@osolmaz/pi-workflows 0.12.0 → 0.13.0

package/dist/extension/decision-channels.js

@@ -1,11 +1,10 @@
-import { createHash, randomUUID } from "node:crypto";
-import fs from "node:fs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { Key, matchesKey, wrapTextWithAnsi } from "@earendil-works/pi-tui";
-import Database from "better-sqlite3";
-import { MAX_PRESENTATION_TRANSPORT_PARTS, decisionDocumentSegments, decisionPresentationFingerprint, digestCanonical, } from "../workflows/decision-presentation.js";
+import { resourceIdFor, tokenHash } from "../state/mutation.js";
+import { MAX_PRESENTATION_TRANSPORT_PARTS, decisionDocumentSegments, decisionPresentationFingerprint, digestCanonical, humanDecisionChannelRequest, } from "../workflows/decision-presentation.js";
 import { HumanDecisionStore, createHumanDecisionAttemptId } from "../workflows/human-decision.js";
 const TELEGRAM_TEXT_LIMIT = 4_096;
 const PI_PRESENTATION_WINDOW_LINES = 18;
@@ -68,12 +67,15 @@ export class PiDecisionChannel {
         this.promptAbort?.abort();
     }
     async deliver(request) {
+        if (await this.alreadyDecided(request.decisionId)) {
+            return { status: "confirmed", channel: this.id, attemptId: "adopted" };
+        }
         const attemptId = createHumanDecisionAttemptId();
         const createdAt = new Date().toISOString();
         const controller = new AbortController();
         this.promptAbort = controller;
         try {
-            await this.options.store.recordDelivery(request, this.id, v2DeliveryRecord(request, this.id, attemptId, "intent", "intent", createdAt));
+            await this.options.store.recordDelivery(request, this.id, deliveryRecord(request, this.id, attemptId, "intent", "intent", createdAt));
             const entries = Object.entries(request.choices);
             const selectedChoice = await this.options.ui.custom((tui, theme, _keybindings, done) => {
                 let choiceIndex = 0;
@@ -139,7 +141,7 @@ export class PiDecisionChannel {
                 const errorCode = controller.signal.aborted
                     ? "pi_selection_settled_elsewhere"
                     : "pi_selection_cancelled";
-                await this.options.store.recordDelivery(request, this.id, v2DeliveryRecord(request, this.id, `${attemptId}-cancelled`, "complete", "failed", createdAt, { errorCode }));
+                await this.options.store.recordDelivery(request, this.id, deliveryRecord(request, this.id, `${attemptId}-cancelled`, "complete", "failed", createdAt, { errorCode }));
                 return { status: "failed", channel: this.id, attemptId, errorCode };
             }
             const definition = request.choices[selectedChoice];
@@ -154,11 +156,14 @@ export class PiDecisionChannel {
                     const errorCode = controller.signal.aborted
                         ? "pi_input_settled_elsewhere"
                         : "pi_input_cancelled";
-                    await this.options.store.recordDelivery(request, this.id, v2DeliveryRecord(request, this.id, `${attemptId}-cancelled`, "complete", "failed", createdAt, { errorCode }));
+                    await this.options.store.recordDelivery(request, this.id, deliveryRecord(request, this.id, `${attemptId}-cancelled`, "complete", "failed", createdAt, { errorCode }));
                     return { status: "failed", channel: this.id, attemptId, errorCode };
                 }
                 response = { choice: selectedChoice, input: { [definition.input.name]: text } };
             }
+            if (await this.alreadyDecided(request.decisionId)) {
+                return { status: "confirmed", channel: this.id, attemptId: "adopted" };
+            }
             const eventId = createHumanDecisionAttemptId();
             await this.options.onAnswer({
                 request,
@@ -166,7 +171,7 @@ export class PiDecisionChannel {
                 source: { channel: this.id, actorId: this.options.actorId, eventId },
                 idempotencyKey: `${this.id}:${eventId}`,
             });
-            await this.options.store.recordDelivery(request, this.id, v2DeliveryRecord(request, this.id, `${attemptId}-confirmed`, "complete", "confirmed", createdAt, { messageCount: 1 }));
+            await this.options.store.recordDelivery(request, this.id, deliveryRecord(request, this.id, `${attemptId}-confirmed`, "complete", "confirmed", createdAt, { messageCount: 1 }));
