stitchkit 0.108.5 → 0.109.0

package/dist/telegram/update-store.d.ts

@@ -12,7 +12,10 @@
  *   whose attempts are spent as `abandoned`;
  * - `renew` and `settle` act only while the record is still `processing` under
  *   the same attempt, so a process that lost its lease cannot overwrite the
- *   one that took it over.
+ *   one that took it over;
+ * - a durable abandonment keeps `settledAt` empty until the consumer has
+ *   handled its final obligation. It stays in this record and is never pruned
+ *   while it is pending.
  */
 export type TelegramUpdateState = 'pending' | 'processing' | 'failed' | 'completed' | 'abandoned';
 export type TelegramUpdateSettlement = {
@@ -32,6 +35,8 @@ export interface TelegramUpdateClaimOptions {
     readonly now: number;
     readonly leaseUntil: number;
     readonly maxAttempts: number;
+    /** Keep an attempts-spent abandonment pending until the consumer acknowledges it. */
+    readonly durableExhaustion?: boolean;
 }
 export interface TelegramUpdateDueQuery {
     readonly now: number;
@@ -43,6 +48,23 @@ export interface StoredTelegramUpdate {
     readonly updateId: number;
     readonly body: string;
 }
+/** The immutable identity of one claim, including a token that never repeats after pruning. */
+export interface TelegramUpdateAttemptIdentity {
+    readonly updateId: number;
+    readonly attempt: number;
+    readonly claimId: string;
+}
+/** A final failure waiting for the consumer's durable obligation. */
+export interface StoredTelegramUpdateExhaustion extends StoredTelegramUpdate, TelegramUpdateAttemptIdentity {
+    readonly exhaustedAt: number;
+    readonly error: string;
+}
+/** One ordered page of final failures still waiting for acknowledgement. */
+export interface TelegramUpdateExhaustionQuery {
+    readonly limit: number;
+    /** Continue strictly after this `update_id`; omit to begin at the first row. */
+    readonly afterUpdateId?: number;
+}
 export interface TelegramUpdateStore {
     /** Record a received update as `pending`; `false` when this `update_id` is already recorded. */
     add(update: StoredTelegramUpdate & {
@@ -51,7 +73,9 @@ export interface TelegramUpdateStore {
     /** Take a claimable update for one attempt; its number, or `undefined` when not taken. */
     claim(updateId: number, options: TelegramUpdateClaimOptions): Promise<number | undefined>;
     /** Extend the lease of this attempt; `false` when the attempt no longer holds the update. */
-    renew(updateId: number, attempt: number, leaseUntil: number): Promise<boolean>;
+    renew(updateId: number, attempt: number, leaseUntil: number, 
+    /** When supplied, a lease that already expired cannot be resurrected. */
+    now?: number): Promise<boolean>;
     /** End this attempt; ignored when the attempt no longer holds the update. */
     settle(updateId: number, attempt: number, settlement: TelegramUpdateSettlement): Promise<void>;
     /** Claimable updates in `update_id` order. */
@@ -59,9 +83,34 @@ export interface TelegramUpdateStore {
     /** Forget `completed` and `abandoned` updates settled before `before`; how many were forgotten. */
     prune(before: number): Promise<number>;
 }
+/** A store able to verify an immutable attempt fence inside the caller's transaction. */
+export interface TelegramUpdateFencedStore extends TelegramUpdateStore {
+    /** Atomically take one claim and return its persisted, globally unique identity. */
+    claimOwned(updateId: number, options: TelegramUpdateClaimOptions): Promise<TelegramUpdateAttemptIdentity | undefined>;
+    /** Extend only this exact claim's live lease. */
+    renewOwned(identity: TelegramUpdateAttemptIdentity, leaseUntil: number, now?: number): Promise<boolean>;
+    /** `true` only while this exact attempt still owns an unexpired lease. */
+    owns(identity: TelegramUpdateAttemptIdentity, at: number): Promise<boolean>;
+    /** Atomically settle only while this exact attempt still owns an unexpired lease. */
+    settleOwned(identity: TelegramUpdateAttemptIdentity, settlement: TelegramUpdateSettlement): Promise<boolean>;
+}
+/**
+ * The same update store with recoverable final-failure delivery.
+ *
+ * `exhaust` leaves the abandonment pending, `dueExhaustions` reads it after a
+ * restart, and `acknowledgeExhaustion` makes it eligible for ordinary pruning.
