@sayknow-cli/coding-agent 0.4.7 → 0.5.0

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -4,11 +4,13 @@ import type { DaemonRuntimeInfo } from "../../daemon/control-types";
 import { HEARTBEAT_TTL_MS } from "./daemon-paths";
 import { type DaemonTransitionLock, type NotificationEndpointFile, type NotificationEndpointFileIdentity, type NotificationExactUnlinkResult } from "./notification-service";
 import { type DaemonProcessReference } from "./telegram-daemon-control";
-export { DAEMON_GENERATION, NOTIFICATION_PROTOCOL_VERSION } from "./telegram-daemon-contract";
+import { type TelegramSetupPreflight } from "./telegram-setup";
+export { DAEMON_GENERATION, NOTIFICATION_PROTOCOL_VERSION, SERVING_EPOCH } from "./telegram-daemon-contract";
 import { type ControlServerLike, type LifecycleControlServerFactory } from "./lifecycle-control-runtime";
 import type { OrchestratorDeps } from "./lifecycle-orchestrator";
-import { NotificationOperatorRuntime, OperatorBackoffPolicy } from "./operator-runtime";
+import { NotificationOperatorRuntime } from "./operator-runtime";
 import { type AliasTable, type CallbackRoute } from "./telegram-reference";
+import { type TopicEndpointBinding } from "./topic-registry";
 export type EnsureDaemonResult = "owner_spawned" | "attached" | "disabled" | "blocked";
 /** Detailed result for orchestration that must distinguish a #2028 handoff from a fresh spawn. */
 export type EnsureTelegramDaemonDetailedResult = "spawned" | "reloaded" | "attached" | "disabled" | "blocked_identity";
@@ -39,6 +41,8 @@ export interface DaemonState {
      * notification wire protocol version. Absent on pre-generation state.
      */
     generation?: number;
+    /** Lifecycle-serving compatibility epoch; absent pre-epoch records are epoch 1. */
+    servingEpoch?: number;
     stoppedAt?: number;
 }
 export interface TelegramDaemonFs {
@@ -54,6 +58,10 @@ export interface TelegramDaemonFs {
     chmod(path: string, mode: number): Promise<void>;
     stat?(path: string): Promise<{
         mtimeMs: number;
+        size?: number;
+        dev?: number;
+        ino?: number;
+        ctimeMs?: number;
     }>;
     readEndpointFile?(path: string): Promise<NotificationEndpointFile>;
     exactUnlink?(path: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
@@ -99,8 +107,25 @@ export declare const CLIENT_PING_PONG_CAPABILITY = "client_ping_pong";
 /** Capability required for typed controls and semantic Selected acknowledgement frames. */
 export declare const ASK_SELECTED_ACK_CAPABILITY = "ask_selected_ack_v1";
 export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
-/** Capability required for tool lifecycle and reasoning-summary frames. */
-export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
+/** Capability for the closed tool phase set: started, completed, failed, and cancelled. */
+export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Receive-only compatibility capability for pre-v2 hosts. */
+export declare const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
+/**
+ * File-lock options whose acquisition budget covers the full reload-reservation
+ * critical section: the in-lock freshness poll plus the controller's
+ * graceful+kill+readiness sequence, with headroom. A contender must be able to
+ * wait out a legitimate slow reload and then attach, never fail startup.