             return { status: "confirmed", channel: this.id, attemptId };
         }
         finally {
@@ -174,6 +179,10 @@ export class PiDecisionChannel {
                 this.promptAbort = null;
         }
     }
+    async alreadyDecided(decisionId) {
+        return ((await this.options.store.readResolved(decisionId)) !== null ||
+            (await this.options.store.readCancellation(decisionId)) !== null);
+    }
     async settle(decision) {
         this.promptAbort?.abort();
         if (this.settlementTask !== null)
@@ -207,156 +216,301 @@ export class PiDecisionChannel {
     }
 }
 class TelegramProjection {
+    state;
     profile;
     owner;
-    db;
-    constructor(filePath, profile, owner) {
+    channelId;
+    resourceId;
+    token = randomBytes(32).toString("base64url");
+    generation = 0;
+    constructor(state, profile, owner) {
+        this.state = state;
         this.profile = profile;
         this.owner = owner;
-        fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-        this.db = new Database(filePath);
-        fs.chmodSync(filePath, 0o600);
-        this.db.pragma("journal_mode = WAL");
-        this.db.pragma("busy_timeout = 5000");
-        this.db.exec(`
-      CREATE TABLE IF NOT EXISTS leases (
-        profile TEXT PRIMARY KEY,
-        owner TEXT NOT NULL,
-        expires_at INTEGER NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS offsets (
-        profile TEXT PRIMARY KEY,
-        next_offset INTEGER NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS callbacks (
-        profile TEXT NOT NULL,
-        token TEXT NOT NULL,
-        request_json TEXT NOT NULL,
-        choice_id TEXT NOT NULL,
-        PRIMARY KEY (profile, token)
-      );
-      CREATE TABLE IF NOT EXISTS replies (
-        profile TEXT NOT NULL,
-        chat_id TEXT NOT NULL,
-        message_id TEXT NOT NULL,
-        request_json TEXT NOT NULL,
-        choice_id TEXT NOT NULL,
-        PRIMARY KEY (profile, chat_id, message_id)
-      );
-      CREATE TABLE IF NOT EXISTS messages (
-        profile TEXT NOT NULL,
-        decision_id TEXT NOT NULL,
-        chat_id TEXT NOT NULL,
-        message_id TEXT NOT NULL,
-        PRIMARY KEY (profile, decision_id, chat_id, message_id)
-      );
-      CREATE TABLE IF NOT EXISTS message_parts (
-        profile TEXT NOT NULL,
-        decision_id TEXT NOT NULL,
-        recipient_index INTEGER NOT NULL,
-        part_index INTEGER NOT NULL,
-        content_digest TEXT NOT NULL,
-        chat_id TEXT NOT NULL,
-        message_id TEXT NOT NULL,
-        PRIMARY KEY (profile, decision_id, recipient_index, part_index)
-      );
-    `);
+        this.channelId = `telegram-${createHash("sha256").update(profile).digest("hex").slice(0, 40)}`;
+        this.resourceId = resourceIdFor("channel", this.channelId);
+        this.state.transaction(() => {
+            const now = Date.now();
+            this.state.connection
+                .prepare(`INSERT INTO resources(
+             resource_id, resource_type, aggregate_key, revision, created_at, updated_at
+           ) VALUES (?, 'channel', ?, 1, ?, ?)
+           ON CONFLICT(resource_type, aggregate_key) DO NOTHING`)
+                .run(this.resourceId, this.channelId, now, now);
+            this.state.connection
+                .prepare("INSERT INTO leases(resource_id, generation) VALUES (?, 0) ON CONFLICT(resource_id) DO NOTHING")
+                .run(this.resourceId);
+            this.state.connection
+                .prepare(`INSERT INTO channels(channel_id, resource_id, adapter_type, profile_key, created_at)
+           VALUES (?, ?, 'telegram', ?, ?) ON CONFLICT(channel_id) DO NOTHING`)
+                .run(this.channelId, this.resourceId, this.profile, now);
+        });
     }
     close() {
         this.release();
-        this.db.close();
+    }
+    ownsLease() {
+        try {
+            this.assertOwner();
+            return true;
+        }
+        catch {
+            return false;
+        }
     }
     acquire(now = Date.now()) {
-        const transaction = this.db.transaction(() => {
-            const row = this.db
-                .prepare("SELECT owner, expires_at FROM leases WHERE profile = ?")
