approval-md 0.4.0 → 0.4.1

package/dist/src/channels/telegram.js

@@ -219,15 +219,16 @@
  * process memory and nothing else: no event is appended, no message is edited,
  * and the log is not opened.
  */
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { GLOSS_UNVERIFIED_SUFFIX, refusedDecisionLine } from "./contract.js";
 // APRV-299. The reaction vocabulary and the verdict type, imported for the
 // reason `core/audit.ts` states where it exports them: they are shown here and
 // decided nowhere. Nothing in this file branches on a reaction, and SPEC.md
 // §11.1 invariant 10's guard scans the modules that decide, which this is not.
 import { REACTIONS } from "../core/audit.js";
-import { TELEGRAM_PROMPT_LAYOUT, } from "../core/prompt-layout.js";
+import { DEFAULT_PROMPT_STYLE, TELEGRAM_PROMPT_LAYOUT, } from "../core/prompt-layout.js";
 import { commandPayloadView, payloadRegionText } from "./payload-view.js";
+import { MINIMAL_DENY_LABEL, renderTelegramMinimal } from "./telegram-minimal.js";
 // ---------------------------------------------------------------------------
 // Configuration
 // ---------------------------------------------------------------------------
@@ -765,6 +766,81 @@ export function renderTelegram(request, heading = TELEGRAM_PROMPT_HEADING, layou
             : `${payload.truncated ? `--- payload TRUNCATED at render (sha256 ${payload.hash}) — no canonical rendering exists; do not grant on this ---\n` : ""}${payloadRegionText(payload, request.class.value)}`,
     };
 }
+/**
+ * The settle edit of a minimal card (APRV-489): the outcome, the card's
+ * headline, the detail lines, and the collapsed block WHOLE.
+ *
+ * The edit replaces the only message that holds the canonical rendering, so
+ * the rendering is never what gives way to fit: the runtime's own detail lines
+ * are shortened instead, with a marker, and the outcome headline always stays.
+ * The card was at most 3800 characters with its quote box and
+ * deadline line, which the edit drops, so headline plus collapsed block always
+ * fit under {@link TELEGRAM_SETTLE_BUDGET} (the card budget is `MINIMAL_MESSAGE_BUDGET` in `telegram-minimal.ts`).
+ */
+export function minimalSettleText(outcome, detail, card) {
+    const head = [`<b>${escapeHtml(outcome)}</b>`, card.headline];
+    // One unit throughout (fix round 2, S3): UTF-16 code units of the HTML,
+    // which is what `.length` counts and never less than the parsed text
+    // Telegram limits. The cut is taken between grapheme clusters of the
+    // UNESCAPED text, so it never splits a surrogate pair, a cluster or an entity.
+    const fixed = [...head, card.details].join("\n").length + 1;
+    const room = Math.max(0, TELEGRAM_SETTLE_BUDGET - fixed);
+    const raw = detail.join("\n");
+    let lines = escapeHtml(raw);
+    if (lines.length > room)
+        lines = shortenHtml(raw, room, SETTLE_SHORTENED_MARK);
+    return [...head, ...(lines.length === 0 ? [] : [lines]), card.details].join("\n");
+}
+/** What a shortened run of detail lines ends with. */
+const SETTLE_SHORTENED_MARK = "… (shortened; the log holds the full record)";
+/** Grapheme clusters, for cuts that never split one. */
+const SETTLE_GRAPHEMES = new Intl.Segmenter("en", { granularity: "grapheme" });
+/** `raw` escaped and cut between clusters so the result, marker included, is at most `budget` UTF-16 units. */
+function shortenHtml(raw, budget, marker) {
+    const limit = Math.max(0, budget - marker.length);
+    let kept = "";
+    for (const { segment } of SETTLE_GRAPHEMES.segment(raw)) {
+        const escaped = escapeHtml(segment);
+        if (kept.length + escaped.length > limit)
+            break;
+        kept += escaped;
+    }
+    return `${kept}${marker}`;
+}
+/**
+ * The settle edit of last resort (fix round 2, S3): sent when Telegram refused
+ * the full settle edit of a minimal card, so a decided card never keeps looking
+ * undecided. The outcome, the request's key, the first detail line (who, when,
+ * which record) cut to fit, and where the rest is. Always under 1000 units.
+ */
+export function shortSettleText(outcome, actionKey, detail) {
+    const first = detail[0] ?? "";
+    return [
+        `<b>${escapeHtml(outcome)}</b>`,
+        `<code>${shortenHtml(actionKey, 200, "")}</code>`,
+        "",
+        ...(first.length === 0 ? [] : [escapeHtml(first).length <= 400 ? escapeHtml(first) : shortenHtml(first, 400, "…")]),
+        "The full record is in the approval log (approval log, approval queue).",
+    ].join("\n");
+}
+/**
+ * Whether a Bot API failure is a refusal of THIS message rather than a passing
+ * failure (fix round 2, S2): any 4xx but 429. A 429, a 5xx and a transport
+ * failure are retried by the dispatch cycle as before; a refusal never will
+ * succeed with the same text, so the minimal card gives way to the technical one.
+ */
+export function isMessageRefusal(cause) {
+    return (cause instanceof TelegramApiError &&
+        cause.status !== null &&
+        cause.status >= 400 &&
+        cause.status < 500 &&
+        cause.status !== 429);
+}
+/**
+ * The longest settle edit of a minimal card, in characters of HTML: under
+ * Telegram's 4096 with room for a relay's `Agent: <name>` line.
+ */
+export const TELEGRAM_SETTLE_BUDGET = 3990;
 /**
  * Split `text` so every chunk survives HTML escaping inside the message limit.
  *
@@ -1336,6 +1412,15 @@ export const TELEGRAM_REVIEW_DENIED = "✗ REVIEWED — DENIED";
  * been recorded.
  */
 export const TELEGRAM_REVIEW_ARMED = "DENY ARMED — nothing is recorded yet";
+/**
+ * The headline a card wears while a grade is held and no verdict has been
+ * given (APRV-482). A grade is not a verdict: tapping one with nothing armed
+ * records nothing, and the card keeps the grade so the OK or the Deny that
+ * follows records it.
+ */
+export function telegramReviewGradeHeld(reaction) {
+    return `GRADE ${reaction.toUpperCase()} HELD — nothing is recorded until you tap OK or Deny`;
+}
 /**
  * What a review tap's single answer says (APRV-302).
  *
@@ -1351,8 +1436,29 @@ export const TELEGRAM_REVIEW_ARMED = "DENY ARMED — nothing is recorded yet";
 export const TELEGRAM_REVIEW_ACK = "Heard — recording your review. The card will say what the log recorded.";
 /** The toast a first Deny tap gets: it says plainly that nothing was written. */
 export const TELEGRAM_REVIEW_ARM_TOAST = "Deny armed — nothing recorded. Tap Deny again to record it, or a reaction to record it with a grade.";
+/**
+ * The card line and toast for a tap that would finish another account's
+ * half-finished review (PR #614 refutation F3): an armed Deny or a held grade
+ * belongs to the account that tapped it, and nothing is recorded. A held grade
+ * is replaced by the tapper's own grade (a grade finishes nothing), which the
+ * line says (PR #614 recheck NF-1, minor). Under 200 characters, the Bot API's
+ * limit for a callback answer.
+ */
+export const TELEGRAM_REVIEW_OTHER_SENDER = "Another account's unfinished review (armed Deny or held grade) is on this card. Nothing was recorded. Tap your own grade to replace a held one; an armed Deny is theirs to finish.";
 /** The toast a reaction that needs the human's own words gets. */
 export const TELEGRAM_REVIEW_NOTE_TOAST = "Heard — reply to the prompt with why. Nothing is recorded until it arrives.";
+/**
+ * The card line for a note prompt that could not be sent (APRV-492). The toast
+ * went out before the send and told the human to reply to a prompt, so the
+ * card says the prompt is not coming and how to be asked again: a grade tap is
+ * what the relay licenses a prompt for. With Deny armed the grade alone asks;
+ * otherwise the grade is held and OK asks.
+ */
+export function telegramReviewNoteUnasked(verdict) {
+    return verdict === "denied"
+        ? "The prompt asking why could not be sent, so nothing was recorded. Tap your grade again to be asked."
+        : "The prompt asking why could not be sent, so nothing was recorded. Tap your grade again, then OK, to be asked.";
+}
 /**
  * What the ForceReply prompt asks for.
