instar 1.3.1348 → 1.3.1349

package/dist/core/version-skew.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-skew.js","sourceRoot":"","sources":["../../src/core/version-skew.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAWrD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,IAA+B,EAAE,IAA+B;IAC9F,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;AACxC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAqB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE5D,yEAAyE;IACzE,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,OAAO,GAAmD,SAAS,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC;QAC3F,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,IACE,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC7C,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YAChC,eAAe,GAAG,GAAG,EACrB,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,MAAM,MAAM,GAA0B;QACpC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;KAC/C,CAAC;IAEF,yEAAyE;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,6DAA6D,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpJ,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC;QAAC,cAAc,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAC5J,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"version-skew.js","sourceRoot":"","sources":["../../src/core/version-skew.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAWrD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,IAA+B,EAAE,IAA+B;IAC9F,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;AACxC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAqB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE5D,yEAAyE;IACzE,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,OAAO,GAAmD,SAAS,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC;QAC3F,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,IACE,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC7C,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YAChC,eAAe,GAAG,GAAG,EACrB,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,MAAM,MAAM,GAA0B;QACpC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACxC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;KAC/C,CAAC;IAEF,yEAAyE;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,6DAA6D,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpJ,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC;QAAC,cAAc,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAC5J,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC"}

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
-  "packageVersion": "1.3.1348",
+  "packageVersion": "1.3.1349",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "7092f64442b2a00efab859e40cdc2ff976800d089e6c8ff32e0f28bce47ad2f4",
+  "sha256": "8b8dc4dd06983cb7d7b51d73c18a48abda82621ac694c0daab2cbc6bbddc8ff0",
   "registrySha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
-  "packageVersion": "1.3.1348"
+  "packageVersion": "1.3.1349"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "35448db940d659661ebdfb09761439033f93a15157540ee2f6eecf825488e1e6",
   "articleCount": 92,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1348"
+  "packageVersion": "1.3.1349"
 }

package/dist/lifeline/TelegramLifeline.d.ts

@@ -154,6 +154,54 @@ export declare class TelegramLifeline {
     private legacyStrictServer;
     /** Full semver of this lifeline, read once at construction. */
     private readonly lifelineVersion;
+    /**
+     * The lifeline ingress secret (docs/specs/telegram-internal-route-lifeline-secret.md).
+     * Held in this process's memory and in its 0600 file only — never in
+     * `process.env`, so nothing this process spawns inherits it.
+     */
+    private _ingressSecret;
+    private get ingressSecret();
+    private lastSecretRefusalLogAt;
+    private lastIngressProofAt;
+    /** Start of the current secret-refusal episode (0 = none). */
+    private secretRefusedSince;
+    private secretRefusedLastAt;
+    private secretRefusalNoticeSent;
+    private secretRefusalNoticeInFlight;
+    private replayInFlight;
+    /** Consecutive refused replay passes in the current episode (drives the backoff). */
+    private secretRefusedPasses;
+    /**
+     * While the server refuses our secret, replay backs off: one minute, then
+     * doubling, capped at fifteen. The message is never dropped; only the rate
+     * of asking falls.
+     */
+    private static readonly SECRET_REFUSAL_RETRY_MS;
+    private static readonly SECRET_REFUSAL_RETRY_MAX_MS;
+    private secretRefusalBackoffMs;
+    /** After this long refused, tell the user once (per episode). */
+    private static readonly SECRET_REFUSAL_NOTICE_AFTER_MS;
+    /**
+     * The server refused our lifeline secret even after a re-read. Not a
+     * property of the message and not an outage: the message stays queued with
+     * no drop budget burned. This bounds the consequences — one log line a
+     * minute, replay backs off from one minute to fifteen (see replayQueue), and
+     * at the first refusal after ten minutes the user is told ONCE, on the
+     * lifeline's own always-available channel, that messages are held and why.
+     */
+    private noteSecretRefusal;
+    private addIngressSecretHeader;
+    /** The server accepted a secret that is not its own (observe): re-read ours. */
+    private observeStaleSecretHint;
+    /**
+     * Tell the server that THIS lifeline sends the ingress secret — at lifeline
+     * start, whenever the server comes up, and every 15 minutes — so the
+     * server's guard is armed within seconds instead of waiting for the next
+     * Telegram message (a standby lifeline never forwards one at all).
