approval-md 0.3.0 → 0.4.1

package/dist/src/channels/telegram.js

@@ -34,6 +34,24 @@
  * notify, long-poll, callbacks, failure modes — against a local mock Bot API
  * server and never touches the real network.
  *
+ * ## Two transports, one update path (APRV-424)
+ *
+ * An update reaches this channel either because it long-polled for it
+ * ({@link TelegramChannel.pollOnce}) or because Telegram posted it to a URL the
+ * runtime registered ({@link TelegramChannel.deliverUpdate}, fed by
+ * `channels/telegram-webhook.ts`). That is the WHOLE of the difference. Both
+ * entry points hand the update to the same {@link TelegramChannel.handleUpdate}
+ * and therefore to the same chat check, the same `senderOf`, the same
+ * resolution ladder, the same `onDecision` handler and the same
+ * annotate-after-decision edit; a decision does not know which door it came
+ * through, and there is no second copy of any of it to drift.
+ *
+ * The two are mutually exclusive per bot, and the Bot API says so first:
+ * `getUpdates` is refused outright while a webhook is set.
+ * {@link TelegramChannel.claimTransport} refuses the in-process form of the
+ * mistake, and the verbs above ask `getWebhookInfo` and the ownership registry
+ * about the cross-process one.
+ *
  * ## Config-declared identity — SPEC.md §11
  *
  * > Human identity in v0.1 is config-declared (an environment variable or
@@ -201,15 +219,16 @@
  * process memory and nothing else: no event is appended, no message is edited,
  * and the log is not opened.
  */
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { GLOSS_UNVERIFIED_SUFFIX, refusedDecisionLine } from "./contract.js";
 // APRV-299. The reaction vocabulary and the verdict type, imported for the
 // reason `core/audit.ts` states where it exports them: they are shown here and
 // decided nowhere. Nothing in this file branches on a reaction, and SPEC.md
 // §11.1 invariant 10's guard scans the modules that decide, which this is not.
 import { REACTIONS } from "../core/audit.js";
-import { TELEGRAM_PROMPT_LAYOUT, } from "../core/prompt-layout.js";
+import { DEFAULT_PROMPT_STYLE, TELEGRAM_PROMPT_LAYOUT, } from "../core/prompt-layout.js";
 import { commandPayloadView, payloadRegionText } from "./payload-view.js";
+import { MINIMAL_DENY_LABEL, renderTelegramMinimal } from "./telegram-minimal.js";
 // ---------------------------------------------------------------------------
 // Configuration
 // ---------------------------------------------------------------------------
@@ -389,6 +408,13 @@ const DEFAULT_MAX_BACKOFF_MS = 30_000;
 export const TELEGRAM_DEFAULT_RETENTION_MS = 24 * 60 * 60 * 1000;
 /** Least time between two sweeps. A sweep is O(map); once a minute is plenty. */
 export const TELEGRAM_SWEEP_INTERVAL_MS = 60_000;
+/**
+ * How many refused cards' nonces a channel remembers as dead (APRV-442).
+ *
+ * A bound on memory and nothing else: a nonce that falls off the end reaches
+ * the action-reference fallback, and the gate judges that tap in full.
+ */
+export const TELEGRAM_REFUSED_NONCE_CAP = 1024;
 // ---------------------------------------------------------------------------
 // Anomalies
 // ---------------------------------------------------------------------------
@@ -740,6 +766,81 @@ export function renderTelegram(request, heading = TELEGRAM_PROMPT_HEADING, layou
             : `${payload.truncated ? `--- payload TRUNCATED at render (sha256 ${payload.hash}) — no canonical rendering exists; do not grant on this ---\n` : ""}${payloadRegionText(payload, request.class.value)}`,
     };
 }
+/**
+ * The settle edit of a minimal card (APRV-489): the outcome, the card's
+ * headline, the detail lines, and the collapsed block WHOLE.
+ *
+ * The edit replaces the only message that holds the canonical rendering, so
+ * the rendering is never what gives way to fit: the runtime's own detail lines
+ * are shortened instead, with a marker, and the outcome headline always stays.
+ * The card was at most 3800 characters with its quote box and
+ * deadline line, which the edit drops, so headline plus collapsed block always
+ * fit under {@link TELEGRAM_SETTLE_BUDGET} (the card budget is `MINIMAL_MESSAGE_BUDGET` in `telegram-minimal.ts`).
+ */
+export function minimalSettleText(outcome, detail, card) {
+    const head = [`<b>${escapeHtml(outcome)}</b>`, card.headline];
+    // One unit throughout (fix round 2, S3): UTF-16 code units of the HTML,
+    // which is what `.length` counts and never less than the parsed text
+    // Telegram limits. The cut is taken between grapheme clusters of the
+    // UNESCAPED text, so it never splits a surrogate pair, a cluster or an entity.
+    const fixed = [...head, card.details].join("\n").length + 1;
+    const room = Math.max(0, TELEGRAM_SETTLE_BUDGET - fixed);
+    const raw = detail.join("\n");
+    let lines = escapeHtml(raw);
+    if (lines.length > room)
+        lines = shortenHtml(raw, room, SETTLE_SHORTENED_MARK);
+    return [...head, ...(lines.length === 0 ? [] : [lines]), card.details].join("\n");
+}
+/** What a shortened run of detail lines ends with. */
+const SETTLE_SHORTENED_MARK = "… (shortened; the log holds the full record)";
+/** Grapheme clusters, for cuts that never split one. */
+const SETTLE_GRAPHEMES = new Intl.Segmenter("en", { granularity: "grapheme" });
+/** `raw` escaped and cut between clusters so the result, marker included, is at most `budget` UTF-16 units. */
+function shortenHtml(raw, budget, marker) {
+    const limit = Math.max(0, budget - marker.length);
+    let kept = "";
+    for (const { segment } of SETTLE_GRAPHEMES.segment(raw)) {
+        const escaped = escapeHtml(segment);
+        if (kept.length + escaped.length > limit)
+            break;
+        kept += escaped;
+    }
+    return `${kept}${marker}`;
+}
+/**
+ * The settle edit of last resort (fix round 2, S3): sent when Telegram refused
+ * the full settle edit of a minimal card, so a decided card never keeps looking
+ * undecided. The outcome, the request's key, the first detail line (who, when,
+ * which record) cut to fit, and where the rest is. Always under 1000 units.
+ */
+export function shortSettleText(outcome, actionKey, detail) {
+    const first = detail[0] ?? "";
+    return [
+        `<b>${escapeHtml(outcome)}</b>`,
+        `<code>${shortenHtml(actionKey, 200, "")}</code>`,
+        "",
+        ...(first.length === 0 ? [] : [escapeHtml(first).length <= 400 ? escapeHtml(first) : shortenHtml(first, 400, "…")]),
+        "The full record is in the approval log (approval log, approval queue).",
+    ].join("\n");
+}
+/**
+ * Whether a Bot API failure is a refusal of THIS message rather than a passing
+ * failure (fix round 2, S2): any 4xx but 429. A 429, a 5xx and a transport
+ * failure are retried by the dispatch cycle as before; a refusal never will
+ * succeed with the same text, so the minimal card gives way to the technical one.
+ */
+export function isMessageRefusal(cause) {
+    return (cause instanceof TelegramApiError &&
+        cause.status !== null &&
+        cause.status >= 400 &&
+        cause.status < 500 &&
+        cause.status !== 429);
+}
+/**
+ * The longest settle edit of a minimal card, in characters of HTML: under
+ * Telegram's 4096 with room for a relay's `Agent: <name>` line.
+ */
+export const TELEGRAM_SETTLE_BUDGET = 3990;
 /**
  * Split `text` so every chunk survives HTML escaping inside the message limit.
  *
@@ -1311,6 +1412,15 @@ export const TELEGRAM_REVIEW_DENIED = "✗ REVIEWED — DENIED";
  * been recorded.
  */
 export const TELEGRAM_REVIEW_ARMED = "DENY ARMED — nothing is recorded yet";
+/**
+ * The headline a card wears while a grade is held and no verdict has been
+ * given (APRV-482). A grade is not a verdict: tapping one with nothing armed
+ * records nothing, and the card keeps the grade so the OK or the Deny that
+ * follows records it.
+ */
+export function telegramReviewGradeHeld(reaction) {
+    return `GRADE ${reaction.toUpperCase()} HELD — nothing is recorded until you tap OK or Deny`;
+}
 /**
  * What a review tap's single answer says (APRV-302).
  *
@@ -1326,8 +1436,29 @@ export const TELEGRAM_REVIEW_ARMED = "DENY ARMED — nothing is recorded yet";
 export const TELEGRAM_REVIEW_ACK = "Heard — recording your review. The card will say what the log recorded.";
 /** The toast a first Deny tap gets: it says plainly that nothing was written. */
 export const TELEGRAM_REVIEW_ARM_TOAST = "Deny armed — nothing recorded. Tap Deny again to record it, or a reaction to record it with a grade.";
+/**
+ * The card line and toast for a tap that would finish another account's
+ * half-finished review (PR #614 refutation F3): an armed Deny or a held grade
+ * belongs to the account that tapped it, and nothing is recorded. A held grade
+ * is replaced by the tapper's own grade (a grade finishes nothing), which the
+ * line says (PR #614 recheck NF-1, minor). Under 200 characters, the Bot API's
+ * limit for a callback answer.
+ */
+export const TELEGRAM_REVIEW_OTHER_SENDER = "Another account's unfinished review (armed Deny or held grade) is on this card. Nothing was recorded. Tap your own grade to replace a held one; an armed Deny is theirs to finish.";
 /** The toast a reaction that needs the human's own words gets. */
 export const TELEGRAM_REVIEW_NOTE_TOAST = "Heard — reply to the prompt with why. Nothing is recorded until it arrives.";
+/**
+ * The card line for a note prompt that could not be sent (APRV-492). The toast
+ * went out before the send and told the human to reply to a prompt, so the
+ * card says the prompt is not coming and how to be asked again: a grade tap is
+ * what the relay licenses a prompt for. With Deny armed the grade alone asks;
+ * otherwise the grade is held and OK asks.
+ */
+export function telegramReviewNoteUnasked(verdict) {
+    return verdict === "denied"
+        ? "The prompt asking why could not be sent, so nothing was recorded. Tap your grade again to be asked."
+        : "The prompt asking why could not be sent, so nothing was recorded. Tap your grade again, then OK, to be asked.";
+}
 /**
  * What the ForceReply prompt asks for.
  *
@@ -1420,6 +1551,255 @@ function trimNotice(text) {
         ? text
         : `${text.slice(0, REVIEW_NOTICE_MAX)}… (cut to fit one message; the whole refusal is on the listener's stderr)`;
 }
+/**
+ * How much payload, in ESCAPED characters, a review card carries whole
+ * (APRV-480).
+ *
+ * A card is one message edited in place, so it cannot spill the payload over
+ * several messages the way a prompt does: the edit that settles it replaces one
+ * message, and a second message holding the rest of the bytes would outlive the
+ * card it belonged to. So the bytes are shown whole or not at all. Never cut:
+ * a review that recorded a payload hash over bytes the reviewer saw half of
+ * would claim more than they read. This is the CEILING; the budget a given
+ * card gets is {@link reviewPayloadBudget}, which is this or the headroom the
+ * card's own rows leave under {@link TELEGRAM_MAX_MESSAGE_CHARS}, whichever is
+ * smaller (PR #614 refutation F4).
+ */
+export const REVIEW_PAYLOAD_BUDGET = 2000;
+/**
+ * The longest agent-written summary a review card shows, in characters (PR
+ * #614 refutation F4). The summary is the requesting party's own claim and its
+ * schema sets no length, so before this cap an agent could write a summary
+ * that pushed the card past Telegram's limit, which failed the send and held
+ * the review queue. Longer text is cut with a marker saying how much is not
+ * shown; the registration record keeps it whole.