+ */
+export declare function reloadReservationLockOptions(input: {
+    freshnessWaitMs: number;
+    readinessTimeoutMs: number;
+    retryDelayMs?: number;
+}): {
+    staleMs: number;
+    retries: number;
+    retryDelayMs: number;
+};
 export declare const BTW_QUESTION_MAX_UNICODE_SCALARS = 4096;
 export declare const BTW_QUESTION_MAX_UTF8_BYTES = 16384;
 export declare function endpointAuthorityDigest(url: string, token: string, connectionIdentity?: string): string;
@@ -136,12 +161,22 @@ type LegacyOwnershipLockMetadata = {
     incarnation?: string;
     startedAt: number;
 };
+type V010OwnershipLockMetadata = {
+    size: 0;
+    mtimeMs?: number;
+    dev?: number;
+    ino?: number;
+    ctimeMs?: number;
+};
 type OwnershipLockRead = {
     kind: "missing";
 } | {
     kind: "malformed";
     raw: string;
     mtimeMs?: number;
+} | {
+    kind: "v010";
+    metadata: V010OwnershipLockMetadata;
 } | {
     kind: "legacy";
     metadata: LegacyOwnershipLockMetadata;
@@ -170,15 +205,59 @@ export declare function liveOwnershipLockDecision(input: {
     attached: false;
     provisional: true;
 } | undefined;
+type OwnerHeartbeatSidecar = {
+    pid: number;
+    incarnation: string;
+    ownerId: string;
+    acquisitionId: string;
+    heartbeatAt: number;
+};
+export interface OwnerFreshnessSnapshot {
+    ownerTag: Pick<OwnerHeartbeatSidecar, "pid" | "incarnation" | "ownerId" | "acquisitionId"> | null;
+    effectiveHeartbeatAt: number | undefined;
+    legacyEmbedded: boolean;
+    state: DaemonState | undefined;
+}
+export declare function readOwnerFreshnessSnapshot(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+}): Promise<OwnerFreshnessSnapshot>;
+/** Marker-free steady heartbeat renewal. The final lock reread fences a stale writer. */
+export declare function renewOwnerHeartbeatSidecar(input: {
+    settings: Settings;
+    ownerId: string;
+    acquisitionId?: string;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    pid?: number;
+    pidIncarnation?: (pid: number) => string | undefined;
+}): Promise<boolean>;
+export interface NotificationRootRegistration {
+    root?: string;
+    managed?: boolean;
+    token?: string;
+}
+export declare function readNotificationRootRegistration(input: {
+    settings: Settings;
+    sessionId: string;
+    fs?: TelegramDaemonFs;
+}): Promise<NotificationRootRegistration>;
+export interface RegisterNotificationRootResult {
+    root: string;
+    /** Per-registration ownership token fencing a stale same-session cleanup from deleting a live replacement registration. */
+    token: string;
+}
 export declare function registerNotificationRoot(input: {
     settings: Settings;
     cwd: string;
     sessionId: string;
     fs?: TelegramDaemonFs;
-}): Promise<string>;
+}): Promise<RegisterNotificationRootResult>;
 export interface UnregisterNotificationRootResult {
     root: string;
     remainingRoots: number;
+    /** Opaque fingerprint of the exact registry written by this successful unregister. */
+    registryFingerprint?: string;
 }
 /** Remove one session's Telegram scan root without disturbing other live session roots. */
 export declare function unregisterNotificationRoot(input: {
@@ -186,8 +265,94 @@ export declare function unregisterNotificationRoot(input: {
     cwd: string;
     sessionId: string;
     fs?: TelegramDaemonFs;
+    /** Ownership token minted by this runtime's own registration; a stale cleanup presenting an older token never deletes a replacement registration. */
+    registrationToken?: string;
 }): Promise<UnregisterNotificationRootResult>;
+/** Run an action while the roots registry lock excludes any registration or unregister. */
+export declare function withNotificationRootRegistryFence(input: {
+    settings: Settings;
+    registryFingerprint: string;
+    action: () => Promise<void>;
+    fs?: TelegramDaemonFs;
+}): Promise<boolean>;
+/**
+ * Leak artifact prefixes left when native exact-unlink cleanup is retained
+ * (#2956). Nothing previously reaped these; they accumulate in the notifications
+ * directory across ownership transitions.
+ */
+export declare const NOTIFICATION_LEAK_ARTIFACT_PREFIXES: readonly [".skc-delete-daemon-transition-", ".skc-exact-unlink-placeholder-", ".skc-delete-notification-endpoint-"];
+/** Grace window before a leak artifact is reaped (covers in-flight unlinks). */
+export declare const NOTIFICATION_LEAK_ARTIFACT_GRACE_MS: number;
+/** True when a path is permanently gone (not a transient I/O blip). */
+export declare function isPermanentMissingPathError(error: unknown): boolean;
+export declare function isNotificationLeakArtifactName(name: string): boolean;
+/**
+ * Drop permanently missing scan roots from the durable registry under the roots
+ * lock. Session map entries that pointed only at those roots are removed too.
+ */
+export declare function pruneMissingNotificationRoots(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    /** When set, only these roots are considered; otherwise every registered root is probed. */
+    candidates?: readonly string[];
+}): Promise<{
+    pruned: string[];
+    remaining: number;
+}>;
+/**
+ * Reap retained exact-unlink / ownership-transition quarantine files older than
+ * the grace window from the notifications directory.