+     * Best-effort: an older server answers 404 and nothing changes.
+     */
+    private proveIngressSecret;
+    private isLifelineSecretRefusal;
     /**
      * Agent hard-sleep wake trigger. When the ServerSupervisor has intentionally
      * slept the server (a `state/slept-marker.json` is present), write
@@ -235,6 +283,7 @@ export declare class TelegramLifeline {
     private watchdog;
     private handleLifelineCommand;
     private replayQueue;
+    private replayQueueLocked;
     /** Whether we've already notified for the current outage. Reset on recovery. */
     private hasNotifiedServerDown;
     /** Suppressed "server down" count during current outage. */

package/dist/lifeline/TelegramLifeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TelegramLifeline.d.ts","sourceRoot":"","sources":["../../src/lifeline/TelegramLifeline.ts"],"names":[],"mappings":"AAoJA,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,kBAAkB,CAAC,CAA8G;IACzI,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,uBAAuB,CAA+C;IAC9E,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,eAAe,CAAK;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,aAAa,CAAQ;IAG7B,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,oBAAoB,CAA8C;gBAE9D,UAAU,CAAC,EAAE,MAAM;IAmG/B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4P5B;;;OAGG;YACW,iBAAiB;IAkB/B;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IA6FtC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;OAIG;IACH,OAAO,CAAC,8BAA8B;IAkBtC;;;;OAIG;IACH,OAAO,CAAC,gCAAgC;IAoBxC;;;;OAIG;IACH,OAAO,CAAC,iCAAiC;IAYzC,mEAAmE;IACnE,OAAO,CAAC,yBAAyB;IAOjC,qDAAqD;IACrD,OAAO,CAAC,sBAAsB;IA6B9B,0EAA0E;YAC5D,oBAAoB;IAOlC;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAwCvB;;;;;;;OAOG;YACW,oBAAoB;IAkDlC;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;YAyEV,IAAI;YAgFJ,aAAa;IAkG3B;;OAEG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,aAAa;IAwB3B;;;OAGG;YACW,gBAAgB;IA2B9B;;OAEG;YACW,qBAAqB;IA+CnC;;;OAGG;YACW,oBAAoB;IAmDlC;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAK;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAQ;IAEvD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB,CAAS;IAEnC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IAEtD;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;OAIG;YACW,eAAe;IAQ7B;;;;;OAKG;YACW,yBAAyB;IAoJvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAuBhC;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;IAuDzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,0BAA0B;IA8BlC,uCAAuC;IACvC,OAAO,CAAC,0BAA0B,CAAK;IACvC,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,oBAAoB,CAAuB;IAEnD;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC;;+CAE2C;IAC3C,OAAO,CAAC,sBAAsB,CAAK;IAEnC,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAuC;YAIzC,qBAAqB;YAsGrB,WAAW;IAsHzB,gFAAgF;IAChF,OAAO,CAAC,qBAAqB,CAAS;IACtC,4DAA4D;IAC5D,OAAO,CAAC,yBAAyB,CAAK;IACtC,0FAA0F;IAC1F,OAAO,CAAC,sBAAsB,CAAK;IACnC,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAe;IAE9D,4EAA4E;IAC5E,OAAO,CAAC,cAAc,CAA6B;IACnD,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAc;IAC7D,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAO;IAE3D;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,kBAAkB;IAkB1B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAgBZ,gBAAgB;YAmChB,mBAAmB;IA4BjC;;;;OAIG;YACW,qBAAqB;IAenC;;OAEG;YACW,mBAAmB;IA+CjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiC1B;;OAEG;YACW,sBAAsB;IAsFpC;;;;;;;;;;;;OAYG;YACW,kBAAkB;IA4GhC;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAWjC;;OAEG;YACW,oBAAoB;IASlC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;;;;;;;;OASG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;YA0Cd,aAAa;IAmG3B;;OAEG;YACW,mBAAmB;IAuDjC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;sDACkD;IAClD,OAAO,CAAC,eAAe;YAKT,WAAW;YAgCX,UAAU;IASxB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;YAMX,OAAO;IA6ErB,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,UAAU;CAWnB"}