+ */
+export const REVIEW_SUMMARY_MAX = 400;
+/**
+ * How much of each row a review card shows, in characters (PR #614 refutation
+ * F4), tried in order until the card fits one message with the longest
+ * heading, the hash-only payload region and the largest notice a tap can add.
+ * `row` caps the key, class, task, command breakdown, gloss, run time and
+ * outcome; `summary` caps the agent's summary (never above
+ * {@link REVIEW_SUMMARY_MAX}); `origin` caps an author or source label. An
+ * ordinary card fits at the first level and shows its rows as they are; only a
+ * card whose rows are pathologically long is cut further, and the last level
+ * fits whatever the rows hold (pinned by the worst-case test in
+ * `tests/channels-telegram.test.ts`).
+ */
+const REVIEW_CAP_LEVELS = [
+    { row: 300, summary: REVIEW_SUMMARY_MAX, origin: 60 },
+    { row: 160, summary: 240, origin: 40 },
+    { row: 80, summary: 120, origin: 30 },
+    { row: 40, summary: 60, origin: 20 },
+];
+/** The longest notice headline a review card shows (F4). Headlines are constants. */
+const REVIEW_NOTICE_HEADLINE_MAX = 100;
+/**
+ * The most characters a review card's notice region (a refusal, or the arming
+ * line) shows, all its lines together (PR #614 refutation F4). Each line was
+ * already cut at {@link REVIEW_NOTICE_MAX}; the region had no total, so a
+ * refusal with several long lines could take the card over the limit and make
+ * the redraw that carries it fail. The whole refusal is on the listener's
+ * stderr.
+ */
+export const REVIEW_NOTICE_REGION_MAX = 600;
+/** The most characters a settled card's detail lines show together (F4). */
+const REVIEW_SETTLED_REGION_MAX = 3000;
+/**
+ * The visible length of HTML this channel wrote: tags removed and each entity
+ * {@link escapeHtml} produces counted as the one character it stands for.
+ * Telegram measures its limit after entity parsing, so this is the number the
+ * limit applies to.
+ */
+export function telegramVisibleLength(html) {
+    return html.replace(/<[^>]*>/gu, "").replace(/&(?:amp|lt|gt);/gu, "x").length;
+}
+/** `text` cut at `max` characters with a marker saying how much is not shown. */
+function capReviewText(text, max) {
+    if (text.length <= max)
+        return text;
+    let cut = text.slice(0, max);
+    const last = cut.charCodeAt(cut.length - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut = cut.slice(0, -1);
+    return `${cut}${reviewCutMarker(text.length - cut.length)}`;
+}
+/** The marker a cut row ends with. */
+function reviewCutMarker(hidden) {
+    return `… [+${String(hidden)} chars not shown]`;
+}
+/** The longest {@link reviewCutMarker}: a JavaScript string is under 2^53 long. */
+const REVIEW_CUT_MARKER_MAX = reviewCutMarker(Number.MAX_SAFE_INTEGER).length;
+/** The line a region ends with when lines were left out. */
+const REVIEW_REGION_OVERFLOW = "… [more on the listener's stderr]";
+/**
+ * Lines cut so that together, counting the newline before each, they show at
+ * most `max` characters plus one cut marker and the overflow line.
+ */
+function capReviewRegion(lines, max) {
+    const out = [];
+    let used = 0;
+    for (const entry of lines) {
+        const room = max - used - 1;
+        if (room <= 0) {
+            out.push(REVIEW_REGION_OVERFLOW);
+            break;
+        }
+        const shown = capReviewText(entry, room);
+        out.push(shown);
+        used += shown.length + 1;
+    }
+    return out;
+}
+/**
+ * The longest payload text, in characters, a review card will even try to
+ * render (APRV-480 refutation: review-delivery resource cap).
+ *
+ * Supervised payloads carry no size cap of their own (`PROPOSE_PAYLOAD_MAX_BYTES`
+ * binds proposals only), and the party under review writes them. Without this
+ * bound every render of a card, every redraw after a tap, and every tap's
+ * {@link reviewPayloadView} would run the canonical renderer and HTML escaping
+ * over the whole payload only to conclude "too long", so an agent could make
+ * each review gesture cost work proportional to bytes it chose. Text past this
+ * length is `too-long` without being rendered at all; the card builder
+ * (`cli/audit-card.ts`) keeps no more than this much text in the card it holds.
+ * Eight times the card budget, because a canonical rendering is never that much
+ * shorter than the JSON it renders, and erring here only ever shows the hash.
+ */
+export const REVIEW_RENDER_INPUT_MAX = REVIEW_PAYLOAD_BUDGET * 8;
+/** The heading over a payload the card shows whole (APRV-480). */
+export const TELEGRAM_REVIEW_PAYLOAD_BYTES = "PAYLOAD — the bytes that ran, shown whole; this review covers them";
+/** The heading over a payload the card names by hash only (APRV-480). */
+export const TELEGRAM_REVIEW_PAYLOAD_HASH_ONLY = "PAYLOAD — NOT SHOWN, hash only; this review does not cover the bytes";
+/** The heading on a card whose execution recorded no payload binding (APRV-480). */
+export const TELEGRAM_REVIEW_PAYLOAD_NONE = "PAYLOAD — none recorded; the execution bound to no payload hash";
+export function reviewPayloadView(card) {
+    const rendering = card.fields.fullPayload.value;
+    const bound = card.fields.payload_hash?.value ?? rendering?.hash ?? null;
+    if (rendering !== null && (bound === null || bound === rendering.hash)) {
+        // Bounded before any rendering work: see REVIEW_RENDER_INPUT_MAX.
+        if (rendering.truncated || rendering.text.length > REVIEW_RENDER_INPUT_MAX) {
+            return { kind: "hash", hash: rendering.hash, reason: "too-long" };
+        }
+        const text = payloadRegionText(rendering, card.fields.class.value);
+        if (escapeHtml(text).length <= reviewPayloadBudget(card)) {
+            return { kind: "bytes", hash: rendering.hash, text };
+        }
+        return { kind: "hash", hash: rendering.hash, reason: "too-long" };
+    }
+    if (bound === null)
+        return { kind: "none" };
+    return { kind: "hash", hash: bound, reason: "unavailable" };
+}
+/** The payload region of a review card, as HTML lines (APRV-480). */
+function reviewPayloadLines(view) {
+    switch (view.kind) {
+        case "bytes":
+            return [`<b>${escapeHtml(TELEGRAM_REVIEW_PAYLOAD_BYTES)}</b>`, `<pre>${escapeHtml(view.text)}</pre>`];
+        case "hash":
+            return [
+                `<b>${escapeHtml(TELEGRAM_REVIEW_PAYLOAD_HASH_ONLY)}</b>`,
+                escapeHtml(view.reason === "too-long"
+                    ? `The bytes are longer than one card carries, so none of them are shown. sha256 ${view.hash}`
+                    : `This runtime does not hold the bytes the execution bound to. sha256 ${view.hash}`),
+            ];
+        default:
+            return [`<b>${escapeHtml(TELEGRAM_REVIEW_PAYLOAD_NONE)}</b>`];
+    }
+}
+/**
+ * A review card's HTML lines around the payload region, every row cut to its
+ * cap (PR #614 refutation F4): `top` is the key and the computed rows, `bottom`
+ * the claimed ones. Pure over the card, so the payload budget computed from it
+ * and the card drawn from it cannot disagree.
+ */
+function reviewCardFrame(card) {
+    let frame = reviewCardFrameAt(card, REVIEW_CAP_LEVELS[0]);
+    for (const level of REVIEW_CAP_LEVELS) {
+        frame = reviewCardFrameAt(card, level);
+        if (reviewFixedLength(frame) + REVIEW_HASH_REGION_MAX <= TELEGRAM_MAX_MESSAGE_CHARS)
+            break;
+    }
+    return frame;
+}
+function reviewCardFrameAt(card, caps) {
+    const computedLines = [];
+    const claimedLines = [];
+    for (const row of REVIEW_CARD_ROWS) {
+        const candidate = reviewRow(card.fields, row);
+        if (candidate === null)
+            continue;
+        if (candidate.line.kind === "computed")
+            computedLines.push(candidate.line);
+        else
+            claimedLines.push(candidate.line);
+    }
+    computedLines.push(line("ran_at", card.ranAt, "ran at", card.ranAt.value));
+    computedLines.push(line("verdict", card.verdict, "verdict", card.verdict.value));
+    const render = (entry) => `• <b>${escapeHtml(entry.label)}:</b> ${escapeHtml(capReviewText(entry.text, entry.field === "summary" ? caps.summary : caps.row))} <i>(${escapeHtml(capReviewText(entry.origin, caps.origin))})</i>`;
+    const author = capReviewText(originOf(card.fields.summary), caps.origin);
+    return {
+        top: [
+            `<code>${escapeHtml(capReviewText(card.fields.action_key.value, caps.row))}</code>`,
+            "",
+            "<b>COMPUTED — derived by the runtime from the log, the policy and the payload bytes</b>",
+            ...computedLines.map(render),
+            "",
+        ],
+        bottom: [
+            "",
+            `<b>CLAIMED — authored by ${escapeHtml(author)}, NOT verified by the runtime</b>`,
+            ...claimedLines.map(render),
+        ],
+    };
+}
+/** The longest heading a live card can wear: Deny armed and a grade held. */
+const REVIEW_HEADING_MAX = Math.max(...REACTIONS.map((reaction) => [TELEGRAM_REVIEW_HEADING, TELEGRAM_REVIEW_ARMED, telegramReviewGradeHeld(reaction)].join(" — ")
+    .length));
+/**
+ * What a notice can add to a card at most: the blank line and the headline,
+ * each after a newline, then the region (newlines counted), one cut marker and
+ * the overflow line after its newline.
+ */
+const REVIEW_NOTICE_RESERVE = 2 +
+    REVIEW_NOTICE_HEADLINE_MAX +
+    REVIEW_CUT_MARKER_MAX +
+    REVIEW_NOTICE_REGION_MAX +
+    REVIEW_CUT_MARKER_MAX +
+    1 +
+    REVIEW_REGION_OVERFLOW.length;
+/** The longest hash-only or none payload region, with the newlines around it. */
+const REVIEW_HASH_REGION_MAX = Math.max(...[
+    { kind: "hash", hash: "0".repeat(64), reason: "too-long" },
+    { kind: "hash", hash: "0".repeat(64), reason: "unavailable" },
+    { kind: "none" },
+].map((view) => telegramVisibleLength(reviewPayloadLines(view).join("\n")) + 2));
+/**
+ * Everything a live card can hold except the payload region: the longest
+ * heading, the frame, the largest notice, and the newlines joining them.
+ */
+function reviewFixedLength(frame) {
+    return (REVIEW_HEADING_MAX +
+        1 +
+        telegramVisibleLength([...frame.top, ...frame.bottom].join("\n")) +
+        REVIEW_NOTICE_RESERVE);
+}
+/**
+ * How many escaped characters of payload this card can show whole (PR #614
+ * refutation F4): {@link REVIEW_PAYLOAD_BUDGET}, or the room the card's own
+ * rows leave under {@link TELEGRAM_MAX_MESSAGE_CHARS} after the longest heading,
+ * the payload heading and the largest notice a tap can add, whichever is
+ * smaller. Pure over the card, so the view a card is drawn with and the view a
+ * tap records are the same view.
+ */
+export function reviewPayloadBudget(card) {
+    const fixed = reviewFixedLength(reviewCardFrame(card)) +
+        // The bytes heading and the newlines around the heading and the payload.