  *
@@ -1445,6 +1551,255 @@ function trimNotice(text) {
         ? text
         : `${text.slice(0, REVIEW_NOTICE_MAX)}… (cut to fit one message; the whole refusal is on the listener's stderr)`;
 }
+/**
+ * How much payload, in ESCAPED characters, a review card carries whole
+ * (APRV-480).
+ *
+ * A card is one message edited in place, so it cannot spill the payload over
+ * several messages the way a prompt does: the edit that settles it replaces one
+ * message, and a second message holding the rest of the bytes would outlive the
+ * card it belonged to. So the bytes are shown whole or not at all. Never cut:
+ * a review that recorded a payload hash over bytes the reviewer saw half of
+ * would claim more than they read. This is the CEILING; the budget a given
+ * card gets is {@link reviewPayloadBudget}, which is this or the headroom the
+ * card's own rows leave under {@link TELEGRAM_MAX_MESSAGE_CHARS}, whichever is
+ * smaller (PR #614 refutation F4).
+ */
+export const REVIEW_PAYLOAD_BUDGET = 2000;
+/**
+ * The longest agent-written summary a review card shows, in characters (PR
+ * #614 refutation F4). The summary is the requesting party's own claim and its
+ * schema sets no length, so before this cap an agent could write a summary
+ * that pushed the card past Telegram's limit, which failed the send and held
+ * the review queue. Longer text is cut with a marker saying how much is not
+ * shown; the registration record keeps it whole.
+ */
+export const REVIEW_SUMMARY_MAX = 400;
+/**
+ * How much of each row a review card shows, in characters (PR #614 refutation
+ * F4), tried in order until the card fits one message with the longest
+ * heading, the hash-only payload region and the largest notice a tap can add.
+ * `row` caps the key, class, task, command breakdown, gloss, run time and
+ * outcome; `summary` caps the agent's summary (never above
+ * {@link REVIEW_SUMMARY_MAX}); `origin` caps an author or source label. An
+ * ordinary card fits at the first level and shows its rows as they are; only a
+ * card whose rows are pathologically long is cut further, and the last level
+ * fits whatever the rows hold (pinned by the worst-case test in
+ * `tests/channels-telegram.test.ts`).
+ */
+const REVIEW_CAP_LEVELS = [
+    { row: 300, summary: REVIEW_SUMMARY_MAX, origin: 60 },
+    { row: 160, summary: 240, origin: 40 },
+    { row: 80, summary: 120, origin: 30 },
+    { row: 40, summary: 60, origin: 20 },
+];
+/** The longest notice headline a review card shows (F4). Headlines are constants. */
+const REVIEW_NOTICE_HEADLINE_MAX = 100;
+/**
+ * The most characters a review card's notice region (a refusal, or the arming
+ * line) shows, all its lines together (PR #614 refutation F4). Each line was
+ * already cut at {@link REVIEW_NOTICE_MAX}; the region had no total, so a
+ * refusal with several long lines could take the card over the limit and make
+ * the redraw that carries it fail. The whole refusal is on the listener's
+ * stderr.
+ */
+export const REVIEW_NOTICE_REGION_MAX = 600;
+/** The most characters a settled card's detail lines show together (F4). */
+const REVIEW_SETTLED_REGION_MAX = 3000;
+/**
+ * The visible length of HTML this channel wrote: tags removed and each entity
+ * {@link escapeHtml} produces counted as the one character it stands for.
+ * Telegram measures its limit after entity parsing, so this is the number the
+ * limit applies to.
+ */
+export function telegramVisibleLength(html) {
+    return html.replace(/<[^>]*>/gu, "").replace(/&(?:amp|lt|gt);/gu, "x").length;
+}
+/** `text` cut at `max` characters with a marker saying how much is not shown. */
+function capReviewText(text, max) {
+    if (text.length <= max)
+        return text;
+    let cut = text.slice(0, max);
+    const last = cut.charCodeAt(cut.length - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut = cut.slice(0, -1);
+    return `${cut}${reviewCutMarker(text.length - cut.length)}`;
+}
+/** The marker a cut row ends with. */
+function reviewCutMarker(hidden) {
+    return `… [+${String(hidden)} chars not shown]`;
+}
+/** The longest {@link reviewCutMarker}: a JavaScript string is under 2^53 long. */
+const REVIEW_CUT_MARKER_MAX = reviewCutMarker(Number.MAX_SAFE_INTEGER).length;
+/** The line a region ends with when lines were left out. */
+const REVIEW_REGION_OVERFLOW = "… [more on the listener's stderr]";
+/**
+ * Lines cut so that together, counting the newline before each, they show at
+ * most `max` characters plus one cut marker and the overflow line.
+ */
+function capReviewRegion(lines, max) {
+    const out = [];
+    let used = 0;
+    for (const entry of lines) {
+        const room = max - used - 1;
+        if (room <= 0) {
+            out.push(REVIEW_REGION_OVERFLOW);
+            break;
+        }
+        const shown = capReviewText(entry, room);
+        out.push(shown);
+        used += shown.length + 1;
+    }
+    return out;
+}
+/**
+ * The longest payload text, in characters, a review card will even try to
+ * render (APRV-480 refutation: review-delivery resource cap).
+ *
+ * Supervised payloads carry no size cap of their own (`PROPOSE_PAYLOAD_MAX_BYTES`
+ * binds proposals only), and the party under review writes them. Without this
+ * bound every render of a card, every redraw after a tap, and every tap's
+ * {@link reviewPayloadView} would run the canonical renderer and HTML escaping
+ * over the whole payload only to conclude "too long", so an agent could make
+ * each review gesture cost work proportional to bytes it chose. Text past this
+ * length is `too-long` without being rendered at all; the card builder
+ * (`cli/audit-card.ts`) keeps no more than this much text in the card it holds.
+ * Eight times the card budget, because a canonical rendering is never that much
+ * shorter than the JSON it renders, and erring here only ever shows the hash.
+ */
+export const REVIEW_RENDER_INPUT_MAX = REVIEW_PAYLOAD_BUDGET * 8;
+/** The heading over a payload the card shows whole (APRV-480). */
+export const TELEGRAM_REVIEW_PAYLOAD_BYTES = "PAYLOAD — the bytes that ran, shown whole; this review covers them";
+/** The heading over a payload the card names by hash only (APRV-480). */
+export const TELEGRAM_REVIEW_PAYLOAD_HASH_ONLY = "PAYLOAD — NOT SHOWN, hash only; this review does not cover the bytes";
+/** The heading on a card whose execution recorded no payload binding (APRV-480). */
+export const TELEGRAM_REVIEW_PAYLOAD_NONE = "PAYLOAD — none recorded; the execution bound to no payload hash";
+export function reviewPayloadView(card) {
+    const rendering = card.fields.fullPayload.value;
+    const bound = card.fields.payload_hash?.value ?? rendering?.hash ?? null;
+    if (rendering !== null && (bound === null || bound === rendering.hash)) {
+        // Bounded before any rendering work: see REVIEW_RENDER_INPUT_MAX.
+        if (rendering.truncated || rendering.text.length > REVIEW_RENDER_INPUT_MAX) {
+            return { kind: "hash", hash: rendering.hash, reason: "too-long" };
+        }
+        const text = payloadRegionText(rendering, card.fields.class.value);
+        if (escapeHtml(text).length <= reviewPayloadBudget(card)) {
+            return { kind: "bytes", hash: rendering.hash, text };
+        }
+        return { kind: "hash", hash: rendering.hash, reason: "too-long" };
+    }
+    if (bound === null)
+        return { kind: "none" };
+    return { kind: "hash", hash: bound, reason: "unavailable" };
+}
+/** The payload region of a review card, as HTML lines (APRV-480). */
+function reviewPayloadLines(view) {
+    switch (view.kind) {
+        case "bytes":
+            return [`<b>${escapeHtml(TELEGRAM_REVIEW_PAYLOAD_BYTES)}</b>`, `<pre>${escapeHtml(view.text)}</pre>`];
+        case "hash":
+            return [
+                `<b>${escapeHtml(TELEGRAM_REVIEW_PAYLOAD_HASH_ONLY)}</b>`,
+                escapeHtml(view.reason === "too-long"
+                    ? `The bytes are longer than one card carries, so none of them are shown. sha256 ${view.hash}`
+                    : `This runtime does not hold the bytes the execution bound to. sha256 ${view.hash}`),
+            ];
+        default:
+            return [`<b>${escapeHtml(TELEGRAM_REVIEW_PAYLOAD_NONE)}</b>`];
+    }
+}
+/**
+ * A review card's HTML lines around the payload region, every row cut to its
+ * cap (PR #614 refutation F4): `top` is the key and the computed rows, `bottom`
+ * the claimed ones. Pure over the card, so the payload budget computed from it
+ * and the card drawn from it cannot disagree.