+{"version":3,"file":"TelegramLifeline.d.ts","sourceRoot":"","sources":["../../src/lifeline/TelegramLifeline.ts"],"names":[],"mappings":"AAsJA,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,kBAAkB,CAAC,CAA8G;IACzI,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,aAAa,CAAgC;IACrD,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,uBAAuB,CAA+C;IAC9E,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,eAAe,CAAK;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,aAAa,CAAQ;IAG7B,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,oBAAoB,CAA8C;gBAE9D,UAAU,CAAC,EAAE,MAAM;IAsG/B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA+P5B;;;OAGG;YACW,iBAAiB;IAkB/B;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IA6FtC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;OAIG;IACH,OAAO,CAAC,8BAA8B;IAkBtC;;;;OAIG;IACH,OAAO,CAAC,gCAAgC;IAoBxC;;;;OAIG;IACH,OAAO,CAAC,iCAAiC;IAYzC,mEAAmE;IACnE,OAAO,CAAC,yBAAyB;IAOjC,qDAAqD;IACrD,OAAO,CAAC,sBAAsB;IA6B9B,0EAA0E;YAC5D,oBAAoB;IAOlC;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAwCvB;;;;;;;OAOG;YACW,oBAAoB;IAkDlC;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;YAyEV,IAAI;YAgFJ,aAAa;IAkG3B;;OAEG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,aAAa;IAwB3B;;;OAGG;YACW,gBAAgB;IA2B9B;;OAEG;YACW,qBAAqB;IA+CnC;;;OAGG;YACW,oBAAoB;IA2DlC;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAK;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAQ;IAEvD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB,CAAS;IAEnC,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IAEtD;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,KAAK,aAAa,GAGxB;IAED,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,kBAAkB,CAAK;IAC/B,8DAA8D;IAC9D,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,2BAA2B,CAAS;IAC5C,OAAO,CAAC,cAAc,CAAS;IAE/B,qFAAqF;IACrF,OAAO,CAAC,mBAAmB,CAAK;IAEhC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAe;IAClE,OAAO,CAAC,sBAAsB;IAI9B,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAe;IAErE;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAoCzB,OAAO,CAAC,sBAAsB;IAK9B,gFAAgF;IAChF,OAAO,CAAC,sBAAsB;IAM9B;;;;;;OAMG;YACW,kBAAkB;YAuBlB,uBAAuB;IAKrC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;OAIG;YACW,eAAe;IAQ7B;;;;;OAKG;YACW,yBAAyB;IAgLvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB;IAuBhC;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;IAuDzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,0BAA0B;IA8BlC,uCAAuC;IACvC,OAAO,CAAC,0BAA0B,CAAK;IACvC,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,oBAAoB,CAAuB;IAEnD;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC;;+CAE2C;IAC3C,OAAO,CAAC,sBAAsB,CAAK;IAEnC,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,aAAa,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAuC;YAIzC,qBAAqB;YAsGrB,WAAW;YA0BX,iBAAiB;IAkH/B,gFAAgF;IAChF,OAAO,CAAC,qBAAqB,CAAS;IACtC,4DAA4D;IAC5D,OAAO,CAAC,yBAAyB,CAAK;IACtC,0FAA0F;IAC1F,OAAO,CAAC,sBAAsB,CAAK;IACnC,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAe;IAE9D,4EAA4E;IAC5E,OAAO,CAAC,cAAc,CAA6B;IACnD,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAc;IAC7D,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAO;IAE3D;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,kBAAkB;IAkB1B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;YAgBZ,gBAAgB;YAmChB,mBAAmB;IA4BjC;;;;OAIG;YACW,qBAAqB;IAenC;;OAEG;YACW,mBAAmB;IA+CjC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiC1B;;OAEG;YACW,sBAAsB;IAsFpC;;;;;;;;;;;;OAYG;YACW,kBAAkB;IA4GhC;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAWjC;;OAEG;YACW,oBAAoB;IASlC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;;;;;;;;OASG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;YA0Cd,aAAa;IAmG3B;;OAEG;YACW,mBAAmB;IAuDjC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;sDACkD;IAClD,OAAO,CAAC,eAAe;YAKT,WAAW;YAgCX,UAAU;IASxB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;YAMX,OAAO;IA6ErB,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,UAAU;CAWnB"}

package/dist/lifeline/TelegramLifeline.js

@@ -39,6 +39,7 @@ import { loadConfig, ensureStateDir, detectTmuxPath, getInstarVersion } from '..
