mode as "apply" | "inspect",
+                sourceUpdateIds: expected.sourceUpdateIds!,
+              }
+          : {
+              kind: "leader.prepareLiveRebind" as const,
+              updates: expected.updates!,
+            }),
+      },
+    });
+    if (
+      !current() ||
+      response?.kind !== "bus.ack" ||
+      response.requestId !== requestId ||
+      response.ok !== true ||
+      !isRecord(response.result)
+    )
+      return undefined;
+    const result = response.result,
+      recipient = result.recipient;
+    if (
+      !hasOnlyWireKeys(result, [
+        "operationId",
+        "recipient",
+        "sourceUpdateIds",
+        "selectedCommand",
+        "preparedSource",
+        "status",
+        "command",
+        "sourceAck",
+        "target",
+        "slot",
+        "action",
+        "oldTarget",
+        "work",
+      ])
+    )
+      return undefined;
+    if (
+      selectedCommand
+        ? !isDeepStrictEqual(
+            parseSelectedCommandInput(result.selectedCommand),
+            selectedCommand,
+          )
+        : Object.hasOwn(result, "selectedCommand")
+    )
+      return undefined;
+    const ids = (
+      "mode" in expected
+        ? [...expected.sourceUpdateIds!]
+        : expected.updates!.map((update) => update.update_id)
+    ).sort((a, b) => a - b);
+    const observedSource = parsePreparedCommandSource(result.preparedSource);
+    if (
+      held
+        ? !observedSource ||
+          observedSource.updateId !== ids[0] ||
+          observedSource.journalBindingKey !== expected.recipientBindingKey ||
+          (expected.preparedSource &&
+            !isDeepStrictEqual(observedSource, expected.preparedSource))
+        : Object.hasOwn(result, "preparedSource")
+    )
+      return undefined;
+    if (
+      result.operationId !== expected.operationId ||
+      !(commandObserving
+        ? result.status === "command-observed"
+        : observing
+          ? result.status === "observed"
+          : settling
+            ? result.status === "protected" ||
+              result.status === "unknown" ||
+              result.status ===
+                (expected.mode === "release" ? "released" : "discarded")
+            : "mode" in expected
+              ? result.status === "saved" || result.status === "applied"
+              : result.status === "saved") ||
+      !isRecord(recipient) ||
+      recipient.instanceId !== expected.instanceId ||
+      recipient.sessionId !== expected.sessionId ||
+      recipient.generation !== captured.registrationGeneration ||
+      recipient.bindingKey !== expected.recipientBindingKey ||
+      !Array.isArray(result.sourceUpdateIds) ||
+      result.sourceUpdateIds.length !== ids.length ||
+      result.sourceUpdateIds.some((id, index) => id !== ids[index])
+    )
+      return undefined;
+    const observation: TelegramBusLiveRebindSaveObservation = {
+      operationId: expected.operationId,
+      recipient: {
+        instanceId: expected.instanceId,
+        sessionId: expected.sessionId,
+        generation: captured.registrationGeneration!,
+        bindingKey: expected.recipientBindingKey,
+      },
+      sourceUpdateIds: ids,
+      ...(held
+        ? { ...structuredClone(marker), preparedSource: { ...observedSource! } }
+        : {}),
+      status: "saved",
+    };
+    if (!("mode" in expected)) return observation;
+    if (commandObserving) {
+      const sourceAck = parsePreparedCommandSource(result.sourceAck);
+      if (
+        !hasOnlyWireKeys(result, [
+          "operationId",
+          "recipient",
+          "sourceUpdateIds",
+          "selectedCommand",
+          "preparedSource",
+          "status",
+          "command",
+          "sourceAck",
+        ]) ||
+        !hasOnlyWireKeys(recipient, [
+          "instanceId",
+          "sessionId",
+          "generation",
+          "bindingKey",
+        ]) ||