+        TELEGRAM_REVIEW_PAYLOAD_BYTES.length +
+        3;
+    return Math.max(0, Math.min(REVIEW_PAYLOAD_BUDGET, TELEGRAM_MAX_MESSAGE_CHARS - fixed));
+}
 /**
  * The card's message: the rows, whatever notice the last tap produced, and the
  * keyboard.
@@ -1432,13 +1812,15 @@ function trimNotice(text) {
  * every card said the same thing to a reader who had already read them once, and
  * pushed the rows a review is actually about off the first screen.
  *
- * Pure. Two things it deliberately does NOT carry, and both are the same rule
- * read twice: no payload region, and no approve button. SPEC.md §10.3 requires
- * the canonical rendering in front of an approver before a DECISION is
- * collected, and this collects none — the action ran, the review says only what
- * a person thought of it, and a card that offered an approve would be
- * presenting a settled fact as a live authorization. A sample is never
- * delivered as an approval request and never accepts a token.
+ * Pure. It carries no approve button: the action ran, and a card that offered
+ * an approve would be presenting a settled fact as a live authorization. A
+ * sample is never delivered as an approval request and never accepts a token.
+ *
+ * It DOES carry a payload region since APRV-480, between the computed rows and
+ * the claimed ones, exactly where a prompt puts its own. Under supervised-retro
+ * the review is the individual approval, so the reviewer reads the bytes that
+ * ran, or is told plainly that the card shows only their hash and why
+ * ({@link reviewPayloadView}). The heading says which, every time.
  */
 export function renderReviewCard(state) {
     const card = state.card;
@@ -1446,41 +1828,27 @@ export function renderReviewCard(state) {
     if (state.settled !== null) {
         return {
             text: [
-                `<b>${escapeHtml(state.settled.headline)}</b>`,
-                `<code>${escapeHtml(key)}</code>`,
+                `<b>${escapeHtml(capReviewText(state.settled.headline, REVIEW_NOTICE_HEADLINE_MAX))}</b>`,
+                `<code>${escapeHtml(capReviewText(key, REVIEW_CAP_LEVELS[0].row))}</code>`,
                 "",
-                ...state.settled.detail.map((entry) => escapeHtml(trimNotice(entry))),
+                ...capReviewRegion(state.settled.detail.map(trimNotice), REVIEW_SETTLED_REGION_MAX).map((entry) => escapeHtml(entry)),
             ].join("\n"),
             keyboard: null,
         };
     }
-    const computedLines = [];
-    const claimedLines = [];
-    for (const row of REVIEW_CARD_ROWS) {
-        const candidate = reviewRow(card.fields, row);
-        if (candidate === null)
-            continue;
-        if (candidate.line.kind === "computed")
-            computedLines.push(candidate.line);
-        else
-            claimedLines.push(candidate.line);
-    }
-    computedLines.push(line("ran_at", card.ranAt, "ran at", card.ranAt.value));
-    computedLines.push(line("verdict", card.verdict, "verdict", card.verdict.value));
-    const render = (entry) => `• <b>${escapeHtml(entry.label)}:</b> ${escapeHtml(entry.text)} <i>(${escapeHtml(entry.origin)})</i>`;
-    const author = originOf(card.fields.summary);
+    const frame = reviewCardFrame(card);
     const lines = [
-        `<b>${escapeHtml(state.denyArmed ? `${TELEGRAM_REVIEW_HEADING} — ${TELEGRAM_REVIEW_ARMED}` : TELEGRAM_REVIEW_HEADING)}</b>`,
-        `<code>${escapeHtml(key)}</code>`,
-        "",
-        "<b>COMPUTED — derived by the runtime from the log, the policy and the payload bytes</b>",
-        ...computedLines.map(render),
-        "",
-        `<b>CLAIMED — authored by ${escapeHtml(author)}, NOT verified by the runtime</b>`,
-        ...claimedLines.map(render),
+        `<b>${escapeHtml([
+            TELEGRAM_REVIEW_HEADING,
+            ...(state.denyArmed ? [TELEGRAM_REVIEW_ARMED] : []),
+            ...(state.heldReaction === null ? [] : [telegramReviewGradeHeld(state.heldReaction)]),
+        ].join(" — "))}</b>`,
+        ...frame.top,
+        ...reviewPayloadLines(reviewPayloadView(card)),
+        ...frame.bottom,
     ];
     if (state.notice !== null) {
-        lines.push("", `<b>${escapeHtml(state.notice.headline)}</b>`, ...state.notice.lines.map((entry) => escapeHtml(trimNotice(entry))));
+        lines.push("", `<b>${escapeHtml(capReviewText(state.notice.headline, REVIEW_NOTICE_HEADLINE_MAX))}</b>`, ...capReviewRegion(state.notice.lines.map(trimNotice), REVIEW_NOTICE_REGION_MAX).map((entry) => escapeHtml(entry)));
     }
     const button = (choice) => ({
         text: REVIEW_BUTTON_LABELS[choice],
@@ -1504,6 +1872,7 @@ export class TelegramApiError extends Error {
     method;
     status;
     description;
+    retryAfterSeconds;
     constructor(message, method, 
     /**
      * The HTTP status, when the failure was an HTTP one. `null` for a transport
@@ -1516,14 +1885,84 @@ export class TelegramApiError extends Error {
      * error body carried one. `null` when the body was absent, unreadable, not
      * JSON, or carried no description.
      */
-    description = null) {
+    description = null, 
+    /**
+     * The Bot API's `parameters.retry_after`, in seconds, when the failure
+     * carried one (PR #614 recheck NF-2). Telegram sends it with 429 "Too Many
+     * Requests" and means it: a send before it elapses is refused again.
+     * `null` when the body named none.
+     */
+    retryAfterSeconds = null) {
         super(message);
         this.method = method;
         this.status = status;
         this.description = description;
+        this.retryAfterSeconds = retryAfterSeconds;
         this.name = "TelegramApiError";
     }
 }
+/**
+ * The Bot API refusals that are a fact about the message itself (PR #614
+ * recheck NF-2). Each is a 400 whose `description` says the text, its markup
+ * or its keyboard is unacceptable, so resending the same card meets the same
+ * refusal however long the sender waits:
+ *
+ * - `message is too long`: the text is over 4096 characters after entities;
+ * - `can't parse entities`: the HTML the card was drawn with does not parse;
+ * - `message text is empty` / `text must be non-empty`: nothing to send;
+ * - `reply markup is too long`: the inline keyboard is over its byte limit;
+ * - `BUTTON_DATA_INVALID`: a button's callback data is over 64 bytes or empty;
+ * - `ENTITIES_TOO_LONG` / `entities too long`: too many formatting entities.
+ *
+ * Deliberately absent, because the card cannot cause them and a retry can
+ * clear them: `chat not found`, `bot was blocked`, `not enough rights` (the
+ * chat's state, which a human repairs), every 429, every 5xx, every timeout and
+ * network failure.
+ */
+const TELEGRAM_DETERMINISTIC_SEND_REFUSALS = [
+    /message is too long/iu,
+    /can't parse entities/iu,
+    /message text is empty|text must be non-empty/iu,
+    /reply markup is too long/iu,
+    /BUTTON_DATA_INVALID/u,
+    /ENTITIES_TOO_LONG|entities too long/iu,
+];
+/**
+ * Whether a failed send is the Bot API refusing the message itself, so that
+ * sending the same message again can only fail again (PR #614 recheck NF-2).
+ *
+ * Only an HTTP 400 whose description matches
+ * {@link TELEGRAM_DETERMINISTIC_SEND_REFUSALS} qualifies. Anything else, an
+ * error that is not a {@link TelegramApiError} included, is treated as
+ * transient, which is the direction that keeps a card in front of the
+ * approver: a transient failure misread as deterministic hides a sample from
+ * the phone, and the converse costs a bounded number of retries.
+ */
+export function isDeterministicSendRefusal(cause) {
+    return (cause instanceof TelegramApiError &&
+        cause.status === 400 &&
+        cause.description !== null &&
+        TELEGRAM_DETERMINISTIC_SEND_REFUSALS.some((pattern) => pattern.test(cause.description)));
+}
+/**
+ * The wait, in milliseconds, a failed call's `retry_after` asks for, or `null`
+ * when it named none (PR #614 recheck NF-2).
+ */
+export function retryAfterMsOf(cause) {
+    if (!(cause instanceof TelegramApiError) || cause.retryAfterSeconds === null)
+        return null;
+    return cause.retryAfterSeconds * 1000;
+}
+/** `parameters.retry_after` from a parsed Bot API body, when it is a positive integer. */
+function retryAfterFrom(parsed) {
+    if (parsed === null || typeof parsed !== "object")
+        return null;
+    const parameters = parsed["parameters"];
+    if (parameters === null || typeof parameters !== "object")
+        return null;
+    const value = parameters["retry_after"];
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
 /**
  * Telegram's wording for "that edit would have changed nothing" (APRV-277).
  *
@@ -1572,6 +2011,37 @@ export function isPollConflict(cause) {
         cause.method === "getUpdates" &&
         (cause.status === 409 || (cause.description !== null && TELEGRAM_POLL_CONFLICT.test(cause.description))));
 }
+/** A fresh, empty batch report. One shape for both transports (APRV-424). */
+function emptyPollResult() {
+    return { updates: 0, outcomes: [], ignored: [], commands: [], reviews: [], refused: [] };
+}
+/**
+ * Why a transport claim was refused. Frozen, per SPEC §11.1 invariant 6.
+ *
+ * One code, because there is one fact: this channel is already receiving
+ * updates by the other transport.
+ */
+export const TELEGRAM_TRANSPORT_REFUSAL_CODES = ["transport-conflict"];
+/**
+ * The in-process half of "long-poll and webhook are mutually exclusive"
+ * (APRV-424).
+ *
+ * It is a belt on the braces and says so. The exclusion that matters is per
+ * BOT and lives above this class, where a process can ask the Bot API
+ * (`getWebhookInfo`) and the per-machine ownership registry who else is
+ * receiving this bot's updates; a channel object knows only about itself.
+ * What this rules out is the one failure a caller could cause here and
+ * nowhere else: feeding one channel instance from both a poll loop and an
+ * HTTP handler, where `handleUpdate`'s single ack slot and the delivery maps
+ * would be written by two arrivals nobody ordered.
+ */
+export class TelegramTransportError extends Error {
+    code = "transport-conflict";
+    constructor(message) {
+        super(message);
+        this.name = "TelegramTransportError";
+    }
+}
 export class TelegramChannel {
     name = "telegram";
     token;
@@ -1591,6 +2061,12 @@ export class TelegramChannel {
     describeAction;
     /** The policy's row layout for this channel (APRV-218). Read-only, and pure input to the renderer. */
     layout;
+    /** The policy's prompt style for this channel (APRV-489). */
+    promptStyle;
+    /** The policy's `say` declarations (APRV-489). Pure input to the minimal renderer. */
+    say;
+    /** The per-delivery resolver (fix round 2, S4), or null for the fixed values above. */
+    promptFor;
     /** When {@link sweep} last ran, so the poll loop can call it every cycle. */
     lastSweepMs = Number.NEGATIVE_INFINITY;
     /**
@@ -1600,6 +2076,25 @@ export class TelegramChannel {
      */
     ack = null;
     handler = null;
+    /**
+     * APRV-196's stale-copy fallback, on or off (APRV-456). Fixed at
+     * construction from {@link TelegramConfig.staleCopy}; nothing an update
+     * carries can change it.
+     */
+    staleCopy;
+    /**
+     * Where a `nonce-not-issued` refusal is recorded (APRV-456). The runtime's,
+     * like every other handler here; absent, the refusal still happens and only
+     * the record is missing.
