@llblab/pi-telegram 0.52.2 → 0.53.1

package/dist/lib/bus.js

@@ -4,95 +4,21 @@
  * Owns serializable bus envelopes, socket/auth helpers, local IPC client/server primitives,
  * cross-instance forwarding helpers, and the live follower registry model.
  */
-import { execFileSync } from "node:child_process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, renameSync, symlinkSync, unlinkSync, } from "node:fs";
-import { createConnection, createServer, } from "node:net";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readlinkSync, renameSync, symlinkSync, unlinkSync, } from "node:fs";
 import { createRequire } from "node:module";
+import { createConnection, createServer, } from "node:net";
 import { platform as getPlatform, tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
-import { classifyTelegramBusTransportError, createTelegramBusTransportTimeoutError, delayTelegramBusTransportRetry, getTelegramBusEndpointDiagnostics, getTelegramBusFollowerEndpoint, getTelegramBusLeaderEndpoint, getTelegramBusPipePath, getTelegramBusTransportRetryPolicy, TELEGRAM_BUS_MAX_DIRECT_UNIX_ENDPOINT_BYTES, isTelegramBusPipePath, isRetryableTelegramBusTransportError, probeTelegramBusEndpoint, } from "./bus-transport.js";
-import { parseTelegramQueueHandoffPayload, TELEGRAM_QUEUE_HANDOFF_PAYLOAD_MAX_BYTES, } from "./queue.js";
-import { isProcessAlive } from "./locks.js";
-import { isWireRecord as isRecord } from "./wire.js";
+import { isDeepStrictEqual } from "node:util";
+import { classifyTelegramBusTransportError, createTelegramBusTransportTimeoutError, delayTelegramBusTransportRetry, getTelegramBusEndpointDiagnostics, getTelegramBusFollowerEndpoint, getTelegramBusLeaderEndpoint, getTelegramBusPipePath, getTelegramBusTransportRetryPolicy, isRetryableTelegramBusTransportError, isTelegramBusPipePath, probeTelegramBusEndpoint, TELEGRAM_BUS_MAX_DIRECT_UNIX_ENDPOINT_BYTES, } from "./bus-transport.js";
+import { TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS } from "./locks.js";
 import { resolveAgentDir } from "./paths.js";
+import { getTelegramProcessBirthIdentity } from "./process-identity.js";
+import { parseTelegramQueueHandoffPayload, TELEGRAM_QUEUE_HANDOFF_PAYLOAD_MAX_BYTES, } from "./queue.js";
+import { areTelegramTargetsEqual, parseTelegramTarget as parseTarget, } from "./target.js";
 import { normalizeTelegramSessionReplacementIntent, } from "./threads.js";
-function readDarwinProcessStart(pid) {
-    return execFileSync("/bin/ps", ["-o", "lstart=", "-p", String(pid)], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
-}
-function getTelegramProcessBirthProof(pid, options = {}) {
-    if (pid <= 0)
-        return { status: "unverifiable" };
-    const platform = options.platform ?? getPlatform();
-    if (platform === "linux") {
-        try {
-            const stat = (options.readProcStat ?? ((targetPid) => readFileSync(`/proc/${targetPid}/stat`, "utf8")))(pid);
-            const closeParen = stat.lastIndexOf(")");
-            const fields = stat
-                .slice(closeParen + 2)
-                .trim()
-                .split(/\s+/u);
-            const startTicks = fields[19];
-            if (startTicks) {
-                return { status: "proven", identity: `${pid}:start:${startTicks}` };
-            }
-        }
-        catch {
-            /* inaccessible process metadata */
-        }
-    }
-    else if (platform === "darwin") {
-        try {
-            const startedAt = (options.readDarwinProcessStart ?? readDarwinProcessStart)(pid);
-            if (startedAt) {
-                const fingerprint = createHash("sha256")
-                    .update(startedAt)
-                    .digest("hex")
-                    .slice(0, 16);
-                return { status: "proven", identity: `${pid}:start:${fingerprint}` };
-            }
-        }
-        catch {
-            /* inaccessible process metadata */
-        }
-    }
-    return { status: "unverifiable" };
-}
-export function getTelegramProcessBirthIdentity(pid, fallbackGeneration, options = {}) {
-    const proof = getTelegramProcessBirthProof(pid, options);
-    return proof.status === "proven"
-        ? proof.identity
-        : `${pid}:generation:${fallbackGeneration}`;
-}
-export function getTelegramProcessLiveness(owner, options = {}) {
-    const processAlive = options.isProcessAlive ?? isProcessAlive;
-    if (!processAlive(owner.processId))
-        return "dead";
-    const proof = getTelegramProcessBirthProof(owner.processId, options);
-    if (proof.status === "unverifiable")
-        return "unverifiable";
-    return proof.identity === owner.processBirthId ? "alive" : "dead";
-}
-export function getTelegramProcessBirthIdentityLiveness(processBirthId, options = {}) {
-    const match = /^(\d+):(start|generation):(.+)$/u.exec(processBirthId);
-    if (!match)
-        return "unverifiable";
-    const processId = Number(match[1]);
-    if (!Number.isSafeInteger(processId) || processId <= 0)
-        return "unverifiable";
-    const processAlive = options.isProcessAlive ?? isProcessAlive;
-    if (!processAlive(processId))
-        return "dead";
-    if (match[2] === "generation")
-        return "unverifiable";
-    const proof = getTelegramProcessBirthProof(processId, options);
-    if (proof.status === "unverifiable")
-        return "unverifiable";
-    return proof.identity === processBirthId ? "alive" : "dead";
-}
+import { hasOnlyWireKeys, isWireRecord as isRecord } from "./wire.js";
 export function createCurrentTelegramBusProcessRuntime(input) {
     return createTelegramBusProcessRuntime({
         getActiveProfileName: input.getActiveProfileName,
@@ -130,6 +56,90 @@ export const TELEGRAM_BUS_CAPABILITY_DIRECTORY_DISPLAY_FORMAT = "directory-displ
 export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_FOLLOWER_AUTO_CONNECT = "workspace-follower-auto-connect-v1";
 export const TELEGRAM_BUS_CAPABILITY_SESSION_REPLACEMENT_INTENT = "session-replacement-intent-v1";
 export const TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE = "workspace-restore-v1";
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE = "live-thread-rebind-save-v1";
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY = "live-thread-rebind-apply-v1";
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE = "live-thread-rebind-settle-v1";
+/** Restricted recipient text/menu delivery; negotiated identity and captured effect authority remain required. */
+export const TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY = "selected-menu-delivery-v1";
+/** Versioned held-command set; syntax is shared, while the captured recipient Commands registry owns supported plans. */
+export const TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET = "live-thread-rebind-command-set-v1";
+/** Every live rebinding needs the save/apply/settle trio; held command selections additionally need these two. */
+export const TELEGRAM_BUS_LIVE_REBIND_CAPABILITIES = [
+    TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE,
+    TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY,
+    TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE,
+];
+export const TELEGRAM_BUS_HELD_COMMAND_CAPABILITIES = [
+    TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET,
+    TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
+];
+function parseSelectedCommandInput(value) {
+    if (!isRecord(value) ||
+        !hasOnlyWireKeys(value, ["name", "target"]) ||
+        typeof value.name !== "string" ||
+        !/^[a-z0-9_]{1,32}$/u.test(value.name) ||
+        !isRecord(value.target) ||
+        !hasOnlyWireKeys(value.target, ["chatId", "threadId"]))
+        return undefined;
+    const target = parseThreadTarget(value.target);
+    return target &&
+        Number.isSafeInteger(target.chatId) &&
+        target.chatId > 0 &&
+        Number.isSafeInteger(target.threadId) &&
+        target.threadId > 0
+        ? { name: value.name, target }
+        : undefined;
+}
+/** Pure live-rebind recipient/operation identity shared by prepare/apply/settle envelopes. */
+function parseLiveRebindRecipient(value) {
+    const { recipientInstanceId, recipientRegistrationGeneration, recipientSessionId, recipientBindingKey, operationId, } = value;
+    return typeof recipientInstanceId === "string" &&
+        recipientInstanceId &&
+        typeof recipientRegistrationGeneration === "string" &&
+        recipientRegistrationGeneration &&
+        typeof recipientSessionId === "string" &&
+        recipientSessionId &&
+        typeof recipientBindingKey === "string" &&
+        recipientBindingKey &&
+        typeof operationId === "string" &&
+        operationId.length > 0 &&
+        operationId.length <= 128
+        ? {
+            recipientInstanceId,
+            recipientRegistrationGeneration,
+            recipientSessionId,
+            recipientBindingKey,
+            operationId,
+        }
+        : undefined;
+}
+/** Non-empty, duplicate-free, non-negative safe-integer Telegram update ids. */
+function isUniqueSourceUpdateIds(value) {
+    return (Array.isArray(value) &&
+        value.length > 0 &&
+        value.every((id) => Number.isSafeInteger(id) && id >= 0) &&
+        new Set(value).size === value.length);
+}
+function parsePreparedCommandSource(value) {
+    if (!isRecord(value) ||
+        !hasOnlyWireKeys(value, [
+            "journalBindingKey",
+            "updateId",
+            "sourceSha256",
+        ]) ||
+        typeof value.journalBindingKey !== "string" ||
+        !value.journalBindingKey ||
+        !Number.isSafeInteger(value.updateId) ||
+        value.updateId < 0 ||
+        typeof value.sourceSha256 !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(value.sourceSha256))
+        return undefined;
+    return {
+        journalBindingKey: value.journalBindingKey,
+        updateId: value.updateId,
+        sourceSha256: value.sourceSha256,
+    };
+}
 export function createTelegramBusProtocolIdentity(input) {
     const runtimeBuild = input.runtimeBuild.trim();
     if (!runtimeBuild || runtimeBuild.length > 128) {