+ */
+export interface TelegramUpdateDurableStore extends TelegramUpdateFencedStore {
+    exhaust(identity: TelegramUpdateAttemptIdentity, exhaustion: {
+        readonly at: number;
+        readonly error: string;
+    }): Promise<boolean>;
+    dueExhaustions(query: TelegramUpdateExhaustionQuery): Promise<readonly StoredTelegramUpdateExhaustion[]>;
+    acknowledgeExhaustion(identity: TelegramUpdateAttemptIdentity, at: number): Promise<boolean>;
+}
 /**
  * A store in this process's memory — for tests, and for a bot that accepts
  * losing what was received but not handled when it restarts.
  */
-export declare function memoryTelegramUpdateStore(): TelegramUpdateStore;
+export declare function memoryTelegramUpdateStore(): TelegramUpdateDurableStore;
 //# sourceMappingURL=update-store.d.ts.map

package/dist/telegram/update-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-store.d.ts","sourceRoot":"","sources":["../../src/telegram/update-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,YAAY,GACZ,QAAQ,GACR,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,oBAAoB,GAAG;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,0FAA0F;IAC1F,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1F,6FAA6F;IAC7F,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,6EAA6E;IAC7E,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAC7E,mGAAmG;IACnG,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC;AAsBD;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAsE/D"}
+{"version":3,"file":"update-store.d.ts","sourceRoot":"","sources":["../../src/telegram/update-store.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,YAAY,GACZ,QAAQ,GACR,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+FAA+F;AAC/F,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,8BACf,SAAQ,oBAAoB,EAC1B,6BAA6B;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,oBAAoB,GAAG;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,0FAA0F;IAC1F,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1F,6FAA6F;IAC7F,KAAK,CACH,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM;IAClB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,6EAA6E;IAC7E,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAC7E,mGAAmG;IACnG,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,yFAAyF;AACzF,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,oFAAoF;IACpF,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;IACtD,iDAAiD;IACjD,UAAU,CACR,QAAQ,EAAE,6BAA6B,EACvC,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,0EAA0E;IAC1E,IAAI,CAAC,QAAQ,EAAE,6BAA6B,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,qFAAqF;IACrF,WAAW,CACT,QAAQ,EAAE,6BAA6B,EACvC,UAAU,EAAE,wBAAwB,GACnC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E,OAAO,CACL,QAAQ,EAAE,6BAA6B,EACvC,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC1D,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,cAAc,CACZ,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,SAAS,8BAA8B,EAAE,CAAC,CAAC;IACtD,qBAAqB,CAAC,QAAQ,EAAE,6BAA6B,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9F;AAuBD;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,0BAA0B,CAmKtE"}

package/dist/tools/cli/args-fields.d.ts

@@ -21,6 +21,12 @@ export declare function appendCliOptionValue(raw: Map<string, string[]>, name: s
  * scalar schema yields an empty map and every value is left as a string.
  */
 export declare function describeSchemaFields(schema: z.ZodType | undefined): Map<string, FieldInfo>;
+/**
+ * Resolve the declared leaf of a dotted option. An intersection's concrete
+ * constraint can refine a free member; a union with a free member stays raw,
+ * because coercion must not choose one accepted branch for the caller.