+        !["completed", "unknown", "not-issued"].includes(
+          result.command as string,
+        ) ||
+        (Object.hasOwn(result, "sourceAck") &&
+          (!sourceAck ||
+            !isDeepStrictEqual(sourceAck, expected.preparedSource) ||
+            result.command === "not-issued"))
+      )
+        return undefined;
+      const settled = {
+        command:
+          result.command as TelegramBusLiveRebindCommandObservation["command"],
+        ...(sourceAck ? { sourceAck: { ...sourceAck } } : {}),
+      };
+      return {
+        ...observation,
+        status: "command-observed",
+        selectedCommand: structuredClone(selectedCommand!),
+        preparedSource: { ...observedSource! },
+        ...settled,
+      };
+    }
+    if (observing) {
+      const work = result.work,
+        oldTarget = parseThreadTarget(result.oldTarget);
+      if (
+        !oldTarget ||
+        !isDeepStrictEqual(oldTarget, expected.oldTarget) ||
+        !isRecord(work) ||
+        [
+          work.sessionBusy,
+          work.targetWork,
+          work.deliveryPending,
+          work.unknown,
+        ].some((flag) => typeof flag !== "boolean")
+      )
+        return undefined;
+      return {
+        ...observation,
+        status: "observed",
+        oldTarget,
+        work: {
+          sessionBusy: work.sessionBusy as boolean,
+          targetWork: work.targetWork as boolean,
+          deliveryPending: work.deliveryPending as boolean,
+          unknown: work.unknown as boolean,
+        },
+      };
+    }
+    if (settling) {
+      if (result.action !== expected.mode) return undefined;
+      return {
+        ...observation,
+        action: expected.mode as "release" | "discard",
+        status:
+          result.status as TelegramBusLiveRebindSettlementObservation["status"],
+      };
+    }
+    const target = parseThreadTarget(result.target),
+      wanted =
+        result.status === "applied" ? expected.target : expected.oldTarget;
+    if (
+      !target ||
+      !isDeepStrictEqual(target, wanted) ||
+      result.slot !== expected.slot
+    )
+      return undefined;
+    return {
+      ...observation,
+      status: result.status as "saved" | "applied",
+      target,
+      slot: expected.slot!,
+    };
   };
 }
 
@@ -1741,15 +2727,21 @@ export function isTelegramBusEnvelopeAuthorized(
   return auth.length === expected.length && timingSafeEqual(auth, expected);
 }
 
+/** Negative acknowledgement carrying only a diagnostic message. */
+export function rejectTelegramBusRequest(
+  requestId: string,
+  message: string,
+): Extract<TelegramBusEnvelope, { kind: "bus.ack" }> {
+  return { kind: "bus.ack", requestId, ok: false, message };
+}
+
 export function createUnauthorizedBusAck(
   requestId: string,
 ): TelegramBusEnvelope {
-  return {
-    kind: "bus.ack",
+  return rejectTelegramBusRequest(
     requestId,
-    ok: false,
-    message: "Unauthorized Telegram bus envelope.",
-  };
+    "Unauthorized Telegram bus envelope.",
+  );
 }
 
 export function createTelegramBusLocalServer(
@@ -1814,7 +2806,9 @@ export function createTelegramBusLocalServer(
       result: Promise.resolve().then(() => deps.handleEnvelope(envelope)),
     };
     requestLedger.set(key, entry);
-    const settled = () => { entry.settled = true; };
+    const settled = () => {
+      entry.settled = true;
+    };
     void entry.result.then(settled, settled);
     return entry.result;
   };
@@ -2070,6 +3064,25 @@ function sendTelegramBusLocalEnvelopeOnce(
 ): Promise<TelegramBusEnvelope | undefined> {
   const timeoutMs = options.timeoutMs ?? 1000;
   return new Promise((resolve, reject) => {
+    const assertAuthority = options.assertAuthority;
+    let issued = false;
+    const assertCurrent = () => {
+      try {
+        assertAuthority?.();
+      } catch (error) {
+        // The caller's reason is a fixed condition label, never request or credential content.