@@ -137,8 +147,7 @@ export function createTelegramBusProtocolIdentity(input) {
     }
     const capabilities = [...new Set(input.capabilities ?? [])].sort();
     if (capabilities.length > 32 ||
-        capabilities.some((capability) => capability.length > 128 ||
-            !/^[a-z0-9][a-z0-9._-]*$/u.test(capability))) {
+        capabilities.some((capability) => capability.length > 128 || !/^[a-z0-9][a-z0-9._-]*$/u.test(capability))) {
         throw new Error("Telegram bus capabilities must be canonical identifiers.");
     }
     return {
@@ -161,13 +170,20 @@ export function hasTelegramBusCapability(identity, capability) {
     return identity?.capabilities.includes(capability) ?? false;
 }
 export function getTelegramInputCustodyPeerReadiness(followers) {
-    return followers.map(follower => {
+    return followers.map((follower) => {
         if (!follower.registrationGeneration || !follower.protocol)
             return "unknown";
         return hasTelegramBusCapability(follower.protocol, TELEGRAM_BUS_CAPABILITY_DURABLE_FOLLOWER_ADMISSION) &&
-            hasTelegramBusCapability(follower.protocol, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE) ? "ready" : "legacy";
+            hasTelegramBusCapability(follower.protocol, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE)
+            ? "ready"
+            : "legacy";
     });
 }
+/** Both peers advertise every required capability over a compatible protocol; reads only the two identities. */
+export function hasTelegramBusSharedCapabilities(local, remote, required) {
+    return (required.every((capability) => hasTelegramBusCapability(local, capability) &&
+        hasTelegramBusCapability(remote, capability)) && getTelegramBusProtocolCompatibility({ local, remote }).compatible);
+}
 export function getTelegramBusProtocolCompatibility(input) {
     if (!input.remote) {
         return {
@@ -196,7 +212,12 @@ export function getTelegramBusProtocolCompatibility(input) {
         : { compatible: true, missingCapabilities: [] };
 }
 export function getTelegramBusSocketPath(agentDir = resolveAgentDir(), platform = getPlatform(), profileName, layout) {
-    return getTelegramBusLeaderEndpoint({ agentDir, platform, profileName, layout });
+    return getTelegramBusLeaderEndpoint({
+        agentDir,
+        platform,
+        profileName,
+        layout,
+    });
 }
 export function getTelegramBusFollowerSocketPath(instanceId, agentDir = resolveAgentDir(), platform = getPlatform(), profileName, layout) {
     return getTelegramBusFollowerEndpoint({
@@ -207,6 +228,20 @@ export function getTelegramBusFollowerSocketPath(instanceId, agentDir = resolveA
         layout,
     });
 }
+/** Whether a live follower is still exactly the captured registration: identity, process, session, endpoint and negotiated protocol. */
+export function isSameTelegramBusFollowerRegistration(live, captured) {
+    return (live.instanceId === captured.instanceId &&
+        live.profileKey === captured.profileKey &&
+        live.sessionId === captured.sessionId &&
+        live.registrationGeneration === captured.registrationGeneration &&
+        live.pid === captured.pid &&
+        live.processBirthId === captured.processBirthId &&
+        live.sessionGeneration === captured.sessionGeneration &&
+        live.cwd === captured.cwd &&
+        live.slot === captured.slot &&
+        live.busSocketPath === captured.busSocketPath &&
+        isDeepStrictEqual(live.protocol, captured.protocol));
+}
 export function getTelegramFollowerTargetOwnership(input) {
     const liveFollower = input.followers.find((follower) => {
         return (follower.target?.chatId === input.target.chatId &&
@@ -228,30 +263,17 @@ export function getTelegramFollowerTargetOwnership(input) {
 }
 const TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD = "__piTelegramAggregateDelivery";
 const TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD = "__piTelegramCrossTargetDelivery";
-export function markTelegramBusAggregateDelivery(body) {
-    return {
-        ...body,
-        [TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD]: true,
-    };
-}
-function isTelegramBusAggregateDelivery(body) {
+function hasTelegramBusDeliveryMarker(body, marker) {
     return Boolean(body &&
         typeof body === "object" &&
         !Array.isArray(body) &&
-        body[TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD] ===
-            true);
+        body[marker] === true);
 }
-export function markTelegramBusCrossTargetDelivery(body) {
-    return {
-        ...body,
-        [TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD]: true,
-    };
+export function markTelegramBusAggregateDelivery(body) {
+    return { ...body, [TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD]: true };
 }
-function isTelegramBusCrossTargetDelivery(body) {
-    return Boolean(body &&
-        typeof body === "object" &&
-        !Array.isArray(body) &&
-        body[TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD] === true);
+export function markTelegramBusCrossTargetDelivery(body) {
+    return { ...body, [TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD]: true };
 }
 export function stripTelegramBusApiMetadata(body) {
     if (!(TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD in body) &&
@@ -317,8 +339,7 @@ export function isTelegramFollowerApiCallAllowed(input) {
             return target.threadId !== undefined;
         const parsedThreadId = typeof threadId === "number" ? threadId : Number(threadId);
         return (Number.isInteger(parsedThreadId) &&
-            (target.threadId === undefined ||
-                !matchesId(threadId, target.threadId)));
+            (target.threadId === undefined || !matchesId(threadId, target.threadId)));
     };
     const isTargetMessageScoped = (body) => {
         if (!isTargetChatScoped(body))
@@ -355,12 +376,12 @@ export function isTelegramFollowerApiCallAllowed(input) {
         if (apiMethod === "sendChatAction")
             return isTargetChatScoped(input.args[1]);
         if (apiMethod === "sendMessage" &&
-            isTelegramBusAggregateDelivery(input.args[1])) {
+            hasTelegramBusDeliveryMarker(input.args[1], TELEGRAM_BUS_AGGREGATE_DELIVERY_FIELD)) {
             const body = input.args[1];
             return body.message_thread_id === undefined && isTargetChatScoped(body);
         }
         if ((apiMethod === "sendMessage" || apiMethod === "sendRichMessage") &&
-            isTelegramBusCrossTargetDelivery(input.args[1])) {
+            hasTelegramBusDeliveryMarker(input.args[1], TELEGRAM_BUS_CROSS_TARGET_DELIVERY_FIELD)) {
             return isDifferentTargetScoped(input.args[1]);
         }
         if (apiMethod === "deleteMessage" ||
@@ -401,8 +422,10 @@ export function createTelegramBusFollowerDeliveryIdentity(input) {
         !Number.isSafeInteger(input.sourceUpdateId) ||
         input.sourceUpdateId < 0 ||
         (input.sourceClaim !== undefined &&
-            (!input.sourceClaim.acquisitionId || input.sourceClaim.acquisitionId.length > 256 ||
-                !input.sourceClaim.handoffId || input.sourceClaim.handoffId.length > 256))) {
+            (!input.sourceClaim.acquisitionId ||
+                input.sourceClaim.acquisitionId.length > 256 ||
+                !input.sourceClaim.handoffId ||
+                input.sourceClaim.handoffId.length > 256))) {
         throw new Error("Telegram follower delivery identity is incomplete.");
     }
     const deliveryId = createHash("sha256")
@@ -417,23 +440,29 @@ export function createTelegramBusFollowerDeliveryIdentity(input) {
         deliveryId: `telegram-follower-v1-${deliveryId}`,
         sourceUpdateId: input.sourceUpdateId,
         recipientBindingKey: input.recipientBindingKey,
-        ...(input.sourceRecoveryKey ? { sourceRecoveryKey: input.sourceRecoveryKey } : {}),
+        ...(input.sourceRecoveryKey
+            ? { sourceRecoveryKey: input.sourceRecoveryKey }
+            : {}),
         ...(input.sourceClaim ? { sourceClaim: { ...input.sourceClaim } } : {}),
     };
 }
 export function canUseTelegramBusInputCustodyReference(input) {
-    return hasTelegramBusCapability(input.local, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE) &&
-        hasTelegramBusCapability(input.remote, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE);
+    return (hasTelegramBusCapability(input.local, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE) &&
+        hasTelegramBusCapability(input.remote, TELEGRAM_BUS_CAPABILITY_INPUT_CUSTODY_REFERENCE));
 }
 export function createTelegramBusFollowerSourceReferenceDeliveryIdentity(input) {
     if (!input.sourceRecoveryKey || !input.source.owner.handoffId)
         throw new Error("Telegram follower source-reference delivery requires an accepted handoff.");
-    return createTelegramBusFollowerDeliveryIdentity({ kind: input.kind,
+    return createTelegramBusFollowerDeliveryIdentity({
+        kind: input.kind,
         recipientBindingKey: input.recipientBindingKey,
         sourceUpdateId: input.source.updateId,
         sourceRecoveryKey: input.sourceRecoveryKey,
-        sourceClaim: { acquisitionId: input.source.owner.acquisitionId,
-            handoffId: input.source.owner.handoffId } });
+        sourceClaim: {
+            acquisitionId: input.source.owner.acquisitionId,
+            handoffId: input.source.owner.handoffId,
+        },
+    });
 }
 export function getTelegramBusEnvelopeTrafficClass(envelope) {
     if (envelope.kind === "follower.register" ||
@@ -478,18 +507,23 @@ export function parseTelegramBusEnvelope(line) {
             envelope = parseRegisterEnvelope(value, requestId, kind);
             break;
         case "follower.heartbeat":
-            envelope = parseHeartbeatEnvelope(value, requestId);
-            break;
         case "follower.disconnect":
-            envelope = parseDisconnectEnvelope(value, requestId);
+            envelope = parseFollowerPresenceEnvelope(value, requestId, kind);
             break;
         case "follower.setThreadDisplayMode":
             if (typeof value.instanceId === "string" &&