+ */
+export declare function describeSchemaPath(schema: z.ZodType | undefined, path: readonly string[]): FieldInfo | undefined;
 /** Strict boolean for a RESERVED option — an unrecognised value is a usage error, never a silent `true`. */
 /**
  * The token after a bare boolean flag, when it is the flag's value: exactly
@@ -33,7 +39,7 @@ export declare function separateBoolValue(next: string | undefined): boolean | u
 /** True for a value the reserved-boolean grammar already claims. */
 export declare function isReservedBoolWord(value: string): boolean;
 export declare function parseReservedBool(name: string, value: string): boolean;
-/** Best-effort coercion for a dotted-path leaf, where the schema type is unknown. */
+/** Preserve the legacy best-effort grammar for a wholly unknown passthrough option. */
 export declare function looseCoerce(value: string): unknown;
 /** Coerce the collected raw string value(s) for one field to its typed form. */
 export declare function coerceField(info: FieldInfo | undefined, values: string[], label: string): unknown;

package/dist/tools/cli/args-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args-fields.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args-fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,IAAI,CAaN;AAwGD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAKD,4GAA4G;AAC5G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAI/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtE;AA8BD,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlD;AAuCD,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAaT;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,OAAO,GACb,IAAI,CAsBN"}
+{"version":3,"file":"args-fields.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args-fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,IAAI,CAaN;AA6GD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAiFD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,SAAS,GAAG,SAAS,CAGvB;AAKD,4GAA4G;AAC5G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAI/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtE;AA8BD,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlD;AAuCD,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAaT;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,OAAO,GACb,IAAI,CAsBN"}

package/dist/tools/cli/args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,aAAa,CAAC;AAGjE,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+BAA+B;IAC/B,OAAO,EAAE,aAAa,CAAC;CACxB;AAsRD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GACL,aAAa,CAUf;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,SAAS,GAC9B,qBAAqB,CAkDvB"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,aAAa,CAAC;AAGjE,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+BAA+B;IAC/B,OAAO,EAAE,aAAa,CAAC;CACxB;AAiSD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GACL,aAAa,CAsBf;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,SAAS,GAC9B,qBAAqB,CAkDvB"}

package/llms/cli.txt

@@ -244,7 +244,7 @@ string, the schema says what it should be:
 | `z.enum([...])`      | `--size large`                                 |
 | `z.array(z.string())`| `--tag a --tag b` → `["a","b"]`                |
 | `z.object({...})`    | `--opts '{"k":"v"}'` (JSON) or `--opts.k v`    |
-| `z.record(z.string(), z.unknown())` | `--data '{"code":"007"}'` (JSON) |
+| `z.record(z.string(), z.unknown())` | `--data '{"code":"007"}'` or `--data.code=007` → `"007"` |
 | `.optional()` / `.default()` | not required                           |
 
 Primitive literals use the same coercion through optional, nullable and default wrappers and as
@@ -255,6 +255,14 @@ Object and record JSON keeps the same behavior when a CLI discovers a tool throu
 `propertyNames`, `minProperties` and `maxProperties` constraints still run before dispatch; CLI
 coercion does not execute application transforms.
 
+A dotted leaf follows the leaf schema, including through optional/nullable wrappers and restored
+MCP object guards. A declared number or boolean is coerced; a string stays byte-for-byte lexical.
+For a free `z.record(z.string(), z.unknown())`, argv provides no JSON type tag, so the dotted
+value also stays a string: `007`, `+007`, `1e3`, `true` and `false` keep those spellings.
+Use the whole-object JSON form when a free record value must be a JSON number or boolean. This
+avoids silently changing identifiers while keeping `z.record(..., z.number())` and
+`z.record(..., z.boolean())` explicitly typed.
+
 After a bare boolean flag, the next token is its value when it is exactly
 `true` or `false` — `--active false` turns it off, as it reads. Any other word
 there stays a positional, and `--` makes a literal `false` one too. The same

package/llms/stitchkit.txt

@@ -83,12 +83,12 @@ own, recorded as an ADR.
 | `stitchkit/geo` | server (Bun or Node) | evolving | managed GeoIP reader generations, last-known-good reload and the optional MaxMind adapter |
 | `stitchkit/oauth` | browser **and** server | evolving | provider-neutral Authorization Code + PKCE request and one-shot callback transaction mechanics |
 | `stitchkit/google` | server (Bun or Node) | evolving | optional Google code exchange and verified OIDC identity adapter |
-| `stitchkit/observability` | server | stable<br>_redefined in 2 of the 53 minors since 0.56.2, most recently 0.92.0_ | request/tool event projections — `createObservability`, trace context, sanitisation |
+| `stitchkit/observability` | server | stable<br>_redefined in 2 of the 54 minors since 0.56.2, most recently 0.92.0_ | request/tool event projections — `createObservability`, trace context, sanitisation |
 | `stitchkit/testing` | tests on Bun or Node | stable | in-process generated clients over a real Fetch handler, the managed-resource conformance kit and manual time for schedules and retries |
 | `stitchkit/declaration` | browser + build and deployment tooling (Bun or Node) | evolving | `ProjectDeclarationSchema` — the one machine-readable statement a repository makes about itself |
 | `stitchkit/react` | browser + server rendering | stable | `createCursorQuery`, `createCacheBridge`, QueryClient and `ApiError` retry policy |
 | `stitchkit/react/keyboard` | browser | evolving | which part of a screen gets a key — ordered layers, one Escape per level, list zones with real focus; see [keyboard guide](keyboard.md) |
-| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 23 of the 53 minors since 0.56.2, most recently 0.105.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
+| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 23 of the 54 minors since 0.56.2, most recently 0.105.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
 | `stitchkit/agent-runtime/sandbox` | server | evolving | optional Linux Bubblewrap sessions, durable workspaces and a host HTTP credential gateway; see [sandbox guide](sandbox.md) |
 | `stitchkit/agent-runtime/testing` | tests on Bun or Node | evolving | credential-free replay, scripted provider faults, deterministic race controls and the agent-store conformance kit |
 | `stitchkit/agent-runtime/harness` | server | evolving | resource-aware process-local facade over the canonical Agent runtime; supervision stays outside |
@@ -100,7 +100,7 @@ own, recorded as an ADR.