+ */
+function reviewCardFrame(card) {
+    let frame = reviewCardFrameAt(card, REVIEW_CAP_LEVELS[0]);
+    for (const level of REVIEW_CAP_LEVELS) {
+        frame = reviewCardFrameAt(card, level);
+        if (reviewFixedLength(frame) + REVIEW_HASH_REGION_MAX <= TELEGRAM_MAX_MESSAGE_CHARS)
+            break;
+    }
+    return frame;
+}
+function reviewCardFrameAt(card, caps) {
+    const computedLines = [];
+    const claimedLines = [];
+    for (const row of REVIEW_CARD_ROWS) {
+        const candidate = reviewRow(card.fields, row);
+        if (candidate === null)
+            continue;
+        if (candidate.line.kind === "computed")
+            computedLines.push(candidate.line);
+        else
+            claimedLines.push(candidate.line);
+    }
+    computedLines.push(line("ran_at", card.ranAt, "ran at", card.ranAt.value));
+    computedLines.push(line("verdict", card.verdict, "verdict", card.verdict.value));
+    const render = (entry) => `• <b>${escapeHtml(entry.label)}:</b> ${escapeHtml(capReviewText(entry.text, entry.field === "summary" ? caps.summary : caps.row))} <i>(${escapeHtml(capReviewText(entry.origin, caps.origin))})</i>`;
+    const author = capReviewText(originOf(card.fields.summary), caps.origin);
+    return {
+        top: [
+            `<code>${escapeHtml(capReviewText(card.fields.action_key.value, caps.row))}</code>`,
+            "",
+            "<b>COMPUTED — derived by the runtime from the log, the policy and the payload bytes</b>",
+            ...computedLines.map(render),
+            "",
+        ],
+        bottom: [
+            "",
+            `<b>CLAIMED — authored by ${escapeHtml(author)}, NOT verified by the runtime</b>`,
+            ...claimedLines.map(render),
+        ],
+    };
+}
+/** The longest heading a live card can wear: Deny armed and a grade held. */
+const REVIEW_HEADING_MAX = Math.max(...REACTIONS.map((reaction) => [TELEGRAM_REVIEW_HEADING, TELEGRAM_REVIEW_ARMED, telegramReviewGradeHeld(reaction)].join(" — ")
+    .length));
+/**
+ * What a notice can add to a card at most: the blank line and the headline,
+ * each after a newline, then the region (newlines counted), one cut marker and
+ * the overflow line after its newline.
+ */
+const REVIEW_NOTICE_RESERVE = 2 +
+    REVIEW_NOTICE_HEADLINE_MAX +
+    REVIEW_CUT_MARKER_MAX +
+    REVIEW_NOTICE_REGION_MAX +
+    REVIEW_CUT_MARKER_MAX +
+    1 +
+    REVIEW_REGION_OVERFLOW.length;
+/** The longest hash-only or none payload region, with the newlines around it. */
+const REVIEW_HASH_REGION_MAX = Math.max(...[
+    { kind: "hash", hash: "0".repeat(64), reason: "too-long" },
+    { kind: "hash", hash: "0".repeat(64), reason: "unavailable" },
+    { kind: "none" },
+].map((view) => telegramVisibleLength(reviewPayloadLines(view).join("\n")) + 2));
+/**
+ * Everything a live card can hold except the payload region: the longest
+ * heading, the frame, the largest notice, and the newlines joining them.
+ */
+function reviewFixedLength(frame) {
+    return (REVIEW_HEADING_MAX +
+        1 +
+        telegramVisibleLength([...frame.top, ...frame.bottom].join("\n")) +
+        REVIEW_NOTICE_RESERVE);
+}
+/**
+ * How many escaped characters of payload this card can show whole (PR #614
+ * refutation F4): {@link REVIEW_PAYLOAD_BUDGET}, or the room the card's own
+ * rows leave under {@link TELEGRAM_MAX_MESSAGE_CHARS} after the longest heading,
+ * the payload heading and the largest notice a tap can add, whichever is
+ * smaller. Pure over the card, so the view a card is drawn with and the view a
+ * tap records are the same view.
+ */
+export function reviewPayloadBudget(card) {
+    const fixed = reviewFixedLength(reviewCardFrame(card)) +
+        // The bytes heading and the newlines around the heading and the payload.
+        TELEGRAM_REVIEW_PAYLOAD_BYTES.length +
+        3;
+    return Math.max(0, Math.min(REVIEW_PAYLOAD_BUDGET, TELEGRAM_MAX_MESSAGE_CHARS - fixed));
+}
 /**
  * The card's message: the rows, whatever notice the last tap produced, and the
  * keyboard.
@@ -1457,13 +1812,15 @@ function trimNotice(text) {
  * every card said the same thing to a reader who had already read them once, and
  * pushed the rows a review is actually about off the first screen.
  *
- * Pure. Two things it deliberately does NOT carry, and both are the same rule
- * read twice: no payload region, and no approve button. SPEC.md §10.3 requires
- * the canonical rendering in front of an approver before a DECISION is
- * collected, and this collects none — the action ran, the review says only what
- * a person thought of it, and a card that offered an approve would be
- * presenting a settled fact as a live authorization. A sample is never
- * delivered as an approval request and never accepts a token.
+ * Pure. It carries no approve button: the action ran, and a card that offered
+ * an approve would be presenting a settled fact as a live authorization. A
+ * sample is never delivered as an approval request and never accepts a token.
+ *
+ * It DOES carry a payload region since APRV-480, between the computed rows and
+ * the claimed ones, exactly where a prompt puts its own. Under supervised-retro
+ * the review is the individual approval, so the reviewer reads the bytes that
+ * ran, or is told plainly that the card shows only their hash and why
+ * ({@link reviewPayloadView}). The heading says which, every time.
  */
 export function renderReviewCard(state) {
     const card = state.card;
@@ -1471,41 +1828,27 @@ export function renderReviewCard(state) {
     if (state.settled !== null) {
         return {
             text: [
-                `<b>${escapeHtml(state.settled.headline)}</b>`,
-                `<code>${escapeHtml(key)}</code>`,
+                `<b>${escapeHtml(capReviewText(state.settled.headline, REVIEW_NOTICE_HEADLINE_MAX))}</b>`,
+                `<code>${escapeHtml(capReviewText(key, REVIEW_CAP_LEVELS[0].row))}</code>`,
                 "",
-                ...state.settled.detail.map((entry) => escapeHtml(trimNotice(entry))),
+                ...capReviewRegion(state.settled.detail.map(trimNotice), REVIEW_SETTLED_REGION_MAX).map((entry) => escapeHtml(entry)),
             ].join("\n"),
             keyboard: null,
         };
     }
-    const computedLines = [];
-    const claimedLines = [];
-    for (const row of REVIEW_CARD_ROWS) {
-        const candidate = reviewRow(card.fields, row);
-        if (candidate === null)
-            continue;
-        if (candidate.line.kind === "computed")
-            computedLines.push(candidate.line);
-        else
-            claimedLines.push(candidate.line);
-    }
-    computedLines.push(line("ran_at", card.ranAt, "ran at", card.ranAt.value));
-    computedLines.push(line("verdict", card.verdict, "verdict", card.verdict.value));
-    const render = (entry) => `• <b>${escapeHtml(entry.label)}:</b> ${escapeHtml(entry.text)} <i>(${escapeHtml(entry.origin)})</i>`;
-    const author = originOf(card.fields.summary);
+    const frame = reviewCardFrame(card);
     const lines = [
-        `<b>${escapeHtml(state.denyArmed ? `${TELEGRAM_REVIEW_HEADING} — ${TELEGRAM_REVIEW_ARMED}` : TELEGRAM_REVIEW_HEADING)}</b>`,
-        `<code>${escapeHtml(key)}</code>`,
-        "",
-        "<b>COMPUTED — derived by the runtime from the log, the policy and the payload bytes</b>",
-        ...computedLines.map(render),
-        "",
-        `<b>CLAIMED — authored by ${escapeHtml(author)}, NOT verified by the runtime</b>`,
-        ...claimedLines.map(render),
+        `<b>${escapeHtml([
+            TELEGRAM_REVIEW_HEADING,
+            ...(state.denyArmed ? [TELEGRAM_REVIEW_ARMED] : []),
+            ...(state.heldReaction === null ? [] : [telegramReviewGradeHeld(state.heldReaction)]),
+        ].join(" — "))}</b>`,
+        ...frame.top,
+        ...reviewPayloadLines(reviewPayloadView(card)),
+        ...frame.bottom,
     ];
     if (state.notice !== null) {
-        lines.push("", `<b>${escapeHtml(state.notice.headline)}</b>`, ...state.notice.lines.map((entry) => escapeHtml(trimNotice(entry))));
+        lines.push("", `<b>${escapeHtml(capReviewText(state.notice.headline, REVIEW_NOTICE_HEADLINE_MAX))}</b>`, ...capReviewRegion(state.notice.lines.map(trimNotice), REVIEW_NOTICE_REGION_MAX).map((entry) => escapeHtml(entry)));
     }
     const button = (choice) => ({
         text: REVIEW_BUTTON_LABELS[choice],
@@ -1529,6 +1872,7 @@ export class TelegramApiError extends Error {
     method;
     status;
     description;
+    retryAfterSeconds;
     constructor(message, method, 
     /**
      * The HTTP status, when the failure was an HTTP one. `null` for a transport
@@ -1541,14 +1885,84 @@ export class TelegramApiError extends Error {
      * error body carried one. `null` when the body was absent, unreadable, not
      * JSON, or carried no description.