                 typeof value.registrationGeneration === "string" &&
-                (value.mode === "letters" || value.mode === "names" ||
-                    value.mode === "directory-snake" || value.mode === "directory-title")) {
-                envelope = { kind, requestId, instanceId: value.instanceId,
-                    registrationGeneration: value.registrationGeneration, mode: value.mode };
+                (value.mode === "letters" ||
+                    value.mode === "names" ||
+                    value.mode === "directory-snake" ||
+                    value.mode === "directory-title")) {
+                envelope = {
+                    kind,
+                    requestId,
+                    instanceId: value.instanceId,
+                    registrationGeneration: value.registrationGeneration,
+                    mode: value.mode,
+                };
             }
             break;
         case "follower.renameThread":
@@ -517,7 +551,8 @@ export function parseTelegramBusEnvelope(line) {
             const intent = normalizeTelegramSessionReplacementIntent(value.intent);
             if (typeof value.instanceId === "string" &&
                 typeof value.registrationGeneration === "string" &&
-                typeof value.sentAtMs === "number" && intent) {
+                typeof value.sentAtMs === "number" &&
+                intent) {
                 envelope = {
                     kind,
                     requestId,
@@ -547,15 +582,122 @@ export function parseTelegramBusEnvelope(line) {
         case "leader.forwardEditedMessage":
             envelope = parseForwardMessageEnvelope(value, requestId, "leader.forwardEditedMessage");
             break;
+        case "leader.prepareLiveRebind": {
+            const selectedCommand = parseSelectedCommandInput(value.selectedCommand);
+            if (!hasOnlyWireKeys(value, [
+                "kind",
+                "requestId",
+                "auth",
+                "recipientInstanceId",
+                "recipientRegistrationGeneration",
+                "recipientSessionId",
+                "recipientBindingKey",
+                "operationId",
+                "updates",
+                "selectedCommand",
+                "sentAtMs",
+            ]) ||
+                (Object.hasOwn(value, "selectedCommand") &&
+                    (!selectedCommand ||
+                        !Array.isArray(value.updates) ||
+                        value.updates.length !== 1)))
+                break;
+            const recipient = parseLiveRebindRecipient(value);
+            if (recipient &&
+                Array.isArray(value.updates) &&
+                value.updates.every(isRecord) &&
+                isUniqueSourceUpdateIds(value.updates.map((update) => update.update_id)) &&
+                typeof value.sentAtMs === "number" &&
+                Number.isFinite(value.sentAtMs)) {
+                envelope = {
+                    kind: "leader.prepareLiveRebind",
+                    requestId,
+                    ...recipient,
+                    updates: value.updates,
+                    sentAtMs: value.sentAtMs,
+                    ...(selectedCommand ? { selectedCommand } : {}),
+                };
+            }
+            break;
+        }
+        case "leader.applyLiveRebind":
+        case "leader.settleLiveRebind": {
+            const selectedCommand = parseSelectedCommandInput(value.selectedCommand), preparedSource = parsePreparedCommandSource(value.preparedSource);
+            if (!hasOnlyWireKeys(value, [
+                "kind",
+                "requestId",
+                "auth",
+                "recipientInstanceId",
+                "recipientRegistrationGeneration",
+                "recipientSessionId",
+                "recipientBindingKey",
+                "operationId",
+                "sourceUpdateIds",
+                "mode",
+                "oldTarget",
+                "selectedCommand",
+                "preparedSource",
+                "sentAtMs",
+            ]) ||
+                (Object.hasOwn(value, "preparedSource") && !selectedCommand) ||
+                (value.mode === "observe-command" &&
+                    (!selectedCommand || Object.hasOwn(value, "oldTarget"))))
+                break;
+            if (Object.hasOwn(value, "selectedCommand") &&
+                (!selectedCommand ||
+                    !Array.isArray(value.sourceUpdateIds) ||
+                    value.sourceUpdateIds.length !== 1 ||
+                    !preparedSource ||
+                    preparedSource.updateId !== value.sourceUpdateIds[0] ||
+                    preparedSource.journalBindingKey !== value.recipientBindingKey))
+                break;
+            const recipient = parseLiveRebindRecipient(value);
+            if (recipient &&
+                (value.kind === "leader.applyLiveRebind"
+                    ? value.mode === "apply" || value.mode === "inspect"
+                    : value.mode === "release" ||
+                        value.mode === "discard" ||
+                        value.mode === "observe-command" ||
+                        (value.mode === "observe" &&
+                            !!parseThreadTarget(value.oldTarget))) &&
+                isUniqueSourceUpdateIds(value.sourceUpdateIds) &&
+                typeof value.sentAtMs === "number" &&
+                Number.isFinite(value.sentAtMs)) {
+                envelope = {
+                    kind: value.kind,
+                    requestId,
+                    ...recipient,
+                    sourceUpdateIds: value.sourceUpdateIds,
+                    mode: value.mode,
+                    sentAtMs: value.sentAtMs,
+                    ...(value.mode === "observe"
+                        ? { oldTarget: parseThreadTarget(value.oldTarget) }
+                        : {}),
+                    ...(selectedCommand ? { selectedCommand, preparedSource } : {}),
+                };
+            }
+            break;
+        }
         case "leader.workspaceRestore":
-            if (typeof value.recipientInstanceId === "string" && value.recipientInstanceId &&
-                typeof value.recipientRegistrationGeneration === "string" && value.recipientRegistrationGeneration &&
-                typeof value.operationId === "string" && value.operationId.length > 0 && value.operationId.length <= 128 &&
+            if (typeof value.recipientInstanceId === "string" &&
+                value.recipientInstanceId &&
+                typeof value.recipientRegistrationGeneration === "string" &&
+                value.recipientRegistrationGeneration &&
+                typeof value.operationId === "string" &&
+                value.operationId.length > 0 &&
+                value.operationId.length <= 128 &&
                 (value.mode === "apply" || value.mode === "inspect") &&
-                typeof value.sentAtMs === "number" && Number.isFinite(value.sentAtMs)) {
-                envelope = { kind: "leader.workspaceRestore", requestId, recipientInstanceId: value.recipientInstanceId,
-                    recipientRegistrationGeneration: value.recipientRegistrationGeneration, operationId: value.operationId,
-                    mode: value.mode, sentAtMs: value.sentAtMs };
+                typeof value.sentAtMs === "number" &&
+                Number.isFinite(value.sentAtMs)) {
+                envelope = {
+                    kind: "leader.workspaceRestore",
+                    requestId,
+                    recipientInstanceId: value.recipientInstanceId,
+                    recipientRegistrationGeneration: value.recipientRegistrationGeneration,
+                    operationId: value.operationId,
+                    mode: value.mode,
+                    sentAtMs: value.sentAtMs,
+                };
             }
             break;
         case "leader.offerQueueHandoff":
@@ -570,6 +712,9 @@ export function parseTelegramBusEnvelope(line) {
         case "follower.routeAgentMessage":
             envelope = parseRouteAgentMessageEnvelope(value, requestId);
             break;
+        case "follower.deliverSelectedMenu":
+            envelope = parseSelectedMenuDeliveryEnvelope(value, requestId);
+            break;
         case "follower.callApi":
             envelope = parseCallApiEnvelope(value, requestId);
             break;
@@ -614,11 +759,24 @@ export function resolveTelegramBusSocketPath(source, platform = getPlatform()) {
         .slice(0, 16);
     return join(fallbackDir, `${digest}.sock`);
 }
+/** Local IPC issuance proof only: this callback/error never enters the envelope or certifies a remote API effect. */
+export class TelegramBusLocalAuthorityError extends Error {
+    requestIssued;
+    constructor(requestIssued, reason) {
+        super(reason
+            ? `Telegram bus local authority is unavailable: ${reason}`
+            : "Telegram bus local authority is unavailable.");
+        this.name = "TelegramBusLocalAuthorityError";
+        this.requestIssued = requestIssued;
+    }
+}
 export function isTelegramBusForwardOwnershipCurrent(expected, current) {
-    return Boolean(current && current.instanceId === expected.instanceId &&
+    return Boolean(current &&
+        current.instanceId === expected.instanceId &&
         current.ownerGeneration === expected.ownerGeneration &&
         current.recipientBindingKey === expected.recipientBindingKey &&
-        JSON.stringify(current.protocolIdentity) === JSON.stringify(expected.protocolIdentity));
+        JSON.stringify(current.protocolIdentity) ===
+            JSON.stringify(expected.protocolIdentity));
 }
 function getTelegramBusForwardSourceUpdateId(value) {
     if (!isRecord(value))
@@ -635,6 +793,11 @@ function createTelegramBusForwardDelivery(kind, sourceUpdateId, recipientBinding
         sourceUpdateId,
     });
 }
+/**
+ * Leader-to-follower forwards and control replies share the stale-liveness window: a follower doing journal work or stalled
+ * by an ordinary multi-second Pi/TUI turn, or a slower Windows named pipe, is not a lost recipient.