+     */
+    refusedDecisionHandler = null;
+    /**
+     * Nonces already refused `nonce-not-issued` (APRV-456), oldest first, capped
+     * at {@link TELEGRAM_REFUSED_NONCE_CAP}. A redelivered or replayed tap on the
+     * same button is refused again with the same toast and records nothing, so
+     * one button costs the log at most one record.
+     */
+    unissuedRefused = new Set();
     /**
      * What to do with a bot command (APRV-216). Absent unless the runtime asked
      * for commands, and its absence is what keeps `message` out of
@@ -1647,11 +2142,60 @@ export class TelegramChannel {
     digests = new Map();
     /** "All" nonce -> the digest message it was issued for. */
     allNonces = new Map();
+    /**
+     * Action keys whose card this process disarmed on a tap the gate did NOT
+     * settle (APRV-442): a refusal (`sender-unmapped`, a budget, an unattested
+     * policy, anything `ok: false`) or a handler that threw. Drained by
+     * {@link takeReleased}.
+     *
+     * The disarm is right and stays, and {@link refusedNonces} keeps it final:
+     * the refused card's bytes resolve to nothing, not even through the
+     * action-reference fallback to the card that replaces it. What the disarm
+     * must not do is leave the listener believing the REQUEST is on the
+     * approver's phone, which is what `DispatchState.delivered` goes on saying
+     * until something tells it otherwise. This set is that something: it names
+     * a card, never an outcome, and the listener re-derives from the verified
+     * log whether the request is still pending before it offers a new card.
+     * Nothing here decides, and losing it to a restart costs nothing, because a
+     * restarted listener re-sends everything pending anyway.
+     */
+    released = new Set();
+    /**
+     * Nonces of cards a refused or failed tap disarmed (APRV-442), oldest first,
+     * capped at {@link TELEGRAM_REFUSED_NONCE_CAP}.
+     *
+     * Without this, a released request's fresh card would give the refused
+     * card's bytes somewhere to go: the nonce misses, the action reference
+     * resolves to the new live card, and a Telegram redelivery of the refused
+     * tap (a webhook retry) or a client replaying the removed buttons would be
+     * refused again, append again, disarm the new card and cause another
+     * re-send, once per replay. A nonce in this set never takes the fallback, so
+     * a refused card stays exactly as dead as it was before APRV-442 and only
+     * the REQUEST is offered again. Forgetting an entry past the cap degrades to
+     * the fallback, whose tap the gate still judges in full: volume, never a
+     * decision.
+     */
+    refusedNonces = new Set();
     rendered = [];
     offset = 0;
     counter = 0;
     stopped = false;
     inFlight = null;
+    /**
+     * The transport this channel has started receiving updates by, or `null`
+     * before the first one (APRV-424). Sticky for the life of the object: a
+     * process that stopped polling has not stopped being a poller, and the
+     * question this answers is which arrival path owns the maps below.
+     */
+    transport = null;
+    /**
+     * Everything {@link redact} scrubs out of anything that leaves this class.
+     *
+     * The bot token from construction, plus any secret a later call was handed:
+     * {@link registerWebhook} adds the `secret_token` before it sends it, so a
+     * Bot API error quoting the request cannot put it on an operator's terminal.
+     */
+    secrets;
     counters = {
         notified: 0,
         updates: 0,
@@ -1666,11 +2210,14 @@ export class TelegramChannel {
             "unknown-command": 0,
         },
         staleCopyDecisions: 0,
+        staleCopyRefusals: 0,
         commands: 0,
         reviews: 0,
     };
     constructor(config) {
         this.token = config.token;
+        this.secrets =
+            config.token.length === 0 ? [] : [{ value: config.token, label: "<token redacted>" }];
         this.chatId = String(config.chatId);
         this.apiBase = (config.apiBase ?? TELEGRAM_DEFAULT_API_BASE).replace(/\/+$/u, "");
         this.fetchImpl = config.fetch ?? globalThis.fetch;
@@ -1687,11 +2234,22 @@ export class TelegramChannel {
         this.now = config.now ?? (() => Date.now());
         this.describeAction = config.describeAction ?? null;
         this.layout = config.layout ?? TELEGRAM_PROMPT_LAYOUT;
+        this.promptStyle = config.promptStyle ?? DEFAULT_PROMPT_STYLE;
+        this.say = config.say ?? {};
+        this.promptFor = config.promptFor ?? null;
+        // APRV-456. Only an explicit `true` or an absent key leaves the fallback on;
+        // anything else a caller passes turns it off, the stricter direction.
+        this.staleCopy = config.staleCopy === undefined || config.staleCopy === true;
         this.makeNonce =
             config.nonce ??
                 (() => {
                     this.counter += 1;
-                    return `${this.counter.toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+                    // APRV-456 refutation S2. On a relayed channel the nonce is the only
+                    // thing binding a button to this process, so it comes from the CSPRNG
+                    // (72 bits) rather than `Math.random`, whose state a reader of a few old
+                    // buttons could in principle recover. base64url carries no `:`, and the
+                    // whole `<verb>:<nonce>:<ref>` stays well inside the 64-byte cap.
+                    return `${this.counter.toString(36)}${randomBytes(9).toString("base64url")}`;
                 });
     }
     // -------------------------------------------------------------------------
@@ -1700,6 +2258,25 @@ export class TelegramChannel {
     onDecision(handler) {
         this.handler = handler;
     }
+    /**
+     * Register where a tap this channel refused on its own is recorded
+     * (APRV-456).
+     *
+     * Separate from {@link onDecision} on purpose: that handler's job is to call
+     * the gate, and a `nonce-not-issued` tap must never reach the gate. The
+     * runtime wires this to an audit-tier append that grants nothing.
+     */
+    onRefusedDecision(handler) {
+        this.refusedDecisionHandler = handler;
+    }
+    /**
+     * Whether APRV-196's stale-copy fallback is on (APRV-456). Read by the
+     * listener for the restart banner, which must not promise that earlier
+     * copies still decide when they do not.
+     */
+    staleCopyEnabled() {
+        return this.staleCopy;
+    }
     /**
      * Register what to do with a checkpoint tap (APRV-257).
      *
@@ -1770,8 +2347,9 @@ export class TelegramChannel {
      * A unit like a checkpoint prompt: one thing to read, never grouped into a
      * digest, and never delivered through {@link notify} — a digest is a set of
      * similar pending REQUESTS decided together, and a sample is neither pending
-     * nor a request. It sends ONE message: no payload region, and a keyboard
-     * whose six buttons collect a verdict and a grade and mint nothing.
+     * nor a request. It sends ONE message: the rows, the payload whole or by hash
+     * (APRV-480, never split across messages), and a keyboard whose six buttons
+     * collect a verdict and a grade and mint nothing.
      *
      * Refuses when no handler is registered, rather than sending a dead button.
      */
@@ -1786,6 +2364,9 @@ export class TelegramChannel {
             card,
             nonce,
             denyArmed: false,
+            heldReaction: null,
+            armedBy: null,
+            heldBy: null,
             settled: null,
             notice: null,
             awaitingNote: null,
@@ -1933,8 +2514,15 @@ export class TelegramChannel {
     async deliverDigest(members, batchDeliveryId, stale = null) {
         const allNonce = this.makeNonce();
         const deliveredAtMs = this.now();
+        // The digest's window is the widest member's: it may be forgotten only when
+        // every member is past deciding, and a member nothing bounds keeps it.
+        const windows = members.map((member) => this.retentionWindowMs(member));
+        const windowMs = windows.includes(null)
+            ? null
+            : Math.max(...windows.filter((window) => window !== null));
         const state = {
             deliveredAtMs,
+            windowMs,
             // Assigned once the message exists; nothing consults it before then.
             deliveryId: "",
             batchDeliveryId,
@@ -1994,13 +2582,16 @@ export class TelegramChannel {
         state.deliveryId = deliveryId;
         // Armed only now, and all at once: until the message with the buttons on it
         // exists there is nothing a callback could legitimately answer.
-        for (const member of state.members) {
+        const rendering = this.digestRendering(stale !== null);
+        for (const [index, member] of state.members.entries()) {
             this.deliveries.set(member.nonce, {
                 actionKey: member.actionKey,
                 actionRef: actionRefOf(member.actionKey),
                 deliveryId,
                 batchDeliveryId,
                 deliveredAtMs,
+                windowMs: windows[index] ?? null,
+                ...(rendering === undefined ? {} : { rendering }),
             });
         }
         this.digests.set(deliveryId, state);
@@ -2085,14 +2676,49 @@ export class TelegramChannel {
                 ],
             ],
         };
-        const sent = await this.sendPrompt(request, TELEGRAM_PROMPT_HEADING, keyboard);
+        // APRV-489. The minimal card is tried only when the policy asked for it,
+        // and anything it will not draw honestly is sent as the technical card,
+        // exactly as a technical policy sends it, with the reason kept for the
+        // decision record and said on stderr.
+        let sent;
+        let rendering;
+        let card;
+        const prompt = this.currentPrompt();
+        // Fix round 2, B2: a request delivered as part of a batch is always the
+        // technical card, as SPEC §10.3 (amended) says of a grouped delivery.
+        const minimal = prompt.fallback !== undefined
+            ? { ok: false, reason: prompt.fallback }
+            : prompt.style !== "minimal"
+                ? null
+                : batchDeliveryId !== undefined
+                    ? { ok: false, reason: "batch" }
+                    : await this.sendMinimal(request, nonce, prompt.say);
+        if (minimal !== null && minimal.ok) {
+            sent = minimal.sent;
+            // R3-S1: the record notes a `say` phrase the runtime overrode with its own.
+            rendering = minimal.sayDoesIgnored ? { style: "minimal", say_does_ignored: true } : { style: "minimal" };
+            card = minimal.card;
+            if (minimal.sayDoesIgnored) {
+                this.complain(`approval: telegram drew its own phrase for ${actionKey}, not the say entry's does: the runtime reads this payload itself`);
+            }
+        }
+        else {
+            if (minimal !== null) {
+                rendering = { style: "technical", fallback: minimal.reason };
+                this.complain(`approval: telegram sent the technical card for ${actionKey}, not the minimal one: ${minimal.reason}`);
+            }
+            sent = await this.sendPrompt(request, TELEGRAM_PROMPT_HEADING, keyboard);
+        }
         this.counters.notified += 1;
         this.deliveries.set(nonce, {
             actionKey,
             actionRef: actionRefOf(actionKey),
             deliveryId: sent.deliveryId,
             deliveredAtMs: this.now(),
+            windowMs: this.retentionWindowMs(request),
             ...(batchDeliveryId === undefined ? {} : { batchDeliveryId }),
+            ...(rendering === undefined ? {} : { rendering }),
+            ...(card === undefined ? {} : { card }),
         });
         return {
             deliveryId: sent.deliveryId,
@@ -2102,6 +2728,95 @@ export class TelegramChannel {
             },
         };
     }
+    /**
+     * Send `request` as ONE minimal card (APRV-489), or report why it was not.
+     *
+     * The card is drawn from the same `renderTelegram` output the technical card
+     * would send, under the same layout, so the collapsed block IS the technical
+     * card. The buttons carry the same callback data as the technical card's; only
+     * the reject label reads "Deny" (R7). Nothing is sent when the card is refused,
+     * so the caller's technical send is the only send.
