# Telegram Bridge Architecture ## Purpose `pi-telegram` is a session-aware Pi runtime extension that binds Telegram destinations to running Pi instances and routes each accepted prompt into the assigned instance's currently active session. It owns the Telegram bridge boundary: - Poll Telegram updates and enforce single-user pairing. - Translate Telegram text, callbacks, media, and files into Pi turns. - Stream previews and deliver final Pi responses back to Telegram. - Provide Telegram-native controls for queueing, model/thinking/settings menus, compaction, abort/stop, prompt templates, reactions, and outbound artifacts. The bridge is a mobile companion for a live Pi runtime, not a remote terminal or session browser. It should let an operator start work in the TUI and continue supervising the instance's active session from Telegram, while staying inside Pi's extension-facing contracts. This document is the architectural map. Focused behavior standards live in sibling docs: - [Public API](./public-api.md) — stable commands, config, package entrypoints, assistant markup, extension APIs, and compatibility boundaries. - [Telegram Delivery API](./delivery.md) — target-aware operational views, logical message handles, lifecycle fencing, and leader/follower transport. - [Telegram Activity API](./activity.md) — normalized Pi lifecycle events, activity/source identity, non-blocking extension dispatch, and delivery contexts. - [UI Style](./ui-style.md) — inline UI labels, navigation, state markers, cards, and dialogs. - [Callback Namespaces](./callback-namespaces.md) — callback prefix ownership and fallback rules. - [Sections](./sections.md) — structured Telegram menu sections. - [Updates](./updates.md) — update classification, default-routing plans, and raw Telegram update interception. - [Voice Integration](./voice.md) — voice reply policy and STT/TTS provider surface. - [Command Templates](./command-templates.md) — shell-free command-template contract. - [Generative Apps](./generative-apps.md) — managed reusable application identity, state, generated button views, hybrid action routing, replacement, and bounded execution contract. - [Telegram Multi-Instance Bus](./multi-instance-bus.md) — Threaded Mode bus leadership, Telegram UI thread targets, instance identity, and leader/follower routing. ## Runtime Topology `index.ts` is a thin package entrypoint that re-exports the default extension from `lib/extension.ts`. `lib/extension.ts` is the only composition root. It wires live Pi ports, Telegram Bot API ports, session-local stores, lifecycle hooks, and domain runtimes. It should operate at high-level domain-runtime boundaries: non-trivial Threaded Mode capability decisions, leader/follower recovery, sync-slice bookkeeping, manual thread cleanup, and bus routing policies belong in their owning `/lib` domains. Reusable logic lives in flat `/lib/*.ts` domain modules rather than a deep local module tree. ### Extension Boundary Vs Supervisor Control `pi-telegram` runs inside the current Pi process as an extension. That gives it safe access to public extension APIs such as aborting work, compacting, dispatching queued prompts, observing lifecycle events, and rendering Telegram-native controls. It does not own the terminal, the interactive-mode chat transcript, or the process lifecycle. Keep this boundary explicit: - Do not use raw TTY injection, ANSI terminal clearing, private TUI container mutation, or a shadow `pi` subprocess to simulate interactive commands. - Do not treat Telegram as a generic remote shell for every Pi slash command. - Commands that require interactive session replacement or TUI rerendering, such as a true Telegram `/new`, need a public Pi API that invokes the same runtime path as the terminal command. - A separate PTY supervisor or daemon could choose to own those risks, but that would be a different product mode rather than this extension's runtime contract. ### Instance, Session, And Context Cost Live Telegram routing belongs to the active authenticated Pi instance, while a durable Workspace Thread belongs to the exact profile/CWD/session identity. Ordinary Telegram prompts enter the session currently bound to that target. Local `/resume` replaces session-scoped runtime state and selects the destination session's binding; it never inherits the source Thread merely because the process is unchanged. Telegram exposes compaction and new-session replacement for the active session: `/new` first completes and removes its exact durable update, then dispatches the runtime-armed `/telegram-connect --internal new ` branch through `pi.sendUserMessage(..., { expandPromptTemplates: true })`, without entering ordinary Connect profile or transport startup, so the handler runs with a real `ExtensionCommandContext` and calls the same `AgentSessionRuntime.newSession()` path as the terminal. Before invoking that path, the current transport owner CAS-publishes one expiring replacement intent inside the existing profile target snapshot. The intent discriminates `workspace-thread` from `classic-chat`. A same- or cross-process successor may consume either only for the exact profile, CWD, source session, target, and fresh lifetime: Threaded continuity re-keys the retained Workspace binding and preserves Thread, slot, and display identity, while Classic continuity preserves the exact chat target without creating a Workspace binding or entering topic lifecycle APIs. A confirmed callback is acknowledged and its dialog is deleted before session replacement begins. Once the successor has delivery authority, it atomically claims the intent by CAS-clearing it and then sends one separate terminal success result with bounded in-process transport retry. The old `withSession` path never publishes success, and an unclaimed intent never sends, preventing duplicate terminal notices across same-process startup and cleanup-ack ambiguity. Mismatch or expiry never authorizes binding takeover. Resume, fork, tree navigation, session switching, and full reload remain outside the stable Telegram API until Pi exposes safe public extension hooks for them. `/telegram-connect` never launches a hidden or headless Pi process. A long-lived background Pi process can own Telegram only when something else explicitly launched that process and it satisfies the normal lock/runtime rules. Pi `print` and `json` modes stay passive and exit rather than becoming hidden polling owners. Pi session JSONL and pi-telegram runtime JSONL serve different purposes. Pi session files contain model conversation, tool, usage, branch, and compaction entries. The shared, profile-labelled `logs.jsonl` contains redacted bridge operations from one or more instances and never become model context. Sharing a Telegram profile or working directory does not by itself merge Pi session identities or model histories. A Telegram prompt is a normal Pi model turn. It inherits the active post-compaction context just like a TUI prompt in the same session; pi-telegram does not promise context isolation or token cost proportional only to the new message. The bundled `telegram-bridge` Skill owns agent operation, while `show-me` owns portable evidence-honest explanation shape plus Telegram phone-width Markdown and browser-artifact adaptation; neither owns the other's transport boundary. A small authority-aware system note routes applicable turns to these and the other bundled Skills. Existing session files created by older versions may still contain historical repeated guidance until session replacement or compaction removes it from active context. The repository uses a **Flat Domain DAG**: - Local imports must form a directed acyclic graph. - Cohesive domain files are preferred over atomizing every helper. - Shared buckets such as `lib/constants.ts` or `lib/types.ts` are avoided. - Constants and state types live with their owning domain. - Narrow structural projections are allowed when they avoid importing broader runtime or wire DTOs. - Source file headers include `Zones:` tags so cross-cutting responsibility stays visible without folder nesting. ### Live-Rebind Module Map For an already-issued leader menu/control command whose semantics finish before delivery, the original chooser may observe its exact warm source-removal ACK for one window of up to eight seconds before answering. Later taps only reobserve; they do not restart that wait. Naming/confirmation/extension producers whose source completion can depend on later publication keep their independent completion path. Updates notifies subscribers only after its carrier retains that ACK, not at the earlier journal-completion hook. Routing rechecks source, recipient, canonical binding and execution generation; observation cannot issue a second command or turn source absence into confirmation. Menu/reply delivery is not awaited. Timeout, abort or authority loss removes subscriptions and retains uncertainty without replay; old-Thread cleanup remains an independent fenced operation. Release `0.53.0` adds the [live-rebind channel](./multi-instance-bus.md#live-rebind-channel) and bounded old-Thread cleanup. It advertises live save/apply/settle, command-set and selected-menu-delivery through bus protocol v3, retaining Workspace Restore for legacy continuity. A loaded 0.53.0 build prefers the live path; an instance still running an older build keeps Restore until it is reloaded. Windows runs the same channel and strict reads, exercised by the CI matrix; there is no platform-specific alternate protocol. The channel reuses existing owners rather than adding a parallel command bus, queue or recovery store: - `routing` / `threads`: Chooser authority, atomic same-session canonical binding/operation publication, recipient application and one-shot cleanup. Supported leader/follower input producers independently retain `inputRelease: held → issued → accepted`: applied binding precedes the cleanup decision and one native input grant; terminal cleanup alone cannot retire held or uncertain input. In-flight/unknown deletion protects the old target through cold reads. A session-replacing producer may positively end unissued cleanup with durable `oldTargetProtected` instead of carrying an old-session delete grant forward; the new binding remains usable. Earlier work otherwise defers cleanup through the existing scheduler. Canonical policy and negotiated reader/execution capabilities belong in the linked channel contract. - `commands`: Shared supported plans for Status/Abort/Stop/Next/Continue and registered prompt templates. Compatible leader status/control plans retain inline replies; held followers retain detached restricted delivery. Leader queue plans capture genuine warm originals before release and retain routing custody; followers execute only their saved carrier. Nonmatching menus/help/naming/confirmation retain native owners, and extension selected producers remain a separate leader-only contract. - `updates` / `journal` / `queue` / `turns`: Existing exact source identity, receipt ownership, no-fold admission, publication/readiness and native removal ACKs. Semantic completion, queue acceptance and reply delivery are not source removal. Uncertain outcomes never permit another handler invocation, fallback admission or a second queue. - `bus` / `bus-follower` / `bindings`: Authenticated generation/session/recipient-scoped transport and preparation. Wire syntax does not decide command availability or create execution authority; the captured recipient registry does. Only the live cleanup origin uses the approved historical-protection reduction. Existing Restore/retirement, strict source readers, queued custody and retained completion ACKs keep their contracts. Command-channel policy and protocol identities belong in [Live-Rebind Channel](./multi-instance-bus.md#live-rebind-channel). ### Domain Ownership Map - `lib/extension.ts`: composition root for live ports, domain runtime construction, cross-domain port wiring, and lifecycle registration. It exposes wiring but owns no process identity, journal-binding selection, mutable late-binding state, admission lifecycle selection, reusable policy, or low-level adapter mechanics; those belong to `bus`, `process-identity`, `journal`, `prompts`, `activity-verbosity`, `updates`, and other named domains. - `api`: Bot API helpers, retries, uploads/downloads, temp cleanup, byte limits, chat actions, lazy token clients, and API error recording. Its optional Workspace-admission client classifies valid threaded requests exactly, chat-only requests chat-wide, malformed declared targets profile-wide, and targetless methods as outside the fence; JSON and multipart leases span internal retries through final settlement. Admission blocks prevent issuance, while release errors remain protective diagnostics and never convert an already-settled non-idempotent request into replay. Production composition resolves this adapter from the current bot/profile admission runtime. - `config` / `setup`: `telegram.json`, bot token setup, named bot/session profiles, first-user pairing, authorization, env fallback, atomic persistence, effective config views, and live config accessors. - `locks` / `polling`: extension-local transport owner storage, exact-owner epoch exposure, process-global reload generations, completed-generation suspension evidence, owner-aware polling lifecycle/takeover/follower registration, and classic-vs-Threaded capability orchestration. Polling owns long-poll state, worker-before-poller startup, strict batch validation, journal-before-offset admission, one offset commit per response, and non-awaited worker signaling. - `journal`: private profile/bot-scoped raw-update authority with strict v1 identity/schema validation, exact deduplication, bounded transaction-serialized `0600` publication, process/session/acquisition-bound prompt/control receipts, owner-fenced completion, durable retry state, and generic removal that rejects queued or legacy failed authority. Prepared v1 `sourceCompletions` retain bounded acceptance-scoped ACKs atomically with exact removal, survive compaction, and require strict source-handle inspection; private worker/Restore consumers and the live-rebind candidate use exact scoped observation without exposing mutation or recovery through public package membranes. Runtime/recovery identity separates token rotation from future proof-gated queue-owner recovery. Read-only follower-journal discovery enumerates canonical profile-exact snapshots and segment roots and reports incomplete evidence for unexpected matching paths. Its optional Workspace-admission adapter conservatively classifies each append batch as exact-target, chat-wide, or profile-wide, holds all leases through publication, and releases acquired partial batches on rejection; production journal bindings resolve that adapter for leader, follower, recipient, and historical-path stores. - `wire`: Non-coercing shallow decoded-value predicates reused by Config, IPC, journal, admission, shared-state, queue, markup and Restore codecs. `isWireRecord` means non-array object, not a plain-object/prototype or JSON-serializability guarantee; `hasOnlyWireKeys` checks own enumerable string keys without requiring fields or considering inherited, hidden or symbol keys; `isNonNegativeWireInteger` preserves safe-number bounds, including zero; `isNonEmptyWireString` deliberately preserves whitespace. Proxy/inspection errors propagate. Domain schemas, lossless/foreign-evidence checks, normalization, errors, physical protection and effect authority remain with their owners. Assistant action fields use the separate shared `outbound-markup.getTelegramActionString` trim policy for voice/buttons. Decimal-only safe API activity parsing must not inherit the legacy integer coercion used by thread/API compatibility paths; hash framing, canonical sorting, encoding, prefixes and truncation remain protocol-owned rather than a generic SHA wrapper. - `thread-naming`: Name/title value policy and the exact-target manual-name dialog under one owner. Owns generated hints, identity normalization/grapheme fallback, palette/entropy selection, distinct identity/manual-display validation, the three-field template formatter and its title adapter, plus expiring session-scoped input/reset/cancel state. Dialog state exists only inside its runtime factory; value-policy calls do not instantiate it. Threads, Routing, Bus leader and extension validation consume this contract directly. Threads keeps old exports and the full provision-request formatter signature through the same typed function reference, not a wrapper. Live occupancy/current-record/slot policy, display projection and API/store effects remain elsewhere. Naming algorithms, palette order, limits, scope/target fencing, expiry and UI copy are unchanged. - `workspace-identity`: Exact session/CWD normalization, bounded directory/session keys and local instance-slot encoding. Owns `TelegramWorkspaceBindingIdentity`, the precomputed-key constructor and the shared key-length bound used by collision handling; it depends only on Node crypto/path and existing platform/CWD defaults. Threads, Sync, Routing and both Bus roles consume identity functions directly from this owner; Threads retains old identity exports as compatibility reexports. These value calls do not borrow Threads storage or effect authority. No store, target allocation, admission, callbacks or reverse dependency; constructing a key grants no storage-reference or custody authority. - `target`: Pure `{ chatId, threadId? }` address-value identity. `areTelegramTargetsEqual` compares both fields exactly; a missing Thread differs from Thread zero, and object identity is no shortcut. `getTelegramTargetKey` keeps the canonical `private` sentinel. Delivery, activity and Workspace domains reuse these functions; optional-target and differently keyed policies remain local. Address equality never grants transport, execution or deletion authority. - `process-identity`: PID liveness and stable process-birth identity: Linux `/proc` start ticks, macOS `ps` start time and Windows creation ticks read through PowerShell (cached only for the current process). Only an absent PID (`ESRCH`) or a mismatched birth proof yields `dead`; a live PID without a birth proof (inaccessible metadata, such as another user's process, or a generation fallback) is `unverifiable`. It is a leaf over Node child-process/crypto/fs/os so Locks, Bus, Journal, Workspace admission and Generative Apps share one proof without durable storage depending on the IPC protocol. Liveness never grants authority by itself. - `bus` / `bus-api` / `bus-leader` / `bus-follower` / `ownership`: Threaded Mode multi-instance bus contracts, profile-scoped process/endpoint identity, local leader/follower IPC, leader-only orchestration, follower-side manual registration/session runtime, follower-routed Bot API calls, and live message ownership. `bus` owns session-native protocol v3 independently from package build, canonical capabilities, compatibility, process runtime identity, profile-aware endpoints, IPC primitives, and replacement-invalidated non-routing registry observations. Registration rejects