+        throw new TelegramBusLocalAuthorityError(
+          issued,
+          error instanceof Error ? error.message : undefined,
+        );
+      }
+    };
+    try {
+      assertCurrent();
+    } catch (error) {
+      reject(error);
+      return;
+    }
     const socket = createConnection(options.socketPath);
     let settled = false;
     let buffer = "";
@@ -2102,14 +3115,28 @@ function sendTelegramBusLocalEnvelopeOnce(
     }, timeoutMs);
     socket.setEncoding("utf8");
     socket.once("connect", () => {
-      socket.write(encodeTelegramBusEnvelope(options.envelope));
+      try {
+        assertCurrent();
+        const encoded = encodeTelegramBusEnvelope(options.envelope);
+        assertCurrent();
+        issued = true;
+        socket.write(encoded);
+      } catch (error) {
+        settle(() => reject(error));
+      }
     });
     socket.on("data", (chunk) => {
       buffer += chunk;
       const newlineIndex = buffer.indexOf("\n");
       if (newlineIndex < 0) return;
       const line = buffer.slice(0, newlineIndex);
-      settle(() => resolve(parseTelegramBusEnvelope(line)));
+      try {
+        const response = parseTelegramBusEnvelope(line);
+        assertCurrent();
+        settle(() => resolve(response));
+      } catch (error) {
+        settle(() => reject(error));
+      }
     });
     socket.once("error", (error) => settle(() => reject(error)));
     socket.once("end", () => settle(() => resolve(undefined)));
@@ -2137,7 +3164,11 @@ export async function sendTelegramBusLocalEnvelope(
         attempts,
         ...info,
       });
-      if (attempt >= attempts || !isRetryableTelegramBusTransportError(error)) {
+      if (
+        error instanceof TelegramBusLocalAuthorityError ||
+        attempt >= attempts ||
+        !isRetryableTelegramBusTransportError(error)
+      ) {
         throw error;
       }
       resolvedOptions.recordTransportEvent?.("client-retry", {
@@ -2179,15 +3210,21 @@ export interface TelegramBusFollowerRegistry {
 export function createTelegramBusForwardOwnershipValidator(
   registry: Pick<TelegramBusFollowerRegistry, "get">,
 ): (ownership: TelegramBusForwardOwnership) => boolean {
-  return ownership => {
+  return (ownership) => {
     const follower = registry.get(ownership.instanceId);
-    return isTelegramBusForwardOwnershipCurrent(ownership,
-      follower?.registrationGeneration && follower.profileKey && follower.protocol ? {
-        instanceId: follower.instanceId,
-        ownerGeneration: follower.registrationGeneration,
-        recipientBindingKey: follower.profileKey,
-        protocolIdentity: follower.protocol,
-      } : undefined);
+    return isTelegramBusForwardOwnershipCurrent(
+      ownership,
+      follower?.registrationGeneration &&
+        follower.profileKey &&
+        follower.protocol
+        ? {
+            instanceId: follower.instanceId,
+            ownerGeneration: follower.registrationGeneration,
+            recipientBindingKey: follower.profileKey,
+            protocolIdentity: follower.protocol,
+          }
+        : undefined,
+    );
   };
 }
 
@@ -2195,15 +3232,22 @@ function hasTelegramBusFollowerIdentityOverlap(
   first: TelegramBusInstanceRegistration,
   second: TelegramBusInstanceRegistration,
 ): boolean {
-  return first.instanceId === second.instanceId ||
-    (first.profileKey !== undefined && first.profileKey === second.profileKey) ||
-    (first.target !== undefined && first.target.chatId === second.target?.chatId &&
-      first.target.threadId === second.target.threadId);
+  return (
+    first.instanceId === second.instanceId ||
+    (first.profileKey !== undefined &&
+      first.profileKey === second.profileKey) ||
+    (first.target !== undefined &&
+      first.target.chatId === second.target?.chatId &&
+      first.target.threadId === second.target.threadId)
+  );
 }
 
 export function createTelegramBusFollowerRegistry(): TelegramBusFollowerRegistry {
   const followers = new Map<string, TelegramBusFollowerView>();
-  const observations = new Set<{ follower: TelegramBusFollowerView; current: boolean }>();
+  const observations = new Set<{
+    follower: TelegramBusFollowerView;
+    current: boolean;
+  }>();
   const clone = (
     follower: TelegramBusFollowerView,
   ): TelegramBusFollowerView => ({
@@ -2223,7 +3267,8 @@ export function createTelegramBusFollowerRegistry(): TelegramBusFollowerRegistry
       const existing = followers.get(registration.instanceId);
       for (const [instanceId, follower] of followers.entries()) {
         if (instanceId === registration.instanceId) continue;
-        if (hasTelegramBusFollowerIdentityOverlap(registration, follower)) followers.delete(instanceId);
+        if (hasTelegramBusFollowerIdentityOverlap(registration, follower))
+          followers.delete(instanceId);
       }
       const next: TelegramBusFollowerView = {
         ...registration,
@@ -2241,7 +3286,8 @@ export function createTelegramBusFollowerRegistry(): TelegramBusFollowerRegistry
       };
       followers.set(registration.instanceId, next);
       for (const observation of observations) {
-        if (!hasTelegramBusFollowerIdentityOverlap(next, observation.follower)) continue;
+        if (!hasTelegramBusFollowerIdentityOverlap(next, observation.follower))
+          continue;
         observation.current = false;
         observations.delete(observation);
       }
@@ -2278,8 +3324,12 @@ export function createTelegramBusFollowerRegistry(): TelegramBusFollowerRegistry
     },
     observeUnregistered: (follower) => {
       // This watches replacement, not process death or delivery authority.