 import { registerAgent, unregisterAgent, startHeartbeat } from '../core/AgentRegistry.js';
 import { SafeFsExecutor } from '../core/SafeFsExecutor.js';
 import { readLifelineRestartSignal, clearLifelineRestartSignal, } from '../core/version-skew.js';
+import { LifelineIngressSecretHolder, LIFELINE_SECRET_HEADER } from '../core/LifelineIngressSecret.js';
 // setup.ts uses @inquirer/prompts which requires Node 20.12+
 // Dynamic import to avoid breaking the lifeline on older Node versions
 // import { installAutoStart } from '../commands/setup.js';
@@ -47,7 +48,7 @@ import { ServerSupervisor } from './ServerSupervisor.js';
 import { createProductionSessionRecoveryConsumer, stageCActivationLeaseIsLive } from '../core/CodexLifecycleProductionComposition.js';
 import { retryWithBackoff } from './retryWithBackoff.js';
 import { notifyMessageDropped } from './droppedMessages.js';
-import { ForwardTransientError, ForwardBadRequestError, ForwardServerBootError, ForwardVersionSkewError, isTerminalForwardError, } from './forwardErrors.js';
+import { ForwardTransientError, ForwardBadRequestError, ForwardServerBootError, ForwardVersionSkewError, isTerminalForwardError, ForwardSecretRefusedError, } from './forwardErrors.js';
 import { decideReplay } from './replayPolicy.js';
 import { writeStartupMarker } from './startupMarker.js';
 import { acquireLockFile } from './lifelineLock.js';
@@ -147,6 +148,9 @@ export class TelegramLifeline {
         this.loadRateLimitState();
         // Wire supervisor events
         this.supervisor.on('serverUp', () => {
+            // A server (re)start re-reads the secret: probe at once, not after the backoff.
+            this.secretRefusedLastAt = 0;
+            void this.proveIngressSecret();
             console.log('[Lifeline] Server is up — replaying queued messages');
             if (this.hasNotifiedServerDown) {
                 this.hasNotifiedServerDown = false;
@@ -324,6 +328,9 @@ export class TelegramLifeline {
             if (this.supervisor.healthy && this.queue.length > 0) {
                 this.replayQueue();
             }
+            if (this.supervisor.healthy && Date.now() - this.lastIngressProofAt > 15 * 60_000) {
+                void this.proveIngressSecret();
+            }
             // B1 — reconcile poll-ownership to the lease intent (no-op unless
             // pollFollowsLease is on; DRY-RUN by default — see reconcilePolling).
             this.reconcilePolling();
@@ -1229,23 +1236,32 @@ export class TelegramLifeline {
             const controller = new AbortController();
             const timer = setTimeout(() => controller.abort(), 10_000);
             try {
-                const cbHeaders = { 'Content-Type': 'application/json' };
-                if (this.projectConfig.authToken) {
-                    cbHeaders['Authorization'] = `Bearer ${this.projectConfig.authToken}`;
-                }
-                const response = await fetch(`http://127.0.0.1:${this.projectConfig.port}/internal/telegram-callback`, {
-                    method: 'POST',
-                    headers: cbHeaders,
-                    body: JSON.stringify({
-                        callbackQueryId: query.id,
-                        data: query.data,
-                        fromUserId: query.from.id,
-                        fromUsername: query.from.username,
-                        messageId: query.message?.message_id,
-                        chatId: query.message?.chat?.id,
-                    }),
-                    signal: controller.signal,
+                const cbBody = JSON.stringify({
+                    callbackQueryId: query.id,
+                    data: query.data,
+                    fromUserId: query.from.id,
+                    fromUsername: query.from.username,
+                    messageId: query.message?.message_id,
+                    chatId: query.message?.chat?.id,
                 });
+                const sendCallback = () => {
+                    const cbHeaders = { 'Content-Type': 'application/json' };
+                    if (this.projectConfig.authToken) {
+                        cbHeaders['Authorization'] = `Bearer ${this.projectConfig.authToken}`;
+                    }
+                    this.addIngressSecretHeader(cbHeaders);
+                    return fetch(`http://127.0.0.1:${this.projectConfig.port}/internal/telegram-callback`, { method: 'POST', headers: cbHeaders, body: cbBody, signal: controller.signal });
+                };
+                let response = await sendCallback();
+                // The server refused our secret: the file may have been replaced since
+                // we cached it. Re-read once and retry. The server dedupes on the
+                // callback id, so a retried tap can never be applied twice.