missing/mismatched protocol before provisioning while preserving compatible package skew; negotiated identity reaches status/state. Leader runtime, leader envelope handling, follower assembly, and follower registration construction require explicit protocol identity, preventing identity-less composition at both production and low-level runtime boundaries. `bus-leader` owns leader envelope handling and polling/server/prune orchestration; its Workspace-admission assembly holds a chat-wide lease across leader provisioning and profile-wide leases across follower provisioning/registration, disconnect/dead cleanup, leader/follower rename, display preference/reconciliation, and detached post-provision cleanup through its delayed API/store settlement. It consumes the profile operation runtime shared with Sync and routing; admission precedes that process-local mutation gate, fence rejection occurs before mutation, and release follows complete settlement. `bus-follower` owns registration/ack negotiation, active leader-auth/election state, heartbeat, authenticated clients, forwarded receiving, and recovery. Its production assembly holds profile-wide admission across follower-to-leader promotion, so a retained fence rejects it before leadership acquisition or store mutation. Production leader composition resolves the admission assembly at each operation boundary. The proof-aware follower Restore receiver replaces legacy target replacement: the old `leader.replaceFollowerTarget` producer, parser and receiver are removed, so even authenticated old-format requests are rejected before recipient effects. Profile admission surrounds exact retained-operation, authenticated leader/context, registration-generation, session/CWD and canonical binding/slot checks. `apply` updates only local registration after the leader's canonical commit; an already matching target does not switch again. `inspect` never switches targets and reports the observed local target plus readiness. Neither mode persists canonical state, manufactures deletion/probe evidence or dispatches input. Validated loading alone does not authorize the recipient effect. `threads.withWorkspaceRestoreSnapshot` now holds the canonical transaction while checking the exact retained intent, binding protection and recovery evidence, then supplies fresh binding/owner data to a synchronous read-only observation. Both `apply` and `inspect` run their existing recipient checks, local application and readiness construction inside this boundary, with fresh scoped-intent and live-context checks. The callback contract excludes asynchronous observers; neither cached projection nor callback completion grants canonical persistence. A follower with `canPersist: false` can observe but still cannot use the leader's registration publisher. Native regressions reject receipts, binding regression, owner detachment, intent adoption and context replacement arriving after load; valid reobservation never repeats apply. The transaction spans the local effect, releases on failure, and neither receiver mode changes canonical bytes. The leader recipient path uses the same observation: session/CWD/slot and active-owner selection consume its fresh binding/owner rows, not the warm store, and the transaction spans local identity application and readiness construction. Full-capacity native worker fixtures reject post-grant receipts, binding/owner regression and context changes both before first apply and during inspection after a lost apply reply, preserving the pending original and issued grant without undoing an earlier valid apply. These fixtures do not authorize activation or live fault injection. A composed capability-gated controller and authenticated envelope connect this receiver across native IPC, with one transport attempt and exact readiness-response validation; see the [bus contract](./multi-instance-bus.md#protocol-identity-and-compatibility). Successor inspection can verify a changed follower registration or process only against its actual session/CWD, one current canonical owner, the unchanged binding/slot and observed local target; an old local target remains not ready. Successors cannot use the original apply grant. Follower target preparation uses `threads.assertWorkspaceRestoreRegistration` before recovery allocation, visibility probes and owner transfer, after probe awaits, and before returning the prepared target. The read-only precondition checks fresh canonical and recovery evidence under the snapshot transaction; a protected target requires its exact binding key, slot and relocated target, never the old target. Lost evidence or late recovery conflicts cannot fall through to visibility-error recovery or leave a transient claim held. This is not registration/transport authority: callers still own authentication, profile/session/leader/generation checks and Workspace admission. Bootstrap now re-enters profile admission and the shared mutation gate for `commitWorkspaceRestoreRegistration`; declared Workspace bindings are checked again in the publication snapshot, even without retained Restore. The synchronous callback rechecks captured leader epoch, profile and operator before writing. Missing, unused, reused or expired publication authority cannot report success; the post-commit ACK rechecks current registration identity, allowing heartbeat, connection-time and Thread-name metadata changes. Lost post-publication authority never removes independently published state. Native authenticated bootstrap tests cover the real transaction and late recovery/authority changes. The root protocol identity now advertises `workspace-restore-v1`; every participating peer must run this build before its Restore is used. - `sync`: demand-driven Telegram reconciliation, mutable sync-slice state, nested provisioning activity, and local assumption policy. It does not own a complete Telegram bot read-model; Bot API lacks a complete topic/thread listing surface. It owns sync slices, invalidation triggers, config-persist invalidation sequencing, exact-target admitted stale-topic API recovery, observation intake, status/debug freshness, paired manual-disconnect/session-restart cleanup assembly, prepared quiescent leader-quit detachment, and reconciliation scheduling across bot identity, pairing assumptions, live target bindings, reservations, and transport health after meaningful observable signals. Production topic lifecycle and disconnect/restart cleanup enter profile-wide admission before the shared Workspace operation gate. Lifecycle admission spans observation-driven store settlement; cleanup admission spans intent publication, Telegram cleanup, binding mutation, durable settlement, and transport release. It should call narrower domain primitives rather than letting `index.ts`, `threads`, or `status` accumulate cross-cutting reconciliation policy. - `thread-reconciler`: Threaded Mode control-plane planning for Telegram thread/tab lifecycle. It owns the reconciliation state machine (`stable`, `provisioning`, `sync-required`, `cleanup-required`), pure plans, proof-before-delete rules, pending-provision protection, fresh-creation grace windows, leader-epoch checks, and the single policy authority for destructive thread cleanup actions. It excludes live Telegram API calls, inbound routing, menu rendering, and direct persistence. - `thread-cleanup-manager`: Proof-only review and confirmed manual inactive-Workspace cleanup coordination. It emits exact profile/binding/target snapshots only when durable inactivity exists, all live-owner/accepted-work/delivery evidence is `clear`, identities are unique, and no reservation, provision, or cleanup competes. Missing, malformed, duplicate, or `unknown` evidence returns no candidates; age and ordering never create authority. Its bounded profile/token-scoped work store atomically persists exact candidate snapshots, records one exact Workspace-issued deletion permit as outcome-unknown, rejects mismatched permits, and confirms deleted state idempotently; strict reads reject malformed/private-file ambiguity. The isolated executor requires an injected exclusive Workspace deletion boundary across fresh planner evidence, exact retained-snapshot comparison, permit acquisition/recording, delete callback, and confirmation. The fence owner must acquire and recheck in admission-ledger order; a retirement fence cannot be nested inside an active ordinary admission lease. Regressions prove drift stops before permit, unavailable/already-issued state cannot fabricate authority, and ambiguous delete remains outcome-unknown without replay. A production-shaped adapter preserves full Workspace records through external-protection resolution, then snapshots exact cleanup fields, reservations, provisions, and cleanup intents; protection exceptions become `unknown`, while source failures propagate fail-closed. Production Settings on the leader exposes **Review inactive tabs** under profile-wide admission with a fresh canonical store reload. One canonical 128-bit-digest work-set is retained; the summary reports the proven count, explicit no-deletion state and Back navigation, warns that Clean deletes the Telegram tabs and their messages but not Pi history/project files, and offers one separate **Clean inactive tabs** confirmation. The exact confirmation callback fits Telegram's 64-byte bound and accepts only canonical work-set IDs. Preview and Back perform no deletion. Permit composition must not call `acquireRetirementFence()` because retirement remains pressure-only. The one admission-ledger fence now carries discriminated `pressure-retirement | manual-thread-cleanup` authority, treats legacy missing kind as pressure, exposes `acquireThreadCleanupFence()`, includes kind in exact comparison/permits, and remains profile-singleton. Cleanup-specific adopt/issue/absence/release/complete APIs preserve existing retirement callers and reject cross-kind use. Review admission releases before cleanup-fence acquisition; that fence then spans exact full-record/protection revalidation, sole permit issuance, work-set recording, one delete attempt, absence confirmation, binding/work-set commit, and fence completion. The kind-specific acquire/adopt/issue/absence/release/complete methods are implemented; pressure methods reject manual fences and cleanup methods reject pressure fences. The permit runtime acquires the cleanup fence, revalidates under it, releases drifted unissued fences, refuses already-issued replay, and retains `commit-ready` until an injected durable commit succeeds. `threads.commitInactiveWorkspaceCleanup()` now removes only an exact full inactive binding after rechecking local records, claims, reservations, provisions, cleanups, and retirement intents; the retained cleanup candidate carries sufficient exact cwd/workspace/instance/global-slot/binding/target/inactivity/update commit identity, and under the retained fence exact absence closes commit-unknown retry without reconstructing the deleted full binding. Commit composition removes the binding before confirming the work-set, and failure retains `commit-ready`. The coordinator validates canonical review identity, resolves the full binding, records the sole permit before one injected delete call, then commits binding, work-set, and fence. A `commit-ready` retry finishes without another delete; ambiguous deletion remains `deletion-issued` and is never replayed. The production runtime wraps this coordinator in the shared Workspace gate without nesting ordinary admission under a manual fence, reloading exact evidence both before and after fence acquisition. It captures profile/token/operator/session-generation/leader authority, binds work-set permits to the exact token-scoped ledger identity rather than the human profile name, and rechecks authority before transport, after deletion and after awaited local commit. The direct executor-only client validates the retained exact permit at issuance and disables retries/fallback. A Settings-port adapter reports deleted, outcome-unknown and blocked counts; a retained unreleased fence cannot be reported as completed cleanup. Fake-port tests exercise the callback lifecycle and successor recovery: takeover requires injected proof, exact fence identity is preserved, live/unverifiable predecessors fail closed, and `commit-ready` resumes without deletion replay. Cross-process workers prove stale `prepared` contenders call fake transport once: deletion requires successful work-set permit CAS, and redundant fences over deleted entries settle without replay. Work-set pre-rename failure and lost post-rename acknowledgement retain recoverable fence truth; durable `deleted` completes that fence without another transport call. Binding-snapshot pre-rename ownership loss reloads and restores the exact binding, while post-rename acknowledgement loss reloads durable absence as successful commit. Cleanup runtime composition additionally requires candidate/work-set/runtime/fence profile equality before mutation and captures one stable successor owner snapshot for adoption. The optional Settings port reports only redacted exact-authority recovery classes: commit pending, deletion outcome unknown with no retry, or unavailable authority. It exposes no target, path, token, or transport details. Slotless bindings with proven inactivity and clear protection are eligible for review. Their work-set, manual fence and permit carry explicit `slot: null`; missing, malformed or non-uppercase letter fields are rejected rather than interpreted as absence. Pressure retirement still requires a real uppercase letter. A slotless manual fence protects its exact target/admission scope without reserving another binding's recycled letter. Existing letter-bearing v1 records remain readable; older readers reject the new null-bearing records, so mixed-version cleanup must not bypass that refusal. Native filesystem regressions exercise confirmed and unknown one-shot outcomes, cold work/fence reads and exact binding commit while the replacement letter holder is preserved; deletion transport remains injected. Production supplies `cleanInactiveThreads` only through this fenced runtime. A new owner may adopt a retained fence only with fresh process-birth death proof; alive/unverifiable predecessors remain protected. Native filesystem tests with injected transport cover success, changed/protected candidates, post-fence protection, unknown deletion, authority loss during loading/deletion/commit and commit-ready retry. They are not live Telegram deletion or native Windows acceptance. - `thread-display`: Shared Letters/Names/Directories projection, Settings-mode/manual-override coordination, initial-create title selection, and serialized leader-owned title application. Owns bounded path disambiguation, ambiguous-label rejection, and profile/mode/epoch plus captured live-binding fences. Acknowledged `displayTitle` remains distinct from stable `threadName`; explicit slotless retained repair uses that generated name (or a manual override) rather than a recycled letter, even without a live owner. Automatic roster/startup and mode passes use `reconcileLive()` on the same queue and skip dormant bindings; a live slotless owner still needs its actual generation fence. The caller owns triggers and live-owner discovery; successful metadata reuse awaits a targeted display attempt under fresh profile admission before fresh allocation resumes. Leader provisioning applies the configured projection before creation; registration ACKs deliver the acknowledged title before initial follower status, and heartbeat ACKs carry later changes. Stable runtime names remain restoration identity rather than presentation. Current-thread/TUI display identity is separate from restoration identity. Live bot choosers, notices, prompt labels, and cross-instance agent-target resolution use acknowledged display titles while captured numeric targets and live registrations remain the routing authority. Settings routes direct-owner changes locally and follower changes through an authenticated capability-gated envelope. The leader serializes preference writes and application. - `workspace-slots`: Pure bounded global-letter selection and pressure-reclamation proposals. It consumes explicit protection/inactivity evidence and never discovers owners, persists state, or performs deletion. - `workspace-admission`: Durable profile-scoped reader/writer ledger for cross-process exact-target, chat-wide, and profile-wide admission leases plus one destructive retirement fence. It owns atomic lease/fence transactions, proven-dead process-birth recovery, conservative malformed/ambiguous-state handling, exact successor adoption, retained-slot projection, and the durable `fenced` → `deletion-issued` → `commit-ready` or `deletion-rejected` outcomes; one fence emits at most one deletion permit. Its runtime binding resolves `workspace-admission[.].json`, stores only the token SHA-256 profile authority, preserves separate named-profile identities across switching, permits changed-token rebind only when the prior ledger is provably empty, and fails closed while foreign leases or a fence remain. Issued fences cannot be released before confirmed absence and durable retirement commit; callers own journal/API/provisioning operations and retirement policy. Production composition supplies admission to journals, JSON/multipart API, leader/follower mutations, topic lifecycle, reroute restoration/reclamation, manual disconnect/session-restart cleanup, exact stale-target recovery, and Thread-store slot reservations; journal-evidence pruning also requires caller-supplied admission. Common async runners and the API adapter reject concurrent reuse of a live operation ID before a second caller can share or release its lease; once the first invocation exits, retry-stable recovery remains available. A 2/2 same-model independent post-fix quorum verified complete production-mutation composition at 0.96 confidence per reviewer. Demand-driven retirement is now operator-authorized and wired to fresh allocation; disposable operator smoke remains distinct from local validation. - `workspace-retirement`: Profile/leader-fenced pressure preparation over the store snapshot. It counts standalone reservations, selects one candidate only at full slot capacity, rechecks protection, and persists/resumes an exact durable intent. Workspace bindings accumulate their historical follower-journal routing keys and distinguish complete fresh metadata from incomplete legacy evidence. Its read-only accepted-work policy resolves those binding-specific journals plus the shared leader journal and combines them with local exact targets, failing closed when source coverage or target decoding is incomplete. It can prune a known empty follower-journal key only from complete readable evidence plus explicit writer quiescence under exact binding/profile/epoch fences and an exact-target admission lease held through durable publication. Incomplete legacy bindings consume discovered hashed journals as target-scoped evidence but remain incomplete so every later retirement repeats discovery. The shared Workspace operation runtime