+     */
+    async sendMinimal(request, nonce, say) {
+        const actionKey = request.action_key.value;
+        const rendering = renderTelegram(request, TELEGRAM_PROMPT_HEADING, this.layout);
+        const drawn = renderTelegramMinimal(request, {
+            header: rendering.header,
+            payloadText: rendering.payloadText,
+            claimedText: rendering.claimedText,
+            anomalous: rendering.lines.some((entry) => entry.label.startsWith(TELEGRAM_ANOMALY_MARK)),
+            payloadLabel: `<b>${PAYLOAD_CHUNK_LABEL}</b>`,
+        }, say);
+        if (!drawn.ok)
+            return { ok: false, reason: drawn.reason };
+        let result;
+        try {
+            result = await this.call("sendMessage", {
+                chat_id: this.chatId,
+                text: drawn.text,
+                parse_mode: "HTML",
+                disable_web_page_preview: true,
+                reply_markup: {
+                    inline_keyboard: [
+                        [
+                            { text: "✅ Approve", callback_data: callbackData("g", nonce, actionKey) },
+                            { text: MINIMAL_DENY_LABEL, callback_data: callbackData("r", nonce, actionKey) },
+                        ],
+                    ],
+                },
+            });
+        }
+        catch (cause) {
+            // Fix round 2, S2: a refusal of the card itself (a Bot API that cannot
+            // parse the expandable block, an entity limit, a relay rule) would refuse
+            // the same card on every cycle and leave the approver with nothing. The
+            // technical card goes instead, once, and the record says why. A passing
+            // failure (429, 5xx, network) is thrown and retried as before.
+            if (isMessageRefusal(cause))
+                return { ok: false, reason: "send-refused" };
+            throw cause;
+        }
+        const fields = rendering.lines.map((entry) => ({
+            field: entry.field,
+            kind: entry.kind,
+            text: entry.text,
+        }));
+        return {
+            ok: true,
+            sent: {
+                deliveryId: String(result.message_id),
+                rendered: { action_key: actionKey, fields, fullPayloadText: rendering.payloadText },
+            },
+            card: { headline: drawn.headline, details: drawn.details },
+            sayDoesIgnored: drawn.sayDoesIgnored === true,
+        };
+    }
+    /**
+     * The style and `say` map in force for the delivery about to be drawn (fix
+     * round 2, S4): the resolver's answer when the verb gave one, else the fixed
+     * configuration. A resolver that throws is `technical`, the side that shows more.
+     */
+    currentPrompt() {
+        if (this.promptFor === null)
+            return { style: this.promptStyle, say: this.say };
+        try {
+            return this.promptFor();
+        }
+        catch (cause) {
+            this.complain(`approval: telegram could not read the prompt style; drawing technical: ${this.describe(cause)}`);
+            return { style: DEFAULT_PROMPT_STYLE, say: {} };
+        }
+    }
+    /**
+     * What a decision on a digest records about its layout (APRV-489): nothing
+     * under a technical policy, and the technical card with its reason under a
+     * minimal one, since a digest is always drawn technical.
+     */
+    digestRendering(stale) {
+        if (this.currentPrompt().style === "technical")
+            return undefined;
+        return { style: "technical", fallback: stale ? "stale-summary" : "digest" };
+    }
     /**
      * Forget every nonce issued for `deliveryId`, and report the action key it
      * was issued for.
@@ -2116,6 +2831,7 @@ export class TelegramChannel {
      */
     disarm(deliveryId) {
         let actionKey = "";
+        let card;
         // Deleting the current entry mid-iteration is defined behaviour for a Map,
         // and every nonce for this message id goes — a re-notify of the same
         // message would otherwise leave an older nonce still resolving.
@@ -2123,6 +2839,7 @@ export class TelegramChannel {
             if (delivery.deliveryId !== deliveryId)
                 continue;
             actionKey = delivery.actionKey;
+            card = delivery.card ?? card;
             this.deliveries.delete(nonce);
         }
         const digest = this.digests.get(deliveryId);
@@ -2130,7 +2847,32 @@ export class TelegramChannel {
             this.allNonces.delete(digest.allNonce);
             this.digests.delete(deliveryId);
         }
-        return actionKey;
+        return { actionKey, card };
+    }
+    /**
+     * How long after delivery the request behind a prompt can still be decided,
+     * on this process's clock, or `null` when nothing bounds it (APRV-423, second
+     * review pass).
+     *
+     * The SHORTER of two bounds, each of which is at or past the gate's own
+     * lapse, so the sweep never forgets a button a decision could still reach:
+     *
+     * - the request's `ttl_remaining_ms`, computed by the listener from the
+     *   verified log against the window the gate judges by (the policy's TTL
+     *   narrowed by the harness cap the requesting hook declared). It was
+     *   measured at tagging time, and delivery is at or after tagging, so
+     *   counting it from delivery ends at or after the real lapse;
+     * - the policy's own TTL ({@link TelegramConfig.approvalTtlMs}), counted from
+     *   delivery, which is at or after the `approval.requested` it really runs
+     *   from. This was the only bound before APRV-423 and it stays as one.
+     *
+     * A request neither bounds is decidable forever, and its entry is dropped
+     * only on an observed settlement. This channel still reads no policy and no
+     * log: both numbers arrive computed, by the verb and by the tagger.
+     */
+    retentionWindowMs(request) {
+        const bounds = [request.ttl_remaining_ms.value, this.approvalTtlMs].filter((bound) => bound !== null);
+        return bounds.length === 0 ? null : Math.min(...bounds);
     }
     /**
      * Drop the delivery bookkeeping no callback can still be honoured against
@@ -2166,17 +2908,23 @@ export class TelegramChannel {
      */
     sweep(nowMs = this.now()) {
         this.lastSweepMs = nowMs;
-        const retention = this.approvalTtlMs ?? TELEGRAM_DEFAULT_RETENTION_MS;
-        const expired = (deliveredAtMs) => nowMs - deliveredAtMs >= retention;
-        // Past the approval TTL the gate refuses every decision, so the request is
-        // terminal whether or not this process saw it settle. With no TTL declared
-        // nothing expires, and only an observed settlement makes an entry droppable.
-        const lapsed = (deliveredAtMs) => this.approvalTtlMs !== null && nowMs - deliveredAtMs >= this.approvalTtlMs;
+        // APRV-423 (second review pass): both halves read the ENTRY's own window,
+        // which is the effective one the gate judges its request by, and fall back
+        // to the policy's TTL and then the default only for an entry that carries
+        // none (a review card, which has no request).
+        const retentionOf = (windowMs) => windowMs ?? this.approvalTtlMs ?? TELEGRAM_DEFAULT_RETENTION_MS;
+        const expired = (deliveredAtMs, windowMs) => nowMs - deliveredAtMs >= retentionOf(windowMs);
+        // Past its window the gate refuses every decision on the request, so it is
+        // terminal whether or not this process saw it settle. With nothing bounding
+        // it nothing expires, and only an observed settlement makes it droppable.
+        const lapsed = (deliveredAtMs, windowMs) => windowMs !== null && nowMs - deliveredAtMs >= windowMs;
         let digests = 0;
         for (const [deliveryId, digest] of this.digests) {
             const terminal = digest.members.every((member) => member.settled !== null);
-            if (!(terminal || lapsed(digest.deliveredAtMs)) || !expired(digest.deliveredAtMs))
+            if (!(terminal || lapsed(digest.deliveredAtMs, digest.windowMs)) ||
+                !expired(digest.deliveredAtMs, digest.windowMs)) {
                 continue;
+            }
             this.digests.delete(deliveryId);
             this.allNonces.delete(digest.allNonce);
             digests += 1;
@@ -2188,8 +2936,10 @@ export class TelegramChannel {
             // decides, and it was just judged above.
             if (this.digests.has(delivery.deliveryId))
                 continue;
-            if (!lapsed(delivery.deliveredAtMs) || !expired(delivery.deliveredAtMs))
+            if (!lapsed(delivery.deliveredAtMs, delivery.windowMs) ||
+                !expired(delivery.deliveredAtMs, delivery.windowMs)) {
                 continue;
+            }
             this.deliveries.delete(nonce);
             deliveries += 1;
         }
@@ -2201,7 +2951,7 @@ export class TelegramChannel {
         // this map holds, so keeping the buttons alive costs a map entry and
         // dropping them early would cost a human their thumb.
         for (const [deliveryId, card] of this.reviewCards) {
-            if (card.settled === null || !expired(card.deliveredAtMs))
+            if (card.settled === null || !expired(card.deliveredAtMs, null))
                 continue;
             this.reviewCards.delete(deliveryId);
             this.reviewNonces.delete(card.nonce);
@@ -2289,20 +3039,41 @@ export class TelegramChannel {
             await this.settleMember(digest, actionKey, outcome, detail);
             return;
         }
-        const settledKey = this.disarm(deliveryId);
-        const text = [
+        const settled = this.disarm(deliveryId);
+        const technicalText = [
             `<b>${escapeHtml(outcome)}</b>`,
-            `<code>${escapeHtml(actionKey ?? settledKey)}</code>`,
+            `<code>${escapeHtml(actionKey ?? settled.actionKey)}</code>`,
             "",
             ...detail.map((entry) => escapeHtml(entry)),
         ].join("\n");
-        await this.call("editMessageText", {
+        // APRV-489. A minimal card keeps its headline and its collapsed details
+        // under the outcome, so the settled message still holds the canonical
+        // rendering the approver answered on. Should that not fit, the technical
+        // annotation is the fallback: the outcome is what the edit must carry.
+        const text = settled.card === undefined ? technicalText : minimalSettleText(outcome, detail, settled.card);
+        const edit = (body) => this.call("editMessageText", {
             chat_id: this.chatId,
             message_id: Number(deliveryId),
-            text,
+            text: body,
             parse_mode: "HTML",
             disable_web_page_preview: true,
         });
+        if (settled.card === undefined) {
+            await edit(text);
+            return;
+        }
+        // Fix round 2, S3: a minimal card is the only message holding its request,
+        // so a refused settle edit would leave a live-looking card on a decided
+        // request. The short settle text always fits and always says the outcome.
+        try {
+            await edit(text);
+        }
+        catch (cause) {
+            if (!isMessageRefusal(cause) || isMessageNotModified(cause))
+                throw cause;
+            this.complain(`approval: telegram refused the settle edit of ${settled.actionKey}; sending the short form`);
+            await edit(shortSettleText(outcome, actionKey ?? settled.actionKey, detail));
+        }
     }
     /**
      * The withdrawal case of {@link annotate} (APRV-106), and the one the
@@ -2311,6 +3082,51 @@ export class TelegramChannel {
     async retract(deliveryId, reason, actionKey) {
         await this.annotate(deliveryId, TELEGRAM_TERMINAL_HEADLINES.withdrawn, [reason], actionKey);
     }
+    /**
+     * The action keys whose card a refused or failed tap disarmed since the last
+     * call, and forget them (APRV-442).
+     *
+     * The listener's dispatch cycle calls this once per cycle and offers a fresh
+     * card for every key the verified log still calls pending. It is a statement
+     * about this process's cards and nothing else: it carries no decision, no
+     * sender and no outcome, and a key in it that the log has since settled is
+     * simply not offered.
+     */
+    takeReleased() {
+        const keys = [...this.released];
+        this.released.clear();
+        return keys;
+    }
+    /**
+     * Mark `delivery`'s card dead and its request released, BEFORE the
+     * annotation that disarms it (APRV-442).
+     *
+     * Every nonce still armed for this request on this message is recorded in
+     * {@link refusedNonces}, together with the nonce the tap carried (which
+     * differs when the tap came from an earlier copy through the fallback), so
+     * none of those bytes can later resolve to the fresh card. On a digest only
+     * this member's nonce is taken: its siblings stay armed on the digest.
+     */
+    release(delivery, tapNonce) {
+        const dead = [tapNonce];
+        for (const [nonce, entry] of this.deliveries) {
+            if (entry.deliveryId === delivery.deliveryId && entry.actionKey === delivery.actionKey) {
+                dead.push(nonce);
+            }
+        }
+        for (const nonce of dead) {
+            // Re-inserted so a nonce marked again counts as the newest.