+ */
+export declare function reapStaleNotificationArtifacts(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    graceMs?: number;
+}): Promise<{
+    removed: string[];
+    skipped: number;
+}>;
+/**
+ * Startup / ownership self-heal: prune dead roots and reap leak artifacts so
+ * `skc daemon reload` recovers a degraded install without manual surgery (#2956).
+ */
+export declare function healTelegramDaemonNotificationState(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    graceMs?: number;
+}): Promise<{
+    prunedRoots: string[];
+    removedArtifacts: string[];
+}>;
 export declare function hasSafeDaemonStateShape(state: unknown): state is DaemonState;
+type ParentDaemonStateBase = Omit<DaemonState, "incarnation" | "acquisitionId" | "ownershipPhase" | "generation" | "launcherPid"> & {
+    incarnation?: undefined;
+    acquisitionId?: undefined;
+    ownershipPhase?: undefined;
+    generation?: unknown;
+    launcherPid?: undefined;
+};
+type GenerationAbsentParentDaemonState = Omit<ParentDaemonStateBase, "generation"> & {
+    generation?: undefined;
+};
+type Generation3ReleaseDaemonState = Omit<ParentDaemonStateBase, "generation"> & {
+    generation: 3;
+};
+export type LegacyParentDaemonState = GenerationAbsentParentDaemonState | Generation3ReleaseDaemonState;
+export interface AttestedLegacyDaemonOwner {
+    state: LegacyParentDaemonState;
+    incarnation: string;
+}
+/** Revalidate the exact two-observation legacy proof immediately before signaling. */
+export declare function readAttestedLegacyDaemonOwner(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    pidIncarnation?: (pid: number) => string | undefined;
+    tokenFingerprint: string;
+    chatId: string;
+}): Promise<AttestedLegacyDaemonOwner | undefined>;
 /** True for a physically live owner with this configuration, including legacy generations. */
 export declare function isPhysicalMatchingOwner(input: {
     state: DaemonState | undefined;
@@ -196,7 +361,7 @@ export declare function isPhysicalMatchingOwner(input: {
     pidAlive: (pid: number) => boolean;
     pidIncarnation?: (pid: number) => string | undefined;
 }): boolean;
-/** True only for a signalable legacy owner or this generation's ready bound child. */
+/** True only for a fully-provenanced modern owner outside the generation-3 parent schema. */
 export declare function isSignalableMatchingOwner(input: {
     state: DaemonState | undefined;
     tokenFingerprint: string;
@@ -211,6 +376,7 @@ export declare function isFreshLiveOwner(input: {
     chatId: string;
     pidAlive: (pid: number) => boolean;
     pidIncarnation?: (pid: number) => string | undefined;
+    effectiveHeartbeatAt?: number;
 }): boolean;
 /** True only when a physically live matching owner can serve this build's daemon lifecycle contract. */
 export declare function isCurrentCompatibleOwner(input: {
@@ -220,6 +386,7 @@ export declare function isCurrentCompatibleOwner(input: {
     chatId: string;
     pidAlive: (pid: number) => boolean;
     pidIncarnation?: (pid: number) => string | undefined;
+    effectiveHeartbeatAt?: number;
 }): boolean;
 export declare function acquireDaemonOwnership(input: {
     settings: Settings;
@@ -245,6 +412,7 @@ export declare function acquireDaemonOwnership(input: {
     provisional?: boolean;
     reason?: "identity_mismatch";
     reloadRequired?: boolean;
+    legacyReloadRequired?: boolean;
 }>;
 export declare function renewDaemonHeartbeat(input: {
     settings: Settings;
@@ -290,7 +458,7 @@ export declare function retireProvisionalDaemonOwnership(input: {
     /** Only no-child confirmation may retire a ready-like launcher publication. */
     allowReadyWithoutChildPid?: boolean;
 }): Promise<boolean>;
-/** Wait for a matching current-generation daemon to publish a ready state. */