serializes topic lifecycle, reroute restoration/reclamation, provisioning, delayed post-provision reconciliation, follower/manual cleanup, rename, and display mutation through one exposed gate. Detached mutation work must reacquire fresh admission rather than inherit a lease already released by its caller. A successor may durably adopt one exact stale-epoch intent after profile/binding/protection revalidation; direct old-epoch execution remains blocked. The isolated executor consumes that gate and requires the durable admission ledger. It acquires or exactly adopts the matching fence, rechecks protection after admissions close, advances to `deletion-issued` before invoking an executor-only `deleteForumTopic` port with the sole permit, and never reissues from that phase. Success or exact absence advances to `commit-ready`; store commit failure retains the fence, and exact completion follows durable binding+intent removal. A successor resolves an issued unknown outcome only through a separate exact-absence probe. Leader composition exposes exact registry, active/queued work, known journals, and profile-exact legacy discovery as protection evidence. Missing queue targets and incomplete reads remain unknown. The common direct Bot API client counts exact JSON/multipart targets until settlement; message-scoped edits/deletes without a thread conservatively protect every binding in their chat. Known historical follower owner keys decode to process-birth identity before liveness checks. Durable intents block matching claims and binding mutations. Fresh leader/follower allocation now uses a serialized capacity wrapper: try ordinary allocation, release its leases on a typed capacity failure, then prepare/adopt/execute retirement under the shared mutation gate and retry once. Restore-only follower startup never evicts. When retirement finds no eligible binding, the wrapper instead reassigns the least recently used letter through the store's metadata-only `reuseLeastRecentlyUsedWorkspaceSlot`, deleting nothing. The executor-only direct-client deletion port validates the exact permit and disables both retries and transport fallback. Strict journal protection reads cannot recover/reset evidence. A confirmed `commit-ready` fence can finish after binding removal without another deletion; unknown outcomes remain fenced. See [demand-driven rotation](./multi-instance-bus.md#demand-driven-slot-rotation) for history loss and recovery boundaries. - `threads`: Telegram UI thread/tab binding state mapped to Bot API `message_thread_id` / `ForumTopic` transport. Owns exact-`cwd` Workspace bindings and transient claims, first-proven inactivity metadata, fenced non-destructive owner detachment with retained Workspace identity/slot, fail-closed retirement occupancy snapshots, and exact durable retirement intents, leader/current-instance identity state, active-turn → follower → leader target preference, matching status projection assembly, profile-bound same-process handoff, exact-claim global-slot allocation and conservative missing/duplicate legacy migration, collision-safe compact thread-name selection, Workspace-aware rename persistence, fenced exact-session target relocation, and primitive provision helpers. Its profile/token/path-bound `workspaceRestore` operations own Restore transitions and publish the exact full source-bound operation in `state[.].json.workspaceRestore` with binding/owner relocation in one ownership-fenced rename, preserving session, slot, naming preferences and journal evidence. There is one stored commit proof, not two stores exchanging receipts. The same owner enforces strict private regular-file/link/size inspection, scope checks inside publication, capacity and transactional revision CAS. Snapshot `read/relocate/update` mechanics are private; there is no separate Restore module or store factory. POSIX files are `0600`; Windows uses directory ACLs. Restore metadata remains bounded to 26 operations and 1 MiB, within an 8 MiB canonical snapshot. Movement clears stale display/probe evidence without claiming deletion. Conflicting source, binding, slot or targets fail closed. Every supporting snapshot publisher compares the full Restore state and its monotonic revision immediately before rename. It also preserves each retained binding's session identity, slot and relocated target, reserves both targets against other bindings, and rejects owner projections on the old target or conflicting slot. Pending creation and reservation staging reject a retained Restore's binding key, slot or either known target before mutating memory; a creation attempt lacking binding identity also conflicts on the retained owner profile or instance, rather than falling through to another slot. Primitive provisioning therefore cannot publish a conflicting creation intent or call `createForumTopic`, while valid existing-target reuse remains available. Candidate and final-disk validation also reject conflicting pending provisions/reservations, including late evidence, without discarding either intent. Restore publication and transitions inspect the private bounded `.provision-recovery.json` receipt file, matching pending ID, creator instance/profile and leader epoch before considering a recovered target. Both predecessor and candidate references remain protected at final publication. Snapshot publication, Restore transitions and recovery receipt writes serialize through the canonical snapshot transaction before the transport-owner publication fence. Conflicting targets or unreadable recovery evidence block advancement without erasing either source; Restore inspection remains available. Recovery writers never replace a differing receipt or repair damaged JSON, and exact duplicates perform no rewrite. Protected snapshot loading also uses strict recovery-file reads. Before publishing a new Restore, final transactional validation requires a known target for every creation retained in the predecessor snapshot, including entries that an in-memory expiry filter would omit. Canonical targets or exact creator/profile/epoch recovery receipts may establish a non-conflicting target; missing or foreign receipts cannot establish availability. Contradictory canonical/recovered targets fail closed. Loading reads recovery evidence once and, while Restore is retained, validates that exact evidence against the predecessor provisions before replacing any working projection. Conflicting, contradictory or invalid matching receipts reject warm and cold loading without changing disk or the previous projection; retained intent inspection remains available independently. Valid receipts merge before expiry filtering, so a late known creation cannot disappear solely because its original timer elapsed. A failed callback reload remains under the existing worker retry/diagnostic policy without another recipient apply, forwarding or cleanup grant; loading is not effect-time authority. Candidate validation refuses conflicting writes; final disk validation prevents a valid warm projection from silently repairing regressed canonical state. Restore transitions likewise refuse advancement or retirement over inconsistent canonical bindings, while retained intent inspection remains available for source protection. Metadata changes, binding-preserving owner succession and non-destructive owner detachment remain permitted; runtime still authenticates successor session authority. The revision survives final removal, closing empty-record ABA; a read-only Restore observation cannot bless an older binding projection. Warm missing/backward/contradictory evidence, corruption, unsupported schema and revision exhaustion refuse mutation. Old draft receipts or a separate Restore file block rather than migrate or manufacture missing originals. Callers hold Workspace admission and exact source/session/target authority. The initial phase is `relocated`, with no separate `prepared` record or receipt handoff. Subsequent `recipient-issued`, `ready`, source-dispatch and cleanup grants remain distinct; executor adoption never resets issuance. Only authenticated readiness observations may confirm the original recipient or retain a same-session `readyRecipient` successor. Terminal source settlement needs positive journal-owner disposition ACKs, never readiness, queue admission or absence. Canonical `queued` facts remain admission-only; `queue-completed` requires matching queued acceptance/receipt/kind and may upgrade only its proven IDs, leaving siblings nonterminal. Cleanup and retirement reject admission-only sources, including legacy facts; cold terminal receipt facts without acceptance or admission with cleanup fail closed without repair. The prepared `recordSourceAcceptance` stores a separate source-hashed positive execution/recipient result under an issued routing grant; it never counts as settlement or authorizes cleanup/source removal. Exact duplicates are read-only, malformed/contradictory cold evidence is retained without repair, and executor adoption preserves the proof. Follower forwarding composes this pre-report publication from the worker's fresh exact deferred-source hash under its existing dispatch admission; a lost publication reply reconciles only the identical retained proof. Its completion report carries that same hash into journal-owned `removeCompletedExact`; missing/changed sources reject atomically, with no ID-only fallback. Follower Restore now derives its scope hash from the immutable request/operator/retained acceptance, excludes mutable executor/progress, and carries it through admission into atomic source removal plus a scoped journal ACK. The worker requires matching returned and strictly retained evidence with fresh post-publication/inspection authority checks before notification. Production binding composition supplies serialized strict completion ports while preserving ordinary recovery. Follower cold ACK hints now consume exact scoped evidence under fresh admission and authenticated read-only recipient inspection, re-reading after awaits; missing/foreign evidence cannot adopt or settle. Leader command Restore now publishes `completed` acceptance before disposal through a private execution-fenced routed carrier; deferred/queued reports bypass that publisher. Memoized detached evidence handles duplicates without changing the original binding. An optional prepared worker queue-publication barrier now holds readiness through async acceptance and exact receipt/owner reinspection, including grouped and same-process cold reconstruction; serialized production bindings now supply strict full-group v1 queue inspection with exact owner/unoffered source and owner hashes, without recovery or writer admission. Production queued Restore publication now waits for fresh Workspace admission, canonical/live leader identity, exact receipt/source/owner evidence and retained `queued` acceptance, then rechecks receipt and recipient after publication/admission without replay. Same-process worker reconstruction resumes only proof publication, not semantic execution. Native two-source media-group integration now holds whole-receipt readiness through partial proof, changed digest and offered ownership, and resumes only proof on same-process worker reconstruction. A private Restore command carrier now suppresses trailing implicit completion after queued reporting and rejects explicit disposal guards, preserving receipt ownership even if queue commit fails. Native `/continue` keeps one queued continuation through publication faults/reconstruction; `/compact` keeps its confirmation-dialog/completed-source semantics. Direct prompt Restore uses queued admission, not another unqueued completion producer. Cold completed-command ACK continuation now uses fresh admission and exact scope inspection before adoption, read-only canonical current-leader ownership, post-await proof rereads and live/canonical cleanup fences without apply, handler, RPC or disposal replay. Missing/partial/foreign evidence and changed authority preserve protection; actual successor ownership/startup and accepted-work clearance remain fixture preconditions. The strict journal now prepares separate `completeQueuedExact` whole-receipt owner/hash-CAS removal plus atomic scoped ACKs, with complete-group cold continuity and no ordinary/v3 downgrade. It is supplied by the serialized private binding sibling. The worker's explicit scope API still requires full-batch immutable scopes. Cached prepared subsets now require a captured strict full queued-receipt origin inspector: exact complete group/full owner and matching queued-entry hashes precede readiness. Every scoped receipt needs an origin witness. Queue membership is immutable for that owner/acquisition; native scoped ACK publication and cold continuity require complete unoffered group disposal, so matching retained queued-origin witnesses acknowledge that whole receipt after lost replies. Unscoped siblings acquire no marker. The worker consumes those scopes through captured exact disposal/readback capabilities, clearing memory only after returned and retained ACK checks under current binding/context/process/session authority. Required scopes stay sticky; failed or uncertain issuance cannot downgrade to ordinary completion, replay disposal or lend its attempt across worker stop/start. Read-only reconciliation requires every requested exact scope and a proven origin witness for each whole receipt; it never infers ordinary sibling completion from absence. Cold queued ACK hints now share exact leader canonical ownership, pre-adoption scope reads and post-await rereads, publishing terminal receipt facts grouped by receipt/kind without replay. Native cases seed the post-disposal boundary and still supply startup/ownership and work clearance. Production queued acceptance now returns immutable full-receipt scopes through the publication barrier. The worker detaches and retains them before readiness, refuses missing terminal capabilities and uses cached scopes when lifecycle callers complete owned receipts. Its captured post-ACK observer emits a routing hint without requesting Pi dispatch; canonical queue-completed publication still rereads exact proof under fresh admission. Completion-only mux selection permits read-only reconciliation of an issued attempt despite lost execution readiness, never another dispatch or disposal. Subset-scoped sources within one receipt now need strict confirmed whole-receipt queued origin before readiness. Any issued disposition, including pre-write uncertainty, closes execution readiness while permitting completion-only proof reconciliation. Mixed batches of independent whole receipts now settle the scoped group before a separate ordinary group, rechecking owner/context/process/session/binding between them. A component failure cannot roll back another positive ACK. Mux/runtime completion retries reuse exact acknowledged receipt objects for local cleanup only, never readiness or another disposal. Ordinary sources acquire no scoped ACK; their unknown disposition retains ordinary protection. Post-ACK authority loss suppresses a stale scoped worker wake. Native producer/lifecycle fixtures cover grouped, discard, lost ACK/readback and canonical publication interruption; Pi handoff remains supplied. Terminal proof lifetime follows [settlement ordering](./multi-instance-bus.md#restore-settlement-ordering); actual startup was accepted in the operator's 0.52.0 live smoke. Cleanup can be issued only after all originals settle; unknown issuance cannot become not-issued. Exact old-target completion or positively unissued cleanup permits terminal retirement without touching accepted recipient queues or authorizing operation-ID reuse. Lost commit replies reconcile only the exact full operation. These operations perform no transport, source dispatch or deletion. Production resolves this native view for authenticated follower reception, exact unfinished-source startup holds even after the target becomes bound, and pressure-retirement protection. Restore capability is advertised; every participating peer must run 0.52.0 or later. The same scoped Restore snapshot also stores at most 26 source-bound temporary-Thread entries for All commands. Each entry records the exact journal binding and update ID, operator, executor, a unique 128-bit title token, `creating` or `created` phase and the acknowledged operator-chat target. It holds no Workspace binding or slot. `reserveTemporaryThread` publishes `creating` before the caller's single creation request. An existing source entry is returned instead of licensing another creation, and only explicit retirement frees the source. `acknowledgeTemporaryThread` records the target once; `adoptTemporaryThread` and `retireTemporaryThread` are executor-fenced exact CAS transitions that release protection only. Created targets are refused to provisions, reservations, Workspace bindings and owner records, both when staged and at final publication. The only exception is a retained Restore of the same source, which may rebind an existing Workspace and slot to the tab. Transition publication checks this protection against the resulting file, not only its predecessor. Strict parsing rejects malformed tokens, duplicate sources, tokens or targets, empty lists and foreign-chat targets. Followers cannot publish. Routing's `sendAllTabTemporaryThreadChooser` uses this store for a known threadless owner command whenever this process owns a leader epoch (no flag or configuration; each effect rechecks epoch, journal binding, operator and context). Under profile admission it adopts or reuses the source's entry, or reserves one and issues a single `createForumTopic` named as described above. A positive thread ID is acknowledged; any error or missing ID leaves `creating` as an unknown outcome. The command original is reported deferred, never completed, and stays in the All journal. A created entry publishes the full reroute/restore chooser inside the tab, whose target becomes the pending chooser's `sourceTarget`. An unknown entry is held with an All notice and never retried. A failed publication leaves the source retryable, and a replay or restart reuses the same tab. The All-command age limit still terminally settles a never-presented replay but never expires a presented tab. Forward from the tab uses the existing command dispatch and unbound-Thread cleanup: the command runs once in the selected Pi, routing reports the deferred All original complete, and the tab is removed through `thread-reconciler`. A worker completion observer then retires the entry under fresh profile admission and current temporary-Thread authority, adopting a predecessor executor first; absence of the entry or lost authority leaves it retained. When the fresh source still supports deferred abandonment, the tab's chooser also offers one **Cancel routing** action and states that it keeps the original privately, without sending it to Pi, and removes this tab. That click first commits the existing private retention and discard tombstone. It then makes one `thread-reconciler` removal attempt for the entry's own acknowledged target and retires the