      */
-    description = null) {
+    description = null, 
+    /**
+     * The Bot API's `parameters.retry_after`, in seconds, when the failure
+     * carried one (PR #614 recheck NF-2). Telegram sends it with 429 "Too Many
+     * Requests" and means it: a send before it elapses is refused again.
+     * `null` when the body named none.
+     */
+    retryAfterSeconds = null) {
         super(message);
         this.method = method;
         this.status = status;
         this.description = description;
+        this.retryAfterSeconds = retryAfterSeconds;
         this.name = "TelegramApiError";
     }
 }
+/**
+ * The Bot API refusals that are a fact about the message itself (PR #614
+ * recheck NF-2). Each is a 400 whose `description` says the text, its markup
+ * or its keyboard is unacceptable, so resending the same card meets the same
+ * refusal however long the sender waits:
+ *
+ * - `message is too long`: the text is over 4096 characters after entities;
+ * - `can't parse entities`: the HTML the card was drawn with does not parse;
+ * - `message text is empty` / `text must be non-empty`: nothing to send;
+ * - `reply markup is too long`: the inline keyboard is over its byte limit;
+ * - `BUTTON_DATA_INVALID`: a button's callback data is over 64 bytes or empty;
+ * - `ENTITIES_TOO_LONG` / `entities too long`: too many formatting entities.
+ *
+ * Deliberately absent, because the card cannot cause them and a retry can
+ * clear them: `chat not found`, `bot was blocked`, `not enough rights` (the
+ * chat's state, which a human repairs), every 429, every 5xx, every timeout and
+ * network failure.
+ */
+const TELEGRAM_DETERMINISTIC_SEND_REFUSALS = [
+    /message is too long/iu,
+    /can't parse entities/iu,
+    /message text is empty|text must be non-empty/iu,
+    /reply markup is too long/iu,
+    /BUTTON_DATA_INVALID/u,
+    /ENTITIES_TOO_LONG|entities too long/iu,
+];
+/**
+ * Whether a failed send is the Bot API refusing the message itself, so that
+ * sending the same message again can only fail again (PR #614 recheck NF-2).
+ *
+ * Only an HTTP 400 whose description matches
+ * {@link TELEGRAM_DETERMINISTIC_SEND_REFUSALS} qualifies. Anything else, an
+ * error that is not a {@link TelegramApiError} included, is treated as
+ * transient, which is the direction that keeps a card in front of the
+ * approver: a transient failure misread as deterministic hides a sample from
+ * the phone, and the converse costs a bounded number of retries.
+ */
+export function isDeterministicSendRefusal(cause) {
+    return (cause instanceof TelegramApiError &&
+        cause.status === 400 &&
+        cause.description !== null &&
+        TELEGRAM_DETERMINISTIC_SEND_REFUSALS.some((pattern) => pattern.test(cause.description)));
+}
+/**
+ * The wait, in milliseconds, a failed call's `retry_after` asks for, or `null`
+ * when it named none (PR #614 recheck NF-2).
+ */
+export function retryAfterMsOf(cause) {
+    if (!(cause instanceof TelegramApiError) || cause.retryAfterSeconds === null)
+        return null;
+    return cause.retryAfterSeconds * 1000;
+}
+/** `parameters.retry_after` from a parsed Bot API body, when it is a positive integer. */
+function retryAfterFrom(parsed) {
+    if (parsed === null || typeof parsed !== "object")
+        return null;
+    const parameters = parsed["parameters"];
+    if (parameters === null || typeof parameters !== "object")
+        return null;
+    const value = parameters["retry_after"];
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
 /**
  * Telegram's wording for "that edit would have changed nothing" (APRV-277).
  *
@@ -1599,7 +2013,7 @@ export function isPollConflict(cause) {
 }
 /** A fresh, empty batch report. One shape for both transports (APRV-424). */
 function emptyPollResult() {
-    return { updates: 0, outcomes: [], ignored: [], commands: [], reviews: [] };
+    return { updates: 0, outcomes: [], ignored: [], commands: [], reviews: [], refused: [] };
 }
 /**
  * Why a transport claim was refused. Frozen, per SPEC §11.1 invariant 6.
@@ -1647,6 +2061,12 @@ export class TelegramChannel {
     describeAction;
     /** The policy's row layout for this channel (APRV-218). Read-only, and pure input to the renderer. */
     layout;
+    /** The policy's prompt style for this channel (APRV-489). */
+    promptStyle;
+    /** The policy's `say` declarations (APRV-489). Pure input to the minimal renderer. */
+    say;
+    /** The per-delivery resolver (fix round 2, S4), or null for the fixed values above. */
+    promptFor;
     /** When {@link sweep} last ran, so the poll loop can call it every cycle. */
     lastSweepMs = Number.NEGATIVE_INFINITY;
     /**
@@ -1656,6 +2076,25 @@ export class TelegramChannel {
      */
     ack = null;
     handler = null;
+    /**
+     * APRV-196's stale-copy fallback, on or off (APRV-456). Fixed at
+     * construction from {@link TelegramConfig.staleCopy}; nothing an update
+     * carries can change it.
+     */
+    staleCopy;
+    /**
+     * Where a `nonce-not-issued` refusal is recorded (APRV-456). The runtime's,
+     * like every other handler here; absent, the refusal still happens and only
+     * the record is missing.
+     */
+    refusedDecisionHandler = null;
+    /**
+     * Nonces already refused `nonce-not-issued` (APRV-456), oldest first, capped
+     * at {@link TELEGRAM_REFUSED_NONCE_CAP}. A redelivered or replayed tap on the
+     * same button is refused again with the same toast and records nothing, so
+     * one button costs the log at most one record.
+     */
+    unissuedRefused = new Set();
     /**
      * What to do with a bot command (APRV-216). Absent unless the runtime asked
      * for commands, and its absence is what keeps `message` out of
@@ -1771,6 +2210,7 @@ export class TelegramChannel {
             "unknown-command": 0,
         },
         staleCopyDecisions: 0,
+        staleCopyRefusals: 0,
         commands: 0,
         reviews: 0,
     };
@@ -1794,11 +2234,22 @@ export class TelegramChannel {
         this.now = config.now ?? (() => Date.now());
         this.describeAction = config.describeAction ?? null;
         this.layout = config.layout ?? TELEGRAM_PROMPT_LAYOUT;
+        this.promptStyle = config.promptStyle ?? DEFAULT_PROMPT_STYLE;
+        this.say = config.say ?? {};
+        this.promptFor = config.promptFor ?? null;
+        // APRV-456. Only an explicit `true` or an absent key leaves the fallback on;
+        // anything else a caller passes turns it off, the stricter direction.