+ */
+const TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS = TELEGRAM_BUS_LEADER_STALE_HEARTBEAT_MS;
 export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
     const getNowMs = deps.getNowMs ?? Date.now;
     const reject = (input) => {
@@ -684,21 +847,32 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
             };
         }
         const sourceReference = canUseTelegramBusInputCustodyReference({
-            local: deps.localProtocolIdentity, remote: ownership.protocolIdentity
+            local: deps.localProtocolIdentity,
+            remote: ownership.protocolIdentity,
         });
-        const reference = sourceReference ? deps.resolveInputCustodyReference?.({
-            sourceUpdateId, recipientBindingKey: ownership.recipientBindingKey
-        }) : undefined;
+        const reference = sourceReference
+            ? deps.resolveInputCustodyReference?.({
+                sourceUpdateId,
+                recipientBindingKey: ownership.recipientBindingKey,
+            })
+            : undefined;
         if (sourceReference && !reference)
-            return { settlement: reject({
-                    status: "retryable", failureClass: "source-reference-missing",
+            return {
+                settlement: reject({
+                    status: "retryable",
+                    failureClass: "source-reference-missing",
                     message: "Forwarded Telegram update has no exact custody reference.",
-                    envelopeKind: kind, ownership, sourceUpdateId
-                }) };
+                    envelopeKind: kind,
+                    ownership,
+                    sourceUpdateId,
+                }),
+            };
         const delivery = reference
             ? createTelegramBusFollowerSourceReferenceDeliveryIdentity({
-                kind: "leader.wakeInputCustody", recipientBindingKey: ownership.recipientBindingKey,
-                sourceRecoveryKey: reference.sourceRecoveryKey, source: reference.source
+                kind: "leader.wakeInputCustody",
+                recipientBindingKey: ownership.recipientBindingKey,
+                sourceRecoveryKey: reference.sourceRecoveryKey,
+                source: reference.source,
             })
             : createTelegramBusForwardDelivery(kind, sourceUpdateId, ownership.recipientBindingKey);
         if (!ownership.ownerGeneration) {
@@ -720,11 +894,15 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
         };
     };
     const send = async (envelope, ownership) => {
-        if (deps.validateForwardOwnership && !deps.validateForwardOwnership(ownership))
+        if (deps.validateForwardOwnership &&
+            !deps.validateForwardOwnership(ownership))
             return reject({
-                status: "retryable", failureClass: "recipient-ownership-stale",
+                status: "retryable",
+                failureClass: "recipient-ownership-stale",
                 message: "Telegram follower ownership changed before forwarding.",
-                envelopeKind: envelope.kind, ownership, delivery: envelope.delivery
+                envelopeKind: envelope.kind,
+                ownership,
+                delivery: envelope.delivery,
             });
         if (deps.getAuthSecret)
             envelope.auth = deps.getAuthSecret();
@@ -734,7 +912,7 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
             response = await sendTelegramBusLocalEnvelope({
                 socketPath,
                 envelope,
-                timeoutMs: deps.timeoutMs,
+                timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
                 retry: getTelegramBusTransportRetryPolicy({
                     endpoint: socketPath,
                     operation: "operation",
@@ -809,88 +987,52 @@ export function createTelegramBusForeignOwnedUpdateForwarder(deps) {
         }
         return { status: "accepted", delivery: envelope.delivery };
     };
+    // A recipient already holding the source reference is only woken; it never receives a second payload copy.
+    const forward = (kind, value, ownership, build) => {
+        const prepared = prepare(kind, value, ownership);
+        if ("settlement" in prepared)
+            return Promise.resolve(prepared.settlement);
+        const base = {
+            requestId: deps.createRequestId(),
+            recipientInstanceId: ownership.instanceId,
+            recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
+            delivery: prepared.delivery,
+        };
+        return send(prepared.sourceReference
+            ? { kind: "leader.wakeInputCustody", ...base, sentAtMs: getNowMs() }
+            : build(base, getNowMs()), ownership);
+    };
     return {
-        forwardCallback: ({ query, ownership }) => {
-            const prepared = prepare("leader.forwardCallback", query, ownership);
-            if ("settlement" in prepared)
-                return Promise.resolve(prepared.settlement);
-            if (prepared.sourceReference)
-                return send({ kind: "leader.wakeInputCustody",
-                    requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-                    recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                    delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-            return send({
-                kind: "leader.forwardCallback",
-                requestId: deps.createRequestId(),
-                recipientInstanceId: ownership.instanceId,
-                recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                delivery: prepared.delivery,
-                query,
-                sentAtMs: getNowMs(),
-            }, ownership);
-        },
-        forwardReaction: ({ reactionUpdate, ownership }) => {
-            const prepared = prepare("leader.forwardReaction", reactionUpdate, ownership);
-            if ("settlement" in prepared)
-                return Promise.resolve(prepared.settlement);
-            if (prepared.sourceReference)
-                return send({ kind: "leader.wakeInputCustody",
-                    requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-                    recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                    delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-            return send({
-                kind: "leader.forwardReaction",
-                requestId: deps.createRequestId(),
-                recipientInstanceId: ownership.instanceId,
-                recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                delivery: prepared.delivery,
-                reactionUpdate,
-                sentAtMs: getNowMs(),
-            }, ownership);
-        },
-        forwardMessage: ({ message, ownership }) => {
-            const prepared = prepare("leader.forwardMessage", message, ownership);
-            if ("settlement" in prepared)
-                return Promise.resolve(prepared.settlement);
-            if (prepared.sourceReference)
-                return send({ kind: "leader.wakeInputCustody",
-                    requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-                    recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                    delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-            return send({
+        forwardCallback: ({ query, ownership }) => forward("leader.forwardCallback", query, ownership, (base, sentAtMs) => ({
+            kind: "leader.forwardCallback",
+            ...base,
+            query,
+            sentAtMs,
+        })),
+        forwardReaction: ({ reactionUpdate, ownership }) => forward("leader.forwardReaction", reactionUpdate, ownership, (base, sentAtMs) => ({
+            kind: "leader.forwardReaction",
+            ...base,
+            reactionUpdate,
+            sentAtMs,
+        })),
+        forwardMessage: ({ message, ownership }) => forward("leader.forwardMessage", message, ownership, (base, sentAtMs) => {
+            const forwardCommentBatchPosition = deps.getForwardCommentBatchPosition?.(message);
+            return {
                 kind: "leader.forwardMessage",
-                requestId: deps.createRequestId(),
-                recipientInstanceId: ownership.instanceId,
-                recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                delivery: prepared.delivery,
+                ...base,
                 message,
-                ...(deps.getForwardCommentBatchPosition?.(message) !== undefined
-                    ? {
-                        forwardCommentBatchPosition: deps.getForwardCommentBatchPosition(message),
-                    }
+                ...(forwardCommentBatchPosition !== undefined
+                    ? { forwardCommentBatchPosition }
                     : {}),
-                sentAtMs: getNowMs(),
-            }, ownership);
-        },
-        forwardEditedMessage: ({ message, ownership }) => {
-            const prepared = prepare("leader.forwardEditedMessage", message, ownership);
-            if ("settlement" in prepared)
-                return Promise.resolve(prepared.settlement);
-            if (prepared.sourceReference)
-                return send({ kind: "leader.wakeInputCustody",
-                    requestId: deps.createRequestId(), recipientInstanceId: ownership.instanceId,
-                    recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                    delivery: prepared.delivery, sentAtMs: getNowMs() }, ownership);
-            return send({
-                kind: "leader.forwardEditedMessage",
-                requestId: deps.createRequestId(),
-                recipientInstanceId: ownership.instanceId,
-                recipientRegistrationGeneration: prepared.recipientRegistrationGeneration,
-                delivery: prepared.delivery,
-                message,
-                sentAtMs: getNowMs(),
-            }, ownership);
-        },
+                sentAtMs,
+            };
+        }),
+        forwardEditedMessage: ({ message, ownership }) => forward("leader.forwardEditedMessage", message, ownership, (base, sentAtMs) => ({
+            kind: "leader.forwardEditedMessage",
+            ...base,
+            message,
+            sentAtMs,
+        })),
     };
 }
 export function listTelegramBusLiveThreadTargets(input) {
@@ -912,48 +1054,441 @@ export function createTelegramBusWorkspaceRestoreController(deps) {
             return undefined;
         const follower = deps.getFollower(input.instanceId);
         const secret = deps.getAuthSecret();
-        if (!secret || !follower?.registrationGeneration || !follower.busSocketPath ||
-            follower.sessionId !== input.sessionId || follower.slot !== input.slot ||
-            !hasTelegramBusCapability(deps.localProtocolIdentity, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) ||
-            !hasTelegramBusCapability(follower.protocol, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) ||
-            !getTelegramBusProtocolCompatibility({ local: deps.localProtocolIdentity, remote: follower.protocol }).compatible)
+        if (!secret ||
+            !follower?.registrationGeneration ||
+            !follower.busSocketPath ||
+            follower.sessionId !== input.sessionId ||
+            follower.slot !== input.slot ||
+            !hasTelegramBusSharedCapabilities(deps.localProtocolIdentity, follower.protocol, [TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE]))