entry only after confirmed removal. A skipped or failed removal edits the chooser to say the tab could not be removed; the entry keeps protecting the tab, and nothing repeats the deletion automatically. A duplicate click abandons nothing twice. After restart a still-waiting source is revived with its Cancel; a selected or bound one belongs to the worker's first snapshot and is not offered Cancel. A retained tab is protected against other cleanup. Native worker/Filesystem regressions execute an actual unbound deletion plan against waiting tabs with warm, cold, newly created and unreadable protection evidence; all veto the transport. Cached inaccessible callbacks without message content or a Thread header still Cancel through exact current journal custody, but a source whose custody changed to queued remains untouched. The shared `createTelegramCleanupTargetProtection` used by bus, Sync and Thread lifecycle now calls the store's `listTemporaryThreadTargets()`, a fresh strict read of acknowledged targets that protects on any read failure. Routing's `isRerouteTargetProtected` exempts only the exact own entry (token, source and target) passed by that tab's Forward, Cancel or pending unbound cleanup. For example, a prompt typed inside the tab can be routed, but its Forward cannot remove the tab. After the entry retires, a still-pending Forward cleanup is ordinary unbound cleanup. Restore from the tab passes the same own-entry exemption to its source-ownership check and then uses the shared Restore producer with the tab as destination. `threads` accepts that relocation only for the Restore of the same source. The command is dispatched once to the restored recipient and reported complete, and the completion observer retires the entry. The Workspace keeps its slot on the tab, and the tab is not removed. A native leader fixture proves this path with Restore authority enabled. Without a leader epoch or the stores, the legacy All chooser remains the fallback. The lifecycle sections below own Restore from the tab, cancellation cleanup and cleanup protection; unknown creation or removal outcomes are never released automatically. Its optional external-slot source makes every generic allocation, Workspace claim, and occupancy snapshot reserve retained admission-fence slots; malformed, unreadable, or non-uppercase evidence fails allocation closed. Its synchronous provision-commit helper transfers exact targeted creation-title evidence into the claim-committed Workspace binding and consumes matching pending evidence; callers retain admission, epoch checks, and durable publication. It should not turn dormant bindings into routing authority, own destructive cleanup policy, or grow into the general Telegram synchronization domain. - `updates` / `routing`: update classification, authorization, callbacks, edits, reactions, forwarding, and inbound composition. `updates` owns production journal workers, leader/follower admission lifecycle construction, binding and settlement selection, queue-handoff projection across recipient journals/admission/IPC/live queue state, process/session queue-owner projection, post-public source binding, exact-signal late settlement, durable receipt readiness, same-process claim reconstruction, and structural worker state. `routing` converts message, callback, guest, section, reroute, and control admissions into exact receipts; its complete unbound-target and reroute restore/reclaim handlers run under the shared profile-wide Workspace operation boundary before store access. Its composed producer captures original journal references and canonical binding authority, then uses `advanceTelegramWorkspaceRestore` for native transitions and authenticated recipient observations under admission. The leader adapter updates its actual local identity; the follower adapter invokes the native one-attempt controller and publishes its live registry target only after exact readiness validation. Its final synchronous registry write runs through `threads.commitWorkspaceRestoreRegistration`: fresh disk/recovery validation and the caller's current-authority check remain inside the same canonical transaction through publication. The preparation assertion shares that validator but cannot substitute for the commit boundary. A late recovery conflict or disk-only binding regression retains the original and issued recipient grant without publishing new routing authority, forwarding input, deleting a Thread or undoing an already applied recipient target. Readiness and dispatch recheck the canonical relocated target as well as session, generation and the recipient's local target; local readiness cannot substitute for a regressed binding/owner projection. Only fresh issuance selects `apply`; retained or unknown issuance selects read-only `inspect`. Exact operation/session/generation/target/slot proofs and post-await/final-observation checks remain mandatory. Same-session successor readiness never changes the original issuance recipient; foreign sessions, ambiguous owners and regressed local targets stay protected. Lost readiness replies reconcile exact retained proof. The shared control path preserves original selection across uncertainty and limits recipient/dispatch callbacks to one admitted invocation; there is no replaceable producer or exported cleanup callback. Reroute forwarding resolves full live recipient binding/generation authority for the selected target and rechecks it after delivery; only a positive matching delivery ACK reports original-source completion through the admission carrier. Restore first publishes that acceptance from a fresh exact worker-source observation and the current recipient binding/generation; failure retains the original without resending. The report carries a detached source digest through admission; the worker checks current binding/context/process/session identity and requires `journal.removeCompletedExact` to match it transactionally before removal. Unsupported exact-disposal ports fail closed; duplicate ordinary reports cannot downgrade the guard. For scoped Restore reports, only an exact returned ACK plus strict retained readback emits the existing post-removal observer; missing inspection capability blocks disposal, and foreign/missing evidence or post-commit authority changes suppress notification. Exact capabilities are snapshotted at construction, and passed marker/inspection arguments are detached. A report or absent source still is not settlement proof, and lost-ACK continuation requires the strict active-journal scope-reader port. Original journal message targets survive rerouting and are not proof of accepted execution destinations; target-only inspection cannot replace conservative binding-wide accepted-work protection. The existing `workspace-retirement` capture now offers the prepared `requireBindingProvenance` option: relevant binding-associated entries remain protected regardless of original target, while nonempty shared/discovered sources without binding provenance return unknown instead of target-based clearance. Complete empty evidence can clear; incomplete or unreadable evidence cannot. Native queued-receipt and corrupted-family fixtures use strict read-only inspection with real reference leases and prove that capture changes no source files or receipts. The default retirement policy is unchanged. Restore cleanup now invokes this strict capture through the composition root before issuing cleanup and at the existing close/delete protection boundaries. A read-only canonical transaction supplies fresh binding references, unioned with retained predecessor references; cache-only metadata cannot clear work added while close awaited. Missing capture, unavailable snapshots, unknown journals and observation errors (including errors after a clear callback result) remain protective. Both roles have native worker fixtures for queued work whose original target differs, damaged journals and references published during close; accepted recipient work remains intact and skipped deletion never retires the intent or replays an issued grant. Other dispatch/cleanup fixtures explicitly supply a clear-evidence precondition and do not prove journal clearance. No own-source exemption exists: own accepted originals and unclassified shared controls may hold cleanup. A confirmed completion in the same source journal now also wakes a ready operation whose originals already have positive settlements and whose cleanup remains unissued. The wake reacquires current profile admission and authority, re-reads the retained operation and strict protection, and never adds the unrelated completion to its settlements. An unrelated queued receipt, foreign journal, ended authority or missing original settlement cannot supply this wake; unknown protection still holds, and an issued cleanup is never retried. Native worker callback-completion fixtures cover both roles with a separately supplied clearance precondition. The optional `onWorkspaceRestoreRecipientObserved` runtime hook in `bus-leader` uses existing authenticated heartbeat traffic, not a new RPC or completion ACK. Both peers must advertise Restore; missing auth/epoch/operator/profile-reader evidence suppresses observation. Delivery and the callback's currentness fence recheck leader epoch, operator, profile, runtime generation and exact live registration; heartbeat/connection timestamps and names are incidental. Runtime stop invalidates the fence before teardown, and listener settlement ends it. Identical in-flight observations coalesce, while old finalization cannot erase a successor observation. Listeners receive isolated snapshots and must return asynchronous work to retain their fence; the heartbeat ACK does not await listener work, and listener or diagnostic-sink failure cannot turn it into a failed ACK. Native IPC fixtures cover these boundaries, including default-profile identity and stop/restart. The composition root now returns the routing controller's continuation promise to preserve that fence through fresh admission and cleanup. Source evidence and recipient hints use distinct typed inputs: a hint cannot manufacture a source settlement. The recipient-hint path independently matches the live registration, retained ready-recipient instance/session/generation, normalized CWD, slot and target; it selects only ready operations in the current source journal whose original IDs already have positive settlements and whose cleanup is unissued. It rechecks this evidence after acquiring admission and carries both local authority and notification currentness through awaited effects. Eight native worker/IPC cases use strict real-journal inspection rather than supplied clearance: a recipient marker worker positively consumes accepted input without emitting a source-leader completion callback, then heartbeat-driven cleanup resumes once. Independent accepted work remains protective until separately consumed; damaged journals, missing original ACKs and uninspected successor generations cannot clear cleanup. A registration change after close retains the issued grant; an uncertain deletion reply cannot be replayed even by a current matching recipient. These fixtures prove native marker consumption, not live Pi scenario acceptance. Cold-snapshot successor inspection also crosses authenticated native IPC: after a new leader adopts the retained operation, a same-session follower successor answers `inspect` under fresh admission and the read-only canonical transaction without applying a local target, even while the original grant is still `recipient-issued`. Confirmation records only `readyRecipient`; the original recipient, request, source settlements and issued cleanup remain unchanged and cannot be reissued or retired. Foreign sessions, ended epochs and unadopted executors observe nothing. These fixtures supply successor registration publication as a precondition and do not prove startup composition. `advanceTelegramWorkspaceRestore` now adopts a retained operation whose full request and operator exactly match but whose executor differs, provided the caller's authority is current; a lost adoption reply reconciles from the retained operation. Adoption changes only executor authority: a `relocated` operation may still receive its first issuance, while `recipient-issued` and `ready` operations proceed only through inspection, and retained routing/cleanup evidence is never reset, settled or retired. The predecessor executor's later transitions are fenced by the executor CAS. Mismatched requests, other operators and ended authority neither adopt nor rewrite canonical bytes. A chooser re-click reaches this path; a new leader can also adopt a ready forwarded or completed-command Restore through exact scoped-ACK continuation. A new leader does not reconstruct source-bound controls. Restore has one controller: the legacy leader new-slot allocation and follower replacement branches are removed. Without that controller or current Restore authority (an unnegotiated peer or lost leadership), a fresh Restore click is refused before selection or any Restore transition, so the chooser keeps its ordinary routes and Cancel. After restart, root composition holds retained Restore originals as historical inputs. The Historical inputs menu entry and its confirmation submenu are removed; old callbacks are refused without routing or abandonment. Existing exact retained abandonment may still retire an unsent Restore through the cold continuation below. `threads.workspaceRestore.retireAbandoned` requires the exact operation, executor and operator, `ready` phase, absent routing and the complete sorted original set. It releases protection without cleanup: the relocated binding, owner and slot stay on the restored Thread, and the previous Thread is kept. Nothing is delivered, deleted or reissued. An interrupted retirement keeps protection and a later independently completed update may recheck its retained proof. The journal's read-only `inspectAbandonedPending(updateId)` returns proof only when exactly one committed `abandon-` discard tombstone exists, the source is no longer pending and its private retention validates against the same binding, entry hash and disposition. Missing or altered retention throws, and inspection never repairs. Root composition exposes this strictly for the active leader journal under an `operator-disposition` reference. Any later completion in that journal selects ready, undispatched Restores and requires committed abandonment evidence for every original, then rechecks under fresh profile admission. Retirement then requires matching journal binding, update and owner authority (`telegram-owner:`); a predecessor executor is adopted first. Startup alone, journal absence, unverifiable evidence or another owner's authority keep protection. Recipient heartbeat hints also select a follower-owned `recipient-issued` operation when the live same-session registration already names the relocated target, normalized CWD and slot. Under fresh admission, `advanceTelegramWorkspaceRestore` adopts it and asks the follower controller only to `inspect`. Positive readiness records `readyRecipient` without changing the original recipient, and issues no dispatch or cleanup; a lost reply or unready target keeps the grant issued. An old target, foreign session, `relocated` phase, leader owner, other journal or stale hint never reaches the recipient. Once ready and still undispatched, the operation can end only after exact retained abandonment proof covers every original. A source-journal completion similarly selects a leader-owned `recipient-issued` operation issued to another leader instance, when this process has the same session and normalized CWD and its local leader identity already holds the relocated slot and target. After a fresh load and admission it adopts and inspects only. The read-only snapshot must show one current binding at the relocated target and one active owner record for this leader instance. Confirmation records a `readyRecipient` for this instance and session generation; it never calls `setCurrentLeaderIdentity`, dispatch or cleanup. Same-process lost replies stay with the original chooser's inspect path. A still-owned predecessor record, old local target, foreign session or CWD, follower owner, other journal or inactive context keep the grant issued. Both recovery paths call `advanceTelegramWorkspaceRestore` with `inspectOnly`. This also lets them take an operation still in `relocated`: the canonical binding already moved, so a same-session successor starts on the relocated target. In that case, and only when the owner was another instance, the first grant is issued to the observed successor and proven by `inspect`; `apply` never runs. `inspectOnly` never commits a relocation when no operation is retained. A successor still on the old target, or the same leader process that owns the chooser, is not selected. Issued, unready, partially abandoned or gated Restores stay protected. Without the strict abandonment reader, source absence never makes a Restore finishable. Exact evidence for any own-source exemption and interrupted startup integration remain activation gates; journal absence is never source completion evidence. The composed worker-owner observers pass committed queue receipts and completion IDs with the journal binding captured before completion commit. Routing snapshots the proof and generation, then re-enters the existing profile admission/gate without awaiting that continuation inside the dispatch gate. It rereads exact retained operations, records only matching unsettled source IDs, issues old-target cleanup once through its existing owner, and retires only terminal evidence. Routing protects both targets of every retained Restore, including against another Restore and ordinary unbound cleanup. Local queued and active work also protects its target. Cleanup exempts only its own old target under an exact retained issued grant, rechecking that evidence and protection at the reconciler's API boundaries. Known protection prevents grant issuance; protection appearing during cleanup retains the issued attempt without retry. A reconciler skip is not deletion confirmation and cannot retire the operation. Stale authority and unknown issued cleanup stay protected; a lost ACK cannot be reconstructed from absence. The continuation never captures an expired dispatch callback. For a ready forwarded Restore with unissued cleanup, completion/recipient hints now read exact immutable removal scopes under fresh admission through the active-journal `operator-disposition` reference. Positive ACKs authorize exact executor adoption and authenticated follower `inspect`, never apply, handler, forwarding or removal replay. Fresh session/CWD/slot/target and protocol checks gate inspection even when registration generation changes. Every unsettled proof is re-read after the await before canonical settlement; partial/missing evidence cannot release another source. The observed live-recipient fence remains active through cleanup. Missing/foreign receipts cannot re-key intent; interrupted settlement publication resumes on a later hint from unchanged