+        this.staleCopy = config.staleCopy === undefined || config.staleCopy === true;
         this.makeNonce =
             config.nonce ??
                 (() => {
                     this.counter += 1;
-                    return `${this.counter.toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+                    // APRV-456 refutation S2. On a relayed channel the nonce is the only
+                    // thing binding a button to this process, so it comes from the CSPRNG
+                    // (72 bits) rather than `Math.random`, whose state a reader of a few old
+                    // buttons could in principle recover. base64url carries no `:`, and the
+                    // whole `<verb>:<nonce>:<ref>` stays well inside the 64-byte cap.
+                    return `${this.counter.toString(36)}${randomBytes(9).toString("base64url")}`;
                 });
     }
     // -------------------------------------------------------------------------
@@ -1807,6 +2258,25 @@ export class TelegramChannel {
     onDecision(handler) {
         this.handler = handler;
     }
+    /**
+     * Register where a tap this channel refused on its own is recorded
+     * (APRV-456).
+     *
+     * Separate from {@link onDecision} on purpose: that handler's job is to call
+     * the gate, and a `nonce-not-issued` tap must never reach the gate. The
+     * runtime wires this to an audit-tier append that grants nothing.
+     */
+    onRefusedDecision(handler) {
+        this.refusedDecisionHandler = handler;
+    }
+    /**
+     * Whether APRV-196's stale-copy fallback is on (APRV-456). Read by the
+     * listener for the restart banner, which must not promise that earlier
+     * copies still decide when they do not.
+     */
+    staleCopyEnabled() {
+        return this.staleCopy;
+    }
     /**
      * Register what to do with a checkpoint tap (APRV-257).
      *
@@ -1877,8 +2347,9 @@ export class TelegramChannel {
      * A unit like a checkpoint prompt: one thing to read, never grouped into a
      * digest, and never delivered through {@link notify} — a digest is a set of
      * similar pending REQUESTS decided together, and a sample is neither pending
-     * nor a request. It sends ONE message: no payload region, and a keyboard
-     * whose six buttons collect a verdict and a grade and mint nothing.
+     * nor a request. It sends ONE message: the rows, the payload whole or by hash
+     * (APRV-480, never split across messages), and a keyboard whose six buttons
+     * collect a verdict and a grade and mint nothing.
      *
      * Refuses when no handler is registered, rather than sending a dead button.
      */
@@ -1893,6 +2364,9 @@ export class TelegramChannel {
             card,
             nonce,
             denyArmed: false,
+            heldReaction: null,
+            armedBy: null,
+            heldBy: null,
             settled: null,
             notice: null,
             awaitingNote: null,
@@ -2108,6 +2582,7 @@ export class TelegramChannel {
         state.deliveryId = deliveryId;
         // Armed only now, and all at once: until the message with the buttons on it
         // exists there is nothing a callback could legitimately answer.
+        const rendering = this.digestRendering(stale !== null);
         for (const [index, member] of state.members.entries()) {
             this.deliveries.set(member.nonce, {
                 actionKey: member.actionKey,
@@ -2116,6 +2591,7 @@ export class TelegramChannel {
                 batchDeliveryId,
                 deliveredAtMs,
                 windowMs: windows[index] ?? null,
+                ...(rendering === undefined ? {} : { rendering }),
             });
         }
         this.digests.set(deliveryId, state);
@@ -2200,7 +2676,39 @@ export class TelegramChannel {
                 ],
             ],
         };
-        const sent = await this.sendPrompt(request, TELEGRAM_PROMPT_HEADING, keyboard);
+        // APRV-489. The minimal card is tried only when the policy asked for it,
+        // and anything it will not draw honestly is sent as the technical card,
+        // exactly as a technical policy sends it, with the reason kept for the
+        // decision record and said on stderr.
+        let sent;
+        let rendering;
+        let card;
+        const prompt = this.currentPrompt();
+        // Fix round 2, B2: a request delivered as part of a batch is always the
+        // technical card, as SPEC §10.3 (amended) says of a grouped delivery.
+        const minimal = prompt.fallback !== undefined
+            ? { ok: false, reason: prompt.fallback }
+            : prompt.style !== "minimal"
+                ? null
+                : batchDeliveryId !== undefined
+                    ? { ok: false, reason: "batch" }
+                    : await this.sendMinimal(request, nonce, prompt.say);
+        if (minimal !== null && minimal.ok) {
+            sent = minimal.sent;
+            // R3-S1: the record notes a `say` phrase the runtime overrode with its own.
+            rendering = minimal.sayDoesIgnored ? { style: "minimal", say_does_ignored: true } : { style: "minimal" };
+            card = minimal.card;
+            if (minimal.sayDoesIgnored) {
+                this.complain(`approval: telegram drew its own phrase for ${actionKey}, not the say entry's does: the runtime reads this payload itself`);
+            }
+        }
+        else {
+            if (minimal !== null) {
+                rendering = { style: "technical", fallback: minimal.reason };
+                this.complain(`approval: telegram sent the technical card for ${actionKey}, not the minimal one: ${minimal.reason}`);
+            }
+            sent = await this.sendPrompt(request, TELEGRAM_PROMPT_HEADING, keyboard);
+        }
         this.counters.notified += 1;
         this.deliveries.set(nonce, {
             actionKey,
@@ -2209,6 +2717,8 @@ export class TelegramChannel {
             deliveredAtMs: this.now(),
             windowMs: this.retentionWindowMs(request),
             ...(batchDeliveryId === undefined ? {} : { batchDeliveryId }),
+            ...(rendering === undefined ? {} : { rendering }),
+            ...(card === undefined ? {} : { card }),
         });
         return {
             deliveryId: sent.deliveryId,
@@ -2218,6 +2728,95 @@ export class TelegramChannel {
             },
         };
     }
+    /**
+     * Send `request` as ONE minimal card (APRV-489), or report why it was not.
+     *
+     * The card is drawn from the same `renderTelegram` output the technical card
+     * would send, under the same layout, so the collapsed block IS the technical
+     * card. The buttons carry the same callback data as the technical card's; only
+     * the reject label reads "Deny" (R7). Nothing is sent when the card is refused,
+     * so the caller's technical send is the only send.
+     */
+    async sendMinimal(request, nonce, say) {
+        const actionKey = request.action_key.value;
+        const rendering = renderTelegram(request, TELEGRAM_PROMPT_HEADING, this.layout);
+        const drawn = renderTelegramMinimal(request, {
+            header: rendering.header,
+            payloadText: rendering.payloadText,
+            claimedText: rendering.claimedText,
+            anomalous: rendering.lines.some((entry) => entry.label.startsWith(TELEGRAM_ANOMALY_MARK)),
+            payloadLabel: `<b>${PAYLOAD_CHUNK_LABEL}</b>`,
+        }, say);
+        if (!drawn.ok)
+            return { ok: false, reason: drawn.reason };
+        let result;
+        try {
+            result = await this.call("sendMessage", {
+                chat_id: this.chatId,
+                text: drawn.text,
+                parse_mode: "HTML",
+                disable_web_page_preview: true,
+                reply_markup: {
+                    inline_keyboard: [
+                        [
+                            { text: "✅ Approve", callback_data: callbackData("g", nonce, actionKey) },
+                            { text: MINIMAL_DENY_LABEL, callback_data: callbackData("r", nonce, actionKey) },
+                        ],
+                    ],
+                },
+            });
+        }
+        catch (cause) {
+            // Fix round 2, S2: a refusal of the card itself (a Bot API that cannot
+            // parse the expandable block, an entity limit, a relay rule) would refuse
+            // the same card on every cycle and leave the approver with nothing. The
+            // technical card goes instead, once, and the record says why. A passing
+            // failure (429, 5xx, network) is thrown and retried as before.
+            if (isMessageRefusal(cause))
+                return { ok: false, reason: "send-refused" };
+            throw cause;
+        }
+        const fields = rendering.lines.map((entry) => ({
+            field: entry.field,
+            kind: entry.kind,
+            text: entry.text,
+        }));
+        return {
+            ok: true,
+            sent: {
+                deliveryId: String(result.message_id),
+                rendered: { action_key: actionKey, fields, fullPayloadText: rendering.payloadText },
+            },
+            card: { headline: drawn.headline, details: drawn.details },
+            sayDoesIgnored: drawn.sayDoesIgnored === true,
+        };
+    }
+    /**
+     * The style and `say` map in force for the delivery about to be drawn (fix
+     * round 2, S4): the resolver's answer when the verb gave one, else the fixed
+     * configuration. A resolver that throws is `technical`, the side that shows more.