             return undefined;
         const captured = structuredClone(follower);
-        const expected = { operationId: input.operationId, sessionId: input.sessionId, slot: input.slot,
-            target: { ...input.target }, oldTarget: { ...input.oldTarget }, mode: input.mode };
+        const expected = {
+            operationId: input.operationId,
+            sessionId: input.sessionId,
+            slot: input.slot,
+            target: { ...input.target },
+            oldTarget: { ...input.oldTarget },
+            mode: input.mode,
+        };
         const current = () => {
-            if (!isCurrent() || deps.getAuthSecret() !== secret ||
+            if (!isCurrent() ||
+                deps.getAuthSecret() !== secret ||
                 !hasTelegramBusCapability(deps.localProtocolIdentity, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE))
                 return false;
             const live = deps.getFollower(captured.instanceId);
-            return !!live && live.registrationGeneration === captured.registrationGeneration &&
-                live.sessionId === captured.sessionId && live.cwd === captured.cwd && live.slot === captured.slot &&
-                live.busSocketPath === captured.busSocketPath && live.target?.chatId === captured.target?.chatId &&
+            return (!!live &&
+                live.registrationGeneration === captured.registrationGeneration &&
+                live.sessionId === captured.sessionId &&
+                live.cwd === captured.cwd &&
+                live.slot === captured.slot &&
+                live.busSocketPath === captured.busSocketPath &&
+                live.target?.chatId === captured.target?.chatId &&
                 live.target?.threadId === captured.target?.threadId &&
                 hasTelegramBusCapability(live.protocol, TELEGRAM_BUS_CAPABILITY_WORKSPACE_RESTORE) &&
-                getTelegramBusProtocolCompatibility({ local: deps.localProtocolIdentity, remote: live.protocol }).compatible;
+                getTelegramBusProtocolCompatibility({
+                    local: deps.localProtocolIdentity,
+                    remote: live.protocol,
+                }).compatible);
         };
         if (!current())
             return undefined;
         const requestId = deps.createRequestId();
-        const response = await sendTelegramBusLocalEnvelope({ socketPath: captured.busSocketPath, timeoutMs: deps.timeoutMs,
-            retry: { attempts: 1, delayMs: 0 }, envelope: { kind: "leader.workspaceRestore", requestId,
-                recipientInstanceId: captured.instanceId, recipientRegistrationGeneration: captured.registrationGeneration,
-                operationId: expected.operationId, mode: expected.mode, auth: secret, sentAtMs: Date.now() } });
-        if (!current() || response?.kind !== "bus.ack" || response.requestId !== requestId || response.ok !== true ||
-            !response.result || typeof response.result !== "object")
+        const response = await sendTelegramBusLocalEnvelope({
+            socketPath: captured.busSocketPath,
+            timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
+            retry: { attempts: 1, delayMs: 0 },
+            envelope: {
+                kind: "leader.workspaceRestore",
+                requestId,
+                recipientInstanceId: captured.instanceId,
+                recipientRegistrationGeneration: captured.registrationGeneration,
+                operationId: expected.operationId,
+                mode: expected.mode,
+                auth: secret,
+                sentAtMs: Date.now(),
+            },
+        });
+        if (!current() ||
+            response?.kind !== "bus.ack" ||
+            response.requestId !== requestId ||
+            response.ok !== true ||
+            !response.result ||
+            typeof response.result !== "object")
             return undefined;
         const result = response.result;
         const recipient = result.recipient;
         const target = parseThreadTarget(result.target);
         const wanted = result.ready === true ? expected.target : expected.oldTarget;
-        if (result.operationId !== expected.operationId || typeof result.ready !== "boolean" || result.slot !== expected.slot ||
-            !target || target.chatId !== wanted.chatId || target.threadId !== wanted.threadId ||
-            recipient?.kind !== "follower" || recipient.instanceId !== captured.instanceId ||
-            recipient.sessionId !== expected.sessionId || recipient.generation !== captured.registrationGeneration)
+        if (result.operationId !== expected.operationId ||
+            typeof result.ready !== "boolean" ||
+            result.slot !== expected.slot ||
+            !target ||
+            target.chatId !== wanted.chatId ||
+            target.threadId !== wanted.threadId ||
+            recipient?.kind !== "follower" ||
+            recipient.instanceId !== captured.instanceId ||
+            recipient.sessionId !== expected.sessionId ||
+            recipient.generation !== captured.registrationGeneration)
+            return undefined;
+        return {
+            operationId: expected.operationId,
+            recipient: {
+                kind: "follower",
+                instanceId: captured.instanceId,
+                sessionId: expected.sessionId,
+                generation: captured.registrationGeneration,
+            },
+            target,
+            slot: expected.slot,
+            ready: result.ready,
+        };
+    };
+}
+/** Each capability has its own effect boundary; transport retries never replay save/dispatch/disposal. */
+export function createTelegramBusLiveRebindController(deps) {
+    return async (input) => {
+        const isCurrent = input.isCurrent.bind(input), localProtocol = structuredClone(deps.localProtocolIdentity);
+        const selectedCommand = parseSelectedCommandInput(input.selectedCommand), held = selectedCommand, preparedSource = parsePreparedCommandSource(input.preparedSource);
+        if (!hasOnlyWireKeys(input, [
+            "operationId",
+            "instanceId",
+            "sessionId",
+            "recipientBindingKey",
+            "isCurrent",
+            "selectedCommand",
+            "preparedSource",
+            "updates",
+            "mode",
+            "sourceUpdateIds",
+            "slot",
+            "target",
+            "oldTarget",
+        ]) ||
+            ("mode" in input &&
+                (![
+                    "apply",
+                    "inspect",
+                    "release",
+                    "discard",
+                    "observe",
+                    "observe-command",
+                ].includes(input.mode) ||
+                    (input.mode === "observe-command" && !selectedCommand))))
+            return undefined;
+        if ((input.preparedSource !== undefined &&
+            (!held ||
+                !preparedSource ||
+                preparedSource.journalBindingKey !== input.recipientBindingKey ||
+                preparedSource.updateId !==
+                    ("mode" in input
+                        ? input.sourceUpdateIds[0]
+                        : input.updates[0]?.update_id))) ||
+            (held && "mode" in input && !preparedSource))
+            return undefined;
+        if (input.selectedCommand !== undefined &&
+            (!held ||
+                ("mode" in input
+                    ? input.sourceUpdateIds.length !== 1 ||
+                        !areTelegramTargetsEqual(input.target, held.target)
+                    : input.updates.length !== 1)))
+            return undefined;
+        const marker = selectedCommand ? { selectedCommand } : {};
+        const expected = structuredClone({
+            operationId: input.operationId,
+            instanceId: input.instanceId,
+            sessionId: input.sessionId,
+            recipientBindingKey: input.recipientBindingKey,
+            ...(held
+                ? { ...marker, ...(preparedSource ? { preparedSource } : {}) }
+                : {}),
+            ...("mode" in input
+                ? {
+                    mode: input.mode,
+                    sourceUpdateIds: input.sourceUpdateIds,
+                    slot: input.slot,
+                    target: input.target,
+                    oldTarget: input.oldTarget,
+                }
+                : { updates: input.updates }),
+        });
+        const observing = "mode" in expected && expected.mode === "observe";
+        const commandObserving = "mode" in expected && expected.mode === "observe-command";
+        const settling = "mode" in expected &&
+            (expected.mode === "release" ||
+                expected.mode === "discard" ||
+                observing ||
+                commandObserving);
+        const required = [
+            TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SAVE,
+            ...("mode" in expected || held
+                ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_APPLY]
+                : []),
+            ...(settling || held ? [TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_SETTLE] : []),
+            ...(held
+                ? [
+                    TELEGRAM_BUS_CAPABILITY_LIVE_REBIND_COMMAND_SET,
+                    TELEGRAM_BUS_CAPABILITY_SELECTED_MENU_DELIVERY,
+                ]
+                : []),
+        ];
+        const follower = deps.getFollower(expected.instanceId), secret = deps.getAuthSecret();
+        if (!isCurrent() ||
+            !secret ||
+            !follower?.registrationGeneration ||
+            !follower.busSocketPath ||
+            follower.sessionId !== expected.sessionId ||
+            !hasTelegramBusSharedCapabilities(deps.localProtocolIdentity, follower.protocol, required))
+            return undefined;
+        const captured = structuredClone(follower);
+        /** The first failed authority condition, by fixed label; undefined while the captured recipient is current. */
+        const staleReason = () => {
+            if (!isCurrent())
+                return "caller authority";
+            if (deps.getAuthSecret() !== secret)
+                return "auth secret";
+            if (!isDeepStrictEqual(deps.localProtocolIdentity, localProtocol) ||
+                !required.every((cap) => hasTelegramBusCapability(deps.localProtocolIdentity, cap)))
+                return "local protocol";
+            const live = deps.getFollower(expected.instanceId);
+            if (!live)
+                return "follower registration";
+            if (live.sessionId !== captured.sessionId ||
+                live.registrationGeneration !== captured.registrationGeneration ||
+                live.sessionGeneration !== captured.sessionGeneration)
+                return "follower generation";
+            if (live.pid !== captured.pid ||
+                live.processBirthId !== captured.processBirthId)
+                return "follower process";
+            if (live.busSocketPath !== captured.busSocketPath ||
+                live.slot !== captured.slot ||
+                live.cwd !== captured.cwd)
+                return "follower endpoint";
+            if ("mode" in expected
+                ? live.slot !== expected.slot ||
+                    !live.target ||
+                    (!areTelegramTargetsEqual(live.target, expected.target) &&
+                        !areTelegramTargetsEqual(live.target, expected.oldTarget))