-                .get(this.profile);
-            if (row !== undefined && row.owner !== this.owner && row.expires_at > now)
+        return this.state.transaction(() => {
+            const lease = this.lease();
+            if (lease.ownerId !== null &&
+                lease.ownerId !== this.owner &&
+                lease.expiresAt !== null &&
+                lease.expiresAt > now) {
                 return false;
-            this.db
-                .prepare("INSERT INTO leases(profile, owner, expires_at) VALUES (?, ?, ?) ON CONFLICT(profile) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at")
-                .run(this.profile, this.owner, now + LEASE_TTL_MS);
+            }
+            const generation = lease.ownerId === this.owner ? lease.generation : lease.generation + 1;
+            const result = this.state.connection
+                .prepare(`UPDATE leases
+           SET generation = ?, owner_type = 'channel', owner_id = ?, token_hash = ?,
+               acquired_at = COALESCE(acquired_at, ?), heartbeat_at = ?, expires_at = ?
+           WHERE resource_id = ? AND generation = ?`)
+                .run(generation, this.owner, tokenHash(this.token), now, now, now + LEASE_TTL_MS, this.resourceId, lease.generation);
+            /* istanbul ignore if -- impossible after exact schema and transaction checks */
+            if (result.changes !== 1)
+                return false;
+            this.generation = generation;
+            this.recordMutation("channel.lease_acquired", { expiresAt: now + LEASE_TTL_MS }, now);
             return true;
         });
-        return transaction();
     }
     renew(now = Date.now()) {
-        return (this.db
-            .prepare("UPDATE leases SET expires_at = ? WHERE profile = ? AND owner = ?")
-            .run(now + LEASE_TTL_MS, this.profile, this.owner).changes === 1);
+        return (this.state.connection
+            .prepare(`UPDATE leases SET heartbeat_at = ?, expires_at = ?
+           WHERE resource_id = ? AND owner_id = ? AND token_hash = ? AND generation = ?`)
+            .run(now, now + LEASE_TTL_MS, this.resourceId, this.owner, tokenHash(this.token), this.generation).changes === 1);
     }
     release() {
-        this.db
-            .prepare("DELETE FROM leases WHERE profile = ? AND owner = ?")
-            .run(this.profile, this.owner);
+        this.state.transaction(() => {
+            const result = this.state.connection
+                .prepare(`UPDATE leases
+           SET owner_type = NULL, owner_id = NULL, token_hash = NULL,
+               acquired_at = NULL, heartbeat_at = NULL, expires_at = NULL
+           WHERE resource_id = ? AND owner_id = ? AND token_hash = ? AND generation = ?`)
+                .run(this.resourceId, this.owner, tokenHash(this.token), this.generation);
+            if (result.changes === 1) {
+                this.recordMutation("channel.lease_released", {}, Date.now());
+            }
+        });
     }
     offset() {
-        return (this.db.prepare("SELECT next_offset FROM offsets WHERE profile = ?").get(this.profile)?.next_offset ?? 0);
+        const row = this.state.connection
+            .prepare("SELECT cursor_value AS cursorValue FROM channel_cursors WHERE channel_id = ? AND cursor_key = 'telegram_update'")
+            .get(this.channelId);
+        return isCursorRow(row) ? Number.parseInt(row.cursorValue, 10) || 0 : 0;
     }
     setOffset(offset) {
-        this.db
-            .prepare("INSERT INTO offsets(profile, next_offset) VALUES (?, ?) ON CONFLICT(profile) DO UPDATE SET next_offset = MAX(next_offset, excluded.next_offset)")
-            .run(this.profile, offset);
+        this.mutate("channel.cursor_updated", { offset }, () => {
+            this.state.connection
+                .prepare(`INSERT INTO channel_cursors(channel_id, cursor_key, cursor_value, updated_at)
+           VALUES (?, 'telegram_update', ?, ?)