journal evidence. Actual successor registration and accepted-work clearance remain fixture preconditions; terminal ACK lifetime and startup composition are still gated. Producer, controller, receiver and settlement are composed and gated by the negotiated `workspace-restore-v1` capability on both peers. Exact local message ownership keeps a published chooser callback local even after its Thread moves to a follower. Transport stays in `bus*`. Native full-capacity tests drive original and callback updates through the real worker and production producer for both roles. - `media` / `text-groups` / `time-injection` / `turns` / `inbound`: inbound extraction, rich reply plaintext, grouped debounce, split-text coalescing (one shared pending-group machine in `media`, `transitionTelegramPendingGroups`, under both albums and split text; batches end at a message ID, never a count), optional time context, handlers, and prompt assembly/editing, including the `[guest]` Guest Mode speed note appended to guest turn text. Group replay replaces stale generation-local message/report bindings without duplicating content. Sticker format follows Bot API `Sticker.is_video` / `is_animated`: static WebP may enter image content, while video WebM and animated TGS remain file attachments with their native extension/MIME and are never read as image payloads. The Sticker object has no documented `mime_type`; frame extraction is not performed. - `queue`: queue contracts, transport stamps, lanes, readiness, mutations, dispatch, enqueueing, and lifecycle sequencing. Durable admission uses deterministic receipts, canonical source sets, replay dedupe, multiple folded-history receipts, append-before-dispatch reporting, exact handoff/control/discard settlement, and a readiness gate. Receipt-bearing inactive-profile work is preserved after current-profile work rather than dropped. - `runtime`: session-local coordination primitives: counters, flags, setup guard, abort handler, the typing loop, dispatch flags, and reset binding. The typing loop is a pure `transitionTelegramTypingLoop` plus one shell that holds each loop's callbacks, samples `shouldContinue` into events and owns the interval. - `machine`: The shared leaf runner for pure in-memory state machines: it commits a transition's next state, runs the effects it returns and wakes state waiters. It owns no machine; `preview`, the `runtime` typing loop, the `model` switch controller, the `media` pending groups, the `lifecycle` compaction observer and the `bus-follower` recovery lifecycle keep their own state, events, effects, timers and transports. The follower's machine owns only the recovery epoch, halt, the in-flight recovery and the armed retry; registration, election and promotion keep their bus contracts. The model switch keeps its staged selection and continuation turn in one machine state, so a restart or clear consumes both together. - `loop-lag`: A leaf for event-loop stall diagnostics. Callers report synchronous blocking by label (`recordTelegramSyncBlock`: contended lock waits, transaction hold time); a drift-based monitor, started with the owner's ownership watcher and stopped with it, records one `event-loop-stall` runtime event per stall at or above 1.5 seconds with the blocking reported inside that window and the process CPU time spent in it (CPU near the lag with no reported blocking means busy JavaScript in this process, including the host application; CPU far below the lag means waiting). It never changes behavior, owns no lock or transport policy, and is evidence for the stall investigation, not a mitigation. Locks is its only production reporter. - `model` / `menu-model` / `menu-thinking` / `menu-status` / `menu-queue` / `menu-settings` / `menu` / `commands`: model identity, thinking levels, scoped model handling, menu render/callback behavior, slash commands, bot commands, and interactive controls. - `sections`: Telegram menu-section registry, opaque section callback tokens, render/callback dispatch, safe section ports, and diagnostics. - `keyboard`: shared inline-keyboard reply-markup shape only; feature domains own labels, callback data, and behavior. - `preview` / `replies` / `rendering`: throttled native Rich Markdown draft delivery, native final reply delivery, reply parameters, transport-limit chunking, and remaining Telegram HTML rendering (bold, italic, strikethrough, spoilers, code, links) for bridge-owned UI/compatibility surfaces. - `delivery`: public extension operational-view delivery, active-turn/instance/aggregate/authorized target policy, logical chunk handles, per-target ordering, runtime generation fencing, and the process-local runtime membrane. Its bridge adapter composes the established UI/compat reply renderer with narrow bus-aware Telegram API and ownership ports; it never exposes bot clients or Pi contexts. - `activity`: public normalized Pi lifecycle registration, activity/source identity, assistant segment and reasoning normalization, executed-tool events, non-blocking per-handler queues, delivery contexts, compatibility adapters, and shutdown fencing. Internal publication/command-work and handler drain notifications share the lifecycle-owned captured-session/transport observer with companion queues and API target counters; bindings/root wire those neutral ports into routing's existing leader cleanup scheduler, never into deletion authority. Routing retains busy/unproven-idle delivery hints without early admission, preserves ordinary timers, and lets semantic settlement or post-settlement output drain request fresh checks. The same domain extends assistant-output observation for connected companion projection: eligible completed local/autonomous public segments retain source order and deduplicate event identity. `bindings` assembles observation, authority, sender, and failure-projection ports; routing owns exact delivery authority, outbound composes established transformations and reply delivery, and Bot API domains implement transport. No separate proactive state-machine domain exists. - `outbound-markup`: delimiter-based assistant action comments, top-level button fence parsing, shared JSON/CML grammar, attribute parsing, voice reply planning, and preview/delivery stripping. - `outbound`: outbound text transformations, voice/button artifact delivery, and generated callback actions. - `generative-apps`: managed deterministic application identity, canonical installation and explicit replacement, content-addressed module loading, state timelines, cross-process transition serialization, bounded executable-plus-argv adaptation, `telegram_bind`, and pre-model-queue `app::method` invocation. It does not own Telegram transport, arbitrary shell execution, or the external application adapted by one Generative App. - `outbound-attachments`: `telegram_attach`, queued outbound files, stat/limit checks, ordinary photo/document delivery, and narrow single-artifact Rich Message planning/sending for probe-confirmed photo/video/audio formats. It owns known-failure fallback eligibility and ambiguous-send no-replay classification through structural error contracts without importing Bot API helpers. - `channel-posts`: profile/token-bound authority for agent-authored channel publication intents, one-shot send/edit/delete fencing, outcome-unknown retention, exact successful post identity, capacity refusal, and bounded local listing. It never reads Telegram history; the composition root supplies direct-leader Bot API effects only after its durable grants. - `status` / `logs`: status bar/status-message rendering, queue-lane summaries, the structural redacted event ring, profile-aware JSONL scope/reset/append behavior, exact-owner destructive commits, fail-soft synchronous and queued diagnostics persistence, status snapshot scheduling, grouped diagnostics, and allowlisted compact connection-failure copy shared by commands and lifecycle. `status` remains a structural leaf; `logs` composes filesystem evidence with status projections and contains every persistence failure so diagnostics cannot terminate or poison the runtime queue. - `bindings` / `lifecycle` / `prompts` / `prompt-templates` / `pi`: Pi-facing command/tool/hook registration and cohesive cross-domain binding assembly, including queue mutation/dispatch/watchdog composition over admission and transport ports; session-generation fencing and start/shutdown sequencing across Queue, grouped input, Delivery, polling, capability monitor, follower refresh, and assistant-output projection; Telegram prompt guidance; prompt-template discovery/expansion; and centralized direct Pi SDK imports. `lifecycle` also owns bounded same-process connect intent across local `/resume`, cancellation/supersession, and fresh-context startup scheduling; it does not own transport authority, durable bindings, queue custody, or source-target continuity. Each Queue start/shutdown invocation captures its session generation for inner post-await checks, including config/temp preparation and polling suspension. Reused context identity cannot authorize an obsolete reset/discard or successor service startup. Follower refresh uses that same invocation-local predicate through its awaited registration/context publication; no mutable shared generation or target-preservation flag crosses overlapping invocations. - `command-templates`: shell-free command-template helpers, composition expansion, placeholder substitution, executable resolution, warnings, and retry/timeout semantics. ### Host Compatibility Boundary Pi is the primary and only officially supported host. `pi-telegram` may still accept narrow, host-neutral representation differences at its existing Pi-facing boundary when they preserve native Pi behavior and do not create a second runtime policy layer: - `prompts` uses Pi's structured `telegram` section for stable connection guidance and a hidden `telegram-turn` message for Telegram-specific turn instructions. Local and custom starts do not receive a new turn note, and Telegram/local switching leaves the connection section unchanged. The note remains in session history as context for its originating input; it is not re-injected on later local/custom starts or resume. Hosts without structured sections, caller-supplied custom hooks and an earlier extension-owned opaque prompt retain equality-guarded append/strip fallback for strings or ordered block arrays without collapsing host-owned blocks. An absent/null prompt is treated as empty, including disconnected metadata stripping. An unchanged fallback returns no override; the bridge does not clear another extension's forced prompt or promise cache stability while that independent override remains active. - `pi` normalizes settings-manager construction that is either synchronous or asynchronous, then adapts either Pi's legacy enabled-model methods or a generic `get` / `set` settings service before model-menu reads and scoped-model persistence use it. Hosts without an explicit reload method rely on fresh asynchronous construction; durable writes still require `flush`. - `lifecycle` continues to require Pi's semantic `agent_settled` boundary. It does not infer terminal settlement from host-specific `agent_end`, retry, or stop events; a compatibility shim must reproduce that contract before it can safely support activity identity and unrecovered-error finalization. This boundary uses no host-name detection, host package dependency, prototype patching, hidden agent process, PTY, or terminal forwarding. Representation adapters are best-effort compatibility rather than an OMP support guarantee. Alternate hosts and community contributors own validation of their compatibility shims and must supply every lifecycle semantic that the bridge requires. ### Guarded Invariants Architecture invariant tests protect: - Acyclic local imports. - Direct Pi SDK imports centralized in the `pi` adapter. - A thin `index.ts` package boundary and `lib/extension.ts` as the composition root without local runtime adapter logic. - Runtime state isolation from local domain imports. - Structural leaf-domain isolation. - Menu/model boundary direction. - API/config separation. - Media/update/API decoupling. - Outbound attachment isolation from queue, inbound media, and API helpers. Mirrored domain regressions live in `/tests/*.test.ts`. Shared test fixtures should exist only when multiple suites genuinely reuse them. ## Configuration And Ownership Telegram configuration lives in `~/.pi/agent/telegram.json`. Bot/session identity (`botToken`, `botUsername`, `botId`, `allowedUserId`) persists only under `profiles.default` or `profiles.`; shared handlers and assistant/voice/time settings stay top-level. Per-profile polling/admission state lives only in the durable update journal as `acceptedThroughUpdateId`. Authoritative transport ownership lives separately in the `transport` section of the pi-telegram-private `~/.pi/agent/tmp/pi-telegram/state.json`, one profile entry per `default` or validated named profile (see [Consolidated Runtime Root](#consolidated-runtime-root)); unrelated extensions never read or write this file. `telegram.json` is one global cross-instance configuration document. Ordinary reads rely on atomic publication and do not take the mutation guard. Only config writes and sender admission enter `telegram.json.transaction`; the update journal never uses it. Every cooperating Pi instance persists only its recursive delta from the snapshot it loaded, merges that delta into the latest disk document inside `telegram.json.transaction`, and publishes atomically only when the semantic result differs; a no-op merge adopts the newer disk snapshot in memory without replacing the file. Unrelated global and profile changes therefore survive stale writers. Two serialized writers changing the same leaf use commit order, so the later local delta wins. A non-transactional external editor cannot participate in that conflict protocol: it should write through same-directory atomic replacement while Pi is idle, then let instances reload; an editor racing the transaction may lose its same-leaf change and must retry from the resulting file. ### Setup Flow First-contact pairing publishes through a profile-exact config-store operation, not a live setter followed by a save. Inside the existing config transaction, it rechecks execution/profile/token identity, reads the current disk owner, and writes only an unpaired profile; a different configured owner denies the candidate without overwrite. Only successful publication or confirmation of the same disk owner updates local authorization. Failure leaves the candidate unpaired for retry, and adopting disk evidence preserves unrelated local settings. Queued writes retain their request-time baseline for the requested disk delta, but cache adoption compares local deltas against the latest observed persisted state. An observed owner is not a local grant edit; later local unpair and external revocation must survive queued completion and subsequent saves. Message/edit/callback pairing and denial admission precede foreign message/target routing and unbound-Thread delegation, so fallback dispatch and ownership recording cannot bypass publication. `/start` menu side effects also stop when pairing returns false; configured matching owners remain authorized. Reactions require an existing positive safe-integer owner and that exact human sender before ownership lookup, forwarding, group flush or queue mutation—even in private chats. Unpaired, foreign-user, bot, missing-user and actor-chat reactions do not initiate pairing or perform those effects. This is publication safety, not operator-confirmed pairing: the first-contact UX is unchanged. `/telegram-setup` progressively resolves the bot token: 1. Use the locally saved token when present. 2. Otherwise use the first supported Telegram token environment variable, prefilled as an exact `$NAME` reference instead of the resolved secret. 3. Otherwise show the example placeholder. `profiles..botToken` may hold a literal token (compatibility) or an exact `$NAME`/`${NAME}` environment reference. References are resolved only at validation and activation boundaries: setup validates the resolved value while persisting the alias, the config store exposes the resolved token to transport and identity hashing, and every other boundary keeps the stored reference. An unresolved reference fails closed with a redacted named-variable diagnostic, and a `$`-prefixed value that is not a valid reference is malformed rather than a literal secret. `ctx.ui.input()` only supports placeholder text, so setup uses `ctx.ui.editor()` when a real default must appear already filled in. Bare and explicit `default` setup/connect commands address the same `profiles.default` entry. Persisted config is written through a private temp file plus atomic rename and left with `0600` permissions. On first load, legacy root identity moves into `profiles.default` in that same serialized atomic transaction when no conflicting canonical value exists; identical duplicates collapse, complementary fields merge, and conflicts reject the load without modifying the file. ### Automatic Pairing Confirmation Design **Status: approved UX direction; isolated storage preparation implemented, production unchanged.** The operator selected an automatically presented confirmation in trusted Pi UI, detached from the journal worker. Current runtime behavior remains the publication-safe automatic first-contact flow described above until implementation and review are complete. Existing configured owners and manual numeric-ID preconfiguration remain compatible. #### Admission And UI - A valid unpaired private human message creates a bounded candidate, not an authorized prompt. Edits and callbacks cannot create independent approval requests; they remain non-executable while unpaired. Guest messages are not a pairing surface. - Return a distinct `pending` admission outcome before foreign routing, ownership recording, unbound handling, downloads, inbound handlers, menus, or model dispatch. The worker must not await either the dialog or approval-time config publication. Pending is not a transient execution error that retries the original prompt into authorization. - Schedule the dialog through the session-owned pairing runtime after candidate admission. Use native `ctx.ui.confirm` with an AbortSignal and timeout; no custom editor, shadow process, model turn, or `/telegram-pair` command is needed. Initial support is terminal UI (`ctx.mode === "tui"`); `hasUI` alone also admits RPC and is insufficient for this terminal trust boundary. Without that surface, remain unpaired and retain manual preconfiguration as the fallback. - Show the exact bot profile and numeric Telegram user ID, plus a bounded, control-character-safe display name as untrusted context. Example title: `Allow Telegram account?