@ouro.bot/cli 0.1.0-alpha.773 → 0.1.0-alpha.774

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.774",
+      "changes": [
+        "Make Sanctuary updates side-effect-safe, move Telegram acceptance to canonical vault credentials, and repair consumed event recoveries through a reviewed daemon command."
+      ]
+    },
     {
       "version": "0.1.0-alpha.773",
       "changes": [

package/deploy/unraid/README.txt

@@ -1331,6 +1331,21 @@ NODE
       ! docker container inspect ouro-butler-provider-readiness >/dev/null 2>&1 || return 1
       validate_sanctuary_roots "$READINESS_RUNTIME_ROOT" "$READINESS_AGENT_ROOT" || return $?
     }
+    verify_sanctuary_telegram_readiness() {
+      TELEGRAM_READINESS_IMAGE_ID=$1
+      validate_exact_image_id "$TELEGRAM_READINESS_IMAGE_ID" || return $?
+      TELEGRAM_READINESS_RUNTIME_ROOT=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli
+      TELEGRAM_READINESS_AGENT_ROOT=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro
+      ! docker container inspect ouro-butler-telegram-readiness >/dev/null 2>&1 || return 1
+      docker run --rm --pull=never --network host --name ouro-butler-telegram-readiness --user 10001:10001 \
+        --read-only --cap-drop ALL --security-opt no-new-privileges \
+        --mount "type=bind,src=$TELEGRAM_READINESS_RUNTIME_ROOT,dst=/home/ouro/.ouro-cli" \
+        --mount "type=bind,src=$TELEGRAM_READINESS_AGENT_ROOT,dst=/home/ouro/AgentBundles/sanctuary.ouro,readonly" \
+        --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh \
+        "$TELEGRAM_READINESS_IMAGE_ID" telegram-readiness >/dev/null || return $?
+      ! docker container inspect ouro-butler-telegram-readiness >/dev/null 2>&1 || return 1
+      validate_sanctuary_roots "$TELEGRAM_READINESS_RUNTIME_ROOT" "$TELEGRAM_READINESS_AGENT_ROOT" || return $?
+    }
     run_sanctuary_docker() {
       /usr/bin/timeout -s KILL 20 /usr/bin/docker "$@"
     }
@@ -1676,11 +1691,12 @@ Update:
     cleanup_event_asset_stage
     trap - EXIT
     if provision_sanctuary_sab_credential "$IMAGE_ID" \
-      && verify_sanctuary_sab_readiness "$IMAGE_ID"; then
+      && verify_sanctuary_sab_readiness "$IMAGE_ID" \
+      && verify_sanctuary_telegram_readiness "$IMAGE_ID"; then
       :
     else
-      SAB_READINESS_STATUS=$?
-      (exit "$SAB_READINESS_STATUS")
+      PRECUTOVER_READINESS_STATUS=$?
+      (exit "$PRECUTOVER_READINESS_STATUS")
     fi
   Guard the atomic autostart disable separately. If it fails, production has not
   been touched and the captured status is propagated:
@@ -1734,7 +1750,7 @@ ouro-butler-rollback
   readiness and autostart have passed, commit first durably renames the record;
   a kill then keeps target production in place and the next run validates its
   exact topology/readiness before finishing commit. Migration failure then enters the same exact container
-  rollback arm before staging starts:
+  rollback arm before target production starts:
     if docker stop ouro-butler \
       && remove_stopped_rollback_if_present "$ROLLBACK_IMAGE_ID" \
       && docker rename ouro-butler ouro-butler-rollback \
@@ -1778,52 +1794,13 @@ ouro-butler-rollback
   both recoveries revalidate, start, bounded-wait, atomically restore production-only
   autostart, and propagate the original failure. If neither exact container can
   be found, the failure propagates with Butler autostart disabled.
-  Put the entire post-rename staging phase in one explicit conditional so
-  `set -eu` cannot bypass rollback at the create, effective-audit, start, or
-  bounded-readiness boundary. Staging uses the exact image ID with no command,
-  environment, port, device, capability, privilege, or extra mount override.
-  A passing staging container is stopped and removed inside the same condition,
-  completing the poller handoff before production creation:
-    if docker create --name ouro-butler-staging --network host --restart unless-stopped --user 10001:10001 \
-      --mount "type=bind,src=/mnt/user/appdata/ouro-butler/runtime/.ouro-cli,dst=/home/ouro/.ouro-cli" \
-      --mount "type=bind,src=/mnt/user/appdata/ouro-butler/agent/sanctuary.ouro,dst=/home/ouro/AgentBundles/sanctuary.ouro" \
-      --mount "type=bind,src=/boot/config/custom/ouro-events/spool,dst=/run/ouro-events,readonly" \
-      "$IMAGE_ID" \
-      && audit_effective ouro-butler-staging "$IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID" \
-      && docker start ouro-butler-staging \
-      && assert_only_running_butler ouro-butler-staging \
-      && wait_butler_ready ouro-butler-staging \
-      && docker stop ouro-butler-staging \
-      && docker rm ouro-butler-staging \
-      && assert_only_running_butler -; then
-      :
-    else
-      STAGING_ACTIVATION_STATUS=$?
-      if docker container inspect ouro-butler-staging >/dev/null 2>&1; then
-        docker stop ouro-butler-staging >/dev/null 2>&1 || true
-        PARTIAL_STAGING_IMAGE_ID=$(docker inspect --format '{{.Image}}' ouro-butler-staging)
-        test "$PARTIAL_STAGING_IMAGE_ID" = "$IMAGE_ID"
-        docker rm --force ouro-butler-staging >/dev/null 2>&1 || true
-      fi
-      ! docker container inspect ouro-butler-staging >/dev/null 2>&1
-      CURRENT_ROLLBACK_IMAGE_ID=$(docker inspect --format '{{.Image}}' ouro-butler-rollback)
-      test "$CURRENT_ROLLBACK_IMAGE_ID" = "$ROLLBACK_IMAGE_ID"
-      migrate_sanctuary_package_managed_bundle "$IMAGE_ID" rollback
-      docker rename ouro-butler-rollback ouro-butler
-      assert_update_source "$ROLLBACK_IMAGE_ID" "$AUDIT_RUNNER_IMAGE_ID"
-      docker start ouro-butler
-      assert_only_running_butler ouro-butler
-      wait_butler_ready ouro-butler
-      enable_butler_autostart
-      migrate_sanctuary_package_managed_bundle "$IMAGE_ID" commit
-      (exit "$STAGING_ACTIVATION_STATUS")
-    fi
-  The failure arm safely handles staging that was never created, remains
-  stopped, is running, or exited: it force-removes any partial staging state,
-  verifies the name is absent, restores and revalidates the old production against
-  its exact pre-recorded image ID, starts and bounded-waits it, atomically
-  restores production-only autostart, and propagates the original failure.
-  At no point may production and staging run together against the same Telegram token.
+  Do not start a target-image daemon between the production rename and final
+  production activation. The exact-image static audit, SAB readiness, and
+  vault-backed Telegram identity check have already passed before autostart or
+  container mutation. Provider and complete daemon readiness are exercised only
+  by the transactional production activation below, whose failure arm restores
+  and revalidates the exact prior production. This prevents a disposable daemon
+  from reconciling or claiming live external-event state before cutover.
   Create and activate production from the same exact image ID and exact authority
   in one explicit conditional so `set -eu` cannot exit before rollback. Only a
   successful create, effective audit, start, stopped rollback assertion, and
@@ -2288,28 +2265,12 @@ Packaged Unit 16 acceptance execution:
   the config from the packaged fixed contract and requires byte-for-byte equality.
   Unit 16d-2 stops at the pre-model quarantine boundary: use a genuinely distinct private Telegram sender, confirm the fixed acknowledgement and owner admission card, and do not approve the contact during this scenario. The production-identical allow-to-one-turn continuation is covered by the Telegram admission integration suite when a second live account is unavailable. Unit 16h is acceptance-only: it exercises the delivery path against isolated state, restores exact health and cron bytes, and does not activate a production daily digest.
   The cursor snapshot is deliberately materialized and executed twice around the
-  live scenario. Telegram bootstrap reads the new bot token from host file
-  descriptor 3; callback injection reads the reviewed saved callback-update JSON
-  from the same descriptor. The launcher explicitly maps host fd 3 to Docker
-  stdin and then to in-container fd 3 only for those two commands. Neither value
-  belongs in argv, shell history, a config file, or an unrelated command's stdin.
-  Define this Bash helper in the root shell. It disables terminal echo while
-  reading the token, opens an anonymous descriptor for the launcher, and unsets
-  the short-lived shell value on either launcher success or failure:
-    run_unit16_telegram_bootstrap() {
-      local UNIT16_BOT_TOKEN UNIT16_BOT_STATUS
-      printf 'Telegram bot token: ' >&2
-      IFS= read -r -s UNIT16_BOT_TOKEN || return $?
-      printf '\n' >&2
-      if "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final telegram-bootstrap telegram-bootstrap.json \
-        3< <(printf '%s\n' "$UNIT16_BOT_TOKEN"); then
-        UNIT16_BOT_STATUS=0
-      else
-        UNIT16_BOT_STATUS=$?
-      fi
-      unset UNIT16_BOT_TOKEN
-      return "$UNIT16_BOT_STATUS"
-    }
+  live scenario. Telegram bootstrap refreshes the canonical agent vault
+  `runtime/config` and keeps the bot token inside the consuming harness process.
+  It never reads the retired container credential file or carries the token in a
+  descriptor, argument, environment variable, shell variable, config, evidence,
+  or output. Callback injection alone maps its reviewed saved callback-update
+  JSON from host fd 3 through Docker stdin to in-container fd 3.
   Stage the reviewed callback JSON at the fixed path below in the root-owned
   tmpfs inbox, then use this single fail-closed helper. It opens the input once,
   validates the opened descriptor and its original path refer to the same
@@ -2378,7 +2339,7 @@ Packaged Unit 16 acceptance execution:
       )
     }
     "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final materialize telegram-bootstrap
-    run_unit16_telegram_bootstrap
+    "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final telegram-bootstrap telegram-bootstrap.json
     "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final materialize cursor-snapshot before
     "$UNIT16_ROOT/sanctuary-unit16-run.sh" "$IMAGE_ID" --profile final cursor-snapshot cursor-snapshot.json
     # Perform the live scenario whose cursor movement is being measured.