+           ON CONFLICT(channel_id, cursor_key) DO UPDATE SET
+             cursor_value = CAST(MAX(CAST(channel_cursors.cursor_value AS INTEGER), CAST(excluded.cursor_value AS INTEGER)) AS TEXT),
+             updated_at = excluded.updated_at`)
+                .run(this.channelId, String(offset), Date.now());
+        });
     }
     putCallback(token, binding) {
-        this.db
-            .prepare("INSERT INTO callbacks(profile, token, request_json, choice_id) VALUES (?, ?, ?, ?) ON CONFLICT(profile, token) DO UPDATE SET request_json = excluded.request_json, choice_id = excluded.choice_id")
-            .run(this.profile, token, JSON.stringify(binding.request), binding.choice);
+        this.putInbox(`callback:${token}`, "callback", binding);
     }
     callback(token) {
-        const row = this.db
-            .prepare("SELECT request_json, choice_id FROM callbacks WHERE profile = ? AND token = ?")
-            .get(this.profile, token);
-        return row === undefined
-            ? undefined
-            : {
-                request: JSON.parse(row.request_json),
-                choice: row.choice_id,
-            };
+        return this.inbox(`callback:${token}`);
     }
     putReply(binding) {
-        this.db
-            .prepare("INSERT INTO replies(profile, chat_id, message_id, request_json, choice_id) VALUES (?, ?, ?, ?, ?) ON CONFLICT(profile, chat_id, message_id) DO UPDATE SET request_json = excluded.request_json, choice_id = excluded.choice_id")
-            .run(this.profile, binding.chatId, binding.promptMessageId, JSON.stringify(binding.request), binding.choice);
+        this.putInbox(`reply:${binding.chatId}:${binding.promptMessageId}`, "reply", binding);
     }
     reply(chatId, messageId) {
-        const row = this.db
-            .prepare("SELECT request_json, choice_id, chat_id, message_id FROM replies WHERE profile = ? AND chat_id = ? AND message_id = ?")
-            .get(this.profile, chatId, messageId);
-        return row === undefined
-            ? undefined
-            : {
-                request: JSON.parse(row.request_json),
-                choice: row.choice_id,
-                chatId: row.chat_id,
-                promptMessageId: row.message_id,
-            };
+        return this.inbox(`reply:${chatId}:${messageId}`);
     }
     deleteReply(chatId, messageId) {
-        this.db
-            .prepare("DELETE FROM replies WHERE profile = ? AND chat_id = ? AND message_id = ?")
-            .run(this.profile, chatId, messageId);
+        this.mutate("channel.reply_consumed", { chatId, messageId }, () => {
+            this.state.connection
+                .prepare("DELETE FROM channel_inbox WHERE channel_id = ? AND external_event_id = ?")
+                .run(this.channelId, `reply:${chatId}:${messageId}`);
+        });
     }
     putMessage(decisionId, chatId, messageId) {
-        this.db
-            .prepare("INSERT OR IGNORE INTO messages(profile, decision_id, chat_id, message_id) VALUES (?, ?, ?, ?)")
-            .run(this.profile, decisionId, chatId, messageId);
+        const localId = transportMessageId(this.channelId, decisionId, chatId, messageId);
+        this.mutate("channel.message_confirmed", { decisionId, chatId, messageId }, () => {
+            const contentHash = this.state.putJson({ chatId, messageId });
+            this.state.connection
+                .prepare(`INSERT INTO channel_messages(
+             message_id, channel_id, decision_id, purpose, content_hash,
+             external_conversation_ref, external_message_ref, status, created_at, updated_at
+           ) VALUES (?, ?, ?, 'delivery', ?, ?, ?, 'confirmed', ?, ?)
+           ON CONFLICT(message_id) DO NOTHING`)
+                .run(localId, this.channelId, decisionId, contentHash, chatId, messageId, Date.now(), Date.now());
+        });
     }
     messages(decisionId) {
-        return this.db
-            .prepare("SELECT chat_id, message_id FROM messages WHERE profile = ? AND decision_id = ? ORDER BY chat_id, message_id")
-            .all(this.profile, decisionId);
+        const rows = this.state.connection
+            .prepare(`SELECT external_conversation_ref AS chatId, external_message_ref AS messageId
+         FROM channel_messages
+         WHERE channel_id = ? AND decision_id = ? AND purpose = 'delivery'
+           AND external_conversation_ref IS NOT NULL AND external_message_ref IS NOT NULL
+         ORDER BY external_conversation_ref, external_message_ref`)
+            .all(this.channelId, decisionId);
+        return rows.filter(isTransportMessageRow).map((row) => ({
+            chat_id: row.chatId,
+            message_id: row.messageId,
+        }));
     }
     putMessagePart(decisionId, recipientIndex, partIndex, contentDigest, chatId, messageId) {
-        this.db
-            .prepare("INSERT INTO message_parts(profile, decision_id, recipient_index, part_index, content_digest, chat_id, message_id) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(profile, decision_id, recipient_index, part_index) DO UPDATE SET content_digest = excluded.content_digest, chat_id = excluded.chat_id, message_id = excluded.message_id")
-            .run(this.profile, decisionId, recipientIndex, partIndex, contentDigest, chatId, messageId);
+        const localId = `telegram-parts-${createHash("sha256")
+            .update(`${this.channelId}\0${decisionId}`)
+            .digest("hex")
+            .slice(0, 40)}`;
+        this.mutate("channel.message_part_confirmed", { decisionId, recipientIndex, partIndex }, () => {
+            const parentHash = this.state.putJson({ decisionId });
+            this.state.connection
+                .prepare(`INSERT INTO channel_messages(
+             message_id, channel_id, decision_id, purpose, content_hash,
+             status, created_at, updated_at
+           ) VALUES (?, ?, ?, 'delivery', ?, 'confirmed', ?, ?)