+            this.refusedNonces.delete(nonce);
+            this.refusedNonces.add(nonce);
+        }
+        while (this.refusedNonces.size > TELEGRAM_REFUSED_NONCE_CAP) {
+            const oldest = this.refusedNonces.values().next().value;
+            if (oldest === undefined)
+                break;
+            this.refusedNonces.delete(oldest);
+        }
+        this.released.add(delivery.actionKey);
+    }
     /**
      * Send one plain message that carries no question (APRV-196).
      *
@@ -2379,6 +3195,7 @@ export class TelegramChannel {
      * decision", not "deliver once at startup, then wait forever".
      */
     async listen(options = {}) {
+        this.claimOrThrow("poll");
         this.stopped = false;
         let backoff = this.backoffMs;
         /**
@@ -2447,6 +3264,7 @@ export class TelegramChannel {
      * what {@link listen} catches and retries.
      */
     async pollOnce() {
+        this.claimOrThrow("poll");
         // APRV-135. Before the long poll, not after: this is where the loop is
         // about to block for up to `pollTimeoutSeconds`, and a sweep that ran after
         // the block would be a sweep that never runs on a quiet chat. Rate-limited
@@ -2458,34 +3276,162 @@ export class TelegramChannel {
         const updates = await this.call("getUpdates", {
             offset: this.offset,
             timeout: this.pollTimeoutSeconds,
-            // APRV-216. `message` is asked for only while a command handler is
-            // registered: see {@link onCommand} for why a listener that reads
-            // messages nobody asked for would break `approval setup channel
-            // telegram`'s chat discovery.
-            // APRV-299 adds the second reason to read messages: a `loved` or
-            // `disliked` on a review card collects the human's words as a REPLY,
-            // because an inline keyboard has no text input.
-            allowed_updates: this.commandHandler === null && this.reviewHandler === null
-                ? ["callback_query"]
-                : ["callback_query", "message"],
+            allowed_updates: this.allowedUpdates(),
         }, this.requestTimeoutMs ?? (this.pollTimeoutSeconds + 10) * 1000);
-        const result = {
-            updates: 0,
-            outcomes: [],
-            ignored: [],
-            commands: [],
-            reviews: [],
+        const result = emptyPollResult();
+        for (const raw of updates)
+            await this.intake(raw, result);
+        return result;
+    }
+    /**
+     * Which update types this channel asks for, on either transport (APRV-424).
+     *
+     * APRV-216. `message` is asked for only while a command handler is
+     * registered: see {@link onCommand} for why a listener that reads messages
+     * nobody asked for would break `approval setup channel telegram`'s chat
+     * discovery. APRV-299 adds the second reason to read messages: a `loved` or
+     * `disliked` on a review card collects the human's words as a REPLY, because
+     * an inline keyboard has no text input.
+     *
+     * One function since APRV-424, because `setWebhook` takes the same list as
+     * `getUpdates` and two spellings of it would be two answers to "what does
+     * this listener read" — with the webhook's answer frozen at registration
+     * time, where nobody would look for it.
+     */
+    allowedUpdates() {
+        return this.commandHandler === null && this.reviewHandler === null
+            ? ["callback_query"]
+            : ["callback_query", "message"];
+    }
+    /**
+     * One update, from whichever transport carried it (APRV-424).
+     *
+     * The whole of what the webhook adds is the ARRIVAL. Everything a tap then
+     * passes through — the chat check, `senderOf`, the checkpoint and review
+     * parsers, the resolution ladder, the early ack, `this.handler` and the
+     * annotation written from the record the gate appended — is
+     * {@link handleUpdate}, called from here and from {@link pollOnce}, and
+     * there is no second copy of any of it. `tests/telegram-webhook.test.ts`
+     * drives one callback through both entry points and compares the records the
+     * log ends up holding.
+     *
+     * The sweep is `pollOnce`'s, for `pollOnce`'s reason: this is the moment the
+     * process is about to be idle, and a channel that only ever wakes for taps
+     * would otherwise never run one.
+     */
+    async deliverUpdate(update) {
+        this.claimOrThrow("webhook");
+        const nowMs = this.now();
+        if (nowMs - this.lastSweepMs >= TELEGRAM_SWEEP_INTERVAL_MS)
+            this.sweep(nowMs);
+        const result = emptyPollResult();
+        await this.intake(update, result);
+        return result;
+    }
+    /** The per-update bookkeeping both transports do, before `handleUpdate`. */
+    async intake(raw, result) {
+        const update = (raw ?? {});
+        const id = update["update_id"];
+        // Meaningless on the webhook, where Telegram acknowledges by the HTTP
+        // response, and harmless: the offset is read by `getUpdates` alone, and a
+        // channel that has claimed the webhook transport never issues one.
+        if (typeof id === "number")
+            this.offset = Math.max(this.offset, id + 1);
+        this.counters.updates += 1;
+        result.updates += 1;
+        await this.handleUpdate(update, result);
+    }
+    /**
+     * Bind this channel to one transport, or say which one already holds it
+     * (APRV-424).
+     *
+     * Idempotent for the transport already claimed, so a webhook server that
+     * claims at start-up and then delivers, or a driver calling `pollOnce` in a
+     * loop, pays nothing. Not released by {@link stop}: a process that stopped
+     * polling has not stopped being a poller, and re-pointing a live channel's
+     * delivery maps at a second arrival path is the state this exists to refuse.
+     */
+    claimTransport(transport) {
+        if (this.transport === null || this.transport === transport) {
+            this.transport = transport;
+            return { ok: true, transport };
+        }
+        return {
+            ok: false,
+            code: "transport-conflict",
+            message: `this channel is already receiving updates by ${this.transport}, so it cannot also receive them by ${transport}. Long polling and a webhook are alternatives per bot: the Bot API refuses getUpdates outright while a webhook is set, and a process running both would answer a tap from whichever half reached it first`,
         };
-        for (const raw of updates) {
-            const update = (raw ?? {});
-            const id = update["update_id"];
-            if (typeof id === "number")
-                this.offset = Math.max(this.offset, id + 1);
-            this.counters.updates += 1;
-            result.updates += 1;
-            await this.handleUpdate(update, result);
+    }
+    /** {@link claimTransport}, for the paths where a refusal is a caller's bug. */
+    claimOrThrow(transport) {
+        const claim = this.claimTransport(transport);
+        if (!claim.ok)
+            throw new TelegramTransportError(claim.message);
+    }
+    // -------------------------------------------------------------------------
+    // Webhook registration (APRV-424)
+    // -------------------------------------------------------------------------
+    /**
+     * Point this bot's updates at `url`, and require `secret` on every post.
+     *
+     * Three properties, and each is a refusal to be clever:
+     *
+     * - **The secret is Telegram's own mechanism**, `secret_token`, echoed back
+     *   on every delivery in the `X-Telegram-Bot-Api-Secret-Token` header. The
+     *   receiver compares it and refuses anything else, so a URL that leaks (a
+     *   proxy log, a referrer, a screenshot) is a URL that still decides
+     *   nothing.
+     * - **It is redacted from this moment on.** The value is added to the
+     *   channel's secret list BEFORE the call, so a Bot API error that quotes
+     *   the request cannot print it.
+     * - **Pending updates are kept.** `drop_pending_updates` is left false:
+     *   taps that arrived while the process was down are the approver's answers,
+     *   and the gate is what decides whether they are still honourable.
+     */
+    async registerWebhook(url, secret) {
+        if (secret.length > 0 && !this.secrets.some((held) => held.value === secret)) {
+            this.secrets.push({ value: secret, label: "<webhook secret redacted>" });
         }
-        return result;
+        await this.call("setWebhook", {
+            url,
+            secret_token: secret,
+            allowed_updates: this.allowedUpdates(),
+            drop_pending_updates: false,
+        });
+    }
+    /**
+     * Take this bot's webhook away, so `getUpdates` works again.
+     *
+     * Called on a clean stop of the webhook runner. Pending updates are kept for
+     * {@link registerWebhook}'s reason: the next process to start — a poller or
+     * another webhook — is entitled to the taps that arrived in between.
+     *
+     * `timeoutMs` is what the stop path passes, and it is shorter than this
+     * channel's ordinary request timeout on purpose (APRV-424, second review,
+     * note 6). A stop already waits for the receiver to drain, and an operator
+     * pressing Ctrl-C a second time is asking for the process to end: half a
+     * minute of an unreachable Bot API on top of that reads as a hang, and the
+     * webhook it failed to remove is reported rather than silently retried.
+     */
+    async deleteWebhook(timeoutMs) {
+        await this.call("deleteWebhook", { drop_pending_updates: false }, ...(timeoutMs === undefined ? [] : [timeoutMs]));
+    }
+    /**
+     * What the Bot API says is receiving this bot's updates right now.
+     *
+     * The one authority on the question, and the reason it is asked at start-up
+     * by both transports: the ownership registry knows about processes on THIS
+     * machine, and a webhook registered from a laptop in another timezone is
+     * still a webhook swallowing every tap this poller is waiting for.
+     */
+    async webhookInfo() {
+        const result = await this.call("getWebhookInfo", {});
+        const url = result["url"];
+        const pending = result["pending_update_count"];
+        return {
+            url: typeof url === "string" ? url : "",
+            pendingUpdateCount: typeof pending === "number" ? pending : 0,
+        };
     }
     /**
      * Exactly one `answerCallbackQuery` per callback query, on every path
@@ -2676,7 +3622,21 @@ export class TelegramChannel {
         // the log when neither is holding the action open.
         let delivery = this.deliveries.get(parsed.nonce);
         let viaStaleCopy = false;
-        if (delivery === undefined && parsed.actionRef !== null) {
+        // APRV-442. A card a refused tap disarmed stays dead: its bytes take no
+        // fallback to the fresh card the listener sends for the same request, so
+        // a redelivered or replayed refused tap reaches neither the gate nor the
+        // new card, exactly as it did before that card existed.
+        const refusedCard = delivery === undefined && this.refusedNonces.has(parsed.nonce);
+        // APRV-456. With the fallback off, a nonce this process is not holding is
+        // the end of the road: no action-reference lookup, no log probe, and never
+        // the decision handler. Behind a relay, a button carrying a real action's
+        // reference may sit under text this gate never wrote, and the approver's
+        // genuine tap would otherwise pass the chat check and the sender mapping.
+        if (delivery === undefined && !refusedCard && !this.staleCopy) {
+            await this.refuseUnissued(parsed, callbackId, result, sender);
+            return;
+        }
+        if (delivery === undefined && parsed.actionRef !== null && !refusedCard) {
             // The pre-restart copy. Its nonce died with the process that issued it,
             // but the request it names is one THIS process has since re-delivered, so
             // the tap decides that request — on the live copy's message, which is
@@ -2687,18 +3647,21 @@ export class TelegramChannel {
             viaStaleCopy = delivery !== undefined;
         }
         if (delivery === undefined) {
-            if (parsed.actionRef !== null) {
+            if (parsed.actionRef !== null && !refusedCard) {
                 // Nothing open here for that action. Say what the log says, which is
                 // the only thing that knows: decided, lapsed, withdrawn, or unknown.
                 const described = this.describeAction?.(parsed.actionRef) ?? null;
                 await this.ignore(result, callbackId, "stale-copy", `no open delivery for action ref ${JSON.stringify(parsed.actionRef)} (an earlier copy of a request this listener is not holding open)`, described ?? TELEGRAM_STALE_UNKNOWN);
                 return;
             }
-            await this.ignore(result, callbackId, "unknown-callback", `no delivery for nonce ${JSON.stringify(parsed.nonce)} (a restarted listener forgets its buttons; the pending queue is re-sent on start)`, 
-            // Two ways to get here, and the reply has to serve both: a button this
-            // process never issued (a restart forgot it), and a button on a message
-            // this process has already annotated (APRV-113 forgets the nonce with
-            // the edit). Either way the message text is the thing to read.