package/deploy/unraid/sanctuary-acceptance-adapter.sh

@@ -6,6 +6,7 @@ VAULT_ENTRY='import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js
 REVOKED_ENTRY='import fs from "node:fs"; import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const result = await module.executeSanctuaryAcceptanceRevokedProbe(process.argv[1], process.argv[2], fs.readFileSync(3, "utf8")); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
 CALLBACK_ENTRY='import fs from "node:fs"; import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const result = await module.executeSanctuaryAcceptanceCallbackProbe(JSON.parse(fs.readFileSync(0, "utf8")), process.argv[1] === "replay"); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
 MATERIALIZE_ENTRY='import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const payload = { operation: "materialize_config", command: process.argv[1] }; if (process.argv[2]) payload.phase = process.argv[2]; const result = await module.executeSanctuaryAcceptanceAdapter(payload); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
+TELEGRAM_READINESS_ENTRY='import("/opt/ouro/dist/heart/daemon/sanctuary-acceptance-adapter.js").then(async (module) => { const result = await module.executeSanctuaryAcceptanceAdapter({ operation: "telegram_readiness" }); process.stdout.write(JSON.stringify(result)); }).catch(() => { process.exitCode = 1; });'
 
 if test "${1:-}" = vault-probe; then
   test "$#" -eq 3 || exit 2
@@ -29,6 +30,11 @@ if test "${1:-}" = materialize-config; then
   exec node --input-type=module -e "$MATERIALIZE_ENTRY" "$2" "${3:-}"
 fi
 