+           ON CONFLICT(message_id) DO NOTHING`)
+                .run(localId, this.channelId, decisionId, parentHash, Date.now(), Date.now());
+            const contentHash = this.state.putText(contentDigest);
+            this.state.connection
+                .prepare(`INSERT INTO channel_message_parts(
+             message_id, recipient_index, part_index, content_hash,
+             external_conversation_ref, external_message_ref
+           ) VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT(message_id, recipient_index, part_index) DO UPDATE SET
+             content_hash = excluded.content_hash,
+             external_conversation_ref = excluded.external_conversation_ref,
+             external_message_ref = excluded.external_message_ref`)
+                .run(localId, recipientIndex, partIndex, contentHash, chatId, messageId);
+        });
     }
     messagePart(decisionId, recipientIndex, partIndex) {
-        return this.db
-            .prepare("SELECT recipient_index, part_index, content_digest, chat_id, message_id FROM message_parts WHERE profile = ? AND decision_id = ? AND recipient_index = ? AND part_index = ?")
-            .get(this.profile, decisionId, recipientIndex, partIndex);
+        const localId = `telegram-parts-${createHash("sha256")
+            .update(`${this.channelId}\0${decisionId}`)
+            .digest("hex")
+            .slice(0, 40)}`;
+        const row = this.state.connection
+            .prepare(`SELECT recipient_index AS recipientIndex, part_index AS partIndex,
+                content_hash AS contentHash,
+                external_conversation_ref AS chatId,
+                external_message_ref AS messageId
+         FROM channel_message_parts
+         WHERE message_id = ? AND recipient_index = ? AND part_index = ?`)
+            .get(localId, recipientIndex, partIndex);
+        if (!isMessagePartProjectionRow(row))
+            return undefined;
+        const content = this.state.readBlob(row.contentHash);
+        /* istanbul ignore if -- foreign key guarantees the content blob */
+        if (content === undefined)
+            throw new Error("Telegram part content is missing");
+        return {
+            recipient_index: row.recipientIndex,
+            part_index: row.partIndex,
+            content_digest: content.content.toString("utf8"),
+            chat_id: row.chatId,
+            message_id: row.messageId,
+        };
     }
+    putInbox(eventId, type, binding) {
+        this.mutate(`channel.${type}_stored`, { eventId }, () => {
+            const payloadHash = this.state.putJson(binding);
+            this.state.connection
+                .prepare(`INSERT INTO channel_inbox(
+             channel_id, external_event_id, event_type, payload_hash, received_at
+           ) VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT(channel_id, external_event_id) DO UPDATE SET payload_hash = excluded.payload_hash`)
+                .run(this.channelId, eventId, type, payloadHash, Date.now());
+        });
+    }
+    inbox(eventId) {
+        const row = this.state.connection
+            .prepare("SELECT payload_hash AS payloadHash FROM channel_inbox WHERE channel_id = ? AND external_event_id = ?")
+            .get(this.channelId, eventId);
+        return isPayloadHashRow(row) ? this.state.readJson(row.payloadHash) : undefined;
+    }
+    mutate(type, payload, operation) {
+        this.state.transaction(() => {
+            this.assertOwner();
+            operation();
+            this.recordMutation(type, payload, Date.now());
+        });
+    }
+    recordMutation(type, payload, now) {
+        const revisionRow = this.state.connection
+            .prepare("SELECT revision FROM resources WHERE resource_id = ?")