`; body explains which account gains access to the running Pi session and that earlier input will not be executed. Neither message text nor credentials enter the dialog or model history. No/ESC, timeout, UI error, or missing UI means no grant. - Permit one candidate and one dialog per active profile/runtime. The candidate lasts 60 seconds from admission; duplicate input does not extend it. Keep the remaining window as a profile-wide cooldown after rejection/error/timeout to prevent immediate dialog flooding. A different requester cannot replace the visible candidate; operators can reject and request a fresh `/start` after the window. Keep this bounded trade-off explicit rather than adding an unbounded waiting list. This limits dialog frequency, not repeated first-requester denial of service; restart also resets ephemeral cooldown. #### Lifecycle And Publication - Candidate states are `pending → publishing → authorized`, or `pending/publishing → denied/cancelled`. UI acceptance starts publication; it is not itself authority. Recheck candidate identity, lifetime, active profile/bot, session generation, and exact current transport owner at the final commit boundary. Reuse the config owner's atomic existing-owner comparison; never clear or replace a configured account as part of pairing. - The approval task owns fresh lifecycle/transport authority. It must not borrow an update execution fence, Workspace lease, or gate that ended when the triggering journal handler returned. No filesystem mutex, Workspace operation gate, or journal worker slot spans the dialog wait. Publication must use a reviewed lock order and a synchronous final ownership check/commit, without holding a filesystem lock across asynchronous work. - Session replacement, shutdown, disconnect, profile/token change, or transport ownership loss cancels the pending dialog through its own AbortController. Late Yes, late UI failure, or stale notification cannot grant, restart, or mutate a successor candidate. A publication failure remains unpaired; retry needs a new request/approval. If publication may already have committed, inspect durable exact-owner evidence rather than issuing a second blind grant. - Pending/UI state is ephemeral and never restored as consent. Do not use `pi.appendEntry`, model history, or a new shared sidecar as an authorization ledger. Any completion notice is best-effort, target/profile/generation-fenced, and outside journal-worker completion; notice failure cannot revoke a committed owner or replay old input. #### Durable Admission Exclusion The independent design review rejected a memory-only pending flag and approval-time backlog deletion: the worker already snapshots multiple entries before awaiting their execution. Instead, persist an immutable journal-owned `preApprovalExcluded` boolean with each newly admitted entry. It is a permanent execution veto, never a grant; `false` still requires ordinary current sender authorization. The candidate's triggering entry and every entry serialized into the journal while the exact persisted profile is unpaired receive `true`. Duplicate append preserves the original classification even if config has since changed. This metadata belongs beside `entry.update`, never inside caller-supplied Telegram payload fields. The worker now requires a versioned snapshot and validates the complete exclusion evidence before reconstructing any queue authority. Missing v2 bits, malformed bits, unknown/missing versions, or excluded queued entries block the snapshot. Excluded executable entries bypass execution preparation, registered handlers, and default routing and proceed only to fenced journal settlement; a held snapshot retains its veto across an earlier handler's await. The durable polling adapter now prepares only contiguous non-excluded runs from the journal's `nonExcludedUpdateIds` result, synchronously after publication and before yielding to the local worker. Excluded positions remain boundaries, so filtering cannot invent a new comment/forward pair across them. The low-level poll loop no longer performs preparation. Failed publication performs no preparation; a preparation/diagnostic failure cannot withhold the wakeup of already-admitted work. Group plans remain ephemeral, not crash-restored journal authority. Candidate offering is still pending and may reach only a narrow path that checks the current unpaired state and exact local polling-owner authority. Only valid private human messages can offer a candidate; excluded edits, callbacks, reactions, deletions, and lifecycle/service payloads settle without their normal effects. After approval, excluded entries settle without execution or another dialog. Include the evidence in every worker snapshot/copy and preserve it across segments, compaction, retry, and restart. `markQueued` rejects excluded sources. Trusted internal events outside external journal admission retain their existing separate authority checks; they are not relabeled by Telegram payload fields. This proves exclusion by **serialized durable admission**, not by network receipt time or the remote sender's clock. A fetched/buffered response admitted after the grant follows post-grant classification. No stronger promise about physically earlier sends is made. No new polling cursor, approval-time watermark, backlog purge, or cross-file grant ledger is introduced. #### Transaction Order And Crash Boundaries The inspected implementation offers synchronous journal append (`appendBatch` wraps its `runMutation`) and exact synchronous transport commit (`lockRuntime.commitIfOwned`). Config persistence queues a promise, so wrapping that promise-returning method in `commitIfOwned` would not protect its eventual write. The preparatory store now supplies `withPairingAdmission(profile, tokenSha256, publish)` for trusted synchronous publication under exact persisted config evidence and an optional per-call `commitIfOwned` port inside `persistAllowedUserId`'s queued write. A real lock-runtime regression proves the latter encloses the config rename and rejects an owner replaced before queue execution. New confirmation callers must require that guard; its omission preserves only the existing automatic first-contact path until integration. The observation seam is now exercised through opt-in journal admission; production adapters and UI remain disconnected. Do not await inside the observation callback or hold ownership while awaiting the persistence queue. - Admission: acquire existing Workspace admission first; inside that operation acquire the config transaction, read exact persisted profile/token/owner evidence, then enter the journal transaction and atomically append entries plus their exclusion bits. Release both filesystem transactions before preparing groups or signaling the worker. After append returns, the durable polling adapter consumes the journal-owned non-excluded ID projection without an intervening await; moving preparation merely after an awaited append would race an already-draining local worker. The projection is not sender authorization. The config-owned observation callback wraps the synchronous append; it must not reacquire Workspace admission from inside config/journal locks. - Approval: wait for UI and the config persistence queue without locks; then enter exact transport-owner transaction → config transaction → final candidate/session/profile/token/deadline checks → owner comparison → atomic config rename. The rename linearizes the grant. Use the same bounded transaction primitives; no UI, network, awaited operation, or diagnostics publication runs while these filesystem locks are held. - Existing code has config-only publication, journal-only mutation, and short owner-fenced Thread/log/endpoint commits. Before activation, verify every added adapter preserves the proposed graph: Workspace admission precedes config; config may enter journal, never journal → config; owner-fenced grant may enter config, never config → owner. A source-level callback/lock-order inventory and contention tests are required, not inferred from the acyclic import graph. An isolated two-process config regression now holds the observation transaction while a separate grant process holds exact owner authority and waits for config; the observer sees exclusion, the grant completes only after release, and a later observation sees the disk owner despite a stale local cache. This proves the config/grant seam, not the still-unwired Workspace → config → journal composition. - Before journal publication there is no durable admission. After excluded-entry publication, restart retains the veto. After Yes but before config rename there is no grant and consent is not restored. After rename but before local status/memory update the disk owner remains authoritative and old exclusions remain. An unknown publication outcome is reconciled through exact disk evidence; it never authorizes blind grant reissue or revocation. #### Schema And Migration Gate Preparatory storage protection is implemented independently of the future veto schema: snapshot and segment parsers classify unsupported integer versions before applying the current shape rules; recovery scans the retained files for unsupported versions before any repair/quarantine/reset, and non-corruption probe errors propagate. Receipt-scope and binding-key codecs use a separate fixed v1 identity version, verified by golden encodings. Production construction still uses v1. Explicitly supplying the synchronous `withPairingAdmission` store port selects v2: every persisted entry requires its immutable exclusion boolean, preserved through failure/retry, segments and compaction. Mixed queue receipts containing an excluded source fail atomically. V2 refuses legacy files, implicit identity rebinding, and corruption/missing-snapshot recovery without repair or reset; migration is not implemented. The opt-in snapshot/segment schema v2 carries the mandatory boolean; v1 continues to reject that field. V2 append requires the existing admission cursor and suppresses absent IDs at or below its previously committed value, preventing a settled excluded entry from being re-admitted after approval. Segment replay rejects exclusion changes and below-cursor resurrection. This mode is for cursor-ordered polling only: do not enable it on out-of-order follower inboxes by inventing a maximum cursor. Their source-evidence/forwarding contract remains an integration gate. No second cursor or tombstone ledger is added. Separate the storage-schema version from stable receipt scopes, queue-owner identities, and journal-binding key codecs: those immutable recovery identities must not change merely because the file format changes. Missing/malformed evidence in the new schema fails closed, and unsupported versions must not enter automatic quarantine/reset as if they were disposable corruption. Before starting a worker or enabling candidate grants, prepare its source under config → journal serialization with no surviving legacy worker snapshots. For an already configured polling profile, preserve existing accepted work and mark legacy entries non-excluded; current sender checks still apply. For an unpaired polling profile, stamp pending/retry legacy entries excluded. The proposed follower policy below instead blocks unpaired retained follower entries; it does not invent an ordered cursor for them. Unexpected queued/claimed/handoff authority in an unpaired legacy journal blocks migration and approval for explicit reconciliation; never silently discard or reinterpret it. Preserve revisions, update IDs, cursor, receipts, owner births/generations, failures, and handoff evidence. A failed migration does not start a worker or UI candidate. Regression tests must prove the unchanged identity codecs and guarded startup ordering. Automatic approval stays disconnected until schema/migration, lock-order, and worker-copy proofs pass. Mixed-version owners/consumers and downgrade remain an explicit rollout gate: do not imply that an older runtime understands the new veto or human-approval requirement. No running instances or live journals are migrated by this design work. #### Follower Source Policy Candidate **Reviewed design; not implemented or activated.** Keep cursor-ordered polling on v2 and out-of-order follower inboxes on v1. This is narrower than adding another storage mode or consent ledger: excluded polling entries must never reach forwarding, while new follower admission must require an already persisted exact user owner. Retained unpaired follower work is a reconciliation gate, not permission to discard it. The config prerequisite is implemented as `withPairedUserAdmission(profile, tokenSha256, userId, publish, assertExecutionCurrent?)`: it returns explicit denial for an absent/different owner or invalid sender ID, observes exact persisted authority under config transaction, and refreshes an unpaired cache before the trusted synchronous callback without writing config. Changed local profile/token, a conflicting cached owner, or an unpublished local unpair refuses instead of silently switching authority. Default/named-profile tests cover peer grants, queued settings and local edits, stale guards, rejected publication, and unchanged config bytes. Combined interleavings also cover local unpair after observation and external revocation before queued completion, including a subsequent save that must not recreate the owner. This method is exercised by isolated journal and receiver tests, not by production follower factories, and does not replace receiver provenance or publication-time fences. The journal prerequisite now exists as the optional `withPairedAdmission` port. It preserves v1 and runs after Workspace admission but before journal locking or recovery-capable reads; explicit denial becomes `sender-denied` without publication. Inputs are normalized once before deriving Workspace scopes, checking sender authority and persisting the same canonical data. The paired-only port and v2 exclusion port are mutually exclusive. Tests prove peer-grant cache refresh, `20 → 10` admission without a cursor, duplicate preservation, canonical-input scope consistency, and guard release after denial/stale context/publication failure. This guards append only: production wiring and startup/read/recovery consumers remain separate cutover work. `createTelegramBusFollowerPairedAdmission()` binds the config port to the journal hook for one canonical message/edit/callback/reaction carrier with an exact source ID. It selects message/edit/callback `from` or reaction `user`, requires a positive safe ID and explicit `is_bot: false`, and rejects defined `sender_chat`/`actor_chat`, ambiguous carriers and invalid grouping metadata. Original forwarding authors and callback-message authors do not authorize the sender. Bot API evidence: [`User`](../.agents/skills/telegram-bot/api.md#user) requires the boolean flag; [`Message`](../.agents/skills/telegram-bot/api.md#message) may expose a fake `from` for chat senders, while [`CallbackQuery`](../.agents/skills/telegram-bot/api.md#callbackquery) and [`MessageReactionUpdated`](../.agents/skills/telegram-bot/api.md#messagereactionupdated) identify the acting user separately. An isolated real IPC receiver/config/journal composition proves provenance checks precede config admission, peer grants refresh the receiver cache, all four kinds survive unordered v1 delivery, and denial/staleness/publication failure does not append or wake the worker. Wakeup follows guard release; config bytes remain unchanged. The required execution assertion and publication-boundary fences remain caller-owned; the helper does not capture or invent receiver lifetime authority. The source constraints are concrete. `createTelegramBusFollowerDurableAdmissionRuntime()` appends each authenticated delivery without a cursor; its receiver checks secret, registration generation, recipient binding and source ID, but production journal factories do not yet select the paired-only port. A synthetic store witness admits IDs `20 → 10` into v1 and retains both; substituting cursor-ordered v2 with a fabricated maximum cursor suppresses `10`. The lifecycle's `bind()` currently constructs the worker, resumes terminal entries, and performs dead-owner cleanup before `worker.start()`, so checking migration only at `start()` is too late. - **New deliveries:** Preserve transport authentication, exact generation/binding/delivery identity and current-session checks. Before append, acquire Workspace admission → config transaction (sender authority) → journal source serialization → journal transaction. A config-owned paired-only seam must confirm the envelope sender is the exact persisted owner of the expected profile/token and refresh that authority in the receiving process before worker signaling. It must never create an owner. Boolean "profile is paired" alone is insufficient; a follower cache loaded before another process's grant may still be unpaired. The guard belongs inside the journal's already-Workspace-admitted synchronous append path, not around public `appendBatch()` or async `admit()`: those wrappers would reacquire Workspace under config or span the wrong boundary. Release these admission/transaction guards before worker signaling and ACK. The existing polling observation port selects v2, so neither it nor the automatic first-contact publisher substitutes for a paired-only v1 seam. - **Source guarantee:** Only the updated leader's exclusion-gated, sender-authorized path may forward content. Followers cannot offer pairing candidates. Bind this contract to the negotiated producer/consumer capability and exact registration; an envelope assertion is not consent. Do not advertise the capability while using an ungated producer or receiver. Mixed/old runtimes remain an operator-coordinated activation prohibition, not a software-enforced downgrade claim. - **Legacy followers:** A configured profile preserves validated v1 accepted work, receipts, births/generations and handoffs without a schema rewrite. If the profile is unpaired, any retained follower source entry—pending, retry, terminal or queued—blocks source startup and a new UI grant until exact operator-authorized reconciliation. Preserve bytes; do not auto-clear, quarantine, assign a maximum cursor, or silently relabel the work. This deliberately narrows automatic legacy migration. Reconcile such state before manual preconfiguration too; no retroactive consent guarantee is inferred from an operator editing the config file. - **Readiness and migration:** Use complete, bounded, strict read-only inspection of the current profile's polling journal and discovered follower snapshots/segments, not recovery-capable `read()` as a preflight. Unknown identity, unreadable/corrupt evidence or incomplete inventory blocks readiness. Stop and await the old local worker, then re-resolve/revalidate profile/token/registration binding before preparation; the binding captured before the await cannot authorize successor startup. Place preparation before worker construction, terminal retry, queue-owner cleanup and handoff consumers, and publish lifecycle availability only after it succeeds. Also cover non-worker readers: Workspace journal protection capture currently calls recovery-capable `read()` and must not repair/reset evidence ahead of readiness. Discovery alone is insufficient: strict inspection must reject symlinks/unknown identities, bound the inventory, and close namespace creation, recovery and handoff paths through journal source serialization or explicit quiescence. Operator-coordinated quiescence of other legacy consumers remains necessary. Preserve fixed recovery identities; no "ready" sidecar or cached boolean grants authority. - **Final grant:** Recheck source readiness inside the queued publication's existing config transaction, under exact transport ownership, only when creating a previously absent owner. New paired follower writers must use the same config admission. The check cannot reacquire config or await; journal locks follow config. Recheck candidate/session/profile/token/deadline immediately before rename after inspection. A startup-only inventory or checks outside that transaction do not close the append/grant race. Required witnesses before accepting this policy: out-of-order first deliveries survive; a legitimate forwarded message after a peer grant refreshes a stale follower cache without writing a grant; unpaired/different-owner/stale-generation admission has no publication or wakeup; unpaired retained follower data survives restart and blocks UI publication; configured legacy receipts remain intact; preparation precedes every recovery consumer; inventory/append/grant contention cannot produce a ready-but-unexcluded path. If these cannot be proved without another durable authority, reopen the source design rather than widening v2 by assumption. #### Strict Journal Inspection Candidate **The isolated reader and local implementation review are complete; it has no production consumer and is not activated.