+if test "${1:-}" = telegram-readiness; then
+  test "$#" -eq 1 || exit 2
+  exec node --input-type=module -e "$TELEGRAM_READINESS_ENTRY"
+fi
+
 test "$#" -eq 0 || exit 2
 
 if test -e /proc/self/fd/3; then

package/deploy/unraid/sanctuary-acceptance-contract.json

@@ -29,7 +29,6 @@
   },
   "adapters": {
     "telegram-poller-quiescence": { "operation": "quiesce_telegram_poller", "authority": "fixed-managed-telegram-poller-stop-and-count", "modelReachable": false, "timeoutMs": 15000 },
-    "telegram-vault-store": { "operation": "store_telegram_bootstrap", "authority": "fixed-runtime-vault-merge", "modelReachable": false, "timeoutMs": 15000 },
     "cursor-snapshot": { "operation": "snapshot", "authority": "fixed-telegram-state-read", "modelReachable": false, "timeoutMs": 15000 },
     "callback-live": { "operation": "callback_playback_preflight|inject_callbacks_concurrently|inject_callback_replay", "authority": "fixed-live-telegram-callback-probe", "modelReachable": false, "timeoutMs": 15000 },
     "key-inventory": { "operation": "inventory_keys", "authority": "fixed-unraid-key-directory-read", "modelReachable": false, "timeoutMs": 15000 },
@@ -91,12 +90,10 @@
         "offsetPath": "/evidence/telegram-bootstrap-offset.json",
         "noncePath": "/evidence/telegram-bootstrap-nonce.txt",
         "pollerAdapter": "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh",
-        "vaultAdapter": "/opt/ouro/deploy/unraid/sanctuary-acceptance-adapter.sh",
         "deadlineMs": 600000,
         "pollTimeoutSeconds": 20
       },
-      "dynamic": ["expectedBotId:getMe.id", "expectedUsername:getMe.username", "currentOffset:fixed-cursor-read"],
-      "privateInputFd": 3
+      "dynamic": ["expectedBotId:getMe.id", "expectedUsername:getMe.username", "currentOffset:fixed-cursor-read"]
     },
     "cursor-snapshot": {
       "fixed": {

package/deploy/unraid/sanctuary-acceptance-harness.sh

@@ -17,7 +17,7 @@ elif test "$#" -gt 1; then
   exit 2
 fi
 
-if test -e /proc/self/fd/3; then
+if test "$COMMAND" = callback-inject && test -e /proc/self/fd/3; then
   exec node --input-type=module -e "$ENTRY" "$COMMAND" "$CONFIG_PATH" 3<&3
 fi
 exec node --input-type=module -e "$ENTRY" "$COMMAND" "$CONFIG_PATH"

package/deploy/unraid/sanctuary-unit16-run.sh

@@ -360,13 +360,13 @@ if test "$COMMAND" = cursor-snapshot; then
 fi
 materialize_config "$EXPECTED_CONFIG" "$SNAPSHOT_PHASE"
 cmp -s "$EXPECTED_CONFIG" "$CONFIG_PATH" || exit 1
-case "$COMMAND" in telegram-bootstrap|callback-inject) test -r /proc/self/fd/3 || exit 2 ;; esac
+case "$COMMAND" in callback-inject) test -r /proc/self/fd/3 || exit 2 ;; esac
 prepare_live_facts
 if test "$COMMAND" = telegram-bootstrap; then quiesce_production_telegram_poller; fi
 if test "$COMMAND" = unraid-key-rotate; then stop_exact_production_container; fi
 
 case "$COMMAND" in
-  telegram-bootstrap) TIME_LIMIT=900; NETWORK=host; INPUT=yes; BUNDLE_MODE=readonly; BROKER=no ;;
+  telegram-bootstrap) TIME_LIMIT=900; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=no ;;
   callback-inject) TIME_LIMIT=120; NETWORK=host; INPUT=yes; BUNDLE_MODE=rw; BROKER=no ;;
   unraid-key-rotate) TIME_LIMIT=600; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
   evidence-snapshot) TIME_LIMIT=4950; NETWORK=host; INPUT=no; BUNDLE_MODE=readonly; BROKER=yes ;;
@@ -424,7 +424,7 @@ fi
 run_harness() {
   if test "$BUNDLE_MODE" = rw; then BUNDLE_SUFFIX=; else BUNDLE_SUFFIX=,readonly; fi
   if test "$COMMAND" = telegram-bootstrap; then
-    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm -i --pull=never --network "$NETWORK" \
+    /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm --pull=never --network "$NETWORK" \
       --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \
       --mount "type=bind,src=$CONFIG_PATH,dst=/run/ouro-acceptance/config.json,readonly" \
       --mount "type=bind,src=$EVIDENCE_ROOT,dst=/evidence" \
@@ -437,9 +437,8 @@ run_harness() {
       --mount "type=bind,src=$HEALTH_FACT,dst=/run/ouro-acceptance/postboot-health.json,readonly" \
       --mount "type=bind,src=$CONTAINER_INSPECT_FACT,dst=/run/ouro-acceptance/container-inspect.json,readonly" \
       --mount "type=bind,src=/proc/sys/kernel/random/boot_id,dst=/run/ouro-acceptance/boot-id,readonly" \
-      --entrypoint /bin/sh "$IMAGE_ID" -ceu \
-      'exec 3<&0; exec /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh "$@" 3<&3' \
-      sanctuary-unit16 "$COMMAND" --config /run/ouro-acceptance/config.json <&3
+      --entrypoint /opt/ouro/deploy/unraid/sanctuary-acceptance-harness.sh "$IMAGE_ID" \
+      "$COMMAND" --config /run/ouro-acceptance/config.json
   elif test "$COMMAND" = callback-inject; then
     /usr/bin/timeout -s KILL "$TIME_LIMIT" /usr/bin/docker run --rm -i --pull=never --network "$NETWORK" \
       --user 10001:10001 --read-only --cap-drop ALL --security-opt no-new-privileges \