-      const observation = { follower: clone(follower), current: ![...followers.values()]
-        .some((current) => hasTelegramBusFollowerIdentityOverlap(current, follower)) };
+      const observation = {
+        follower: clone(follower),
+        current: ![...followers.values()].some((current) =>
+          hasTelegramBusFollowerIdentityOverlap(current, follower),
+        ),
+      };
       if (observation.current) observations.add(observation);
       return {
         isCurrent: () => observation.current,
@@ -2340,12 +3390,12 @@ async function handleTelegramBusSocketLine(
       ...classifyTelegramBusTransportError(error),
     });
     socket.write(
-      encodeTelegramBusEnvelope({
-        kind: "bus.ack",
-        requestId: envelope.requestId,
-        ok: false,
-        message: "Telegram bus handler failed.",
-      }),
+      encodeTelegramBusEnvelope(
+        rejectTelegramBusRequest(
+          envelope.requestId,
+          "Telegram bus handler failed.",
+        ),
+      ),
     );
   }
 }
@@ -2359,32 +3409,15 @@ function parseRegisterEnvelope(
   return registration ? { kind, requestId, registration } : undefined;
 }
 
-function parseHeartbeatEnvelope(
-  value: Record<string, unknown>,
-  requestId: string,
-): TelegramBusEnvelope | undefined {
-  return typeof value.instanceId === "string" &&
-    typeof value.sentAtMs === "number"
-    ? {
-        kind: "follower.heartbeat",
-        requestId,
-        instanceId: value.instanceId,
-        ...(typeof value.registrationGeneration === "string"
-          ? { registrationGeneration: value.registrationGeneration }
-          : {}),
-        sentAtMs: value.sentAtMs,
-      }
-    : undefined;
-}
-
-function parseDisconnectEnvelope(
+function parseFollowerPresenceEnvelope(
   value: Record<string, unknown>,
   requestId: string,
+  kind: "follower.heartbeat" | "follower.disconnect",
 ): TelegramBusEnvelope | undefined {
   return typeof value.instanceId === "string" &&
     typeof value.sentAtMs === "number"
     ? {
-        kind: "follower.disconnect",
+        kind,
         requestId,
         instanceId: value.instanceId,
         ...(typeof value.registrationGeneration === "string"
@@ -2429,14 +3462,17 @@ function parseTelegramBusFollowerDeliveryIdentity(
     typeof value.recipientBindingKey !== "string" ||
     !value.recipientBindingKey ||
     (value.sourceRecoveryKey !== undefined &&
-      (typeof value.sourceRecoveryKey !== "string" || !value.sourceRecoveryKey ||
+      (typeof value.sourceRecoveryKey !== "string" ||
+        !value.sourceRecoveryKey ||
         value.sourceRecoveryKey.length > 1_024)) ||
     (value.sourceClaim !== undefined &&
       (!isRecord(value.sourceClaim) ||
         typeof value.sourceClaim.acquisitionId !== "string" ||
-        !value.sourceClaim.acquisitionId || value.sourceClaim.acquisitionId.length > 256 ||
+        !value.sourceClaim.acquisitionId ||
+        value.sourceClaim.acquisitionId.length > 256 ||
         typeof value.sourceClaim.handoffId !== "string" ||
-        !value.sourceClaim.handoffId || value.sourceClaim.handoffId.length > 256))
+        !value.sourceClaim.handoffId ||
+        value.sourceClaim.handoffId.length > 256))
   ) {
     return undefined;
   }
@@ -2445,10 +3481,16 @@ function parseTelegramBusFollowerDeliveryIdentity(
     sourceUpdateId: value.sourceUpdateId as number,
     recipientBindingKey: value.recipientBindingKey,
     ...(typeof value.sourceRecoveryKey === "string"
-      ? { sourceRecoveryKey: value.sourceRecoveryKey } : {}),
+      ? { sourceRecoveryKey: value.sourceRecoveryKey }
+      : {}),
     ...(isRecord(value.sourceClaim)