+/** Wait for a matching compatible owner to publish a ready state. Readiness is serving-epoch gated (same-epoch cross-generation owners attach, per isCurrentCompatibleOwner); generation is inventory-only here. Mutation paths still require exact current-generation equality. */
 export declare function waitForTelegramDaemonReady(input: {
     settings: Settings;
     ownerId?: string;
@@ -321,6 +489,8 @@ export declare function confirmTelegramDaemonSpawn(input: {
     sleep?: (ms: number) => Promise<void>;
     waitStepMs?: number;
     timeoutMs?: number;
+    /** Retain an unproven no-PID child lease during a successor handoff. */
+    preserveOnUnprovenChildExit?: boolean;
 }): Promise<boolean>;
 export declare function releaseDaemonOwnership(input: {
     settings: Settings;
@@ -338,6 +508,22 @@ export declare function releaseDaemonOwnership(input: {
 export declare function readDaemonState(settings: Pick<Settings, "getAgentDir">, fs?: TelegramDaemonFs): Promise<DaemonState | undefined>;
 /** Read the persisted notification roots list. */
 export declare function readDaemonRoots(settings: Pick<Settings, "getAgentDir">, fs?: TelegramDaemonFs): Promise<string[]>;
+/** Injectable readers for {@link resolveTelegramSetupPreflight}, defaulting to the real OS/state probes. */
+export interface ResolveTelegramSetupPreflightDeps {
+    readDaemonState?: (settings: Settings) => Promise<DaemonState | undefined>;
+    pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
+}
+/**
+ * Build the Telegram setup preflight from persisted daemon state. The daemon is
+ * reported live ONLY when its PID is alive AND its current process incarnation
+ * still matches the persisted incarnation. Skipping the incarnation check makes
+ * a stale state file whose PID has been recycled by an unrelated process
+ * masquerade as a live owner, which wrongly blocks discovery pairing. Both the
+ * `notify setup` CLI and the /settings Notifications tab share this resolver so
+ * pairing behaves identically on both surfaces.
+ */
+export declare function resolveTelegramSetupPreflight(settings: Settings, deps?: ResolveTelegramSetupPreflightDeps): Promise<TelegramSetupPreflight>;
 export interface TelegramSpawnOwnerInput {
     settings: Settings;
     roots?: string[];
@@ -362,6 +548,7 @@ export type TelegramSpawnOwnerResult = {
     runtime: DaemonRuntimeInfo;
     warnings: string[];
     reloadRequired?: boolean;
+    legacyReloadRequired?: boolean;
 } | {
     result: "blocked";
     runtime: DaemonRuntimeInfo;
@@ -389,6 +576,29 @@ export declare function buildTelegramDaemonSpawnArgs(input: {
  * already-persisted roots.
  */
 export declare function spawnTelegramDaemonOwner(input: TelegramSpawnOwnerInput, deps?: TelegramDaemonDeps): Promise<TelegramSpawnOwnerResult>;
+/**
+ * Owner-bound reclamation of a confirmed-dead daemon owner, mirroring the
+ * daemon step of `skc notify recovery`. It returns a structured, actionable
+ * result and removes only identity-verified dead-owner artifacts while holding
+ * the transition fence; live, successor, unknown, or unreadable evidence is
+ * retained.
+ */
+export type DeadOwnerRecoveryResult = {
+    recovered: true;
+    reason: "cleared";
+} | {
+    recovered: false;
+    reason: "not-confirmed-dead" | "unsafe-lock" | "transition-contended" | "owner-superseded" | "unsafe-endpoint" | "endpoint-changed" | "endpoint-directory-unreadable" | "lock-changed";
+};
+/** Preflight cleanup for a confirmed-dead owner, with identity-bound removal. */
+export declare function reclaimDeadDaemonOwner(input: {
+    settings: Settings;
+    endpointDir?: string;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
+}): Promise<DeadOwnerRecoveryResult>;
 /**
  * Ensure a configured daemon owns this session root, preserving ownership safety
  * while exposing whether a #2028 generation handoff was required.