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.773",
+  "runtimeVersion": "0.1.0-alpha.774",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.773</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.774</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/cli-help.js

@@ -127,10 +127,10 @@ exports.COMMAND_REGISTRY = {
     },
     event: {
         category: "Tasks",
-        description: "Submit a verified external event to an owning agent and optionally wake its private runtime",
-        usage: "ouro event submit --agent <agent> --source <source> --type <event-type> --id <provider-id> [--summary <text>] [--evidence <path>] [--payload <path>] [--priority high|normal|low] [--no-wake]",
+        description: "Submit an external event or apply a reviewed receipt-repair manifest through the owning daemon",
+        usage: "ouro event submit --agent <agent> --source <source> --type <event-type> --id <provider-id> [--summary <text>] [--evidence <path>] [--payload <path>] [--priority high|normal|low] [--no-wake] | ouro event repair --manifest <path>",
         example: "ouro event submit --agent slugger --source app-store-connect --type feedback.created --id evt_123 --evidence /tmp/feedback",
-        subcommands: ["submit"],
+        subcommands: ["submit", "repair"],
     },
     poke: {
         category: "Tasks",

package/dist/heart/daemon/cli-parse.js

@@ -201,6 +201,11 @@ function parseMessageCommand(args) {
 }
 function parseEventCommand(args) {
     const sub = args[0];
+    if (sub === "repair") {
+        if (args.length !== 3 || args[1] !== "--manifest" || !args[2])
+            throw new Error(`Usage\n${usage()}`);
+        return { kind: "external.event.repair", manifestPath: args[2] };
+    }
     if (sub !== "submit")
         throw new Error(`Usage\n${usage()}`);
     let agent;

package/dist/heart/daemon/daemon.js

@@ -2014,6 +2014,26 @@ class OuroDaemon {
                     data: dispatched,
                 };
             }
+            case "external.event.repair": {
+                if (this.externalEventReconcileRunning)
+                    return { ok: false, error: "external event reconciliation is already active; repair made no changes" };
+                this.externalEventReconcileRunning = true;
+                try {
+                    try {
+                        const result = (0, router_1.repairExternalEventsFromManifest)(command.manifestPath, { root: this.externalEventRootPath() });
+                        return { ok: result.failed.length === 0, message: `external event repair applied=${result.applied.length} alreadyApplied=${result.alreadyApplied.length} failed=${result.failed.length} pending=${result.pending.length}`, data: result };
+                    }
+                    catch (error) {
+                        const message = (error instanceof Error ? error.message : /* v8 ignore next -- defensive: repair parser and filesystem dependencies throw Error instances @preserve */ String(error)).slice(0, 1_000);
+                        const result = { applied: [], alreadyApplied: [], failed: [{ identity: "<manifest>", error: message }], pending: [] };
+                        (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.external_event_repair", message: "rejected external event repair manifest", meta: { applied: 0, alreadyApplied: 0, failed: 1, pending: 0 } });
+                        return { ok: false, error: `external event repair rejected: ${message}`, data: result };
+                    }
+                }
+                finally {
+                    this.externalEventReconcileRunning = false;
+                }
+            }
             case "private.decisions": {
                 const requestedLimit = Number.isInteger(command.limit) && command.limit && command.limit > 0 ? command.limit : 20;
                 const limit = Math.min(requestedLimit, 1000);