+                : !isDeepStrictEqual(live.target, captured.target))
+                return "follower target";
+            if (!required.every((cap) => hasTelegramBusCapability(live.protocol, cap)) ||
+                !isDeepStrictEqual(live.protocol, captured.protocol) ||
+                !getTelegramBusProtocolCompatibility({
+                    local: deps.localProtocolIdentity,
+                    remote: live.protocol,
+                }).compatible)
+                return "follower protocol";
+            return undefined;
+        };
+        const current = () => staleReason() === undefined;
+        if (!current())
+            return undefined;
+        const requestId = deps.createRequestId();
+        const response = await sendTelegramBusLocalEnvelope({
+            socketPath: captured.busSocketPath,
+            timeoutMs: deps.timeoutMs ?? TELEGRAM_BUS_FOLLOWER_CONTROL_TIMEOUT_MS,
+            retry: { attempts: 1, delayMs: 0 },
+            ...(held
+                ? {
+                    assertAuthority: () => {
+                        const reason = staleReason();
+                        if (reason)
+                            throw new Error(`Selected held input sender authority changed (${reason}).`);
+                    },
+                }
+                : {}),
+            envelope: {
+                requestId,
+                auth: secret,
+                ...(held
+                    ? {
+                        ...marker,
+                        ...("mode" in expected
+                            ? { preparedSource: expected.preparedSource }
+                            : {}),
+                    }
+                    : {}),
+                recipientInstanceId: expected.instanceId,
+                recipientRegistrationGeneration: captured.registrationGeneration,
+                recipientSessionId: expected.sessionId,
+                recipientBindingKey: expected.recipientBindingKey,
+                operationId: expected.operationId,
+                sentAtMs: Date.now(),
+                ...("mode" in expected
+                    ? settling
+                        ? {
+                            kind: "leader.settleLiveRebind",
+                            mode: expected.mode,
+                            sourceUpdateIds: expected.sourceUpdateIds,
+                            ...(observing ? { oldTarget: expected.oldTarget } : {}),
+                        }
+                        : {
+                            kind: "leader.applyLiveRebind",
+                            mode: expected.mode,
+                            sourceUpdateIds: expected.sourceUpdateIds,
+                        }
+                    : {
+                        kind: "leader.prepareLiveRebind",
+                        updates: expected.updates,
+                    }),
+            },
+        });
+        if (!current() ||
+            response?.kind !== "bus.ack" ||
+            response.requestId !== requestId ||
+            response.ok !== true ||
+            !isRecord(response.result))
+            return undefined;
+        const result = response.result, recipient = result.recipient;
+        if (!hasOnlyWireKeys(result, [
+            "operationId",
+            "recipient",
+            "sourceUpdateIds",
+            "selectedCommand",
+            "preparedSource",
+            "status",
+            "command",
+            "sourceAck",
+            "target",
+            "slot",
+            "action",
+            "oldTarget",
+            "work",
+        ]))
+            return undefined;
+        if (selectedCommand
+            ? !isDeepStrictEqual(parseSelectedCommandInput(result.selectedCommand), selectedCommand)
+            : Object.hasOwn(result, "selectedCommand"))
+            return undefined;
+        const ids = ("mode" in expected
+            ? [...expected.sourceUpdateIds]
+            : expected.updates.map((update) => update.update_id)).sort((a, b) => a - b);
+        const observedSource = parsePreparedCommandSource(result.preparedSource);
+        if (held
+            ? !observedSource ||
+                observedSource.updateId !== ids[0] ||
+                observedSource.journalBindingKey !== expected.recipientBindingKey ||
+                (expected.preparedSource &&
+                    !isDeepStrictEqual(observedSource, expected.preparedSource))
+            : Object.hasOwn(result, "preparedSource"))
+            return undefined;
+        if (result.operationId !== expected.operationId ||
+            !(commandObserving
+                ? result.status === "command-observed"
+                : observing
+                    ? result.status === "observed"
+                    : settling
+                        ? result.status === "protected" ||
+                            result.status === "unknown" ||
+                            result.status ===
+                                (expected.mode === "release" ? "released" : "discarded")
+                        : "mode" in expected
+                            ? result.status === "saved" || result.status === "applied"
+                            : result.status === "saved") ||
+            !isRecord(recipient) ||
+            recipient.instanceId !== expected.instanceId ||
+            recipient.sessionId !== expected.sessionId ||
+            recipient.generation !== captured.registrationGeneration ||
+            recipient.bindingKey !== expected.recipientBindingKey ||
+            !Array.isArray(result.sourceUpdateIds) ||
+            result.sourceUpdateIds.length !== ids.length ||
+            result.sourceUpdateIds.some((id, index) => id !== ids[index]))
+            return undefined;
+        const observation = {
+            operationId: expected.operationId,
+            recipient: {
+                instanceId: expected.instanceId,
+                sessionId: expected.sessionId,
+                generation: captured.registrationGeneration,
+                bindingKey: expected.recipientBindingKey,
+            },
+            sourceUpdateIds: ids,
+            ...(held
+                ? { ...structuredClone(marker), preparedSource: { ...observedSource } }
+                : {}),
+            status: "saved",
+        };
+        if (!("mode" in expected))
+            return observation;
+        if (commandObserving) {
+            const sourceAck = parsePreparedCommandSource(result.sourceAck);
+            if (!hasOnlyWireKeys(result, [
+                "operationId",
+                "recipient",
+                "sourceUpdateIds",
+                "selectedCommand",
+                "preparedSource",
+                "status",
+                "command",
+                "sourceAck",
+            ]) ||
+                !hasOnlyWireKeys(recipient, [
+                    "instanceId",
+                    "sessionId",
+                    "generation",
+                    "bindingKey",
+                ]) ||
+                !["completed", "unknown", "not-issued"].includes(result.command) ||
+                (Object.hasOwn(result, "sourceAck") &&
+                    (!sourceAck ||
+                        !isDeepStrictEqual(sourceAck, expected.preparedSource) ||
+                        result.command === "not-issued")))
+                return undefined;
+            const settled = {
+                command: result.command,
+                ...(sourceAck ? { sourceAck: { ...sourceAck } } : {}),
+            };
+            return {
+                ...observation,
+                status: "command-observed",
+                selectedCommand: structuredClone(selectedCommand),
+                preparedSource: { ...observedSource },
+                ...settled,
+            };
+        }
+        if (observing) {
+            const work = result.work, oldTarget = parseThreadTarget(result.oldTarget);
+            if (!oldTarget ||
+                !isDeepStrictEqual(oldTarget, expected.oldTarget) ||
+                !isRecord(work) ||
+                [
+                    work.sessionBusy,
+                    work.targetWork,
+                    work.deliveryPending,
+                    work.unknown,
+                ].some((flag) => typeof flag !== "boolean"))
+                return undefined;
+            return {
+                ...observation,
+                status: "observed",
+                oldTarget,
+                work: {
+                    sessionBusy: work.sessionBusy,
+                    targetWork: work.targetWork,
+                    deliveryPending: work.deliveryPending,
+                    unknown: work.unknown,
+                },
+            };
+        }
+        if (settling) {
+            if (result.action !== expected.mode)
+                return undefined;
+            return {
+                ...observation,
+                action: expected.mode,
+                status: result.status,
+            };
+        }
+        const target = parseThreadTarget(result.target), wanted = result.status === "applied" ? expected.target : expected.oldTarget;
+        if (!target ||
+            !isDeepStrictEqual(target, wanted) ||
+            result.slot !== expected.slot)
             return undefined;
-        return { operationId: expected.operationId, recipient: { kind: "follower", instanceId: captured.instanceId,
-                sessionId: expected.sessionId, generation: captured.registrationGeneration }, target, slot: expected.slot, ready: result.ready };
+        return {
+            ...observation,
+            status: result.status,
+            target,
+            slot: expected.slot,
+        };
     };
 }
 export function isTelegramBusEnvelopeAuthorized(envelope, secret) {
@@ -965,13 +1500,12 @@ export function isTelegramBusEnvelopeAuthorized(envelope, secret) {
     const expected = Buffer.from(secret);
     return auth.length === expected.length && timingSafeEqual(auth, expected);
 }
+/** Negative acknowledgement carrying only a diagnostic message. */
+export function rejectTelegramBusRequest(requestId, message) {
+    return { kind: "bus.ack", requestId, ok: false, message };
+}
 export function createUnauthorizedBusAck(requestId) {
-    return {
-        kind: "bus.ack",
-        requestId,
-        ok: false,
-        message: "Unauthorized Telegram bus envelope.",
-    };
+    return rejectTelegramBusRequest(requestId, "Unauthorized Telegram bus envelope.");
 }
 export function createTelegramBusLocalServer(deps) {
     const requestLedger = new Map();
@@ -1022,7 +1556,9 @@ export function createTelegramBusLocalServer(deps) {
             result: Promise.resolve().then(() => deps.handleEnvelope(envelope)),
         };
         requestLedger.set(key, entry);
-        const settled = () => { entry.settled = true; };
+        const settled = () => {
+            entry.settled = true;
+        };
         void entry.result.then(settled, settled);
         return entry.result;
     };
@@ -1246,6 +1782,24 @@ function getTelegramBusEnvelopeDiagnostics(envelope) {
 function sendTelegramBusLocalEnvelopeOnce(options) {
     const timeoutMs = options.timeoutMs ?? 1000;
     return new Promise((resolve, reject) => {
+        const assertAuthority = options.assertAuthority;
+        let issued = false;
+        const assertCurrent = () => {
+            try {
+                assertAuthority?.();
+            }
+            catch (error) {
+                // The caller's reason is a fixed condition label, never request or credential content.