+     */
+    currentPrompt() {
+        if (this.promptFor === null)
+            return { style: this.promptStyle, say: this.say };
+        try {
+            return this.promptFor();
+        }
+        catch (cause) {
+            this.complain(`approval: telegram could not read the prompt style; drawing technical: ${this.describe(cause)}`);
+            return { style: DEFAULT_PROMPT_STYLE, say: {} };
+        }
+    }
+    /**
+     * What a decision on a digest records about its layout (APRV-489): nothing
+     * under a technical policy, and the technical card with its reason under a
+     * minimal one, since a digest is always drawn technical.
+     */
+    digestRendering(stale) {
+        if (this.currentPrompt().style === "technical")
+            return undefined;
+        return { style: "technical", fallback: stale ? "stale-summary" : "digest" };
+    }
     /**
      * Forget every nonce issued for `deliveryId`, and report the action key it
      * was issued for.
@@ -2232,6 +2831,7 @@ export class TelegramChannel {
      */
     disarm(deliveryId) {
         let actionKey = "";
+        let card;
         // Deleting the current entry mid-iteration is defined behaviour for a Map,
         // and every nonce for this message id goes — a re-notify of the same
         // message would otherwise leave an older nonce still resolving.
@@ -2239,6 +2839,7 @@ export class TelegramChannel {
             if (delivery.deliveryId !== deliveryId)
                 continue;
             actionKey = delivery.actionKey;
+            card = delivery.card ?? card;
             this.deliveries.delete(nonce);
         }
         const digest = this.digests.get(deliveryId);
@@ -2246,7 +2847,7 @@ export class TelegramChannel {
             this.allNonces.delete(digest.allNonce);
             this.digests.delete(deliveryId);
         }
-        return actionKey;
+        return { actionKey, card };
     }
     /**
      * How long after delivery the request behind a prompt can still be decided,
@@ -2438,20 +3039,41 @@ export class TelegramChannel {
             await this.settleMember(digest, actionKey, outcome, detail);
             return;
         }
-        const settledKey = this.disarm(deliveryId);
-        const text = [
+        const settled = this.disarm(deliveryId);
+        const technicalText = [
             `<b>${escapeHtml(outcome)}</b>`,
-            `<code>${escapeHtml(actionKey ?? settledKey)}</code>`,
+            `<code>${escapeHtml(actionKey ?? settled.actionKey)}</code>`,
             "",
             ...detail.map((entry) => escapeHtml(entry)),
         ].join("\n");
-        await this.call("editMessageText", {
+        // APRV-489. A minimal card keeps its headline and its collapsed details
+        // under the outcome, so the settled message still holds the canonical
+        // rendering the approver answered on. Should that not fit, the technical
+        // annotation is the fallback: the outcome is what the edit must carry.
+        const text = settled.card === undefined ? technicalText : minimalSettleText(outcome, detail, settled.card);
+        const edit = (body) => this.call("editMessageText", {
             chat_id: this.chatId,
             message_id: Number(deliveryId),
-            text,
+            text: body,
             parse_mode: "HTML",
             disable_web_page_preview: true,
         });
+        if (settled.card === undefined) {
+            await edit(text);
+            return;
+        }
+        // Fix round 2, S3: a minimal card is the only message holding its request,
+        // so a refused settle edit would leave a live-looking card on a decided
+        // request. The short settle text always fits and always says the outcome.
+        try {
+            await edit(text);
+        }
+        catch (cause) {
+            if (!isMessageRefusal(cause) || isMessageNotModified(cause))
+                throw cause;
+            this.complain(`approval: telegram refused the settle edit of ${settled.actionKey}; sending the short form`);
+            await edit(shortSettleText(outcome, actionKey ?? settled.actionKey, detail));
+        }
     }
     /**
      * The withdrawal case of {@link annotate} (APRV-106), and the one the
@@ -3005,6 +3627,15 @@ export class TelegramChannel {
         // a redelivered or replayed refused tap reaches neither the gate nor the
         // new card, exactly as it did before that card existed.
         const refusedCard = delivery === undefined && this.refusedNonces.has(parsed.nonce);
+        // APRV-456. With the fallback off, a nonce this process is not holding is
+        // the end of the road: no action-reference lookup, no log probe, and never
+        // the decision handler. Behind a relay, a button carrying a real action's
+        // reference may sit under text this gate never wrote, and the approver's
+        // genuine tap would otherwise pass the chat check and the sender mapping.
+        if (delivery === undefined && !refusedCard && !this.staleCopy) {
+            await this.refuseUnissued(parsed, callbackId, result, sender);
+            return;
+        }
         if (delivery === undefined && parsed.actionRef !== null && !refusedCard) {
             // The pre-restart copy. Its nonce died with the process that issued it,
             // but the request it names is one THIS process has since re-delivered, so
@@ -3046,6 +3677,9 @@ export class TelegramChannel {
             ...(delivery.batchDeliveryId === undefined
                 ? {}
                 : { batchDeliveryId: delivery.batchDeliveryId }),
+            // APRV-489. The layout THIS card was drawn in, from this process's own
+            // record of what it sent; nothing in the tap chooses it.
+            ...(delivery.rendering === undefined ? {} : { rendering: delivery.rendering }),
             ...(parsed.decision === "reject"
                 ? { note: `${TELEGRAM_REJECT_NOTE} (callback ${callbackId})` }
                 : {}),
@@ -3172,12 +3806,14 @@ export class TelegramChannel {
         let landed = 0;
         const refusals = [];
         for (const member of open) {
+            const allRendering = this.digestRendering(digest.stale !== null);
             const one = {
                 action_key: member.actionKey,
                 decision,
                 deliveryId: digest.deliveryId,
                 batchDeliveryId: digest.batchDeliveryId,
                 ...(sender === undefined ? {} : { sender }),
+                ...(allRendering === undefined ? {} : { rendering: allRendering }),
                 ...(decision === "reject"
                     ? { note: `${TELEGRAM_REJECT_NOTE} (callback ${callbackId}, all)` }
                     : {}),
@@ -3347,31 +3983,88 @@ export class TelegramChannel {
             await this.ignore(result, callbackId, "unknown-callback", "a review tap arrived before the runtime registered a review handler", "The runtime is not ready to record reviews.");
             return;
         }
+        // PR #614 refutation F3. An armed Deny and a held grade are one account's
+        // unfinished review. A tap that would finish either (any verdict, or a
+        // grade landing on an armed Deny) from a different account is refused on
+        // the card, so a record never carries a grade or a denial its reviewer did
+        // not tap. A grade tapped with nothing armed only replaces the held grade
+        // and is not refused: it finishes nothing, and its new holder is the tapper.
+        const tapper = sender === undefined ? null : sender.id;
+        const finishes = tap.choice === "ok" || tap.choice === "deny" || state.denyArmed;
+        const othersArm = state.denyArmed && state.armedBy !== tapper;
+        const othersGrade = state.heldReaction !== null && state.heldBy !== tapper;
+        if (finishes && (othersArm || (othersGrade && (tap.choice === "ok" || tap.choice === "deny")))) {
+            state.notice = { headline: TELEGRAM_NOT_RECORDED, lines: [TELEGRAM_REVIEW_OTHER_SENDER] };
+            await this.safeAnswer(callbackId, TELEGRAM_REVIEW_OTHER_SENDER);
+            await this.redrawReview(state);
+            return;
+        }
         // The first Deny tap arms and writes nothing. Stated on the card, so the
         // approver reads the state rather than inferring it from a toast.