** `inspectTelegramUpdateJournalFamily({ directory, path, profile, botIdentity, limits })` returns absence or a validated file plus file/byte/work accounting. Its optional `knownBotId` result is a validation constraint, possibly inherited from the caller, not enrichment of the stored identity. It requires canonical paths and available `O_NOFOLLOW`/`O_NONBLOCK` flags, refusing unsupported platforms rather than weakening acquisition. Linux fixtures cover metadata, resource and mutation boundaries; canonicalized fixture roots also pass with a symlink-backed temp directory. On unavailable open flags, tests assert refusal and unchanged evidence instead of expecting successful decoding, with an explicit coverage diagnostic. Synthetic load-time variants cover each missing flag and both together; these are not native Windows or whole-profile readiness evidence. Isolated filesystem probes establish why wrapping the ordinary reader is insufficient: reading an empty foreign-profile journal rewrites its identity; revisioned snapshots skip redundant retained segments even when those segments declare an unsupported schema; follower discovery follows canonical snapshot symlinks outside the scanned directory. Source inspection also shows unbounded `readdirSync()` allocation and separate snapshot/unapplied-segment byte budgets. These are counterexamples to reuse as strict preflight, not evidence that normal legacy recovery has changed. - `Owner and result`: Keep the inspector in `journal`, reuse its schema/entry/receipt validators, and extract shared pure replay only when needed. Inspect one exact journal family first; profile inventory is a later caller. Return validated evidence or absence, not permission, a cached ready flag, or a synthesized empty journal. Do not call `read()`, the current `readCurrentStrict()` closure, recovery, identity rebinding, compaction, publication, or lock-file creation from the inspector. - `Acquisition`: Accept an approved canonical directory anchor, a journal path within it, expected profile/token identity, and explicit positive safe-integer file-count, aggregate-byte, per-collection/state-entry and aggregate-work limits. Bound directory enumeration before collecting/sorting names, including ignored entries and a bounded overflow witness. Open only regular non-symlink files; reject linked path components beneath the anchor, unexpected segment entries, wrong types, uncertain absence, and observable namespace/handle changes. Read bounded bytes from the opened handle, reject invalid UTF-8, and count snapshot plus every retained segment against one aggregate budget before parsing. A size check followed by unbounded `readFileSync(path)` is insufficient. - `Schema and identity`: Recognize only supported v1/v2 snapshots, validate every retained segment including revisions covered by the snapshot, and require exact profile/token identity without empty-file rebinding or same-bot token substitution. Maintain one validation-only known bot-ID constraint across expected identity, snapshot and every segment, including redundant segments: two conflicting known IDs fail even when the snapshot omits that field. Preserve the stored snapshot identity; a missing optional bot ID cannot cause identity enrichment. Unknown, mixed, malformed, or incomplete evidence fails closed with bytes untouched. Existing deterministic legacy failure-ID projection may remain a decoder behavior; it does not authorize a rewrite or new recovery identity. - `Replay`: Start only from a validated snapshot; a retained segment directory without a snapshot is not empty-source proof. Validate filenames, matching revisions, intrinsic `previousRevision === revision - 1`, and unique disposition failure IDs for every segment, but do not demand a complete historical chain below the snapshot. Apply only the contiguous newer chain (`revision === currentRevision + 1`), preserving cursor, revisions, receipts, owners, births/generations, failure/handoff metadata and v2 immutable exclusion checks. Bound raw `entries`, `upsertedEntries`, `removedUpdateIds` and `operatorDispositions` before invoking codecs; also bound reconstructed entries/dispositions. Charge aggregate work for raw collection validation and repeated reconstructed-state validation so small deltas cannot hide excessive replay work. Avoid argument-spread maxima; positive caller limits are not an engine argument-count guarantee. Never infer a polling cursor from follower IDs or repair a gap. - `Serialization boundary`: The caller owns Workspace/config/journal ordering and must establish writer quiescence or the corresponding existing transaction before consuming evidence. Stable metadata checks and repeat enumeration detect some changes; they do not defeat hostile same-user path substitution or prove namespace closure. Do not hold a filesystem mutex across an await. Profile discovery, namespace creation, recovery and handoff writers must be audited before final grant can use this reader; ignored/archive storage needs proof that it cannot feed an automatic consumer, not an assumption based on its name. - `Migration boundary`: Rejecting mixed schemas is initially safe but is not a crash-complete migration protocol. A v2 snapshot followed by interrupted cleanup of older v1 segments needs a separately proven reconciliation rule before activation. Do not add a sidecar, remove uncertain segments, or claim downgrade safety to bypass that gate. - `Proof cohort`: Exercise v1/v2 current and legacy metadata, exact empty-identity rejection, redundant unsupported/mixed segments, revision gaps, missing snapshots, symlinks/wrong types, aggregate size/count/entry overflow, and unchanged tree bytes on every outcome. Fault injection must distinguish detectable concurrent changes from guaranteed serialization. Native Windows/path behavior, complete profile inventory and grant-time contention remain separate evidence gates. The retained single-family reader has no consumer or production wiring; its tests do not establish writer quiescence. #### Canonical Profile Journal Inventory `inspectTelegramProfileJournalNamespace()` inventories only the legacy flat polling/follower namespace using the strict family reader; its isolated implementation review is complete. It refuses any `sessions` entry rather than silently certifying the new namespace. Active followers use `sessions//journal.[.].json`. `inspectTelegramSessionJournalNamespace()` shares the same inspection kernel and adds the canonical session tree alongside polling and retained flat recipients; session families have the role-neutral `session` source label. Its read-only native tests cover shared limits, foreign non-reading and post-inspection nested-file changes. Candidate Workspace protection now invokes this strict evidence surface on each capture, even for a binding whose recorded sources are complete, and uses its bounded catalog for discovered current-profile readers. Invalid/incomplete evidence or missing discovered-path resolution yields unknown accepted-work protection. Native tests preserve every source byte, scoped read references and freshness after a later corruption. No tuple pruning or filesystem cleanup is enabled by this integration; private-retention classification, external consumer references and writer closure remain gates. Retention now participates in the shared census and file/byte/work accounting. Every original is classified against its exact journal; protection refuses uncommitted copies or missing committed originals instead of guessing cancellation. A retained-only family without its exact v1 snapshot remains unknown. Committed originals remain preserved and independently reference-audited; classifying them is not permission to erase history. It returns deterministic source roles/paths/evidence, shared accounting and a validation-only bot-ID constraint. Tests cover exact aggregate boundaries, unread foreign contents, segment-only cross-family conflicts and root changes after the last family inspection. It does not certify consumer-reference closure or authorize a grant, migration, cleanup, or startup. - `Names and scope`: The legacy inventory covers `inbox[.].json` and `follower-inbox-<16 lowercase hex>[.].json` paths plus their `.segments` directories. Supported profile namespace components are the current lowercase ASCII alphanumeric names of at most 32 characters; `default` has no suffix. Treat any case-insensitive `inbox` substring as journal-like, even in otherwise unrelated names such as `personal-inbox-notes.txt`. Reject noncanonical aliases, malformed journal-like names, journal-shaped symlinks/wrong types, and sanitizing profile names rather than guessing ownership. Canonically distinct foreign-profile names can be classified without reading their contents; count them and unrelated entries against the directory limit. Never infer a Workspace binding or allocation authority from a filename hash. - `Inventory and limits`: Stream a bounded root census before inspecting families, deduplicate snapshot/segment pairs, always inspect the polling path (including absence), and inspect current-profile follower paths deterministically. Share file/byte/work budgets across families rather than resetting each call. Keep the family collection/state ceiling; inventory work charges at least one unit per family visit, including absence, and otherwise the family's decoded/revalidated collection count. Reject exhaustion before another visit. Re-enumerate within the same root-entry bound and reject observable namespace changes; missing discovered families cannot silently become empty evidence. The legacy census compares metadata for every root entry, including unrelated and foreign files. The session-aware census additionally covers session folders, their leaves and every segment/private-original entry, including foreign-profile metadata without opening foreign contents. Directory accounting spans the entire observed tree; each recensus has the same whole-tree ceiling. Observable nested segment edits, new sessions and foreign-file metadata changes also invalidate the result. Operational quiescence must cover this whole observed root, not merely current-profile journal writers. Return source roles, paths, validated evidence and accounting, not a ready flag or partial success. - `Cross-family identity`: Carry the validation-only known bot-ID constraint across families as well as across each family's retained files. The family reader may expose that constraint separately from its unchanged snapshot identity; do not enrich stored identities or recovery keys. This must catch contradictory IDs present only in segments while both snapshots omit the field. - `Private retention`: `inspectTelegramUpdateJournalRetention()` is a separate read-only evidence surface over one exact v1 journal family and its `.retained` originals, using the existing no-follow bounded acquisition kernel. It validates canonical `abandon-.json` names, the full private envelope, known journal identity, entry/disposition digest, unique source IDs and exact committed discard tombstones. No tombstone means `uncommitted`, even when the journal entry is absent; a copy alone never proves cancellation. Contradictory/foreign/damaged/linked evidence or a missing snapshot refuses classification. Reads and recensus share aggregate file/byte/work limits with the snapshot/segments. The session-aware whole-namespace guard now consumes this classification and returns original-preservation facts separately from executable entries. Reverse tombstone-to-original checks reject missing copies; a valid copy without commit stays `uncommitted` and blocks protection clearance. This does not authorize replay, deletion or writer closure; the legacy flat-only inventory continues to refuse private-retention directories. - `Archive consumers`: The source audit finds no replay reader of private originals. `updates` invokes `inspectPendingRetention` before dispatch and holds copied/unverifiable pending inputs as `abandoning`; fresh cancellation uses the same copy for exact retry. `extension` retains `inspectAbandonedPending` under an operator-disposition reference for routing. `routing` uses that committed proof to settle an unsent Restore and rechecks every cancelled group before temporary-tab cleanup. A cold `inspectAbandonedPending` still reads the original even after executable entries are gone. Therefore its exact journal tombstone is a continuing durable dependency, not evidence that the archive is disposable. Retention inspection returns the validated original `journalBindingKey` and `failureId` alongside its path/update ID; callers must not reconstruct these from the current session, filename hash or a changed bot identity. This audit does not close arbitrary out-of-namespace references or writer lifetimes, and does not permit dropping tombstones or originals. - `Unclassified storage`: A `recovery` entry initially blocks this inventory without archive traversal. Unknown journal-shaped temporary/legacy residue also blocks. Relaxation requires an audited proof of non-consumption or separately authorized reconciliation, not treating a directory name as permission to ignore accepted work. Arbitrary/out-of-namespace durable consumer references remain a separate mandatory reconciliation gate; a canonical directory census alone cannot establish their absence. - `Integration boundary`: Neither strict inventory is a production recipient selector or authorizes session-file cleanup. Production uses exact session recipients and combined discovery without claiming strict namespace closure. Caller-proven serialization/quiescence remains mandatory; repeated metadata/census checks do not defeat hostile same-user substitutions. Tests must cover exact shared-budget boundaries, default/named namespaces, foreign-file non-reading, ambiguous names/types/links, absent and orphaned families, hidden cross-family ID conflicts, observable census changes, unchanged evidence, and unsupported-platform refusal. Reader/writer closure and final grant-time contention follow only after this evidence layer is independently reviewed. #### Source Closure Audit Boundaries Source audit confirms that canonical inventory is not yet usable as a production readiness check: - `Profile path correction`: Historical production wiring passed `(agentDir?, profileName?)` resolvers directly to profile-only ports, allowing a named profile to become a relative `/tmp/pi-telegram/` root. The authorized bounded inventory inspected every current and retained historical CWD hint for exact candidates using the sole configured/retained `default` profile; no defective-path source existed. The canonical root's 30 v1 families were inspected without repair and retain five queued source records in two follower families, so they remain migration authority rather than empty-state evidence. Production now uses dedicated profile-only polling/admission resolvers that bind `resolveAgentDir()` and produce canonical suffixed paths; a composition invariant rejects the old callback shape. The isolated two-CWD fixture remains as historical counterexample evidence and preserves its queued work and leases. This correction does not establish writer exclusion, migrate canonical v1 custody or activate prepared v3 consumers. - `Prepared reference preflight`: `paths.requireTelegramStoragePathReference(selected, approved)` returns only an already absolute, normalized, exactly matching spelling; relative paths, traversal aliases and different resource/profile paths throw without filesystem access or normalization of the returned reference. The approved path must come from independent caller authority. A corrected resolver output is not evidence that historical references were reconciled. This lexical check proves neither physical identity nor consumer/writer closure, and it does not authorize migration. Production uses the corrected profile-only resolvers. `Storage reference preparation` in `tests/integration.test.ts` reconstructs the historical callback shape only in a disposable fixture: default-profile publication still works, named leader/admission resolution refuses before mutation, and correct follower/recipient paths cannot bypass a mismatched admission location. All fixture files, segments, receipts, leases and directory names remain unchanged after refusal. The no-op-guard negative control fails both this composition test and the mirrored path test. The completed inventory found no defective-path source in the identified scope; moving canonical v1 storage and activating consumers remain separate gates. - `Reference coverage`: Inspected receipt/handoff callers select exact active lifecycle bindings rather than opening arbitrary receipt-supplied paths. Historical Workspace keys feed the canonical follower-path hasher; arbitrary path resolver wiring currently receives ordinary discovery results. No automatic reader of quarantined journal contents was found. Provision-recovery metadata and follower state hints do have automatic readers, but do not replay journal entries. None of these observations authorizes relaxing recovery refusal or proves live-reference completeness. - `Coordinator reference roots`: Current Workspace bindings are not the only address owners. Retirement intents retain an exact `binding`; Restore operations retain `request.binding` independently of the relocated current binding plus an opaque source journal key and routing acceptance/settlement facts. Temporary tabs retain source keys in membership and cancellation/completion/issuance groups. Terminal