 | `stitchkit/agent-runtime/sqlite/bun` | server (Bun) | evolving | durable built-in SQLite store for the agent runtime |
 | `stitchkit/agent-runtime/sqlite/node` | server (Node ≥ 22.5) | evolving | durable built-in SQLite store for the agent runtime |
 | `stitchkit-tui` | terminal (Bun) | evolving | optional official OpenTUI host over a caller-composed headless runtime |
-| `stitchkit/application` | browser + server | evolving<br>_redefined in 13 of the 53 minors since 0.56.2, most recently 0.105.0_ | managed resource graph, readiness, admission, schedules, subtree restart and bounded shutdown |
+| `stitchkit/application` | browser + server | evolving<br>_redefined in 13 of the 54 minors since 0.56.2, most recently 0.105.0_ | managed resource graph, readiness, admission, schedules, subtree restart and bounded shutdown |
 | `stitchkit/application/grammy` | server | evolving | a grammY bot as application resources — configuration, then polling with updates admitted by batch — and the webhook adapter |
 | `stitchkit/application/opentelemetry` | server | evolving | maps application snapshots onto an injected OpenTelemetry `Meter` |
 | `stitchkit/application/schemas` | browser + server | evolving | the application's snapshot, health and shutdown schemas alone, without the kernel |
@@ -621,6 +621,13 @@ preserve facts the generic client cannot invent — for example a Unix transport
 an effect from `UNKNOWN_ERROR` alone; inspect the owned adapter's cause and retry
 only when it proves that dispatch did not happen.
 
+The same evidence survives when caller abort or the request deadline wins the
+race: the public code remains `REQUEST_ABORTED` or `REQUEST_TIMEOUT`, while
+the exact rejection produced by the transport remains in `ApiError.cause`.
+That cause is internal diagnostic data — it is not included by JSON/string
+rendering — so delivery state and trace metadata remain available without
+putting transport payloads or credentials in a client-facing error.
+
 For an endpoint without contract arguments, pass only the options object:
 
 ```ts

package/llms/telegram.txt

@@ -337,9 +337,10 @@ import { Database } from 'bun:sqlite'
 import type { Update } from 'grammy/types'
 
 const webhook = { token: env.BOT_TOKEN, url: env.WEBHOOK_URL, secret: env.WEBHOOK_SECRET }
+const updateStore = sqliteTelegramUpdateStore({ database: new Database(env.UPDATES_DB) })
 
 const intake = createTelegramUpdateIntake<Update>({
-  store: sqliteTelegramUpdateStore({ database: new Database(env.UPDATES_DB) }),
+  store: updateStore,
   handle: (update) => bot.handleUpdate(update),
   onFailure: (failure) => logger.warn('Update failed', { ...failure }),
 })
@@ -383,13 +384,55 @@ fix (a refused message, a blocked user) is abandoned; `maxAttempts` (5) ends
 the rest. Delivery is at least once: a handler that finished but could not be
 recorded as finished runs again.