+                throw new TelegramBusLocalAuthorityError(issued, error instanceof Error ? error.message : undefined);
+            }
+        };
+        try {
+            assertCurrent();
+        }
+        catch (error) {
+            reject(error);
+            return;
+        }
         const socket = createConnection(options.socketPath);
         let settled = false;
         let buffer = "";
@@ -1274,7 +1828,16 @@ function sendTelegramBusLocalEnvelopeOnce(options) {
         }, timeoutMs);
         socket.setEncoding("utf8");
         socket.once("connect", () => {
-            socket.write(encodeTelegramBusEnvelope(options.envelope));
+            try {
+                assertCurrent();
+                const encoded = encodeTelegramBusEnvelope(options.envelope);
+                assertCurrent();
+                issued = true;
+                socket.write(encoded);
+            }
+            catch (error) {
+                settle(() => reject(error));
+            }
         });
         socket.on("data", (chunk) => {
             buffer += chunk;
@@ -1282,7 +1845,14 @@ function sendTelegramBusLocalEnvelopeOnce(options) {
             if (newlineIndex < 0)
                 return;
             const line = buffer.slice(0, newlineIndex);
-            settle(() => resolve(parseTelegramBusEnvelope(line)));
+            try {
+                const response = parseTelegramBusEnvelope(line);
+                assertCurrent();
+                settle(() => resolve(response));
+            }
+            catch (error) {
+                settle(() => reject(error));
+            }
         });
         socket.once("error", (error) => settle(() => reject(error)));
         socket.once("end", () => settle(() => resolve(undefined)));
@@ -1308,7 +1878,9 @@ export async function sendTelegramBusLocalEnvelope(options) {
                 attempts,
                 ...info,
             });
-            if (attempt >= attempts || !isRetryableTelegramBusTransportError(error)) {
+            if (error instanceof TelegramBusLocalAuthorityError ||
+                attempt >= attempts ||
+                !isRetryableTelegramBusTransportError(error)) {
                 throw error;
             }
             resolvedOptions.recordTransportEvent?.("client-retry", {
@@ -1324,21 +1896,27 @@ export async function sendTelegramBusLocalEnvelope(options) {
     }
 }
 export function createTelegramBusForwardOwnershipValidator(registry) {
-    return ownership => {
+    return (ownership) => {
         const follower = registry.get(ownership.instanceId);
-        return isTelegramBusForwardOwnershipCurrent(ownership, follower?.registrationGeneration && follower.profileKey && follower.protocol ? {
-            instanceId: follower.instanceId,
-            ownerGeneration: follower.registrationGeneration,
-            recipientBindingKey: follower.profileKey,
-            protocolIdentity: follower.protocol,
-        } : undefined);
+        return isTelegramBusForwardOwnershipCurrent(ownership, follower?.registrationGeneration &&
+            follower.profileKey &&
+            follower.protocol
+            ? {
+                instanceId: follower.instanceId,
+                ownerGeneration: follower.registrationGeneration,
+                recipientBindingKey: follower.profileKey,
+                protocolIdentity: follower.protocol,
+            }
+            : undefined);
     };
 }
 function hasTelegramBusFollowerIdentityOverlap(first, second) {
-    return first.instanceId === second.instanceId ||
-        (first.profileKey !== undefined && first.profileKey === second.profileKey) ||
-        (first.target !== undefined && first.target.chatId === second.target?.chatId &&
-            first.target.threadId === second.target.threadId);
+    return (first.instanceId === second.instanceId ||
+        (first.profileKey !== undefined &&
+            first.profileKey === second.profileKey) ||
+        (first.target !== undefined &&
+            first.target.chatId === second.target?.chatId &&
+            first.target.threadId === second.target.threadId));
 }
 export function createTelegramBusFollowerRegistry() {
     const followers = new Map();
@@ -1417,8 +1995,10 @@ export function createTelegramBusFollowerRegistry() {
         },
         observeUnregistered: (follower) => {
             // This watches replacement, not process death or delivery authority.
-            const observation = { follower: clone(follower), current: ![...followers.values()]
-                    .some((current) => hasTelegramBusFollowerIdentityOverlap(current, follower)) };
+            const observation = {
+                follower: clone(follower),
+                current: ![...followers.values()].some((current) => hasTelegramBusFollowerIdentityOverlap(current, follower)),
+            };
             if (observation.current)
                 observations.add(observation);
             return {
@@ -1468,37 +2048,18 @@ async function handleTelegramBusSocketLine(line, socket, handleEnvelope, recordT
             ...getTelegramBusEnvelopeDiagnostics(envelope),
             ...classifyTelegramBusTransportError(error),
         });
-        socket.write(encodeTelegramBusEnvelope({
-            kind: "bus.ack",
-            requestId: envelope.requestId,
-            ok: false,
-            message: "Telegram bus handler failed.",
-        }));
+        socket.write(encodeTelegramBusEnvelope(rejectTelegramBusRequest(envelope.requestId, "Telegram bus handler failed.")));
     }
 }
 function parseRegisterEnvelope(value, requestId, kind) {
     const registration = parseRegistration(value.registration);
     return registration ? { kind, requestId, registration } : undefined;
 }
-function parseHeartbeatEnvelope(value, requestId) {
+function parseFollowerPresenceEnvelope(value, requestId, kind) {
     return typeof value.instanceId === "string" &&
         typeof value.sentAtMs === "number"
         ? {
-            kind: "follower.heartbeat",
-            requestId,
-            instanceId: value.instanceId,
-            ...(typeof value.registrationGeneration === "string"
-                ? { registrationGeneration: value.registrationGeneration }
-                : {}),
-            sentAtMs: value.sentAtMs,
-        }
-        : undefined;
-}
-function parseDisconnectEnvelope(value, requestId) {
-    return typeof value.instanceId === "string" &&
-        typeof value.sentAtMs === "number"
-        ? {
-            kind: "follower.disconnect",
+            kind,
             requestId,
             instanceId: value.instanceId,
             ...(typeof value.registrationGeneration === "string"
@@ -1536,14 +2097,17 @@ function parseTelegramBusFollowerDeliveryIdentity(value) {
         typeof value.recipientBindingKey !== "string" ||
         !value.recipientBindingKey ||
         (value.sourceRecoveryKey !== undefined &&
-            (typeof value.sourceRecoveryKey !== "string" || !value.sourceRecoveryKey ||
+            (typeof value.sourceRecoveryKey !== "string" ||
+                !value.sourceRecoveryKey ||
                 value.sourceRecoveryKey.length > 1_024)) ||
         (value.sourceClaim !== undefined &&
             (!isRecord(value.sourceClaim) ||
                 typeof value.sourceClaim.acquisitionId !== "string" ||
-                !value.sourceClaim.acquisitionId || value.sourceClaim.acquisitionId.length > 256 ||
+                !value.sourceClaim.acquisitionId ||
+                value.sourceClaim.acquisitionId.length > 256 ||
                 typeof value.sourceClaim.handoffId !== "string" ||
-                !value.sourceClaim.handoffId || value.sourceClaim.handoffId.length > 256))) {
+                !value.sourceClaim.handoffId ||
+                value.sourceClaim.handoffId.length > 256))) {
         return undefined;
     }
     return {
@@ -1551,10 +2115,16 @@ function parseTelegramBusFollowerDeliveryIdentity(value) {
         sourceUpdateId: value.sourceUpdateId,
         recipientBindingKey: value.recipientBindingKey,
         ...(typeof value.sourceRecoveryKey === "string"
-            ? { sourceRecoveryKey: value.sourceRecoveryKey } : {}),
+            ? { sourceRecoveryKey: value.sourceRecoveryKey }
+            : {}),
         ...(isRecord(value.sourceClaim)
-            ? { sourceClaim: { acquisitionId: value.sourceClaim.acquisitionId,
-                    handoffId: value.sourceClaim.handoffId } } : {}),
+            ? {
+                sourceClaim: {
+                    acquisitionId: value.sourceClaim.acquisitionId,
+                    handoffId: value.sourceClaim.handoffId,
+                },
+            }
+            : {}),
     };
 }
 function parseForwardCallbackEnvelope(value, requestId) {
@@ -1617,37 +2187,58 @@ function parseForwardMessageEnvelope(value, requestId, kind) {
 }
 function parseOfferInputCustodyHandoffEnvelope(value, requestId) {
     const source = value.source;
-    if (!isRecord(source) || typeof value.recipientInstanceId !== "string" ||
+    if (!isRecord(source) ||
+        typeof value.recipientInstanceId !== "string" ||
         typeof value.recipientRegistrationGeneration !== "string" ||
-        typeof value.recipientBindingKey !== "string" || !value.recipientBindingKey ||
-        typeof value.sourceRecoveryKey !== "string" || !value.sourceRecoveryKey ||
+        typeof value.recipientBindingKey !== "string" ||
+        !value.recipientBindingKey ||
+        typeof value.sourceRecoveryKey !== "string" ||
+        !value.sourceRecoveryKey ||
         value.sourceRecoveryKey.length > 1_024 ||
-        typeof source.journalBindingKey !== "string" || !source.journalBindingKey ||