+            .get(this.resourceId);
+        /* istanbul ignore if -- exact schema and internal query shape */
+        /* istanbul ignore if -- impossible after exact schema and transaction checks */
+        if (!isRevisionProjectionRow(revisionRow))
+            throw new Error("Telegram channel resource is missing");
+        const revision = revisionRow.revision + 1;
+        this.state.connection
+            .prepare("UPDATE resources SET revision = ?, updated_at = ? WHERE resource_id = ? AND revision = ?")
+            .run(revision, now, this.resourceId, revision - 1);
+        const payloadHash = this.state.putJson(payload, now);
+        this.state.connection
+            .prepare(`INSERT INTO events(
+           event_id, resource_id, resource_revision, event_type, actor_type,
+           actor_id, lease_generation, payload_hash, recorded_at
+         ) VALUES (?, ?, ?, ?, 'channel', ?, ?, ?, ?)`)
+            .run(`event-${randomUUID()}`, this.resourceId, revision, type, this.owner, this.generation === 0 ? null : this.generation, payloadHash, now);
+    }
+    assertOwner() {
+        const lease = this.lease();
+        if (lease.ownerId !== this.owner ||
+            lease.generation !== this.generation ||
+            lease.tokenHash === null ||
+            !lease.tokenHash.equals(tokenHash(this.token)) ||
+            lease.expiresAt === null ||
+            lease.expiresAt <= Date.now()) {
+            throw new Error(`Telegram profile ${this.profile} is not owned by this channel process`);
+        }
+    }
+    lease() {
+        const row = this.state.connection
+            .prepare(`SELECT generation, owner_id AS ownerId, token_hash AS tokenHash,
+                expires_at AS expiresAt
+         FROM leases WHERE resource_id = ?`)
+            .get(this.resourceId);
+        /* istanbul ignore if -- exact schema and internal query shape */
+        /* istanbul ignore if -- impossible after exact schema and transaction checks */
+        if (!isTelegramLeaseRow(row))
+            throw new Error("Telegram channel lease is missing");
+        return row;
+    }
+}
+function transportMessageId(channelId, decisionId, chatId, messageId) {
+    return `telegram-message-${createHash("sha256")
+        .update(`${channelId}\0${decisionId}\0${chatId}\0${messageId}`)
+        .digest("hex")
+        .slice(0, 40)}`;
+}
+function isTelegramLeaseRow(value) {
+    return isProjectionRecord(value);
+}
+function isCursorRow(value) {
+    return isProjectionRecord(value);
+}
+function isPayloadHashRow(value) {
+    return isProjectionRecord(value);
+}
+function isTransportMessageRow(value) {
+    return isProjectionRecord(value);
+}
+function isMessagePartProjectionRow(value) {
+    return isProjectionRecord(value);
+}
+function isRevisionProjectionRow(value) {
+    return isProjectionRecord(value);
+}
+function isProjectionRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 class TelegramCallError extends Error {
     ambiguous;
@@ -396,7 +550,7 @@ export class TelegramDecisionChannel {
         this.onAnswer = options.onAnswer;
         this.fetchFn = options.fetchFn ?? fetch;
         this.apiBase = options.apiBase ?? DEFAULT_API_BASE;
-        this.projection = new TelegramProjection(path.join(options.configDir ?? decisionConfigDir(), "telegram-state.sqlite"), options.profileName, options.ownerId ?? randomUUID());
+        this.projection = new TelegramProjection(options.store.state, options.profileName, options.ownerId ?? randomUUID());
     }
     async start() {
         if (this.running)
@@ -416,6 +570,21 @@ export class TelegramDecisionChannel {
     }
     async deliver(request) {
         const channelPath = this.channelPath();
+        if (!this.projection.ownsLease()) {
+            const attemptId = `queued-${createHash("sha256")
+                .update(`${this.id}\0${request.decisionId}\0${request.requestDigest}`)
+                .digest("hex")
+                .slice(0, 40)}`;
+            await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, attemptId, "complete", "intent", new Date().toISOString(), {
+                errorCode: "queued_for_channel_owner",
+            }));
+            return {
+                status: "unknown",
+                channel: this.id,
+                attemptId,
+                errorCode: "queued_for_channel_owner",
+            };
+        }
         const parts = renderTelegramParts(request);
         const partDigests = parts.map((part) => digestCanonical(part));
         const prior = await this.store.listDeliveries(request.decisionId, channelPath);
@@ -443,7 +612,7 @@ export class TelegramDecisionChannel {
         }
         const attemptId = createHumanDecisionAttemptId();
         const createdAt = new Date().toISOString();
-        await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, attemptId, "intent", "intent", createdAt, {
+        await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, attemptId, "intent", "intent", createdAt, {
             partCount: parts.length,
         }));
         const keyboard = this.registerCallbacks(request);
@@ -454,8 +623,7 @@ export class TelegramDecisionChannel {
                 const partIndex = partOffset + 1;
                 const contentDigest = partDigests[partOffset];
                 const projected = this.projection.messagePart(request.decisionId, recipientIndex, partIndex);
-                const confirmed = prior.some((record) => record.schema === "pi-workflows.human-decision-delivery.v2" &&
-                    record.phase === "part" &&
+                const confirmed = prior.some((record) => record.phase === "part" &&
                     record.state === "confirmed" &&