-      ? { sourceClaim: { acquisitionId: value.sourceClaim.acquisitionId as string,
-          handoffId: value.sourceClaim.handoffId as string } } : {}),
+      ? {
+          sourceClaim: {
+            acquisitionId: value.sourceClaim.acquisitionId as string,
+            handoffId: value.sourceClaim.handoffId as string,
+          },
+        }
+      : {}),
   };
 }
 
@@ -2524,42 +3566,68 @@ function parseForwardMessageEnvelope(
 }
 
 function parseOfferInputCustodyHandoffEnvelope(
-  value: Record<string, unknown>, requestId: string,
+  value: Record<string, unknown>,
+  requestId: string,
 ): TelegramBusEnvelope | undefined {
   const source = value.source;
-  if (!isRecord(source) || typeof value.recipientInstanceId !== "string" ||
+  if (
+    !isRecord(source) ||
+    typeof value.recipientInstanceId !== "string" ||
     typeof value.recipientRegistrationGeneration !== "string" ||
-    typeof value.recipientBindingKey !== "string" || !value.recipientBindingKey ||
-    typeof value.sourceRecoveryKey !== "string" || !value.sourceRecoveryKey ||
+    typeof value.recipientBindingKey !== "string" ||
+    !value.recipientBindingKey ||
+    typeof value.sourceRecoveryKey !== "string" ||
+    !value.sourceRecoveryKey ||
     value.sourceRecoveryKey.length > 1_024 ||
-    typeof source.journalBindingKey !== "string" || !source.journalBindingKey ||
+    typeof source.journalBindingKey !== "string" ||
+    !source.journalBindingKey ||
     source.journalBindingKey !== value.sourceRecoveryKey ||
-    typeof source.tokenSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(source.tokenSha256) ||
-    !Number.isSafeInteger(source.updateId) || (source.updateId as number) < 0 ||
-    typeof value.handoffId !== "string" || !value.handoffId || value.handoffId.length > 256 ||
-    typeof value.sentAtMs !== "number") return undefined;
-  return { kind: "leader.offerInputCustodyHandoff", requestId,
+    typeof source.tokenSha256 !== "string" ||
+    !/^[a-f0-9]{64}$/u.test(source.tokenSha256) ||
+    !Number.isSafeInteger(source.updateId) ||
+    (source.updateId as number) < 0 ||
+    typeof value.handoffId !== "string" ||
+    !value.handoffId ||
+    value.handoffId.length > 256 ||
+    typeof value.sentAtMs !== "number"
+  )
+    return undefined;
+  return {
+    kind: "leader.offerInputCustodyHandoff",
+    requestId,
     recipientInstanceId: value.recipientInstanceId,
     recipientRegistrationGeneration: value.recipientRegistrationGeneration,
     recipientBindingKey: value.recipientBindingKey,
     sourceRecoveryKey: value.sourceRecoveryKey,
-    source: { journalBindingKey: source.journalBindingKey,
-      tokenSha256: source.tokenSha256, updateId: source.updateId as number },
-    handoffId: value.handoffId, sentAtMs: value.sentAtMs };
+    source: {
+      journalBindingKey: source.journalBindingKey,
+      tokenSha256: source.tokenSha256,
+      updateId: source.updateId as number,
+    },
+    handoffId: value.handoffId,
+    sentAtMs: value.sentAtMs,
+  };
 }
 
 function parseWakeInputCustodyEnvelope(
-  value: Record<string, unknown>, requestId: string,
+  value: Record<string, unknown>,
+  requestId: string,
 ): TelegramBusEnvelope | undefined {
   const delivery = parseTelegramBusFollowerDeliveryIdentity(value.delivery);
-  return delivery && delivery.sourceRecoveryKey && delivery.sourceClaim &&
+  return delivery &&
+    delivery.sourceRecoveryKey &&
+    delivery.sourceClaim &&
     typeof value.recipientInstanceId === "string" &&
     typeof value.recipientRegistrationGeneration === "string" &&
     typeof value.sentAtMs === "number"
-    ? { kind: "leader.wakeInputCustody", requestId,
+    ? {