package/dist/heart/daemon/sanctuary-acceptance-adapter.js

@@ -255,6 +255,7 @@ function createSanctuaryAcceptanceAdapterDependencies(secretFd = 3, options = {}
         interactiveRuntime: executeSanctuaryInteractiveRuntimeOperation,
         hostRequest: options.hostRequest ?? ((payload) => defaultHostRequest(payload, hostBrokerSocket, adapterTimeoutMs)),
         telegramCredentials: () => (0, telegram_1.loadTelegramSenseCredentials)(TARGET_ID),
+        createTelegramApi: telegram_client_1.createTelegramBotApi,
         readLiveGrounding: readIndependentSanctuaryGrounding,
         runProductionBoundaryProbe: runSanctuaryProductionBoundaryProbe,
     };
@@ -1827,12 +1828,6 @@ function exactKeys(value, keys, label) {
     if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify([...keys].sort()))
         throw new Error(`${label} shape is invalid`);
 }
-function positiveDecimal(value, label) {
-    const result = text(value, label);
-    if (!/^[1-9][0-9]*$/u.test(result))
-        throw new Error(`${label} is invalid`);
-    return result;
-}
 function sha256(value) {
     return (0, node_crypto_1.createHash)("sha256").update(value, "utf8").digest("hex");
 }
@@ -1845,18 +1840,6 @@ async function runtimeConfig(reader, label, ...args) {
         throw new Error(`${label} is unavailable`);
     return result.config;
 }
-async function storeTelegramBootstrap(payload, deps) {
-    const patch = {
-        telegramBotToken: text(payload.botToken, "Telegram bot credential"),
-        telegramAuthorizedUserId: positiveDecimal(payload.authorizedUserId, "Telegram authorized user"),
-        telegramAuthorizedChatId: positiveDecimal(payload.authorizedChatId, "Telegram authorized chat"),
-    };
-    const stored = await dependency(deps.mergeRuntime, "runtime vault writer")(TARGET_ID, patch);
-    if (!stored.ok || Object.entries(patch).some(([key, value]) => stored.config[key] !== value)) {
-        throw new Error("Telegram bootstrap vault readback failed");
-    }
-    return { stored: true };
-}
 function cursorSnapshot(payload, deps) {
     exactKeys(payload, ["allowGenesis", "operation", "schema"], "Telegram cursor snapshot request");
     if (payload.schema !== "telegram-cursor-v1" || typeof payload.allowGenesis !== "boolean")
@@ -2306,6 +2289,54 @@ function materializeConfig(payload, deps) {
     }
     return config;
 }
+async function telegramReadiness(payload, deps) {
+    exactKeys(payload, ["operation"], "Telegram readiness payload");
+    let refreshed;
+    try {
+        refreshed = await dependency(deps.refreshRuntime, "runtime credential refresher")(TARGET_ID);
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    }
+    if (!refreshed.ok)
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    let credentials;
+    try {
+        credentials = dependency(deps.telegramCredentials, "Telegram credentials")();
+        (0, telegram_1.telegramBotIdFromToken)(credentials.botToken);
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are invalid; actor: human-required; repair vault runtime/config");
+    }
+    let api;
+    try {
+        api = dependency(deps.createTelegramApi, "Telegram API factory")({ token: credentials.botToken });
+    }
+    catch {
+        throw new Error("Telegram client initialization failed; actor: agent-runnable; retry Telegram readiness");
+    }
+    let bot;
+    try {
+        bot = await api.request("getMe", {}, AbortSignal.timeout(30_000));
+    }
+    catch {
+        throw new Error("Telegram getMe failed; actor: agent-runnable; retry Telegram readiness");
+    }
+    finally {
+        try {
+            api.stop();
+        }
+        catch {
+            throw new Error("Telegram client cleanup failed; actor: agent-runnable; retry Telegram readiness");
+        }
+    }
+    if (!bot || typeof bot !== "object" || Array.isArray(bot)
+        || String(bot.id) !== "8541786263"
+        || bot.username !== "MendelowCloudButlerBot") {
+        throw new Error("Telegram bot identity mismatch; actor: human-required; repair vault runtime/config");
+    }
+    return { ready: true, identityMatches: true };
+}
 async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctuaryAcceptanceAdapterDependencies()) {
     const payload = object(rawPayload, "acceptance adapter payload");
     const operation = text(payload.operation, "operation");
@@ -2325,9 +2356,6 @@ async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctu
             case "revoked-key-auth-rejection":
                 result = await revokedKeyAuthRejection(payload, deps);
                 break;
-            case "store_telegram_bootstrap":
-                result = await storeTelegramBootstrap(payload, deps);
-                break;
             case "quiesce_telegram_poller":
                 result = telegramPollerQuiescence(payload, deps);
                 break;
@@ -2410,6 +2438,9 @@ async function executeSanctuaryAcceptanceAdapter(rawPayload, deps = createSanctu
             case "materialize_config":
                 result = materializeConfig(payload, deps);
                 break;
+            case "telegram_readiness":
+                result = await telegramReadiness(payload, deps);
+                break;
             default: throw new Error("unknown Sanctuary acceptance adapter operation");
         }
         (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_acceptance_adapter_end", message: "Sanctuary acceptance adapter completed", meta: { operation } });