+                if (response.status === 401 && await this.isLifelineSecretRefusal(response)) {
+                    this.ingressSecret.reload();
+                    response = await sendCallback();
+                }
+                if (response.ok)
+                    this.observeStaleSecretHint(response);
                 if (!response.ok) {
                     await this.apiCall('answerCallbackQuery', {
                         callback_query_id: query.id,
@@ -1283,6 +1299,122 @@ export class TelegramLifeline {
     legacyStrictServer = false;
     /** Full semver of this lifeline, read once at construction. */
     lifelineVersion = getInstarVersion();
+    /**
+     * The lifeline ingress secret (docs/specs/telegram-internal-route-lifeline-secret.md).
+     * Held in this process's memory and in its 0600 file only — never in
+     * `process.env`, so nothing this process spawns inherits it.
+     */
+    _ingressSecret = null;
+    get ingressSecret() {
+        if (!this._ingressSecret)
+            this._ingressSecret = new LifelineIngressSecretHolder(this.projectConfig.stateDir);
+        return this._ingressSecret;
+    }
+    lastSecretRefusalLogAt = 0;
+    lastIngressProofAt = 0;
+    /** Start of the current secret-refusal episode (0 = none). */
+    secretRefusedSince = 0;
+    secretRefusedLastAt = 0;
+    secretRefusalNoticeSent = false;
+    secretRefusalNoticeInFlight = false;
+    replayInFlight = false;
+    /** Consecutive refused replay passes in the current episode (drives the backoff). */
+    secretRefusedPasses = 0;
+    /**
+     * While the server refuses our secret, replay backs off: one minute, then
+     * doubling, capped at fifteen. The message is never dropped; only the rate
+     * of asking falls.
+     */
+    static SECRET_REFUSAL_RETRY_MS = 60_000;
+    static SECRET_REFUSAL_RETRY_MAX_MS = 15 * 60_000;
+    secretRefusalBackoffMs() {
+        const n = Math.max(0, this.secretRefusedPasses - 1);
+        return Math.min(TelegramLifeline.SECRET_REFUSAL_RETRY_MAX_MS, TelegramLifeline.SECRET_REFUSAL_RETRY_MS * 2 ** Math.min(n, 10));
+    }
+    /** After this long refused, tell the user once (per episode). */
+    static SECRET_REFUSAL_NOTICE_AFTER_MS = 10 * 60_000;
+    /**
+     * The server refused our lifeline secret even after a re-read. Not a
+     * property of the message and not an outage: the message stays queued with
+     * no drop budget burned. This bounds the consequences — one log line a
+     * minute, replay backs off from one minute to fifteen (see replayQueue), and
+     * at the first refusal after ten minutes the user is told ONCE, on the
+     * lifeline's own always-available channel, that messages are held and why.
+     */
+    noteSecretRefusal(inboundTopicId) {
+        const nowMs = Date.now();
+        if (this.secretRefusedSince === 0)
+            this.secretRefusedSince = nowMs;
+        this.secretRefusedLastAt = nowMs;
+        if (nowMs - this.lastSecretRefusalLogAt > 60_000) {
+            this.lastSecretRefusalLogAt = nowMs;
+            console.error('[Lifeline] server refused the lifeline ingress secret after a re-read — ' +
+                `messages stay queued. Secret readable here: ${this.ingressSecret.get() !== null}`);
+        }
+        if (!this.secretRefusalNoticeSent && !this.secretRefusalNoticeInFlight
+            && nowMs - this.secretRefusedSince >= TelegramLifeline.SECRET_REFUSAL_NOTICE_AFTER_MS) {
+            const topic = this.resolveUpdatesAlertTopic();
+            if (topic !== null) {
+                // "Sent" is recorded only once the send succeeded; a failure leaves it
+                // unset, so the next refusal (the backoff cadence) tries again.