+        //
+        // PR #614 recheck NF-1: arming is earned the way a held grade is. The tap
+        // goes to the runtime with NO verdict, and the card arms only when the
+        // answer is `verdict-required`, which the runtime gives only after the
+        // sender and the class's roster have passed. An unmapped or off-roster
+        // account's Deny is refused on the card with its own code and arms
+        // nothing, so it cannot leave a half-finished denial that blocks the
+        // approvers' taps.
         if (tap.choice === "deny" && !state.denyArmed) {
-            state.denyArmed = true;
-            state.notice = null;
-            await this.safeAnswer(callbackId, TELEGRAM_REVIEW_ARM_TOAST);
-            await this.redrawReview(state);
+            const answered = await this.recordReview(state, {
+                sampleSeq: state.card.sampleSeq,
+                ...(sender === undefined ? {} : { sender }),
+            }, result, { kind: "deny", by: tapper });
+            await this.safeAnswer(callbackId, state.denyArmed ? TELEGRAM_REVIEW_ARM_TOAST : answered?.toast ?? TELEGRAM_NOT_RECORDED);
             return;
         }
-        const verdict = state.denyArmed ? "denied" : "ok";
         if (tap.choice === "ok" || tap.choice === "deny") {
             // `ok` with deny armed is a correction, and it disarms: a human who
             // reached for Deny and then chose OK meant OK, and nothing was written in
             // between for the change of mind to contradict.
             const chosen = tap.choice === "deny" ? "denied" : "ok";
             state.denyArmed = chosen === "denied";
+            if (!state.denyArmed)
+                state.armedBy = null;
+            // APRV-482: a grade held from before the verdict rides with it, and a
+            // grade that wants words asks for them now, exactly as a grade tapped
+            // after an armed Deny always has. The pair core refuses outright is sent
+            // straight through, so no note is collected for a record that will not
+            // exist.
+            const held = state.heldReaction;
+            if (held !== null) {
+                const conflicts = chosen === "denied" && (held === "liked" || held === "loved");
+                if (!conflicts && (held === "loved" || held === "disliked")) {
+                    await this.safeAnswer(callbackId, TELEGRAM_REVIEW_NOTE_TOAST);
+                    await this.askForNote(state, chosen, held, sender);
+                    return;
+                }
+            }
             await this.safeAnswer(callbackId, TELEGRAM_REVIEW_ACK);
             await this.recordReview(state, {
                 sampleSeq: state.card.sampleSeq,
                 verdict: chosen,
+                ...(held === null ? {} : { reaction: held }),
                 ...(sender === undefined ? {} : { sender }),
             }, result);
             return;
         }
         const reaction = tap.choice;
+        if (!state.denyArmed) {
+            // APRV-482. A grade with no verdict is not an approval. The card holds
+            // the grade (process memory, stated in its heading) and the tap still
+            // goes to the runtime with NO verdict, so the refusal on the card is the
+            // core's own `verdict-required` and its words, and the operator's stderr
+            // says the same. No note is asked for: words for a record that is about
+            // to be refused would be attention spent on nothing.
+            await this.safeAnswer(callbackId, TELEGRAM_REVIEW_ACK);
+            await this.recordReview(state, {
+                sampleSeq: state.card.sampleSeq,
+                reaction,
+                ...(sender === undefined ? {} : { sender }),
+            }, result, { kind: "grade", reaction, by: tapper });
+            return;
+        }
+        const verdict = "denied";
         // The two grades that require the human's own words ask for them FIRST, and
         // nothing is appended until the reply arrives. The exception is the pair
         // `core/audit.ts` refuses outright: a denied review that says liked or
@@ -3403,26 +4096,75 @@ export class TelegramChannel {
      * stays open, and a fresh card is offered — and can never cost a record
      * nobody asked for.
      *
-     * A second prompt replaces the first: only one grade can be outstanding on
-     * one card, and the older prompt stops resolving so a late reply to it lands
-     * nowhere rather than recording a grade the human moved on from.
+     * Only one grade can be outstanding on one card, so a second prompt that is
+     * SENT replaces the first, and the older prompt stops resolving: a late reply
+     * to it lands nowhere rather than recording a grade the human moved on from.
+     *
+     * APRV-492, and the relay licenses one prompt per GRADE tap, so which taps
+     * get a prompt sent is not this method's choice alone. Three rules:
+     *
+     * - A tap that would ask the SAME question again (same verdict, same grade,
+     *   same account: a doubled OK or a doubled second Deny) sends nothing. The
+     *   prompt on screen already collects those words, and a second send would
+     *   be refused.
+     * - A prompt for a DIFFERENT VERDICT retires the old one BEFORE the send. A
+     *   verdict change is not a grade tap, so the relay refuses that send, and an
+     *   old prompt left live would record the verdict the human just changed. A
+     *   note may be lost this way; a wrong verdict is never recorded.
+     * - A prompt for the same verdict and a different grade follows a grade tap,
+     *   which the relay licenses, and retires the old one only once the new send
+     *   has succeeded. A send that fails anyway (the network, not the relay)
+     *   leaves the old prompt live, and a reply to it records the grade the old
+     *   prompt names in its own text, not the one the card now holds: an
+     *   accepted residual (PR #619 refutation S2).
+     *
+     * A send that fails says so on the card, because the toast already told the
+     * human to reply to a prompt: the note was not asked for, nothing was
+     * recorded, and a grade tap asks again. Then it throws, so the operator hears
+     * of it. A later prompt that is sent clears that line.
      */
     async askForNote(state, verdict, reaction, sender) {
-        if (state.awaitingNote !== null)
-            this.reviewNotePrompts.delete(state.awaitingNote.promptId);
+        const waiting = state.awaitingNote;
+        if (waiting !== null &&
+            waiting.verdict === verdict &&
+            waiting.reaction === reaction &&
+            waiting.sender?.id === sender?.id &&
+            this.reviewNotePrompts.get(waiting.promptId) === state.deliveryId) {
+            return;
+        }
+        if (waiting !== null && waiting.verdict !== verdict) {
+            this.reviewNotePrompts.delete(waiting.promptId);
+            state.awaitingNote = null;
+        }
         const lines = reviewNotePromptLines(reaction, verdict, state.card.fields.action_key.value);
-        const sent = await this.call("sendMessage", {
-            chat_id: this.chatId,
-            text: lines
-                .map((entry, index) => (index === 0 ? `<b>${escapeHtml(entry)}</b>` : escapeHtml(entry)))
-                .join("\n"),
-            parse_mode: "HTML",
-            disable_web_page_preview: true,
-            reply_markup: { force_reply: true },
-        });
+        let sent;
+        try {
+            sent = await this.call("sendMessage", {
+                chat_id: this.chatId,
+                text: lines
+                    .map((entry, index) => (index === 0 ? `<b>${escapeHtml(entry)}</b>` : escapeHtml(entry)))
+                    .join("\n"),
+                parse_mode: "HTML",
+                disable_web_page_preview: true,
+                reply_markup: { force_reply: true },
+            });
+        }
+        catch (cause) {
+            state.notice = { headline: TELEGRAM_NOT_RECORDED, lines: [telegramReviewNoteUnasked(verdict)] };
+            await this.redrawReview(state);
+            throw cause;
+        }
         const promptId = String(sent.message_id);
+        if (state.awaitingNote !== null)
+            this.reviewNotePrompts.delete(state.awaitingNote.promptId);
         state.awaitingNote = { promptId, verdict, reaction, ...(sender === undefined ? {} : { sender }) };
         this.reviewNotePrompts.set(promptId, state.deliveryId);
+        const unasked = state.notice?.lines;
+        if (unasked?.length === 1 &&
+            (unasked[0] === telegramReviewNoteUnasked("ok") || unasked[0] === telegramReviewNoteUnasked("denied"))) {
+            state.notice = null;
+            await this.redrawReview(state);
+        }
     }
     /**
      * A message replying to an outstanding note prompt (APRV-299).
@@ -3494,13 +4236,25 @@ export class TelegramChannel {
      * to say which half they meant, and `note-required` asks for words — so the
      * buttons stay, with the refusal rendered above them and the arming intact.
      */
-    async recordReview(state, tap, result) {
+    async recordReview(state, tap, result, 
+    /**
+     * A lone grade to hold, or a Deny to arm, if the runtime answers
+     * `verdict-required` (PR #614 refutation N6/F3, recheck NF-1): only then
+     * has the tapper passed the sender and roster checks, so only then is the
+     * half-finished review theirs to finish.
+     */
+    hold) {
         const handler = this.reviewHandler;
         if (handler === null)
-            return;
+            return null;
+        // APRV-481: whether the bytes were on this card is the card's own fact,
+        // decided by the same pure view that drew it, so the record's payload hash
+        // can never name more than the reviewer was shown.