+        kind: "leader.wakeInputCustody",
+        requestId,
         recipientInstanceId: value.recipientInstanceId,
         recipientRegistrationGeneration: value.recipientRegistrationGeneration,
-        delivery, sentAtMs: value.sentAtMs }
+        delivery,
+        sentAtMs: value.sentAtMs,
+      }
     : undefined;
 }
 
@@ -2710,6 +3778,171 @@ function parseRouteAgentMessageEnvelope(
   };
 }
 
+const nonempty = (input: unknown, limit = 128): input is string =>
+  typeof input === "string" && !!input.trim() && input.length <= limit;
+const positive = (input: unknown): input is number =>
+  Number.isSafeInteger(input) && (input as number) > 0;
+const nonnegative = (input: unknown): input is number =>
+  Number.isSafeInteger(input) && (input as number) >= 0;
+
+/** Shared closed text-effect codec; parsing alone supplies no recipient or issuance authority. */
+export function parseTelegramBusSelectedMenuTextEffect(
+  effect: unknown,
+): TelegramBusSelectedMenuTextEffect | undefined {
+  if (
+    !isRecord(effect) ||
+    (effect.kind !== "send-text" && effect.kind !== "edit-text") ||
+    !hasOnlyWireKeys(effect, [
+      "kind",
+      "text",
+      "parseMode",
+      "replyMarkup",
+      ...(effect.kind === "send-text" ? ["replyToMessageId"] : ["messageId"]),
+    ]) ||
+    !nonempty(effect.text, 4096) ||
+    (effect.parseMode !== undefined && effect.parseMode !== "HTML") ||
+    (effect.kind === "send-text"
+      ? effect.replyToMessageId !== undefined &&
+        !positive(effect.replyToMessageId)
+      : !positive(effect.messageId))
+  )
+    return undefined;
+  let replyMarkup: TelegramBusSelectedMenuTextEffect["replyMarkup"];
+  if (effect.replyMarkup !== undefined) {
+    const markup = effect.replyMarkup;
+    if (
+      !isRecord(markup) ||
+      !hasOnlyWireKeys(markup, ["inline_keyboard"]) ||
+      !Array.isArray(markup.inline_keyboard) ||
+      markup.inline_keyboard.length > 32 ||
+      markup.inline_keyboard.some(
+        (row) =>
+          !Array.isArray(row) ||
+          !row.length ||
+          row.length > 8 ||
+          row.some(
+            (button) =>
+              !isRecord(button) ||
+              !hasOnlyWireKeys(button, ["text", "callback_data"]) ||
+              !nonempty(button.text) ||
+              !nonempty(button.callback_data, 64) ||
+              Buffer.byteLength(button.callback_data, "utf8") > 64,
+          ),
+      )
+    )
+      return undefined;
+    replyMarkup = {
+      inline_keyboard: markup.inline_keyboard.map((row) =>
+        (row as { text: string; callback_data: string }[]).map((button) => ({
+          text: button.text,
+          callback_data: button.callback_data,
+        })),
+      ),
+    };
+  }
+  const common = {
+    text: effect.text,
+    ...(effect.parseMode === "HTML" ? { parseMode: "HTML" as const } : {}),
+    ...(replyMarkup ? { replyMarkup } : {}),
+  };
+  return effect.kind === "send-text"
+    ? {
+        ...common,
+        kind: "send-text",
+        ...(effect.replyToMessageId !== undefined
+          ? { replyToMessageId: effect.replyToMessageId as number }
+          : {}),
+      }
+    : { ...common, kind: "edit-text", messageId: effect.messageId as number };
+}
+
+function parseSelectedMenuDeliveryEnvelope(
+  value: Record<string, unknown>,
+  requestId: string,
+): TelegramBusSelectedMenuDelivery | undefined {
+  const recipient = value.recipient,
+    executor = value.executor,
+    effect = parseTelegramBusSelectedMenuTextEffect(value.effect);
+  if (
+    !hasOnlyWireKeys(value, [
+      "kind",
+      "requestId",
+      "auth",
+      "instanceId",
+      "registrationGeneration",