+        typeof source.journalBindingKey !== "string" ||
+        !source.journalBindingKey ||
         source.journalBindingKey !== value.sourceRecoveryKey ||
-        typeof source.tokenSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(source.tokenSha256) ||
-        !Number.isSafeInteger(source.updateId) || source.updateId < 0 ||
-        typeof value.handoffId !== "string" || !value.handoffId || value.handoffId.length > 256 ||
+        typeof source.tokenSha256 !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(source.tokenSha256) ||
+        !Number.isSafeInteger(source.updateId) ||
+        source.updateId < 0 ||
+        typeof value.handoffId !== "string" ||
+        !value.handoffId ||
+        value.handoffId.length > 256 ||
         typeof value.sentAtMs !== "number")
         return undefined;
-    return { kind: "leader.offerInputCustodyHandoff", requestId,
+    return {
+        kind: "leader.offerInputCustodyHandoff",
+        requestId,
         recipientInstanceId: value.recipientInstanceId,
         recipientRegistrationGeneration: value.recipientRegistrationGeneration,
         recipientBindingKey: value.recipientBindingKey,
         sourceRecoveryKey: value.sourceRecoveryKey,
-        source: { journalBindingKey: source.journalBindingKey,
-            tokenSha256: source.tokenSha256, updateId: source.updateId },
-        handoffId: value.handoffId, sentAtMs: value.sentAtMs };
+        source: {
+            journalBindingKey: source.journalBindingKey,
+            tokenSha256: source.tokenSha256,
+            updateId: source.updateId,
+        },
+        handoffId: value.handoffId,
+        sentAtMs: value.sentAtMs,
+    };
 }
 function parseWakeInputCustodyEnvelope(value, requestId) {
     const delivery = parseTelegramBusFollowerDeliveryIdentity(value.delivery);
-    return delivery && delivery.sourceRecoveryKey && delivery.sourceClaim &&
+    return delivery &&
+        delivery.sourceRecoveryKey &&
+        delivery.sourceClaim &&
         typeof value.recipientInstanceId === "string" &&
         typeof value.recipientRegistrationGeneration === "string" &&
         typeof value.sentAtMs === "number"
-        ? { kind: "leader.wakeInputCustody", requestId,
+        ? {
+            kind: "leader.wakeInputCustody",
+            requestId,
             recipientInstanceId: value.recipientInstanceId,
             recipientRegistrationGeneration: value.recipientRegistrationGeneration,
-            delivery, sentAtMs: value.sentAtMs }
+            delivery,
+            sentAtMs: value.sentAtMs,
+        }
         : undefined;
 }
 function parseQueueHandoffEnvelope(value, requestId, kind) {
@@ -1777,6 +2368,144 @@ function parseRouteAgentMessageEnvelope(value, requestId) {
         sentAtMs: value.sentAtMs,
     };
 }
+const nonempty = (input, limit = 128) => typeof input === "string" && !!input.trim() && input.length <= limit;
+const positive = (input) => Number.isSafeInteger(input) && input > 0;
+const nonnegative = (input) => Number.isSafeInteger(input) && input >= 0;
+/** Shared closed text-effect codec; parsing alone supplies no recipient or issuance authority. */
+export function parseTelegramBusSelectedMenuTextEffect(effect) {
+    if (!isRecord(effect) ||
+        (effect.kind !== "send-text" && effect.kind !== "edit-text") ||
+        !hasOnlyWireKeys(effect, [
+            "kind",
+            "text",
+            "parseMode",
+            "replyMarkup",
+            ...(effect.kind === "send-text" ? ["replyToMessageId"] : ["messageId"]),
+        ]) ||
+        !nonempty(effect.text, 4096) ||
+        (effect.parseMode !== undefined && effect.parseMode !== "HTML") ||
+        (effect.kind === "send-text"
+            ? effect.replyToMessageId !== undefined &&
+                !positive(effect.replyToMessageId)
+            : !positive(effect.messageId)))
+        return undefined;
+    let replyMarkup;
+    if (effect.replyMarkup !== undefined) {
+        const markup = effect.replyMarkup;
+        if (!isRecord(markup) ||
+            !hasOnlyWireKeys(markup, ["inline_keyboard"]) ||
+            !Array.isArray(markup.inline_keyboard) ||
+            markup.inline_keyboard.length > 32 ||
+            markup.inline_keyboard.some((row) => !Array.isArray(row) ||
+                !row.length ||
+                row.length > 8 ||
+                row.some((button) => !isRecord(button) ||
+                    !hasOnlyWireKeys(button, ["text", "callback_data"]) ||
+                    !nonempty(button.text) ||
+                    !nonempty(button.callback_data, 64) ||
+                    Buffer.byteLength(button.callback_data, "utf8") > 64)))
+            return undefined;
+        replyMarkup = {
+            inline_keyboard: markup.inline_keyboard.map((row) => row.map((button) => ({
+                text: button.text,
+                callback_data: button.callback_data,
+            }))),
+        };
+    }
+    const common = {
+        text: effect.text,
+        ...(effect.parseMode === "HTML" ? { parseMode: "HTML" } : {}),
+        ...(replyMarkup ? { replyMarkup } : {}),
+    };
+    return effect.kind === "send-text"
+        ? {
+            ...common,
+            kind: "send-text",
+            ...(effect.replyToMessageId !== undefined
+                ? { replyToMessageId: effect.replyToMessageId }
+                : {}),
+        }
+        : { ...common, kind: "edit-text", messageId: effect.messageId };
+}
+function parseSelectedMenuDeliveryEnvelope(value, requestId) {
+    const recipient = value.recipient, executor = value.executor, effect = parseTelegramBusSelectedMenuTextEffect(value.effect);
+    if (!hasOnlyWireKeys(value, [
+        "kind",
+        "requestId",
+        "auth",
+        "instanceId",
+        "registrationGeneration",
+        "operationId",
+        "recipient",
+        "executor",
+        "operatorUserId",
+        "effect",
+        "sentAtMs",
+    ]) ||
+        !nonempty(requestId) ||
+        !nonempty(value.instanceId) ||
+        !nonempty(value.registrationGeneration) ||
+        !nonempty(value.operationId) ||
+        !isRecord(recipient) ||
+        !hasOnlyWireKeys(recipient, [
+            "sessionId",
+            "sessionGeneration",
+            "processId",
+            "processBirthId",
+            "profileKey",
+            "journalBindingKey",
+            "target",
+        ]) ||
+        !nonempty(recipient.sessionId) ||
+        !nonnegative(recipient.sessionGeneration) ||
+        !positive(recipient.processId) ||
+        !nonempty(recipient.processBirthId) ||
+        !nonempty(recipient.profileKey, 1024) ||
+        !nonempty(recipient.journalBindingKey, 8192) ||
+        recipient.profileKey === recipient.journalBindingKey ||
+        !isRecord(recipient.target) ||
+        !hasOnlyWireKeys(recipient.target, ["chatId", "threadId"]) ||
+        !positive(recipient.target.chatId) ||
+        !positive(recipient.target.threadId) ||
+        !positive(value.operatorUserId) ||
+        value.operatorUserId !== recipient.target.chatId ||
+        !isRecord(executor) ||
+        !hasOnlyWireKeys(executor, ["instanceId", "leaderEpoch"]) ||
+        !nonempty(executor.instanceId) ||
+        !nonempty(executor.leaderEpoch) ||
+        !effect ||
+        typeof value.sentAtMs !== "number" ||
+        !Number.isFinite(value.sentAtMs) ||
+        value.sentAtMs < 0 ||
+        (value.auth !== undefined && typeof value.auth !== "string"))
+        return undefined;
+    return {
+        kind: "follower.deliverSelectedMenu",
+        requestId,
+        instanceId: value.instanceId,
+        registrationGeneration: value.registrationGeneration,
+        operationId: value.operationId,
+        recipient: {
+            sessionId: recipient.sessionId,
+            sessionGeneration: recipient.sessionGeneration,
+            processId: recipient.processId,
+            processBirthId: recipient.processBirthId,
+            profileKey: recipient.profileKey,
+            journalBindingKey: recipient.journalBindingKey,
+            target: {
+                chatId: recipient.target.chatId,
+                threadId: recipient.target.threadId,
+            },
+        },
+        executor: {
+            instanceId: executor.instanceId,
+            leaderEpoch: executor.leaderEpoch,
+        },
+        operatorUserId: value.operatorUserId,
+        effect,
+        sentAtMs: value.sentAtMs,
+    };
+}
 function parseCallApiEnvelope(value, requestId) {
     return typeof value.instanceId === "string" &&
         typeof value.method === "string" &&
@@ -1888,7 +2617,8 @@ function parseRegistration(value) {
     if (typeof value.cwd === "string")
         registration.cwd = value.cwd;
     if (value.sessionId !== undefined) {
-        if (typeof value.sessionId !== "string" || !value.sessionId ||
+        if (typeof value.sessionId !== "string" ||
+            !value.sessionId ||
             value.sessionId !== value.sessionId.trim() ||
             Buffer.byteLength(value.sessionId, "utf8") > 256)
             return undefined;
@@ -1916,15 +2646,6 @@ function parseRegistration(value) {
         registration.target = target;
     return registration;
 }
-function parseTarget(value) {
-    if (value === undefined)
-        return undefined;
-    if (!isRecord(value) || typeof value.chatId !== "number")
-        return undefined;
-    return typeof value.threadId === "number"
-        ? { chatId: value.chatId, threadId: value.threadId }
-        : { chatId: value.chatId };
-}
 function parseThreadTarget(value) {
     const target = parseTarget(value);
     return target && typeof target.threadId === "number"