 
+Use `handleAttempt` when the handler needs the immutable attempt fence and an
+ownership-loss signal. A signal asks slow work to stop; the fence is what
+authorizes a domain write. Check it through a transaction-bound reference store
+inside the same database transaction as that write:
+
+```ts
+handleAttempt: async (update, { fence, ownerLost }) => {
+  ownerLost.throwIfAborted()
+  await database.transaction(async (tx) => {
+    const transactionStore = postgresTelegramUpdateStore({
+      query: (text, parameters) => tx.query(text, parameters),
+      createTable: false,
+    })
+    if (!(await transactionStore.owns(fence, Date.now()))) return
+    await applyDomainTransition(tx, update)
+  })
+}
+```
+
+The fence contains the claim's own `{ updateId, attempt, claimId }`. The opaque
+`claimId` is persisted and never reused, so an old handler cannot adopt either
+a newer attempt or a pruned and recreated `updateId`. Existing `handle(update)`
+remains unchanged, including direct functions whose own optional second
+argument has a different meaning.
+
+For a final obligation, configure `handleExhaustion`. The reference store keeps
+the terminal record unacknowledged until this handler resolves, including
+across restart; a throw leaves it for the next sweep. Delivery is at least once,
+so use the complete `{ updateId, attempt, claimId }` as an idempotency key in
+the consumer database:
+
+```ts
+handleExhaustion: ({ updateId, attempt, claimId, update, error }) =>
+  recordFinalFailureOnce({ key: `telegram:${updateId}:${attempt}:${claimId}`, update, error })
+```
+
+This reuses the update row and table. Without `handleExhaustion`, terminal
+abandonment retains its previous behavior.
+
 With grammY the handler is `bot.handleUpdate`, which wraps a middleware's error
 in a `BotError`; the intake unwraps it, so `retry`, `onFailure` and the error
 stored with the update are what the middleware threw — a `retry` that returns
 `false` for the bot's own terminal error sees that error.
 
-The store is an interface of six atomic steps (`TelegramUpdateStore`), so the
-bot's own database holds it:
+The base store remains the six atomic steps of `TelegramUpdateStore`. A
+`TelegramUpdateFencedStore` adds `claimOwned`, `renewOwned`, `owns` and
+`settleOwned`; `TelegramUpdateDurableStore` adds the final-obligation methods.
+Reference stores implement both, so the bot's own database holds the fence and
+final obligation without a second queue:
 
 | Store | Takes |
 |---|---|
@@ -416,7 +459,12 @@ postgresTelegramUpdateStore({
 Each rule is one conditional statement, so a claim is atomic across every
 process sharing the table. By default the table is created on first use; where
 migrations own the schema, `postgresTelegramUpdateStoreSchema(table)` is the
-statement to put in one.
+statement to put in one. Apply it before using `handleAttempt` or
+`handleExhaustion`; it adds `claim_id` idempotently. Legacy `handle(update)`
+uses base PostgreSQL operations that do not reference that column. SQLite adds
+the column automatically and tolerates two rolling processes racing the
+migration. A direct base-store claim with `durableExhaustion: true` also opts
+into the column-backed durable capability.
 
 A store of your own — over an ORM, another database — is put through the same
 rules the shipped ones are, concurrent claims included:
@@ -506,13 +554,16 @@ injected grammY bot. → ADR 0143, ADR 0201 — [guide](../guide/telegram.md)
 | `telegramWebhookUrl` | function | the address with an `owner` tag derived from the secret: equal for one secret, different for another, the path untouched |
 | `checkTelegramWebhook` / `TelegramWebhookState` | function / _type_ | whether the webhook still points here: `owned`, `ownerHost`, `pendingUpdates`, Telegram's `lastError` |
 | `receiveTelegramWebhook` / `ReceiveTelegramWebhookOptions` / `TelegramUpdateAcceptance` | function / _type_ | one webhook `Request`: 403 without the secret (compared in constant time), 405 for another method, 400 for no update, 200 once `accept` recorded it |
-| `createTelegramUpdateIntake` | function | webhook updates recorded before Telegram is answered and handled after: chat order kept, other chats alongside up to `maxConcurrent`, a renewed lease per attempt, a sweep that takes over what a restart or a dead process left, retries, `maxAttempts`, finished updates remembered `retainMs` to refuse repeats; at least once |
-| `TelegramUpdateIntakeConfig` / `TelegramUpdateIntake` / `TelegramUpdateEnvelope` / `TelegramUpdateFailure` / `TelegramUpdateStoreStep` | _type_ | `store`, `handle` (a grammY `BotError` is unwrapped: `retry`, `onFailure` and the stored error see what the middleware threw), `retry`, `maxAttempts` (5), `leaseMs` (120 000), `pendingGraceMs` (60 000), `sweepEveryMs` (30 000), `retainMs` (24 h), `maxConcurrent` (32), `onFailure`, `onStoreError`, `now`; `accept(body)`, `start()`, `sweep()`, `idle()`, `close()` |