@@ -397,6 +607,9 @@ export declare function ensureTelegramDaemonRunningDetailed(input: {
     settings: Settings;
     cwd: string;
     sessionId: string;
+    registerRoot?: boolean;
+    /** Receives each registration this ensure operation minted so the caller can fence its own later cleanup. */
+    onRegistered?: (registration: RegisterNotificationRootResult) => void;
 }, deps?: TelegramDaemonDeps): Promise<EnsureTelegramDaemonDetailedResult>;
 /**
  * Legacy compatibility mapping for callers that only distinguish ownership from
@@ -449,7 +662,10 @@ export type TelegramPollResult = {
 export interface TelegramUpdatePollerOptions {
     botApi: BotApi;
     runtime: NotificationOperatorRuntime;
-    backoff: OperatorBackoffPolicy;
+    backoff: {
+        next(): number;
+        reset(): void;
+    };
     processUpdate: (update: unknown) => Promise<TelegramUpdateOutcome>;
     health?: TelegramPollHealth;
 }
@@ -469,6 +685,11 @@ export declare class TelegramEventDispatchState {
     readonly busy: Set<string>;
     readonly inboundReactions: Map<number, {
         messageId: number;
+        socketLease?: {
+            session: SessionSocket;
+            token: number;
+            logicalSessionId: string;
+        };
     }>;
     readonly seenUpdateIds: Set<number>;
 }
@@ -533,7 +754,7 @@ export interface TelegramDaemonOptions {
     richDraft?: {
         enabled: boolean;
     };
-    /** Tool start/completion messages (enabled by default). */
+    /** Tool start/completion messages (off by default; explicit opt-in only). */
     toolActivity?: {
         enabled: boolean;
     };
@@ -551,11 +772,15 @@ interface SessionSocket {
     sessionId: string;
     /** Current logical session carried by valid threaded frames on this transport. */
     logicalSessionId: string;
+    /** Endpoint metadata proved this logical id belongs to this discovery record. */
+    logicalSessionIdTrusted: boolean;
     token: string;
     endpointKey: string;
     endpointDigest: string;
     hostGeneration: number;
     ws: WebSocket;
+    /** Timestamp (via opts.now) at which this socket began connecting. */
+    connectingSince: number;
     pending: Map<string, {
         sessionId: string;
         actionId: string;
@@ -563,6 +788,8 @@ interface SessionSocket {
     /** True once the server advertised the `client_ping_pong` capability. */
     capable: boolean;
     ephemeralCapable: boolean;
+    /** Tool activity contract advertised by the connected host. */
+    toolActivityCapability?: "v1" | "v2";
     /** Timestamp (via opts.now) of the last received pong; seeds the TTL window. */
     lastPongAt: number;
     /** Nonce of the most recent in-flight ping, if any. */
@@ -574,6 +801,13 @@ interface SessionSocket {
     /** Queues live frames until startup replay is applied. */
     replayPending: boolean;
     replayQueue: Record<string, unknown>[];
+    /** Trusted recovery may not route until its durable endpoint lease is committed. */
+    recoveryLease?: {
+        state: "pending" | "authorized" | "rejected";
+        logicalSessionId: string;
+        binding: TopicEndpointBinding;
+        token: number;
+    };
 }
 export declare class TelegramNotificationDaemon {
     #private;
@@ -585,6 +819,9 @@ export declare class TelegramNotificationDaemon {
     /** Endpoint-bound ownership for visible or dispatching tool bubbles. */
     private readonly toolActivityOwners;
     private readonly revokedToolEndpoints;
+    /** Exact settlement of each admitted legacy-v1 start; retained only while visible. */
+    private readonly legacyToolStarts;
+    private nextLegacyToolStartId;
     private readonly unresolvedToolTerminalizations;
     private toolTerminalizationChain;
     private toolActivityPolicyEpoch;
@@ -598,28 +835,46 @@ export declare class TelegramNotificationDaemon {
     private readonly pollConflictBackoff;
     private readonly loopBackoff;
     private running;
+    /** Once set, a concurrent startup await can never restore a running daemon. */
+    private stopRequested;
     private readonly fsImpl;
     private readonly botApi;
     private readonly effects;
     private readonly topics;
     /** Serializes registry snapshots so an older atomic write cannot overwrite newer rename state. */
+    /** Legacy sockets have no durable token, so explicit teardown is their revocation fence. */
+    private readonly droppedSessions;
     private topicsPersistQueue;
+    /** Serializes recovery compare/write/publish claims so competing endpoint migrations cannot durably diverge. */
+    private recoveryBindingClaimQueue;
+    /** Durable compensation fences retry under supervision until persistence succeeds. */
+    private readonly compensationFenceRetries;
     /** Daemon edit attempts that can race an accepted user service message. */
     private readonly daemonRenameAttempts;
     private readonly selectedAckPending;
     private readonly pool;
     private readonly poller;