+        const view = reviewPayloadView(state.card);
+        const sent = view.kind === "bytes" ? { ...tap, payloadHash: view.hash } : tap;
         let response;
         try {
-            response = await handler(tap);
+            response = await handler(sent);
         }
         catch (cause) {
             state.notice = { headline: TELEGRAM_NOT_RECORDED, lines: [TELEGRAM_HANDLER_FAILED] };
@@ -3508,11 +4262,14 @@ export class TelegramChannel {
             throw cause;
         }
         this.counters.reviews += 1;
-        result.reviews.push({ tap, ok: response.ok });
+        result.reviews.push({ tap: sent, ok: response.ok });
         if (response.ok) {
             state.settled = { headline: response.headline, detail: response.detail };
             state.notice = null;
             state.denyArmed = false;
+            state.heldReaction = null;
+            state.armedBy = null;
+            state.heldBy = null;
             this.reviewNonces.delete(state.nonce);
             if (state.awaitingNote !== null) {
                 this.reviewNotePrompts.delete(state.awaitingNote.promptId);
@@ -3521,8 +4278,23 @@ export class TelegramChannel {
         }
         else {
             state.notice = { headline: response.headline, lines: response.detail };
+            if (hold !== undefined && response.code === "verdict-required") {
+                if (hold.kind === "grade") {
+                    state.heldReaction = hold.reaction;
+                    state.heldBy = hold.by;
+                }
+                else {
+                    // The armed state is the card's message; the refusal that earned it
+                    // is the runtime's word for "a verdict is still needed", which the
+                    // armed heading already says.
+                    state.denyArmed = true;
+                    state.armedBy = hold.by;
+                    state.notice = null;
+                }
+            }
         }
         await this.redrawReview(state);
+        return response;
     }
     /** One `editMessageText` that replaces a review card's text and its keyboard. */
     async redrawReview(state) {
@@ -3547,6 +4319,81 @@ export class TelegramChannel {
             this.complain(`approval: telegram could not redraw the review card for sample seq ${String(state.card.sampleSeq)} (message ${state.deliveryId}): ${this.describe(cause)} — the log is what it is; only the message is stale`);
         }
     }
+    /**
+     * Refuse a decision tap whose nonce this process is not holding, with the
+     * stale-copy fallback off (APRV-456).
+     *
+     * What it does, in order, and what it never does:
+     *
+     * - It never calls the decision handler, so the gate is never asked. That is
+     *   the property: a button this process did not put on the screen cannot
+     *   carry a human's tap to `decide()`, whatever reference it carries.
+     * - It looks the reference up among the deliveries THIS process holds open,
+     *   and only to name the action on the audit record. A reference that names
+     *   nothing open here produces no record: there is no action key this
+     *   process could truthfully write, and inventing one from bytes that came
+     *   off the network is the self-report §11.1 invariant 4 forbids.
+     * - It hands at most one record per nonce to {@link onRefusedDecision}: a
+     *   redelivered or replayed tap on the same button is refused with the same
+     *   toast and records nothing.
+     * - It leaves the live card alone. The request stays pending, and the card
+     *   this process did send still decides it.
+     *
+     * "Not holding" covers a nonce this process never issued and one it issued
+     * and has since forgotten (an annotated card, a swept delivery, a restart).
+     * It does not try to tell them apart: a set of every nonce ever issued would
+     * reopen the hole for anyone who has seen one genuine button's bytes, because
+     * an old nonce with a new reference would pass it. The cost is that a tap on
+     * an earlier copy after a restart is refused on this shape and the approver
+     * taps the newest card, which the restart banner says.
+     */
+    async refuseUnissued(parsed, callbackId, result, sender) {
+        this.counters.staleCopyRefusals += 1;
+        const live = parsed.actionRef === null ? undefined : this.liveDeliveryFor(parsed.actionRef);
+        const repeat = this.unissuedRefused.has(parsed.nonce);
+        // Re-inserted so a nonce refused again counts as the newest, and capped:
+        // memory, never a decision. A nonce that falls off the end is refused again
+        // and may record again, which is volume and nothing else.
+        this.unissuedRefused.delete(parsed.nonce);
+        this.unissuedRefused.add(parsed.nonce);
+        while (this.unissuedRefused.size > TELEGRAM_REFUSED_NONCE_CAP) {
+            const oldest = this.unissuedRefused.values().next().value;
+            if (oldest === undefined)
+                break;
+            this.unissuedRefused.delete(oldest);
+        }
+        // APRV-456 refutation S4: the nonce is NOT quoted here. This message becomes
+        // `payload.message` on the audit record, and the nonce is bytes whoever
+        // made the card chose; quoting it would let a forger write text of their
+        // choosing into the hash-chained log, one tap at a time.
+        const message = `${parsed.decision} tap refused: its button carries a nonce this listener is not holding, and this listener's stale-copy fallback is off (a relayed channel, or --no-stale-copy). It was not carried to the gate by its action reference, because behind a relay a button with a real request's reference can sit under text this gate never sent. Nothing was decided; the request, if pending, is still open on the newest card this listener sent.`;
+        const refusal = { ok: false, code: "nonce-not-issued", message };
+        result.refused.push({
+            code: refusal.code,
+            action_key: live?.actionKey ?? null,
+            detail: message,
+        });
+        this.complain(`approval: telegram refused a callback (nonce-not-issued): nonce ${JSON.stringify(parsed.nonce)}${live === undefined ? "" : ` for ${live.actionKey}`}${repeat ? " (again; not recorded twice)" : ""}`);
+        // The toast first: it is the only answer this query gets, and the record
+        // below changes nothing about what the person is told.
+        await this.safeAnswer(callbackId, refusedDecisionLine(refusal.code));
+        if (live === undefined || repeat || this.refusedDecisionHandler === null)
+            return;
+        const decision = {
+            action_key: live.actionKey,
+            decision: parsed.decision,
+            deliveryId: live.deliveryId,
+            ...(sender === undefined ? {} : { sender }),
+        };
+        try {
+            this.refusedDecisionHandler({ decision, refusal });
+        }
+        catch (cause) {
+            // Best effort by contract: the refusal has happened and been told; only
+            // the record is lost, and the operator hears that here.
+            this.complain(`approval: telegram could not record a nonce-not-issued refusal for ${live.actionKey}: ${this.describe(cause)}`);
+        }
+    }
     async ignore(result, callbackId, kind, detail, reply) {
         this.counters.anomalies[kind] += 1;
         result.ignored.push({ kind, detail });
@@ -3649,26 +4496,30 @@ export class TelegramChannel {
      * replace the real reason with a worse one.
      */
     async describeFailure(response) {
+        const nothing = { description: null, retryAfterSeconds: null };
         let body;
         try {
             body = await response.text();
         }
         catch {
-            return null;
+            return nothing;
         }
         let parsed;
         try {
             parsed = JSON.parse(body);
         }
         catch {
-            return null;
+            return nothing;
         }
         if (parsed === null || typeof parsed !== "object")
-            return null;
+            return nothing;
         const description = parsed["description"];
-        if (typeof description !== "string" || description.length === 0)
-            return null;
-        return this.redact(description);
+        return {
+            description: typeof description !== "string" || description.length === 0 ? null : this.redact(description),
+            // PR #614 recheck NF-2: a 429 says how long to wait, and the review
+            // walkthrough honours it rather than spending its retry budget early.
+            retryAfterSeconds: retryAfterFrom(parsed),
+        };
     }
     /**
      * One Bot API call.
@@ -3698,10 +4549,10 @@ export class TelegramChannel {
                 // was thrown out of were the same "HTTP 400" on the operator's
                 // terminal. Read best effort — a status is still worth reporting when
                 // the body is missing, truncated, or not JSON at all.
-                const description = await this.describeFailure(response);
+                const { description, retryAfterSeconds } = await this.describeFailure(response);
                 throw new TelegramApiError(description === null
                     ? `${method}: HTTP ${response.status}`
-                    : `${method}: HTTP ${response.status} (${description})`, method, response.status, description);
+                    : `${method}: HTTP ${response.status} (${description})`, method, response.status, description, retryAfterSeconds);
             }
             raw = await response.text();
         }
@@ -3735,7 +4586,7 @@ export class TelegramChannel {
             // No HTTP status: this envelope arrived on a 2xx. The description is
             // carried anyway so a caller reads the same field whichever shape the
             // failure took (APRV-277).
-            null, description);
+            null, description, retryAfterFrom(envelope));
         }
         return envelope["result"];
     }