-| `TelegramUpdateStore` / `StoredTelegramUpdate` / `TelegramUpdateState` / `TelegramUpdateSettlement` / `TelegramUpdateClaimOptions` / `TelegramUpdateDueQuery` | _type_ | the store an intake runs on: `add`, `claim`, `renew`, `settle`, `due`, `prune`, each atomic on one record — a claim takes `pending`, a due `failed` or a lapsed `processing`; renew and settle only by the attempt holding it |
+| `createTelegramUpdateIntake` | function | webhook updates recorded before Telegram is answered and handled after: chat order kept, other chats alongside up to `maxConcurrent`, a renewed lease and immutable fence per attempt, a sweep that takes over what a restart or a dead process left, retries, `maxAttempts`, optional recoverable exhaustion delivery, finished updates remembered `retainMs` to refuse repeats; at least once |
+| `TelegramUpdateIntakeConfig` / `TelegramUpdateAttemptIntakeConfig` / `TelegramUpdateIntakeOptions` / `TelegramUpdateIntake` / `TelegramUpdateEnvelope` / `TelegramUpdateFailure` / `TelegramUpdateStoreStep` | _type_ | `store`, unchanged `handle(update)` or attempt-aware `handleAttempt(update, context)` (a grammY `BotError` is unwrapped), shared `retry`, `maxAttempts` (5), `leaseMs` (120 000), `pendingGraceMs` (60 000), `sweepEveryMs` (30 000), `retainMs` (24 h), `maxConcurrent` (32), `onFailure`, durable `handleExhaustion`, `onExhaustionFailure`, `onStoreError`, `now`; `accept(body)`, `start()`, `sweep()`, `idle()`, `close()` |
+| `TelegramUpdateAttemptContext` / `TelegramUpdateAttemptIdentity` / `TelegramUpdateOwnershipLostError` | _type_ / class | immutable `{ updateId, attempt, claimId }` fence plus `ownerLost`; the persisted opaque claim token prevents a stale capability from matching after prune/re-add, while a store check in the consumer's DB transaction fences a domain write |
+| `TelegramUpdateExhaustion` / `TelegramUpdateExhaustionFailure` / `StoredTelegramUpdateExhaustion` / `TelegramUpdateExhaustionQuery` | _type_ | a terminal update/attempt/error retained in the update store until `handleExhaustion` resolves; ordered `{ limit, afterUpdateId? }` pages prevent a failing first batch from starving later rows; delivery failures are observational and leave it due |
+| `TelegramUpdateStore` / `StoredTelegramUpdate` / `TelegramUpdateState` / `TelegramUpdateSettlement` / `TelegramUpdateClaimOptions` / `TelegramUpdateDueQuery` | _type_ | the base store an intake runs on: `add`, `claim`, `renew`, `settle`, `due`, `prune`, each atomic on one record — a claim takes `pending`, a due `failed` or a lapsed `processing`; renew and settle only by the attempt holding it |
+| `TelegramUpdateFencedStore` / `TelegramUpdateDurableStore` | _type_ | reference-store capabilities: `claimOwned` creates and returns the persisted identity, `renewOwned`, `owns(identity, at)` and `settleOwned(identity, settlement)` act only on that exact unexpired claim; `exhaust`, `dueExhaustions`, `acknowledgeExhaustion` keep a final consumer obligation in the same row until exact acknowledgement |
 | `memoryTelegramUpdateStore` | function | the store in this process's memory — tests, or a bot that accepts losing unhandled updates to a restart |
 | `sqliteTelegramUpdateStore` / `SqliteTelegramUpdateStoreConfig` / `TelegramSqliteDatabase` | function / _type_ | the store in SQLite over the handle the application opened — `bun:sqlite` `Database` or `node:sqlite` `DatabaseSync`; `table` (default `telegram_updates`) created when missing |
 | `postgresTelegramUpdateStore` / `PostgresTelegramUpdateStoreConfig` / `TelegramPostgresQuery` | function / _type_ | the store in Postgres over the client the application holds, as one `query(text, parameters)` returning rows — Bun `sql.unsafe`, Prisma `$queryRawUnsafe`, `pg` `pool.query`; each rule one conditional statement; `table`, `createTable` (default `true`) |
-| `postgresTelegramUpdateStoreSchema` | function | the table and its index as a statement for a migration, safe to run twice |
+| `postgresTelegramUpdateStoreSchema` | function | the table, idempotent `claim_id` upgrade and index as a statement for a migration, safe to run twice; required before fenced methods when `createTable: false`, while legacy base methods remain compatible with the prior table |
 | `checkTelegramUpdateStore` | function | put any store through every rule, each on a fresh store from `make`, concurrent claims included; resolves with the violations, empty when it keeps them |
 
 ---

package/llms/{upgrading-0.100.0-0.108.0.txt → upgrading-0.101.0-0.109.0.txt}

@@ -1,14 +1,81 @@
-# Upgrading 0.100.0 → 0.108.0 — stitchkit docs slice
+# Upgrading 0.101.0 → 0.109.0 — stitchkit docs slice
 
 > Generated from the `docs/` tree by `bun run gen:llms`. The index of all slices is
 > `llms.txt` in this package.