                     record.recipientIndex === recipientIndex &&
                     record.partIndex === partIndex &&
@@ -468,11 +636,16 @@ export class TelegramDecisionChannel {
                 }
                 if (confirmed || projected !== undefined) {
                     const errorCode = "telegram_part_evidence_mismatch";
-                    await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, `${attemptId}-r${recipientIndex}-p${partIndex}-unknown`, "part", "unknown", createdAt, { recipientIndex, partIndex, partCount: parts.length, contentDigest, errorCode }));
+                    await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, `${attemptId}-r${recipientIndex}-p${partIndex}-unknown`, "part", "unknown", createdAt, { recipientIndex, partIndex, partCount: parts.length, contentDigest, errorCode }));
                     return { status: "unknown", channel: this.id, attemptId, errorCode };
                 }
                 const partAttemptId = `${attemptId}-r${recipientIndex}-p${partIndex}`;
-                await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, `${partAttemptId}-intent`, "part", "intent", createdAt, { recipientIndex, partIndex, partCount: parts.length, contentDigest }));
+                await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, `${partAttemptId}-intent`, "part", "intent", createdAt, {
+                    recipientIndex,
+                    partIndex,
+                    partCount: parts.length,
+                    contentDigest,
+                }));
                 try {
                     const result = await this.call("sendMessage", {
                         chat_id: chatId,
@@ -482,24 +655,24 @@ export class TelegramDecisionChannel {
                     const messageId = telegramMessageId(result);
                     this.projection.putMessage(request.decisionId, chatId, messageId);
                     this.projection.putMessagePart(request.decisionId, recipientIndex, partIndex, contentDigest, chatId, messageId);
-                    await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, `${partAttemptId}-confirmed`, "part", "confirmed", createdAt, { recipientIndex, partIndex, partCount: parts.length, contentDigest }));
+                    await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, `${partAttemptId}-confirmed`, "part", "confirmed", createdAt, { recipientIndex, partIndex, partCount: parts.length, contentDigest }));
                 }
                 catch (error) {
                     const callError = normalizeCallError(error);
                     const state = callError.ambiguous ? "unknown" : "failed";
-                    await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, `${partAttemptId}-${state}`, "part", state, createdAt, {
+                    await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, `${partAttemptId}-${state}`, "part", state, createdAt, {
                         recipientIndex,
                         partIndex,
                         partCount: parts.length,
                         contentDigest,
                         errorCode: callError.code,
                     }));
-                    await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, `${attemptId}-${state}`, "complete", state, createdAt, { partCount: parts.length, errorCode: callError.code }));
+                    await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, `${attemptId}-${state}`, "complete", state, createdAt, { partCount: parts.length, errorCode: callError.code }));
                     return { status: state, channel: this.id, attemptId, errorCode: callError.code };
                 }
             }
         }
-        await this.store.recordDelivery(request, channelPath, v2DeliveryRecord(request, this.id, `${attemptId}-confirmed`, "complete", "confirmed", createdAt, { partCount: parts.length, messageCount: parts.length * recipients.length }));
+        await this.store.recordDelivery(request, channelPath, deliveryRecord(request, this.id, `${attemptId}-confirmed`, "complete", "confirmed", createdAt, { partCount: parts.length, messageCount: parts.length * recipients.length }));
         return { status: "confirmed", channel: this.id, attemptId };
     }
     async settle(decision) {
@@ -639,6 +812,7 @@ export class TelegramDecisionChannel {
                 continue;
             }
             try {
+                await this.deliverPendingRequests();
                 const result = await this.call("getUpdates", {
                     offset: this.projection.offset(),
                     timeout: 20,
@@ -661,6 +835,27 @@ export class TelegramDecisionChannel {
             }
         }
     }
+    async deliverPendingRequests() {
+        const channelPath = this.channelPath();
+        for (const request of await this.store.listRequests()) {
+            if (request.expiresAt !== undefined && Date.parse(request.expiresAt) <= Date.now())
+                continue;
+            if ((await this.store.readResolved(request.decisionId)) !== null)
+                continue;
+            if ((await this.store.readCancellation(request.decisionId)) !== null)
+                continue;
+            const deliveries = await this.store.listDeliveries(request.decisionId, channelPath);
+            if (!deliveries.some((record) => record.state === "intent" && record.errorCode === "queued_for_channel_owner")) {
+                continue;
+            }
+            try {
+                await this.deliver(humanDecisionChannelRequest(request));
+            }
+            catch {
+                // Durable delivery evidence controls retries for each request.