+            await this.ignore(result, callbackId, "unknown-callback", refusedCard
+                ? `nonce ${JSON.stringify(parsed.nonce)} is on a card a refused tap disarmed (APRV-442); the request, if still pending, is on a newer card`
+                : `no delivery for nonce ${JSON.stringify(parsed.nonce)} (a restarted listener forgets its buttons; the pending queue is re-sent on start)`, 
+            // Three ways to get here, and the reply has to serve all of them: a
+            // button this process never issued (a restart forgot it), a button on a
+            // message this process has already annotated (APRV-113 forgets the
+            // nonce with the edit), and a button on a card a refused tap disarmed
+            // (APRV-442). Either way the message text is the thing to read.
             "This button is no longer live — read the message for the outcome, or the newest message for the request.");
             return;
         }
@@ -2714,6 +3677,9 @@ export class TelegramChannel {
             ...(delivery.batchDeliveryId === undefined
                 ? {}
                 : { batchDeliveryId: delivery.batchDeliveryId }),
+            // APRV-489. The layout THIS card was drawn in, from this process's own
+            // record of what it sent; nothing in the tap chooses it.
+            ...(delivery.rendering === undefined ? {} : { rendering: delivery.rendering }),
             ...(parsed.decision === "reject"
                 ? { note: `${TELEGRAM_REJECT_NOTE} (callback ${callbackId})` }
                 : {}),
@@ -2739,6 +3705,9 @@ export class TelegramChannel {
             outcome = this.handler(decision);
         }
         catch (cause) {
+            // APRV-442: the card is about to be disarmed and nothing settled the
+            // request. Marked BEFORE the annotation, which forgets the nonces.
+            this.release(delivery, parsed.nonce);
             await this.annotateQuietly(delivery.deliveryId, delivery.actionKey, TELEGRAM_NOT_RECORDED, [
                 TELEGRAM_HANDLER_FAILED,
             ]);
@@ -2763,6 +3732,18 @@ export class TelegramChannel {
             // message, which is right in both directions: a terminal request has no
             // decision left to collect, and a still-pending one is re-delivered as a
             // fresh prompt by the next dispatch cycle.
+            //
+            // APRV-442. That re-delivery used to be a promise nothing kept: the
+            // disarm forgets the card's nonces, but the listener's own bookkeeping
+            // went on saying the request was on the phone, so the cycle never sent
+            // it again and the original card's action-reference fallback found
+            // nothing live. A wrong account's tap made the prompt dead until a
+            // restart. Releasing names this CARD as gone and nothing else; the cycle
+            // re-derives from the verified log whether the request is still pending
+            // before it offers a new one. Marked BEFORE the annotation, which forgets
+            // the nonces it records. The refusal itself, its record and its wording
+            // are untouched.
+            this.release(delivery, parsed.nonce);
             await this.annotateQuietly(delivery.deliveryId, delivery.actionKey, TELEGRAM_NOT_RECORDED, [
                 this.answerFor(outcome),
             ]);
@@ -2825,12 +3806,14 @@ export class TelegramChannel {
         let landed = 0;
         const refusals = [];
         for (const member of open) {
+            const allRendering = this.digestRendering(digest.stale !== null);
             const one = {
                 action_key: member.actionKey,
                 decision,
                 deliveryId: digest.deliveryId,
                 batchDeliveryId: digest.batchDeliveryId,
                 ...(sender === undefined ? {} : { sender }),
+                ...(allRendering === undefined ? {} : { rendering: allRendering }),
                 ...(decision === "reject"
                     ? { note: `${TELEGRAM_REJECT_NOTE} (callback ${callbackId}, all)` }
                     : {}),
@@ -3000,31 +3983,88 @@ export class TelegramChannel {
             await this.ignore(result, callbackId, "unknown-callback", "a review tap arrived before the runtime registered a review handler", "The runtime is not ready to record reviews.");
             return;
         }
+        // PR #614 refutation F3. An armed Deny and a held grade are one account's
+        // unfinished review. A tap that would finish either (any verdict, or a
+        // grade landing on an armed Deny) from a different account is refused on
+        // the card, so a record never carries a grade or a denial its reviewer did
+        // not tap. A grade tapped with nothing armed only replaces the held grade
+        // and is not refused: it finishes nothing, and its new holder is the tapper.
+        const tapper = sender === undefined ? null : sender.id;
+        const finishes = tap.choice === "ok" || tap.choice === "deny" || state.denyArmed;
+        const othersArm = state.denyArmed && state.armedBy !== tapper;
+        const othersGrade = state.heldReaction !== null && state.heldBy !== tapper;
+        if (finishes && (othersArm || (othersGrade && (tap.choice === "ok" || tap.choice === "deny")))) {
+            state.notice = { headline: TELEGRAM_NOT_RECORDED, lines: [TELEGRAM_REVIEW_OTHER_SENDER] };
+            await this.safeAnswer(callbackId, TELEGRAM_REVIEW_OTHER_SENDER);
+            await this.redrawReview(state);
+            return;
+        }
         // The first Deny tap arms and writes nothing. Stated on the card, so the
         // approver reads the state rather than inferring it from a toast.
+        //
+        // PR #614 recheck NF-1: arming is earned the way a held grade is. The tap
+        // goes to the runtime with NO verdict, and the card arms only when the
+        // answer is `verdict-required`, which the runtime gives only after the
+        // sender and the class's roster have passed. An unmapped or off-roster
+        // account's Deny is refused on the card with its own code and arms
+        // nothing, so it cannot leave a half-finished denial that blocks the
+        // approvers' taps.
         if (tap.choice === "deny" && !state.denyArmed) {
-            state.denyArmed = true;
-            state.notice = null;
-            await this.safeAnswer(callbackId, TELEGRAM_REVIEW_ARM_TOAST);
-            await this.redrawReview(state);
+            const answered = await this.recordReview(state, {
+                sampleSeq: state.card.sampleSeq,
+                ...(sender === undefined ? {} : { sender }),
+            }, result, { kind: "deny", by: tapper });
+            await this.safeAnswer(callbackId, state.denyArmed ? TELEGRAM_REVIEW_ARM_TOAST : answered?.toast ?? TELEGRAM_NOT_RECORDED);
             return;
         }
-        const verdict = state.denyArmed ? "denied" : "ok";
         if (tap.choice === "ok" || tap.choice === "deny") {
             // `ok` with deny armed is a correction, and it disarms: a human who
             // reached for Deny and then chose OK meant OK, and nothing was written in
             // between for the change of mind to contradict.
             const chosen = tap.choice === "deny" ? "denied" : "ok";
             state.denyArmed = chosen === "denied";
+            if (!state.denyArmed)
+                state.armedBy = null;
+            // APRV-482: a grade held from before the verdict rides with it, and a
+            // grade that wants words asks for them now, exactly as a grade tapped
+            // after an armed Deny always has. The pair core refuses outright is sent
+            // straight through, so no note is collected for a record that will not
+            // exist.
+            const held = state.heldReaction;
+            if (held !== null) {
+                const conflicts = chosen === "denied" && (held === "liked" || held === "loved");
+                if (!conflicts && (held === "loved" || held === "disliked")) {
+                    await this.safeAnswer(callbackId, TELEGRAM_REVIEW_NOTE_TOAST);
+                    await this.askForNote(state, chosen, held, sender);
+                    return;
+                }
+            }
             await this.safeAnswer(callbackId, TELEGRAM_REVIEW_ACK);
             await this.recordReview(state, {
                 sampleSeq: state.card.sampleSeq,
                 verdict: chosen,
+                ...(held === null ? {} : { reaction: held }),
                 ...(sender === undefined ? {} : { sender }),
             }, result);
             return;
         }
         const reaction = tap.choice;
+        if (!state.denyArmed) {
+            // APRV-482. A grade with no verdict is not an approval. The card holds
+            // the grade (process memory, stated in its heading) and the tap still
+            // goes to the runtime with NO verdict, so the refusal on the card is the
+            // core's own `verdict-required` and its words, and the operator's stderr
+            // says the same. No note is asked for: words for a record that is about
+            // to be refused would be attention spent on nothing.
+            await this.safeAnswer(callbackId, TELEGRAM_REVIEW_ACK);
+            await this.recordReview(state, {
+                sampleSeq: state.card.sampleSeq,
+                reaction,
+                ...(sender === undefined ? {} : { sender }),
+            }, result, { kind: "grade", reaction, by: tapper });
+            return;
+        }
+        const verdict = "denied";
         // The two grades that require the human's own words ask for them FIRST, and
         // nothing is appended until the reply arrives. The exception is the pair
         // `core/audit.ts` refuses outright: a denied review that says liked or
@@ -3056,26 +4096,75 @@ export class TelegramChannel {
      * stays open, and a fresh card is offered — and can never cost a record
      * nobody asked for.
      *
-     * A second prompt replaces the first: only one grade can be outstanding on
-     * one card, and the older prompt stops resolving so a late reply to it lands
-     * nowhere rather than recording a grade the human moved on from.
+     * Only one grade can be outstanding on one card, so a second prompt that is
+     * SENT replaces the first, and the older prompt stops resolving: a late reply
+     * to it lands nowhere rather than recording a grade the human moved on from.
+     *
+     * APRV-492, and the relay licenses one prompt per GRADE tap, so which taps
+     * get a prompt sent is not this method's choice alone. Three rules:
+     *
+     * - A tap that would ask the SAME question again (same verdict, same grade,
+     *   same account: a doubled OK or a doubled second Deny) sends nothing. The
+     *   prompt on screen already collects those words, and a second send would
+     *   be refused.
+     * - A prompt for a DIFFERENT VERDICT retires the old one BEFORE the send. A
+     *   verdict change is not a grade tap, so the relay refuses that send, and an
+     *   old prompt left live would record the verdict the human just changed. A
+     *   note may be lost this way; a wrong verdict is never recorded.
+     * - A prompt for the same verdict and a different grade follows a grade tap,
+     *   which the relay licenses, and retires the old one only once the new send
+     *   has succeeded. A send that fails anyway (the network, not the relay)
+     *   leaves the old prompt live, and a reply to it records the grade the old
+     *   prompt names in its own text, not the one the card now holds: an
+     *   accepted residual (PR #619 refutation S2).
+     *
+     * A send that fails says so on the card, because the toast already told the
+     * human to reply to a prompt: the note was not asked for, nothing was
+     * recorded, and a grade tap asks again. Then it throws, so the operator hears
+     * of it. A later prompt that is sent clears that line.