 
-Contains: Guide: Upgrading, 0.100.0 → 0.108.0  (docs/guide/upgrading.md)
+Contains: Guide: Upgrading, 0.101.0 → 0.109.0  (docs/guide/upgrading.md)
 
 ==============================================================================
-# Guide: Upgrading, 0.100.0 → 0.108.0  (docs/guide/upgrading.md)
+# Guide: Upgrading, 0.101.0 → 0.109.0  (docs/guide/upgrading.md)
 ==============================================================================
 
+## Released migration: 0.109.0
+
+### free CLI record leaves are lexical
+
+**Who must act:** scripts that pass dotted values into a free `record<string, unknown>` and rely on
+stitchkit guessing numbers or booleans from their spelling. Declared object leaves and whole-object
+JSON keep their typed behavior.
+
+Free record values have no schema type to justify coercion. They now preserve argv text, so values
+such as `007`, `1e3`, `true` and `false` arrive exactly as written.
+See [ADR 0257](../decisions/0257-cli-dotted-values-follow-their-declared-schema.md).
+
+1. Pass typed free-record values as one JSON object:
+
+   ```sh
+   # before: produced { count: 5 } by spelling-based inference
+   app command --data.count=5
+   # after: JSON says explicitly that 5 is a number
+   app command --data='{"count":5}'
+   ```
+
+2. If dotted flags are the intended interface, declare their object shape; a `z.number()` or
+   `z.boolean()` leaf still coerces and validates its own CLI value.
+
+### Opting into Telegram attempt fencing
+
+Existing `handle(update)` callbacks and the six-method `TelegramUpdateStore` need no change. The
+new capability is opt-in
+([ADR 0256](../decisions/0256-a-telegram-attempt-is-fenced-by-a-persisted-claim.md)).
+
+1. To fence a domain write, move only that handler to the explicit context-aware option:
+
+   ```ts
+   createTelegramUpdateIntake({
+     store,
+     handleAttempt: async (update, { fence, ownerLost }) => {
+       ownerLost.throwIfAborted()
+       await domainTransaction(async (tx) => {
+         if (await transactionStore(tx).owns(fence, Date.now())) await apply(tx, update)
+       })
+     },
+   })
+   ```
+
+2. A direct grammY handler remains `handle: bot.handleUpdate.bind(bot)`; stitchkit does not pass its
+   attempt context into grammY's optional webhook-envelope parameter.
+
+3. A custom store used by `handleAttempt` implements `claimOwned`, `renewOwned`, `owns` and
+   `settleOwned` over the full `{ updateId, attempt, claimId }` identity. If it also delivers
+   `handleExhaustion`, implement `exhaust`, `dueExhaustions` and `acknowledgeExhaustion`. Run
+   `checkTelegramUpdateStore` against a fresh database; it checks base, fenced and durable rules
+   according to the methods the store exposes.
+
+4. SQLite stores add `claim_id` automatically. PostgreSQL stores with the default
+   `createTable: true` do the same. When migrations own a PostgreSQL table, apply the returned
+   schema before enabling `handleAttempt` or `handleExhaustion`:
+
+   ```ts
+   await sql.unsafe(postgresTelegramUpdateStoreSchema('telegram_updates'))
+   // Equivalent addition for an existing table:
+   // ALTER TABLE telegram_updates ADD COLUMN IF NOT EXISTS claim_id TEXT;
+   ```
+
+   Legacy `handle(update)` continues to use base operations that do not reference `claim_id`, so
+   the migration is required only when the new capability or an explicit base
+   `claim(..., { durableExhaustion: true })` is enabled.