     private readonly dispatchState;
+    /** Bot-wide flood-control window; inbound polling remains eligible during it. */
+    private botCooldownUntil;
+    private warnedBotCooldownUntil;
     /** Original markdown of rich messages we sent (chat+message_id), for restoring reply context on inbound replies. */
     private readonly replyStore;
     /** Per-session debounce + monotonic draft-id state for opt-in draft streaming. */
     private readonly draftStream;
     /** Identity-bearing sessions by repo/branch surface, used to avoid transient duplicate topics. */
     private readonly topicOwnerByIdentity;
+    /** Ephemeral legacy topic owners retained across a same-socket config rekey. */
+    private readonly legacyTopicOwners;
+    /** Preserved initiator topics must not route through a rekeyed transport. */
+    private readonly preservedInitiatorTopics;
     /** Non-identity frames held until identity creates the correct thread. */
     private readonly pendingThreadedFrames;
-    /** Endpoint generation tombstones for sessions that already sent session_closed. */
+    /** Durable endpoint leases for sessions that already sent an authorized session_closed. */
     private readonly closedEndpointKeys;
+    /** Exactly one authorized transport may route each recovered logical session. */
+    private readonly logicalSessionOwners;
+    private nextSocketLeaseToken;
     /** True once the daemon has nudged the user to enable Threaded Mode. */
     private threadedFallbackNoticeSent;
     /** Sessions whose identity header was already sent flat (Threaded Mode off). */
@@ -689,6 +944,9 @@ export declare class TelegramNotificationDaemon {
     private refreshBotIdentity;
     /** Map a lifecycle response/error to a user-facing message (G010 surfacing). */
     private formatLifecycleResponse;
+    private callBotApi;
+    private readonly callBotApiClassified;
+    private botApiWithOutcomeCollector;
     constructor(opts: TelegramDaemonOptions);
     private createSessionRouter;
     loadAliases(): Promise<void>;
@@ -698,6 +956,7 @@ export declare class TelegramNotificationDaemon {
     private pruneSeenUpdateIds;
     private rememberSeenUpdateId;
     private reserveSeenUpdateId;
+    private releaseSeenUpdateId;
     scanRoots(): Promise<void>;
     connectSession(sessionId: string, url: string, token: string): void;
     /**
@@ -734,9 +993,21 @@ export declare class TelegramNotificationDaemon {
     private topicIdentityKey;
     private topicIdentityBase;
     private topicOwnerForIdentity;
-    private sessionCanClaimIdentity;
+    private admitLegacyToolStart;
+    private legacyToolStartForTerminal;
+    private settleLegacyToolStart;
+    private cancelUnsentLegacyToolStart;
+    private failLegacyToolStart;
+    private settleRejectedLegacyToolSubmission;
+    private cancelLegacyToolStartsForSession;
+    private cleanLegacyToolStartsForCapabilityUpgrade;
+    private cancelLegacyToolStartsForPolicyTransition;
     private toolActivityOwner;
+    private renderThreadedFrame;
+    private toolActivityFrameWithoutSummaries;
+    private toolActivitySummariesAreCurrent;
     private toolActivityAuthorityIsCurrent;
+    private toolActivityDeliveryIsCurrent;
     private submitThreadedFrame;
     private existingTopicForPrivateChat;
     private topicAuthorityLease;
@@ -759,7 +1030,9 @@ export declare class TelegramNotificationDaemon {
     private deleteTopic;
     private persistTopics;
     loadTopics(): Promise<void>;
-    /** Download a Telegram file by its file_path (from getFile) into memory. */
+    /** Retry crash-interrupted topic deletes; only a definite Telegram result clears the durable fence. */
+    private reconcilePendingTopicDeletes;
+    /** Download one Telegram file with the Bot API's 20 MiB ceiling and one end-to-end deadline. */
     private downloadTelegramFile;
     /**
      * Per-session private temp directories (mode 0700) holding inbound non-image
@@ -781,6 +1054,7 @@ export declare class TelegramNotificationDaemon {
      * to append to the injected text.
      */
     private resolveInboundAttachment;
+    private resolveInboundAttachmentSerial;
     /**
      * Serialize all pool flushes. Every caller (`submitThreadedFrame`, the flat
      * fallback, the drain timer's `void this.flushPool()`, topic teardown) goes

package/dist/types/sdk/bus/telegram-reference.d.ts

@@ -73,6 +73,7 @@ export declare function buildActionMessage(action: {
     id: string;
     question?: string;
     options?: string[];
+    recommendedIndex?: unknown;
     controls?: readonly TelegramActionControl[];
     summary?: string;
 }): RenderedMessage;
@@ -81,6 +82,7 @@ export declare function buildActionMarkdown(action: {
     kind: "ask" | "idle";
     question?: string;
     options?: string[];
+    recommendedIndex?: unknown;
     summary?: string;
 }): string;
 /** Send Telegram HTML text chunks sequentially so long messages preserve order. */