package/dist/heart/daemon/sanctuary-acceptance-harness.js

@@ -45,6 +45,8 @@ const node_fs_1 = require("node:fs");
 const node_fs_2 = require("node:fs");
 const path = __importStar(require("node:path"));
 const runtime_1 = require("../../nerves/runtime");
+const telegram_1 = require("../../senses/telegram");
+const runtime_credentials_1 = require("../runtime-credentials");
 const MAX_ADAPTER_OUTPUT = 1_048_576;
 const DEFAULT_ADAPTER_TIMEOUT_MS = 240_000;
 const DEFAULT_TELEGRAM_TIMEOUT_MS = 10_000;
@@ -59,6 +61,9 @@ function createSanctuaryAcceptanceHarnessDependencies(secretFd = 3, options = {}
     const telegramTimeoutMs = options.telegramTimeoutMs ?? DEFAULT_TELEGRAM_TIMEOUT_MS;
     return {
         readSecret: () => (0, node_fs_1.readFileSync)(secretFd, "utf8"),
+        refreshRuntime: runtime_credentials_1.refreshRuntimeCredentialConfig,
+        mergeRuntime: runtime_credentials_1.mergeRuntimeCredentialConfig,
+        telegramCredentials: telegram_1.loadTelegramSenseCredentials,
         runAdapter: async (executable, payload, remainingMs) => {
             requireAbsoluteExecutable(executable);
             const result = (0, node_child_process_1.spawnSync)(executable, [], {
@@ -92,6 +97,25 @@ function createSanctuaryAcceptanceHarnessDependencies(secretFd = 3, options = {}
         telegramTimeoutMs,
     };
 }
+async function canonicalTelegramBootstrapToken(deps) {
+    let refreshed;
+    try {
+        refreshed = await deps.refreshRuntime("sanctuary");
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    }
+    if (!refreshed.ok)
+        throw new Error("Telegram runtime credentials are unavailable; actor: human-required; unlock or repair vault runtime/config");
+    try {
+        const token = deps.telegramCredentials("sanctuary").botToken.trim();
+        (0, telegram_1.telegramBotIdFromToken)(token);
+        return token;
+    }
+    catch {
+        throw new Error("Telegram runtime credentials are invalid; actor: human-required; repair vault runtime/config");
+    }
+}
 function object(value, label) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error(`${label} must be an object`);
@@ -322,6 +346,10 @@ async function telegramRequest(deps, token, method, body, requestTimeoutMs = dep
         throw new Error("Telegram request failed");
     return envelope.result;
 }
+function telegramBootstrapRequestError(method, error) {
+    const outcome = error instanceof Error && /timed out/iu.test(error.message) ? "timed out" : "failed";
+    return new Error(`Telegram ${method} ${outcome}; actor: agent-runnable; retry Telegram bootstrap`);
+}
 exports.SANCTUARY_UNIT_16_EVIDENCE_LABELS = [
     "unit-12c-1-opaque-identity",
     "unit-14b-3-opaque-identity-live",
@@ -871,10 +899,8 @@ async function telegramBootstrap(config, deps) {
     const noncePath = confinedPath(root, config.noncePath, "noncePath");
     refuseExistingCheckpoint(root, noncePath);
     const pollerAdapter = adapter(config.pollerAdapter, "pollerAdapter");
-    const vaultAdapter = adapter(config.vaultAdapter, "vaultAdapter");
-    if (pollerAdapter !== PACKAGED_PROVENANCE_ADAPTER || vaultAdapter !== PACKAGED_PROVENANCE_ADAPTER) {
+    if (pollerAdapter !== PACKAGED_PROVENANCE_ADAPTER)
         throw new Error("Telegram bootstrap requires the fixed packaged acceptance adapter");
-    }
     const deadlineMs = integer(config.deadlineMs, "deadlineMs", 300_000);
     if (deadlineMs > 900_000)
         throw new Error("Telegram bootstrap deadline exceeds 15 minutes");
@@ -882,11 +908,17 @@ async function telegramBootstrap(config, deps) {
     if (pollTimeoutSeconds > 50)
         throw new Error("Telegram poll timeout exceeds 50 seconds");
     const token = deps.readSecret().trim();
-    if (!token)
-        throw new Error("Telegram token descriptor is empty");
-    const bot = object(await telegramRequest(deps, token, "getMe"), "Telegram getMe result");
-    if (String(bot.id) !== expectedBotId || bot.username !== expectedUsername)
-        throw new Error("Telegram bot identity mismatch");
+    let getMe;
+    try {
+        getMe = await telegramRequest(deps, token, "getMe");
+    }
+    catch (error) {
+        throw telegramBootstrapRequestError("getMe", error);
+    }
+    const bot = object(getMe, "Telegram getMe result");
+    if (String(bot.id) !== expectedBotId || bot.username !== expectedUsername) {
+        throw new Error("Telegram bot identity mismatch; actor: human-required; repair vault runtime/config");
+    }
     const nonce = deps.randomBytes(16).toString("hex");
     const base = {
         schemaVersion: 1,
@@ -909,11 +941,17 @@ async function telegramBootstrap(config, deps) {
         let nextOffset = currentOffset;
         let match;
         while (deps.now() < deadline && !match) {
-            const updates = await telegramRequest(deps, token, "getUpdates", {
-                offset: nextOffset,
-                timeout: pollTimeoutSeconds,
-                allowed_updates: ["message"],
-            }, (pollTimeoutSeconds + 5) * 1_000);
+            let updates;
+            try {
+                updates = await telegramRequest(deps, token, "getUpdates", {
+                    offset: nextOffset,
+                    timeout: pollTimeoutSeconds,
+                    allowed_updates: ["message"],
+                }, (pollTimeoutSeconds + 5) * 1_000);
+            }
+            catch (error) {
+                throw telegramBootstrapRequestError("getUpdates", error);
+            }
             if (!Array.isArray(updates))
                 throw new Error("Telegram getUpdates result must be an array");
             const parsed = updates.map((entry) => object(entry, "Telegram update"));
@@ -952,14 +990,20 @@ async function telegramBootstrap(config, deps) {
             offsetDigest: digest(nextUpdateId),
         };
         replaceCheckpoint(root, evidencePath, confirmed);
-        const stored = object(await deps.runAdapter(vaultAdapter, {
-            operation: "store_telegram_bootstrap",
-            botToken: token,
-            authorizedUserId: userId,
-            authorizedChatId: chatId,
-        }), "vault adapter result");
-        if (stored.stored !== true)
-            throw new Error("Telegram vault adapter did not attest storage");
+        let stored;
+        try {
+            stored = await deps.mergeRuntime("sanctuary", {
+                telegramAuthorizedUserId: userId,
+                telegramAuthorizedChatId: chatId,
+            });
+        }
+        catch {
+            throw new Error("Telegram bootstrap vault update failed; actor: agent-runnable; retry Telegram bootstrap");
+        }
+        if (!stored.ok || stored.config.telegramBotToken !== token
+            || stored.config.telegramAuthorizedUserId !== userId || stored.config.telegramAuthorizedChatId !== chatId) {
+            throw new Error("Telegram bootstrap vault readback failed; actor: agent-runnable; retry Telegram bootstrap");
+        }
         replaceCheckpoint(root, evidencePath, { ...confirmed, phase: "vault_committed" });
         atomicPrivateJson(root, offsetPath, { nextUpdateId });
         replaceCheckpoint(root, evidencePath, { ...confirmed, phase: "complete", completedAt: deps.now() });
@@ -1779,9 +1823,11 @@ async function executeSanctuaryAcceptanceHarness(command, rawConfig, deps = crea
     try {
         const config = object(rawConfig, "acceptance config");
         switch (command) {
-            case "telegram-bootstrap":
-                await telegramBootstrap(config, deps);
+            case "telegram-bootstrap": {
+                const token = await canonicalTelegramBootstrapToken(deps);
+                await telegramBootstrap(config, { ...deps, readSecret: () => token });
                 break;
+            }
             case "cursor-snapshot":
                 await cursorSnapshot(config, deps);
                 break;