+                this.secretRefusalNoticeInFlight = true;
+                this.sendToTopic(topic, 'Heads up: your Telegram messages are reaching my lifeline but my server is not accepting them, ' +
+                    'because the two no longer agree on their shared key. Your messages are NOT lost — they are saved ' +
+                    'and will be delivered as soon as this is fixed. Sending /lifeline restart usually resolves it.').then(() => {
+                    this.secretRefusalNoticeSent = true;
+                }).finally(() => {
+                    this.secretRefusalNoticeInFlight = false;
+                }).catch((sendErr) => {
+                    console.warn(`[Lifeline] failed to send secret-refusal notice to topic ${topic} (inbound was ${inboundTopicId}): ` +
+                        `${sendErr instanceof Error ? sendErr.message : sendErr}`);
+                });
+            }
+        }
+    }
+    addIngressSecretHeader(headers) {
+        const secret = this.ingressSecret.get();
+        if (secret)
+            headers[LIFELINE_SECRET_HEADER] = secret;
+    }
+    /** The server accepted a secret that is not its own (observe): re-read ours. */
+    observeStaleSecretHint(response) {
+        if (response.headers.get('x-instar-lifeline-secret-stale') === '1') {
+            this.ingressSecret.reload();
+        }
+    }
+    /**
+     * Tell the server that THIS lifeline sends the ingress secret — at lifeline
+     * start, whenever the server comes up, and every 15 minutes — so the
+     * server's guard is armed within seconds instead of waiting for the next
+     * Telegram message (a standby lifeline never forwards one at all).
+     * Best-effort: an older server answers 404 and nothing changes.
+     */
+    async proveIngressSecret() {
+        try {
+            const headers = { 'Content-Type': 'application/json' };
+            if (this.projectConfig.authToken)
+                headers['Authorization'] = `Bearer ${this.projectConfig.authToken}`;
+            this.addIngressSecretHeader(headers);
+            const post = () => fetch(`http://127.0.0.1:${this.projectConfig.port}/internal/lifeline-proof`, { method: 'POST', headers, body: JSON.stringify({ lifelineVersion: this.lifelineVersion }), signal: AbortSignal.timeout(5_000) });
+            this.lastIngressProofAt = Date.now();
+            let response = await post();
+            if (response.status === 401 && await this.isLifelineSecretRefusal(response)) {
+                this.ingressSecret.reload();
+                this.addIngressSecretHeader(headers);
+                response = await post();
+            }
+            if (response.ok)
+                this.observeStaleSecretHint(response);
+        }
+        catch {
+            // @silent-fallback-ok — the proof is an optimisation; the first real
+            // forward carries the same secret and arms the guard just the same.
+        }
+    }
+    async isLifelineSecretRefusal(response) {
+        const body = (await response.clone().json().catch(() => ({})));
+        return body.error === 'lifeline-secret-required';
+    }
     /**
      * Agent hard-sleep wake trigger. When the ServerSupervisor has intentionally
      * slept the server (a `state/slept-marker.json` is present), write
@@ -1350,6 +1482,7 @@ export class TelegramLifeline {
             ...(senderBotId !== undefined ? { senderBotId } : {}),
             ...(includeVersion ? { lifelineVersion: this.lifelineVersion } : {}),
         });
+        let secretReloaded = false;
         const doForward = async () => {
             const controller = new AbortController();
             const timer = setTimeout(() => controller.abort(), 10_000);
@@ -1358,6 +1491,7 @@ export class TelegramLifeline {
                 if (this.projectConfig.authToken) {
                     fwdHeaders['Authorization'] = `Bearer ${this.projectConfig.authToken}`;
                 }
+                this.addIngressSecretHeader(fwdHeaders);
                 const response = await fetch(`http://127.0.0.1:${this.projectConfig.port}/internal/telegram-forward`, {
                     method: 'POST',
                     headers: fwdHeaders,
@@ -1366,6 +1500,7 @@ export class TelegramLifeline {
                 });
                 if (response.ok) {
                     this.observeForwardResponseDriftHeader(response);
+                    this.observeStaleSecretHint(response);
                     return true;
                 }
                 if (response.status === 426) {
@@ -1376,6 +1511,19 @@ export class TelegramLifeline {
                     const body = (await response.json().catch(() => ({})));
                     throw new ForwardServerBootError(body.retryAfterMs ?? 1000);
                 }
+                if (response.status === 401 && await this.isLifelineSecretRefusal(response)) {
+                    // The server refused our secret: the file may have been replaced
+                    // since we cached it. Re-read it ONCE per forward and let
+                    // retryWithBackoff try again with the fresh value. If the server
+                    // still refuses, stop retrying: the message is re-queued without
+                    // burning any replay budget (never dropped as "server unreachable").