      */
     async askForNote(state, verdict, reaction, sender) {
-        if (state.awaitingNote !== null)
-            this.reviewNotePrompts.delete(state.awaitingNote.promptId);
+        const waiting = state.awaitingNote;
+        if (waiting !== null &&
+            waiting.verdict === verdict &&
+            waiting.reaction === reaction &&
+            waiting.sender?.id === sender?.id &&
+            this.reviewNotePrompts.get(waiting.promptId) === state.deliveryId) {
+            return;
+        }
+        if (waiting !== null && waiting.verdict !== verdict) {
+            this.reviewNotePrompts.delete(waiting.promptId);
+            state.awaitingNote = null;
+        }
         const lines = reviewNotePromptLines(reaction, verdict, state.card.fields.action_key.value);
-        const sent = await this.call("sendMessage", {
-            chat_id: this.chatId,
-            text: lines
-                .map((entry, index) => (index === 0 ? `<b>${escapeHtml(entry)}</b>` : escapeHtml(entry)))
-                .join("\n"),
-            parse_mode: "HTML",
-            disable_web_page_preview: true,
-            reply_markup: { force_reply: true },
-        });
+        let sent;
+        try {
+            sent = await this.call("sendMessage", {
+                chat_id: this.chatId,
+                text: lines
+                    .map((entry, index) => (index === 0 ? `<b>${escapeHtml(entry)}</b>` : escapeHtml(entry)))
+                    .join("\n"),
+                parse_mode: "HTML",
+                disable_web_page_preview: true,
+                reply_markup: { force_reply: true },
+            });
+        }
+        catch (cause) {
+            state.notice = { headline: TELEGRAM_NOT_RECORDED, lines: [telegramReviewNoteUnasked(verdict)] };
+            await this.redrawReview(state);
+            throw cause;
+        }
         const promptId = String(sent.message_id);
+        if (state.awaitingNote !== null)
+            this.reviewNotePrompts.delete(state.awaitingNote.promptId);
         state.awaitingNote = { promptId, verdict, reaction, ...(sender === undefined ? {} : { sender }) };
         this.reviewNotePrompts.set(promptId, state.deliveryId);
+        const unasked = state.notice?.lines;
+        if (unasked?.length === 1 &&
+            (unasked[0] === telegramReviewNoteUnasked("ok") || unasked[0] === telegramReviewNoteUnasked("denied"))) {
+            state.notice = null;
+            await this.redrawReview(state);
+        }
     }
     /**
      * A message replying to an outstanding note prompt (APRV-299).
@@ -3147,13 +4236,25 @@ export class TelegramChannel {
      * to say which half they meant, and `note-required` asks for words — so the
      * buttons stay, with the refusal rendered above them and the arming intact.
      */
-    async recordReview(state, tap, result) {
+    async recordReview(state, tap, result, 
+    /**
+     * A lone grade to hold, or a Deny to arm, if the runtime answers
+     * `verdict-required` (PR #614 refutation N6/F3, recheck NF-1): only then
+     * has the tapper passed the sender and roster checks, so only then is the
+     * half-finished review theirs to finish.
+     */
+    hold) {
         const handler = this.reviewHandler;
         if (handler === null)
-            return;
+            return null;
+        // APRV-481: whether the bytes were on this card is the card's own fact,
+        // decided by the same pure view that drew it, so the record's payload hash
+        // can never name more than the reviewer was shown.
+        const view = reviewPayloadView(state.card);
+        const sent = view.kind === "bytes" ? { ...tap, payloadHash: view.hash } : tap;
         let response;
         try {
-            response = await handler(tap);
+            response = await handler(sent);
         }
         catch (cause) {
             state.notice = { headline: TELEGRAM_NOT_RECORDED, lines: [TELEGRAM_HANDLER_FAILED] };
@@ -3161,11 +4262,14 @@ export class TelegramChannel {
             throw cause;
         }
         this.counters.reviews += 1;
-        result.reviews.push({ tap, ok: response.ok });
+        result.reviews.push({ tap: sent, ok: response.ok });
         if (response.ok) {
             state.settled = { headline: response.headline, detail: response.detail };
             state.notice = null;
             state.denyArmed = false;
+            state.heldReaction = null;
+            state.armedBy = null;
+            state.heldBy = null;
             this.reviewNonces.delete(state.nonce);
             if (state.awaitingNote !== null) {
                 this.reviewNotePrompts.delete(state.awaitingNote.promptId);
@@ -3174,8 +4278,23 @@ export class TelegramChannel {
         }
         else {
             state.notice = { headline: response.headline, lines: response.detail };
+            if (hold !== undefined && response.code === "verdict-required") {
+                if (hold.kind === "grade") {
+                    state.heldReaction = hold.reaction;
+                    state.heldBy = hold.by;
+                }
+                else {
+                    // The armed state is the card's message; the refusal that earned it
+                    // is the runtime's word for "a verdict is still needed", which the
+                    // armed heading already says.
+                    state.denyArmed = true;
+                    state.armedBy = hold.by;
+                    state.notice = null;
+                }
+            }
         }
         await this.redrawReview(state);
+        return response;
     }
     /** One `editMessageText` that replaces a review card's text and its keyboard. */
     async redrawReview(state) {
@@ -3200,6 +4319,81 @@ export class TelegramChannel {
             this.complain(`approval: telegram could not redraw the review card for sample seq ${String(state.card.sampleSeq)} (message ${state.deliveryId}): ${this.describe(cause)} — the log is what it is; only the message is stale`);
         }
     }
+    /**
+     * Refuse a decision tap whose nonce this process is not holding, with the
+     * stale-copy fallback off (APRV-456).
+     *
+     * What it does, in order, and what it never does:
+     *
+     * - It never calls the decision handler, so the gate is never asked. That is
+     *   the property: a button this process did not put on the screen cannot
+     *   carry a human's tap to `decide()`, whatever reference it carries.
+     * - It looks the reference up among the deliveries THIS process holds open,
+     *   and only to name the action on the audit record. A reference that names
+     *   nothing open here produces no record: there is no action key this
+     *   process could truthfully write, and inventing one from bytes that came
+     *   off the network is the self-report §11.1 invariant 4 forbids.
+     * - It hands at most one record per nonce to {@link onRefusedDecision}: a
+     *   redelivered or replayed tap on the same button is refused with the same
+     *   toast and records nothing.
+     * - It leaves the live card alone. The request stays pending, and the card
+     *   this process did send still decides it.
+     *
+     * "Not holding" covers a nonce this process never issued and one it issued
+     * and has since forgotten (an annotated card, a swept delivery, a restart).
+     * It does not try to tell them apart: a set of every nonce ever issued would
+     * reopen the hole for anyone who has seen one genuine button's bytes, because
+     * an old nonce with a new reference would pass it. The cost is that a tap on
+     * an earlier copy after a restart is refused on this shape and the approver
+     * taps the newest card, which the restart banner says.
+     */
+    async refuseUnissued(parsed, callbackId, result, sender) {
+        this.counters.staleCopyRefusals += 1;
+        const live = parsed.actionRef === null ? undefined : this.liveDeliveryFor(parsed.actionRef);
+        const repeat = this.unissuedRefused.has(parsed.nonce);
+        // Re-inserted so a nonce refused again counts as the newest, and capped:
+        // memory, never a decision. A nonce that falls off the end is refused again
+        // and may record again, which is volume and nothing else.
+        this.unissuedRefused.delete(parsed.nonce);
+        this.unissuedRefused.add(parsed.nonce);
+        while (this.unissuedRefused.size > TELEGRAM_REFUSED_NONCE_CAP) {
+            const oldest = this.unissuedRefused.values().next().value;
+            if (oldest === undefined)
+                break;
+            this.unissuedRefused.delete(oldest);
+        }
+        // APRV-456 refutation S4: the nonce is NOT quoted here. This message becomes
+        // `payload.message` on the audit record, and the nonce is bytes whoever
+        // made the card chose; quoting it would let a forger write text of their
+        // choosing into the hash-chained log, one tap at a time.
+        const message = `${parsed.decision} tap refused: its button carries a nonce this listener is not holding, and this listener's stale-copy fallback is off (a relayed channel, or --no-stale-copy). It was not carried to the gate by its action reference, because behind a relay a button with a real request's reference can sit under text this gate never sent. Nothing was decided; the request, if pending, is still open on the newest card this listener sent.`;
+        const refusal = { ok: false, code: "nonce-not-issued", message };
+        result.refused.push({
+            code: refusal.code,
+            action_key: live?.actionKey ?? null,
+            detail: message,
+        });
+        this.complain(`approval: telegram refused a callback (nonce-not-issued): nonce ${JSON.stringify(parsed.nonce)}${live === undefined ? "" : ` for ${live.actionKey}`}${repeat ? " (again; not recorded twice)" : ""}`);
+        // The toast first: it is the only answer this query gets, and the record
+        // below changes nothing about what the person is told.
+        await this.safeAnswer(callbackId, refusedDecisionLine(refusal.code));
+        if (live === undefined || repeat || this.refusedDecisionHandler === null)
+            return;
+        const decision = {
+            action_key: live.actionKey,
+            decision: parsed.decision,
+            deliveryId: live.deliveryId,
+            ...(sender === undefined ? {} : { sender }),
+        };
+        try {
+            this.refusedDecisionHandler({ decision, refusal });
+        }
+        catch (cause) {
+            // Best effort by contract: the refusal has happened and been told; only
+            // the record is lost, and the operator hears that here.
+            this.complain(`approval: telegram could not record a nonce-not-issued refusal for ${live.actionKey}: ${this.describe(cause)}`);
+        }
+    }
     async ignore(result, callbackId, kind, detail, reply) {
         this.counters.anomalies[kind] += 1;
         result.ignored.push({ kind, detail });
@@ -3274,9 +4468,20 @@ export class TelegramChannel {
     // -------------------------------------------------------------------------
     // Transport
     // -------------------------------------------------------------------------
-    /** Replace the token with a placeholder anywhere it appears in `text`. */
+    /**
+     * Replace every secret this channel holds with a placeholder in `text`.
+     *
+     * The bot token always, and since APRV-424 the webhook `secret_token` too,
+     * from the moment {@link registerWebhook} is handed it. Both are values that
+     * only ever travel TO the Bot API, so anything coming back that quotes one
+     * is a diagnostic about to print a credential.
+     */
     redact(text) {
-        return this.token.length === 0 ? text : text.split(this.token).join("<token redacted>");
+        let redacted = text;
+        for (const secret of this.secrets) {
+            redacted = redacted.split(secret.value).join(secret.label);
+        }
+        return redacted;
     }
     describe(cause) {
         return this.redact(cause instanceof Error ? cause.message : String(cause));
@@ -3291,26 +4496,30 @@ export class TelegramChannel {
      * replace the real reason with a worse one.
      */
     async describeFailure(response) {
+        const nothing = { description: null, retryAfterSeconds: null };
         let body;
         try {
             body = await response.text();
         }
         catch {
-            return null;
+            return nothing;
         }
         let parsed;
         try {
             parsed = JSON.parse(body);
         }
         catch {
-            return null;
+            return nothing;
         }
         if (parsed === null || typeof parsed !== "object")
-            return null;
+            return nothing;
         const description = parsed["description"];
-        if (typeof description !== "string" || description.length === 0)
-            return null;
-        return this.redact(description);
+        return {
+            description: typeof description !== "string" || description.length === 0 ? null : this.redact(description),
+            // PR #614 recheck NF-2: a 429 says how long to wait, and the review
+            // walkthrough honours it rather than spending its retry budget early.
+            retryAfterSeconds: retryAfterFrom(parsed),
+        };
     }
     /**
      * One Bot API call.
@@ -3340,10 +4549,10 @@ export class TelegramChannel {
                 // was thrown out of were the same "HTTP 400" on the operator's
                 // terminal. Read best effort — a status is still worth reporting when
                 // the body is missing, truncated, or not JSON at all.
-                const description = await this.describeFailure(response);
+                const { description, retryAfterSeconds } = await this.describeFailure(response);
                 throw new TelegramApiError(description === null
                     ? `${method}: HTTP ${response.status}`
-                    : `${method}: HTTP ${response.status} (${description})`, method, response.status, description);
+                    : `${method}: HTTP ${response.status} (${description})`, method, response.status, description, retryAfterSeconds);
             }
             raw = await response.text();
         }
@@ -3377,7 +4586,7 @@ export class TelegramChannel {
             // No HTTP status: this envelope arrived on a 2xx. The description is
             // carried anyway so a caller reads the same field whichever shape the
             // failure took (APRV-277).
-            null, description);
+            null, description, retryAfterFrom(envelope));
         }
         return envelope["result"];
     }