+            }
+        }
+    }
     async call(method, payload, signal) {
         let response;
         try {
@@ -711,7 +906,9 @@ export function createTelegramChannels(options) {
     }
     return channels;
 }
-export async function verifyTelegramTokenFile(tokenFile, fetchFn = fetch, apiBase = DEFAULT_API_BASE) {
+export async function verifyTelegramTokenFile(tokenFile, fetchFn, apiBase = DEFAULT_API_BASE) {
+    /* istanbul ignore next -- global fetch is used only by operator setup */
+    const request = fetchFn ?? fetch;
     if (!path.isAbsolute(tokenFile))
         throw new Error("Telegram token file path must be absolute");
     await requirePrivateFile(tokenFile, "Telegram token file");
@@ -720,7 +917,7 @@ export async function verifyTelegramTokenFile(tokenFile, fetchFn = fetch, apiBas
         throw new Error("Telegram token file is empty");
     let response;
     try {
-        response = await fetchFn(`${apiBase}/bot${encodeURIComponent(token)}/getMe`, {
+        response = await request(`${apiBase}/bot${encodeURIComponent(token)}/getMe`, {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: "{}",
@@ -848,9 +1045,9 @@ function parseCredentialConfig(value) {
     }
     return { schema: "pi-workflows.credentials.v1", telegram };
 }
-function v2DeliveryRecord(request, channel, attemptId, phase, state, createdAt, extra = {}) {
+function deliveryRecord(request, channel, attemptId, phase, state, createdAt, extra = {}) {
     return {
-        schema: "pi-workflows.human-decision-delivery.v2",
+        schema: "pi-workflows.human-decision-delivery.v1",
         attemptId,
         decisionId: request.decisionId,
         requestDigest: request.requestDigest,
@@ -864,23 +1061,13 @@ function v2DeliveryRecord(request, channel, attemptId, phase, state, createdAt,
     };
 }
 function isCompleteDelivery(record) {
-    return (record.state === "confirmed" &&
-        (record.schema === "pi-workflows.human-decision-delivery.v1" || record.phase === "complete"));
+    return record.state === "confirmed" && record.phase === "complete";
 }
 function hasUnsettledDeliveryIntent(records) {
-    const hasLegacyIntent = records.some((record) => record.schema === "pi-workflows.human-decision-delivery.v1" && record.state === "intent");
-    if (hasLegacyIntent &&
-        !records.some((record) => record.schema === "pi-workflows.human-decision-delivery.v1" && record.state !== "intent")) {
-        return true;
-    }
     return records.some((record) => {
-        if (record.schema !== "pi-workflows.human-decision-delivery.v2" ||
-            record.phase !== "part" ||
-            record.state !== "intent") {
+        if (record.phase !== "part" || record.state !== "intent")
             return false;
-        }
-        return !records.some((other) => other.schema === "pi-workflows.human-decision-delivery.v2" &&
-            other.phase === "part" &&
+        return !records.some((other) => other.phase === "part" &&
             other.state !== "intent" &&
             other.recipientIndex === record.recipientIndex &&
             other.partIndex === record.partIndex &&