+                    if (!secretReloaded) {
+                        secretReloaded = true;
+                        this.ingressSecret.reload();
+                        throw new ForwardTransientError(401);
+                    }
+                    throw new ForwardSecretRefusedError();
+                }
                 if (response.status === 400) {
                     const body = await response.json().catch(() => ({}));
                     // Graceful degradation: if we included lifelineVersion and the
@@ -1416,6 +1564,11 @@ export class TelegramLifeline {
             // Record success for watchdog.
             this.consecutiveForwardFailures = 0;
             this.lastForwardSuccessAt = Date.now();
+            // A delivered forward ends any secret-refusal episode.
+            this.secretRefusedSince = 0;
+            this.secretRefusedLastAt = 0;
+            this.secretRefusedPasses = 0;
+            this.secretRefusalNoticeSent = false;
             // Successful forward → the skew episode (if any) has resolved.
             // Clear the flag and the alert-dedupe timestamp so the next episode
             // gets its own user-visible notification.
@@ -1429,6 +1582,13 @@ export class TelegramLifeline {
                 this.handleVersionSkew(err, topicId);
                 return 'skew';
             }
+            // The server will not accept our lifeline secret. Not a property of the
+            // message and not an outage: re-queue with no budget burned (the same
+            // replay decision as a skew), and say so loudly — at most once a minute.
+            if (err instanceof ForwardSecretRefusedError) {
+                this.noteSecretRefusal(topicId);
+                return 'skew';
+            }
             this.consecutiveForwardFailures++;
             // A genuine HTTP-400 is the ONLY message-specific ("poison") failure —
             // the server looked at this message and refused it. Everything else
@@ -1693,9 +1853,28 @@ export class TelegramLifeline {
         // the very episodes that trigger queuing) lost the in-memory messages with
         // no trace. That is the 2026-06-06 topic-21487 untracked-loss: a real user
         // question vanished without even a dropped-messages.json record.
+        // Single flight: a pass that outlives the tick must not overlap the next.
+        if (this.replayInFlight)
+            return;
+        // While the server refuses our secret every forward fails identically, so
+        // back off (one minute, doubling, capped at fifteen) instead of
+        // re-forwarding the whole queue on every tick.
+        if (this.secretRefusedLastAt !== 0
+            && Date.now() - this.secretRefusedLastAt < this.secretRefusalBackoffMs())
+            return;
         const messages = this.queue.peek();
         if (messages.length === 0)
             return;
+        this.replayInFlight = true;
+        try {
+            await this.replayQueueLocked(messages);
+        }
+        finally {
+            this.replayInFlight = false;
+        }
+    }
+    /* @self-action-controller: lifeline-secret-refusal-redrive */
+    async replayQueueLocked(messages) {
         console.log(`[Lifeline] Replaying ${messages.length} queued messages`);
         let replayed = 0;
         let failed = 0;
@@ -1725,6 +1904,12 @@ export class TelegramLifeline {
                 poisonFailures: msg.replayFailures ?? 0,
                 transientFailures: msg.transientReplayFailures ?? 0,
             });
+            // The server refused our secret: the rest of the queue would be refused
+            // the same way. Stop this pass; everything stays on disk, no budget burned.
+            if (outcome === 'skew' && this.secretRefusedLastAt !== 0 && !this.versionSkewActive) {
+                this.secretRefusedPasses++; // one refused PASS — drives the backoff
+                break;
+            }
             if (decision.action === 'delivered') {
                 this.queue.markDelivered(msg.id); // remember id so a redelivery can't re-queue it
                 replayed++;