package/dist/heart/external-events/router.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getExternalEventRoot = getExternalEventRoot;
 exports.externalEventRecordPath = externalEventRecordPath;
 exports.readExternalEventRecord = readExternalEventRecord;
+exports.repairExternalEventsFromManifest = repairExternalEventsFromManifest;
 exports.listExternalEventStatus = listExternalEventStatus;
 exports.buildExternalEventMessage = buildExternalEventMessage;
 exports.recordExternalEvent = recordExternalEvent;
@@ -333,6 +334,200 @@ function readExternalEventRecord(recordPath) {
     }
     return parsed;
 }
+const MAX_REPAIR_MANIFEST_BYTES = 1024 * 1024;
+const MAX_REPAIR_ENTRIES = 512;
+const SHA256_HEX = /^[a-f0-9]{64}$/u;
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    return actual.length === expected.length && actual.every((key, index) => key === [...expected].sort()[index]);
+}
+function repairIdentity(entry) {
+    return `${entry.agent}/${entry.source}/${entry.eventId}`;
+}
+function repairedRecord(record, repairedAt) {
+    return {
+        ...record,
+        version: record.version + 1,
+        updatedAt: repairedAt,
+        failureProvenance: { class: "execution_lease_expired", failedAt: repairedAt },
+        recoveryGrant: undefined,
+    };
+}
+function recordBytes(record) {
+    return `${JSON.stringify(record, null, 2)}\n`;
+}
+function digestBytes(raw) {
+    return (0, node_crypto_1.createHash)("sha256").update(raw).digest("hex");
+}
+function parseRepairManifest(manifestPath) {
+    const descriptor = fs.openSync(manifestPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    let raw;
+    try {
+        const stat = fs.fstatSync(descriptor);
+        if (!stat.isFile() || stat.size > MAX_REPAIR_MANIFEST_BYTES)
+            throw new Error("External event repair manifest must be a bounded regular file");
+        raw = fs.readFileSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        throw new Error("External event repair manifest is invalid JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("External event repair manifest is invalid");
+    const value = parsed;
+    if (!hasExactKeys(value, ["schemaVersion", "repairedAt", "reason", "evidence", "requestedBy", "reviewedBy", "entries"])
+        || value.schemaVersion !== 1 || !canonicalIso(value.repairedAt)
+        || typeof value.reason !== "string" || value.reason.length < 1 || Buffer.byteLength(value.reason) > 2_000
+        || typeof value.requestedBy !== "string" || value.requestedBy.length < 1 || Buffer.byteLength(value.requestedBy) > 256
+        || typeof value.reviewedBy !== "string" || value.reviewedBy.length < 1 || Buffer.byteLength(value.reviewedBy) > 256
+        || value.requestedBy === value.reviewedBy
+        || !Array.isArray(value.evidence) || value.evidence.length < 1 || value.evidence.length > 32
+        || value.evidence.some((item) => typeof item !== "string" || item.length < 1 || Buffer.byteLength(item) > 1_000)
+        || !Array.isArray(value.entries) || value.entries.length < 1 || value.entries.length > MAX_REPAIR_ENTRIES)
+        throw new Error("External event repair manifest is invalid or unbounded");
+    const seen = new Set();
+    for (const candidate of value.entries) {
+        if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+            throw new Error("External event repair manifest entry is invalid");
+        const entry = candidate;
+        const identity = repairIdentity(entry);
+        if (!hasExactKeys(entry, ["agent", "source", "eventId", "preimageSha256", "postimageSha256", "version", "generation", "failureProvenance", "recoveryGrant"])
+            || !hasExactKeys(entry.failureProvenance ?? {}, ["class", "failedAt"])
+            || !hasExactKeys(entry.recoveryGrant ?? {}, ["generation", "consumedAt"])
+            || !entry.agent || !entry.source || !entry.eventId || entry.agent !== entry.agent.trim() || entry.source !== entry.source.trim() || entry.eventId !== entry.eventId.trim()
+            || Buffer.byteLength(entry.agent) > 160 || Buffer.byteLength(entry.source) > 160 || Buffer.byteLength(entry.eventId) > 160
+            || !SHA256_HEX.test(entry.preimageSha256) || !SHA256_HEX.test(entry.postimageSha256)
+            || entry.preimageSha256 === entry.postimageSha256
+            || !Number.isSafeInteger(entry.version) || entry.version < 1 || !Number.isSafeInteger(entry.generation) || entry.generation < 1
+            || entry.failureProvenance?.class !== "provider_lane_unavailable" || !canonicalIso(entry.failureProvenance.failedAt)
+            || entry.recoveryGrant?.generation !== entry.generation || !canonicalIso(entry.recoveryGrant.consumedAt))
+            throw new Error(`External event repair entry is invalid for ${identity}`);
+        if (seen.has(identity))
+            throw new Error(`External event repair manifest has duplicate identity ${identity}`);
+        seen.add(identity);
+    }
+    return value;
+}
+function assertRepairRecordPath(root, entry) {
+    const resolvedRoot = path.resolve(root);
+    const recordPath = externalEventRecordPath(resolvedRoot, entry);
+    const relative = path.relative(resolvedRoot, path.resolve(recordPath));
+    /* v8 ignore next -- defense in depth: safePathSegment cannot emit traversal @preserve */
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        throw new Error(`External event repair path escapes its root for ${repairIdentity(entry)}`);
+    for (let candidate = resolvedRoot;; candidate = path.dirname(candidate)) {
+        const stat = fs.lstatSync(candidate);
+        if (stat.isSymbolicLink())
+            throw new Error(`External event repair refuses symlink root for ${repairIdentity(entry)}`);
+        if (candidate === path.dirname(candidate))
+            break;
+    }
+    const expected = [
+        [resolvedRoot, "directory"],
+        [path.join(resolvedRoot, safePathSegment(entry.agent)), "directory"],
+        [path.join(resolvedRoot, safePathSegment(entry.agent), safePathSegment(entry.source)), "directory"],
+        [recordPath, "file"],
+    ];
+    for (const [candidate, kind] of expected) {
+        const stat = fs.lstatSync(candidate);
+        if (stat.isSymbolicLink())
+            throw new Error(`External event repair refuses symlink path for ${repairIdentity(entry)}`);
+        if ((kind === "directory" && !stat.isDirectory()) || (kind === "file" && !stat.isFile()))
+            throw new Error(`External event repair path shape is invalid for ${repairIdentity(entry)}`);
+    }
+    return recordPath;
+}