+      "operationId",
+      "recipient",
+      "executor",
+      "operatorUserId",
+      "effect",
+      "sentAtMs",
+    ]) ||
+    !nonempty(requestId) ||
+    !nonempty(value.instanceId) ||
+    !nonempty(value.registrationGeneration) ||
+    !nonempty(value.operationId) ||
+    !isRecord(recipient) ||
+    !hasOnlyWireKeys(recipient, [
+      "sessionId",
+      "sessionGeneration",
+      "processId",
+      "processBirthId",
+      "profileKey",
+      "journalBindingKey",
+      "target",
+    ]) ||
+    !nonempty(recipient.sessionId) ||
+    !nonnegative(recipient.sessionGeneration) ||
+    !positive(recipient.processId) ||
+    !nonempty(recipient.processBirthId) ||
+    !nonempty(recipient.profileKey, 1024) ||
+    !nonempty(recipient.journalBindingKey, 8192) ||
+    recipient.profileKey === recipient.journalBindingKey ||
+    !isRecord(recipient.target) ||
+    !hasOnlyWireKeys(recipient.target, ["chatId", "threadId"]) ||
+    !positive(recipient.target.chatId) ||
+    !positive(recipient.target.threadId) ||
+    !positive(value.operatorUserId) ||
+    value.operatorUserId !== recipient.target.chatId ||
+    !isRecord(executor) ||
+    !hasOnlyWireKeys(executor, ["instanceId", "leaderEpoch"]) ||
+    !nonempty(executor.instanceId) ||
+    !nonempty(executor.leaderEpoch) ||
+    !effect ||
+    typeof value.sentAtMs !== "number" ||
+    !Number.isFinite(value.sentAtMs) ||
+    value.sentAtMs < 0 ||
+    (value.auth !== undefined && typeof value.auth !== "string")
+  )
+    return undefined;
+  return {
+    kind: "follower.deliverSelectedMenu",
+    requestId,
+    instanceId: value.instanceId,
+    registrationGeneration: value.registrationGeneration,
+    operationId: value.operationId,
+    recipient: {
+      sessionId: recipient.sessionId,
+      sessionGeneration: recipient.sessionGeneration,
+      processId: recipient.processId,
+      processBirthId: recipient.processBirthId,
+      profileKey: recipient.profileKey,
+      journalBindingKey: recipient.journalBindingKey,
+      target: {
+        chatId: recipient.target.chatId,
+        threadId: recipient.target.threadId,
+      },
+    },
+    executor: {
+      instanceId: executor.instanceId,
+      leaderEpoch: executor.leaderEpoch,
+    },
+    operatorUserId: value.operatorUserId,
+    effect,
+    sentAtMs: value.sentAtMs,
+  };
+}
+
 function parseCallApiEnvelope(
   value: Record<string, unknown>,
   requestId: string,
@@ -2839,9 +4072,13 @@ function parseRegistration(
   }
   if (typeof value.cwd === "string") registration.cwd = value.cwd;
   if (value.sessionId !== undefined) {
-    if (typeof value.sessionId !== "string" || !value.sessionId ||
-        value.sessionId !== value.sessionId.trim() ||
-        Buffer.byteLength(value.sessionId, "utf8") > 256) return undefined;
+    if (
+      typeof value.sessionId !== "string" ||
+      !value.sessionId ||
+      value.sessionId !== value.sessionId.trim() ||
+      Buffer.byteLength(value.sessionId, "utf8") > 256
+    )
+      return undefined;
     registration.sessionId = value.sessionId;
   }
   if (typeof value.pid === "number") registration.pid = value.pid;
@@ -2866,14 +4103,6 @@ function parseRegistration(
   return registration;
 }
 
-function parseTarget(value: unknown): TelegramTarget | undefined {
-  if (value === undefined) return undefined;
-  if (!isRecord(value) || typeof value.chatId !== "number") return undefined;
-  return typeof value.threadId === "number"
-    ? { chatId: value.chatId, threadId: value.threadId }
-    : { chatId: value.chatId };
-}
-
 function parseThreadTarget(
   value: unknown,
 ): (TelegramTarget & { threadId: number }) | undefined {