+
 ## Released migration: 0.108.0
 
 ### a request that never left is its own send outcome
@@ -831,72 +898,3 @@ text.replace(new RegExp(TELEGRAM_BOT_TOKEN_PATTERN.source, 'g'), '[redacted]')
 createJsonLogger({})
 redactTelegramBotToken(text)
 ```
-
-## Released migration: 0.100.0
-
-### watch capacity and session/live/delivery adoption
-
-**Who must act:** watch consumers exceeding 1024 hub sources, 1024 hub subscribers,
-1024 client keys or 128 listeners per key. These previously unbounded collections
-now refuse excess admission. Choose explicit positive finite limits, for example:
-
-```ts
-// Before: no hub-wide capacity bounds.
-createWatchHub({ read, watchable });
-// After: explicitly budget a larger workload.
-createWatchHub({ read, watchable, maxSources: 4096, maxSubscribers: 4096 });
-// Client limits are configured independently.
-createWatchClient({ ...clientConfig, maxKeys: 2048, maxListenersPerKey: 256 });
-```
-
-The remaining steps apply only to applications opting into session lifetimes,
-scoped watched reads, managed subscriptions or multi-action notification delivery.
-Existing clients within the limits and single-send outboxes need no migration.
-
-Replace local session generation counters with one `createSessionScope`; share it
-with `createSessionCredentials`. Guard transport attempts, complete asynchronous
-operations and final synchronous delivery. Route credential persistence through
-one coordinator. Keep provider-specific error classification and bounded command
-retry in the application. Coordination is per client instance.
-
-Upgrade both watch endpoints before enabling session-scoped watches: strict older
-servers reject the new optional `WatchKey.instance`. Server-verified scope controls
-sharing; the client instance is only routing identity. Bind exact watched handles
-to session-qualified cache keys. Existing delta/reconnect behavior stays in place.
-For applications needing more than 1024 hub sources/subscribers or client keys, set
-explicit finite capacity options. Enable a reconciliation interval when lost hints
-must recover without a reconnect.
-
-For multi-action outboxes, enqueue new items with a versioned delivery plan and
-return small JSON receipts from `send`. Existing queued single-send items should
-be drained before enabling a delivery executor on that queue, or migrated under
-the store's atomic transition. When a new executor version ships, list the old
-version's projection in `delivery.retiredVersions` until its queued items drain;
-a plan version with no executor waits, reported to `onError` as
-`NotificationPlanVersionError` (from 0.100.1).
-Make projection idempotent. Provider idempotency/reconciliation remains necessary
-for a crash between remote success and checkpoint. These APIs are available starting with 0.100.0.
-
-### exclusive lock recovery
-
-New lock and reclaim-guard records include `owner.process`: kernel boot identity,
-process birth token and namespace. `readDiagnosticJournalLockDiagnosis(error)`
-adds `identity` to distinguish matched lifetime evidence, PID reuse, a different
-boot, an absent PID, a legacy record or unavailable identity. Legacy `alive` only
-means the PID is present; it does not prove that the recorded writer still exists.
-
-**Who must act:** deployments recovering a legacy lock with a reused live PID,
-or bundling file-lock consumers into a standalone Darwin executable. Legacy
-records cannot safely infer their missing boot/start identity from `acquiredAt`.
-Stop all writers to that resource, verify exclusive ownership, preserve the old
-lock for incident evidence outside the active lock path, and restart with the
-new package. Never delete a lock merely because it is old. New acquisitions
-write the modern record; no journal data migration is needed.
-
-Darwin distributions must retain the package's architecture-matched native
-`.node` asset for process birth measurement, as for contained filesystem access.
-If native/proc identity cannot be read, new locks explicitly record null and
-recovery refuses rather than treating unknown ownership as death. From 0.100.1 a
-Linux kernel without time namespaces (before 5.6) records the PID namespace alone
-instead of null, so its locks recover like any other. Existing
-`refuse` policy and the separately configured ownerless-file grace are unchanged.