+function assertRepairPostimage(record, entry, repairedAt) {
+    if (record.agent !== entry.agent || record.source !== entry.source || record.eventId !== entry.eventId
+        || record.version !== entry.version + 1 || record.generation !== entry.generation
+        || record.executionState !== "dead_letter"
+        || record.failureProvenance?.class !== "execution_lease_expired" || record.failureProvenance.failedAt !== repairedAt
+        || record.recoveryGrant !== undefined)
+        throw new Error(`External event repair postimage is invalid for ${repairIdentity(entry)}`);
+}
+function emitRepairResult(result) {
+    (0, runtime_1.emitNervesEvent)({
+        ...(result.failed.length > 0 ? { level: "error" } : {}),
+        component: "daemon",
+        event: "daemon.external_event_repair",
+        message: "processed reviewed external event repair manifest",
+        meta: { applied: result.applied.length, alreadyApplied: result.alreadyApplied.length, failed: result.failed.length, pending: result.pending.length },
+    });
+    return result;
+}
+function repairExternalEventsFromManifest(manifestPath, options) {
+    const manifest = parseRepairManifest(manifestPath);
+    const root = options.root;
+    const prepared = [];
+    const result = { applied: [], alreadyApplied: [], failed: [], pending: [] };
+    for (const entry of manifest.entries) {
+        const identity = repairIdentity(entry);
+        try {
+            const recordPath = assertRepairRecordPath(root, entry);
+            const raw = fs.readFileSync(recordPath);
+            const digest = digestBytes(raw);
+            const record = readExternalEventRecord(recordPath);
+            if (digest === entry.postimageSha256) {
+                assertRepairPostimage(record, entry, manifest.repairedAt);
+                prepared.push({ entry, recordPath, state: "post" });
+                result.alreadyApplied.push(identity);
+                continue;
+            }
+            if (digest !== entry.preimageSha256)
+                throw new Error(`External event repair preimage conflict for ${identity}`);
+            if (record.agent !== entry.agent || record.source !== entry.source || record.eventId !== entry.eventId
+                || record.version !== entry.version || record.generation !== entry.generation
+                || record.failureProvenance?.class !== entry.failureProvenance.class || record.failureProvenance.failedAt !== entry.failureProvenance.failedAt
+                || record.recoveryGrant?.generation !== entry.recoveryGrant.generation || record.recoveryGrant.consumedAt !== entry.recoveryGrant.consumedAt
+                || record.executionState !== "dead_letter"
+                || digestBytes(recordBytes(repairedRecord(record, manifest.repairedAt))) !== entry.postimageSha256)
+                throw new Error(`External event repair preimage is unauthorized for ${identity}`);
+            prepared.push({ entry, recordPath, state: "pre" });
+        }
+        catch (error) {
+            result.failed.push({ identity, error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: validation and filesystem dependencies throw Error instances @preserve */ String(error) });
+        }
+    }
+    if (result.failed.length > 0) {
+        result.pending.push(...prepared.filter(({ state }) => state === "pre").map(({ entry }) => repairIdentity(entry)));
+        return emitRepairResult(result);
+    }
+    for (let index = 0; index < prepared.length; index += 1) {
+        const item = prepared[index];
+        const identity = repairIdentity(item.entry);
+        if (item.state === "post")
+            continue;
+        try {
+            withRecordLock(item.recordPath, () => {
+                assertRepairRecordPath(root, item.entry);
+                const raw = fs.readFileSync(item.recordPath);
+                const digest = digestBytes(raw);
+                if (digest === item.entry.postimageSha256) {
+                    assertRepairPostimage(readExternalEventRecord(item.recordPath), item.entry, manifest.repairedAt);
+                    result.alreadyApplied.push(identity);
+                    return;
+                }
+                if (digest !== item.entry.preimageSha256)
+                    throw new Error("record advanced after prevalidation");
+                const record = readExternalEventRecord(item.recordPath);
+                atomicWrite(item.recordPath, repairedRecord(record, manifest.repairedAt));
+                result.applied.push(identity);
+            });
+        }
+        catch (error) {
+            result.failed.push({ identity, error: error instanceof Error ? error.message : /* v8 ignore next -- defensive: validation and filesystem dependencies throw Error instances @preserve */ String(error) });
+            result.pending.push(...prepared.slice(index + 1).map(({ entry }) => repairIdentity(entry)));
+            break;
+        }
+    }
+    return emitRepairResult(result);
+}
 function listExternalEventStatus(root) {
     if (!fs.existsSync(root))
         return [];
@@ -1160,7 +1355,15 @@ function reconcileExternalEvent(recordPath, options = {}) {
             return record;
         const maxAttempts = options.maxAttempts ?? 5;
         const baseDelayMs = options.baseDelayMs ?? 1_000;
-        return commitMutation(recordPath, retryState(record, now, maxAttempts, baseDelayMs, "execution lease expired", "execution_lease_expired"), now);
+        const retried = retryState(record, now, maxAttempts, baseDelayMs, "execution lease expired", "execution_lease_expired");
+        const consumedProviderRecoveryExpired = retried.executionState === "dead_letter"
+            && record.failureProvenance?.class === "provider_lane_unavailable"
+            && record.recoveryGrant?.generation === record.generation;
+        return commitMutation(recordPath, consumedProviderRecoveryExpired ? {
+            ...retried,
+            failureProvenance: { class: "execution_lease_expired", failedAt: now },
+            recoveryGrant: undefined,
+        } : retried, now);
     });
 }
 function advanceExternalEventFromAwait(recordPath, input) {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.773",
+  "version": "0.1.0-alpha.774",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ouro.bot/cli",
-      "version": "0.1.0-alpha.773",
+      "version": "0.1.0-alpha.774",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.78.0",
         "@azure/identity": "^4.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.773",
+  "version": "0.1.0-alpha.774",
   "engines": {
     "node": ">=22"
   },