membership is not permission to drop the underlying cold proof. Normalized snapshot cloning preserves exact session tuples in these independent roots. Metadata pruning of one current binding therefore cannot establish reference closure across the coordinator. Production abandonment, completion and queued-receipt proof adapters now follow the exact source journal key, not the active session. Historical receipt observation does not acquire readiness; matching durable completion is terminal evidence, while absence, another owner or an offered receipt is not. Actual `/new` and session-boundary lost-reply lifecycle reconciliation remain separate acceptance gates. - `Historical journal proof lookup`: The binding runtime exposes narrow `inspectSourceAbandonment`, `inspectSourceCompletion` and `inspectQueuedReceipt` observations by exact journal key, not a historical store or execution port. Completion and whole unoffered receipt matching reuse the ordinary store's private validators/matchers rather than introducing a second proof dialect. It requires a canonical serialized key with the current profile/bot receipt scope and a polling, retained flat or canonical session filename beneath the approved polling root. Exact token-scope originals can remain inspectable after bot-ID discovery. Strict bounded no-follow retention acquisition validates the snapshot, tombstone and original; missing, linked or damaged evidence refuses rather than recovering. Cooperating source serialization surrounds the read, and profile/token/bot/root agreement is rechecked before and after acquisition and after serialization release. `routing` supplies each original group's key; `extension` owns its scoped operator-disposition reference. Native session-switch witnesses use the same recipient hash and update ID in both sessions, proving old cancellation without reading successor custody or publishing active readiness. Prompt/control native fixtures additionally preserve same-hash/same-update-ID/same-receipt-name successor custody, reject wrong owners, partial groups and offers, and inspect durable completion after a caller loses its disposal reply. Returned proof mutation cannot alter the source. This grants neither replay nor cleanup/writer closure. - `Prepared address CAS`: `commitWorkspaceJournalEvidence` accepts an optional exact `journalSources` subset. Omission preserves tuples for every existing production caller. Supplied metadata must be a bounded canonical subset of the exact expected binding; additions, malformed records and stale expected snapshots refuse without partially updating legacy keys/completeness. The native persisted/cold Restore fixture demonstrates that current-binding pruning leaves the independent saved Restore addresses intact. This is only an in-memory metadata CAS followed by existing persistence, not a filesystem grant, all-writer transaction or reference-closure proof. No production caller yet supplies a subset; tuple-aware removal and physical cleanup remain gated. - `Consumer ordering`: Replacement now snapshots originating runtime/recovery key values before awaited shutdown, rejects changed/missing bindings afterward, and uses a fresh matching descriptor before worker construction or recovery reads. Startup replacement and forced transport replacement have held-stop regressions, an old-code negative control and independent mutable-descriptor probes. Legacy same-key reuse without replacement remains unchanged; matching keys alone do not establish session/registration lifetime or compatibility of captured worker dependencies. Terminal retry and dead-owner cleanup precede worker start. Status and polling bootstrap also use recovery-capable reads. Workspace protection is now consumed by demand-driven slot rotation and uses a strict non-repairing binding reader rather than ordinary recovery-capable `read()`. Source-readiness and migration consumers retain their separate gates. - `Quiescence gaps`: Worker stop aborts/awaits draining but can leave unsettled handlers. Config append guards do not serialize other journal mutations or recovery. Whole-root churn also includes transaction staging before acquisition, state staging before owner-fenced rename, logs, admission ledgers, recovery metadata and endpoints. Holding config or owners alone does not quiesce that root. A journal transaction itself creates an `inbox`-containing name rejected by inventory, so acquiring journal locks and then invoking this census is not a supported composition. Metadata stability cannot protect an unguarded interval through grant publication. - `Prepared worker source lifetime`: A native config/journal/lifecycle fixture reproduced fresh maintenance reads followed by an old worker's revoked input context, blocking the next input despite unchanged source/runtime keys. The gated v3 resolver now keeps one narrow worker port per actual store handle in a `WeakMap`. Lifecycle snapshots the custody port captured at worker construction: renewing it triggers stop, fresh post-stop binding validation and worker replacement even with equal string keys or an in-place descriptor update. Repeated descriptors over the same store still reuse compatible dependencies; legacy bindings remain unchanged. No persistent key, schema, capability or production activation changed. Native leader-restart and active-follower tests cover renewal and stable reuse; a held-handler fixture preserves the exact durable `running` claim while independent input progresses, then rejects the cancelled origin's late effect. Negative controls prove both captured identity and stable per-store port reuse are required. This is source-handle freshness, not proof of arbitrary callback validity or global readiness; renewed callable lifetimes require a fresh store handle rather than in-place rewriting of its methods. - `Prepared donor receipt projection`: Native temporary config, Workspace admission, v3 store, lifecycle and real queue binding reproduced control effects from stale donor readiness after offer, transfer or discard while raw transport authority was lost. The strict worker port now observes the complete source-ID group, kind, exact queued owner/acquisition and absence of an offer at readiness/owner lookup. It can only restrict an already retained receipt, never adopt a new one. Unavailable observation fails closed without repair or removing local work; unchanged/cancelled ownership and a later successful observation remain usable without transport reacquisition. Native grouped-receipt fixtures cover another store handle mutating without a wake, unrelated accepted work, late prompt revocation and lost completion ACKs. Three isolated loader controls establish the need for current observation, explicit completion acknowledgement and confirmed local cleanup. The shared [settlement contract](#queue-and-dispatch-safety) preserves acknowledged prompt cleanup before `agent_start`; a late CAS refusal cannot undo an earlier control effect. Production still uses legacy bindings, without this observation port. These are point-of-use observations, not a lock spanning every later effect, proof of all writers/consumers, multi-journal atomic completion, live acceptance or performance evidence. - `Prepared pending mutations`: Native config/Workspace/v3/lifecycle/queue composition now proves accepted independent work progresses after transport loss while a governing reaction is pending or held in its actual handler. Successful Skip settles without a model turn; a failed running mutation stays outcome-unknown, blocks only the governed item and is not replayed. The fixture exposed a genuine lost wake: an older blocked drain result erased a newer signal after accepted-work completion. The worker now consumes newer wakes within the same drain run, preserving `waitForDrain`; signals preceding a later write failure cannot clear its latch or cause hot retry. Business-deletion probes also reproduced both wrong-namespace durable removal and memory-only removal after discard failure. Bot API `Message.business_connection_id` and `BusinessMessagesDeleted` establish that even equal chat/message IDs do not identify bot-chat work, so default routing now ignores this carrier rather than manufacturing deletion intent. Raw handlers remain usable. Independent loader controls falsify the namespace and wake fixes. These are native disposable composition results, not live Business/Telegram or Windows acceptance. - `Immutable pending-mutation exclusion`: The native fixture reproduced a permanently excluded reaction stranding already accepted work after transport loss. The dependency scan now ignores only `preApprovalExcluded === true`; missing legacy evidence and explicit false remain protective. Real config unpairing establishes the veto, and re-pairing, duplicate append and reopening do not remove it. Both accepted prompts dispatch through the actual queue binding while transport remains unavailable; the excluded entry stays identical and no reaction handler runs. A loader control restoring the old scan fails both unpaired and re-paired cases. Observation does not dispose of excluded input or establish general source readiness. - `Preparation prerequisites`: Reuse the completed native prerequisites; an unprepared source's read refusal is not permission to recover during queue preflight. The common worker's `removeCompleted` slot now delegates to `removeExcluded` only in the prepared v3 port. Native restoration and shutdown/restart cases drain the retained pending exclusion without executing its reaction or replaying accepted prompts, retaining the admission cursor. The journal owner rejects mixed excluded/non-excluded requests atomically; adapter checks preserve unclaimed, ready, running, queued and offered work. Queue/failure mutation stays forbidden. This is not generic raw completion, retry-quarantine disposition or production activation; existing strict exclusion-removal failure/replay-barrier tests remain authoritative. A native queue-binding call after worker shutdown exposed an unleased pending-mutation read of the retained source. Lifecycle now snapshots its reference binding and scopes pending-mutation/count reads when the long-lived reference is absent; active reads reuse it. Acquisition refusal occurs before I/O, and read failure releases the temporary reference without clearing accepted work. Stopped receipt readiness/owner projection reads nothing and cannot restore execution. The real registry/queue fixture covers stop, failure, capacity denial, restart, transport loss and forgotten-source refusal; a loader control removing the scoped reference fails. This tracks participating observation, not callable renewal or global writer exclusion. The donor handoff coordinator supplies a concrete retained mutation caller: its remote stage can reject after lifecycle shutdown, then attempt cancellation. That synchronous cancellation now uses the same scoped reference mechanism before the existing exact journal CAS; it does not reactivate the worker. Native tests hold the remote promise across shutdown and prove cancellation with original custody, denial before mutation at reference capacity, and failed cancellation after real recipient acceptance/lost ACK. Donor memory and recipient ownership survive; the latter case verifies that the native CAS was reached rather than mistaking a swallowed test assertion for refusal. A loader restoring unscoped cancellation fails all three cases. Forwarded durable admission and recipient acceptance have no await before their initial mutation. A separate native registration counterexample established the startup gap: local IPC registration could publish its generation before binding preparation, so a receiver ACKed delivery into the retained old journal. The current fixture holds the actual preparation callback return independently of nonblocking worker stop; an unsettled older handler is not the preparation gate. The follower assembly now exposes inbound generation only after `onRegistered` succeeds for that exact generation and current context. Registration state itself remains available to prepare the worker. Native tests prove early refusal, old/new journal preservation, retry into the new binding after release, context-replaced refusal and failed-preparation refusal. Loader controls independently falsify early-publication and context checks. This is local IPC/lifecycle evidence, not live Telegram or native-Windows acceptance. The deferred media producer has additional native config/v3/lifecycle/media-group/turn-preparer/enqueue evidence using the execution-guard wiring supplied by `routing`: an active delayed attachment creates one queued receipt under a held reference; clearing groups and stopping the worker while preparation is held makes the existing post-await enqueue fence refuse before memory append, queued report or custody mutation. The exact running record remains unchanged. Removing that fence through an isolated loader falsifies the stopped case. No extra callback authority or reference reacquisition was added. A separate native paired-runtime denial witness confirmed that a reply returning after worker shutdown could previously default to complete and remove the running source without a reference. Admission now rechecks the shared execution fence after `defaultHandle` returns, before exposing any outcome to the custody session. Active denial completes once under the live reference; an interrupted denial makes no completion attempt, retains its exact running record, and is not replayed on restart while unrelated accepted prompts still dispatch after transport loss. A loader removing the new check reproduces the durable removal. This closes composed default-handler return, not every standalone session/report consumer. Same-generation follower refresh has separate native IPC evidence: after lifecycle shutdown, both a new context object and a reused object with an advanced session generation previously admitted into a stopped worker, and `setContext` did not reprepare it. The assembly's ready proof now binds registration generation, context and the supplied Pi session generation, checked on every inbound generation lookup. Its async `setContext` delegates heartbeat context publication and reuses binding preparation when that proof is stale; the refresh hook awaits it without changing bus membership. Failed preparation remains unready, is diagnostic rather than a thrown session-start failure, and can be retried. Native cases prove early refusal, unchanged journal, same registration generation and subsequent processing with the refreshed context, including failure/retry. Independent generation/preparation loader controls fail. Production supplies the context/session-generation ports; standalone callers without them retain their caller-owned lifecycle contracts. Initial/re-registration now captures Pi session generation before receiver startup and retains one local attempt identity. Checks after startup, RPC, preparation and first heartbeat refuse expired work; stop and a changed-context refresh invalidate the attempt. Owned stale cleanup clears only that request's local authority, never a newer attempt. Native local-IPC cases reproduce and fence response-time session drift on a reused object, startup-time drift, stop, overlapping newer registration and refresh during the initial heartbeat; stable registration and a fresh retry still succeed. Independent controls falsify session, attempt and refreshed-owner protection. This is client request authority, not remote provisioning rollback or global consumer/writer closure. The actual control-handoff reconciler now consumes the coordinator's already-serialized payload and changes only its destination journal binding; it no longer clones a live control's `execute` function. Native v3 config/journal, reconciler, wire-codec, recipient staging and queue-dispatch composition verifies one recipient-local execution and no model turn, rejection with original donor custody, and a lost post-acceptance ACK retaining donor memory without another transfer or effect. Restoring the old whole-item clone falsifies all three cases. This closes the concrete serialization blocker, not production legacy-copy replay, global physical-reference/writer closure, historical migration or live acceptance. Further cutover work requires its operator-authorized inventory and activation evidence. Preserve exact cancellation/settlement authority and actual unsettled-handler barriers. Source inspection/grant wiring remains disconnected. #### Source Operation Serialization `Journal.createTelegramJournalSourceSerialization()` is the journal-owned lock-only source serializer at `tmp/pi-telegram/runtime/journals.transaction`; it never touches `telegram.json` or its transaction. Tests cover callback result/error preservation, release/retry, an unchanged (even unreadable) config, and that holding it never blocks pairing observation, paired admission or owner-fenced grant in another process. It reads no config, validates no profile/token/sender, and exposes no lock capability. The callback's own result is not authority. Acquire required Workspace admission and any sender (config) admission first; never acquire owners inside it. Promise-returning callbacks are outside the contract: their continuations run after lock release, not as protected asynchronous transactions. The opt-in journal-store composition now separates continuations rather than adding a second prepared-worker projection. Independent review covers all 12 stateful methods, source-callback rejection before journal locking/read/recovery, actual contention, publication-failure release/retry and unchanged receipt CAS: - `Append`: Canonicalize once → Workspace admission → choose polling observation or paired-human admission → private journal transaction. Without a sender-admission mode, use the lock-only continuation when configured. Do not wrap an admission callback in another config transaction. - `Other store operations`: Lock-only journal source serialization → opt-in `sourceAccess` family acquisition → private journal transaction → direct consumption of that operation-local evidence. The same ordering applies after append's selected admission continuation. Acquiring before journal staging is valid only when source serialization excludes all participating family writers through consumption. Without `sourceAccess`, ordinary recovery-capable `readCurrent()` remains unchanged. Ordinary `read()` is optimistic: it first runs the same strict, repair-free evidence read without config or journal guards, because atomic publication makes it safe; only a refused or reconciliation-requiring read retries once through this serialized path, which owns repair. Receipt/owner/handoff CAS and process-birth proof stay authoritative; no caller-supplied lock-held bypass or ambient reentrancy depth is exposed. - `Resource binding`: Participating continuations must use the same actual config resource. Arbitrary injected callbacks cannot prove that themselves; real factory/operation tests must establish one acquisition per operation. The dispatcher is implemented and locally reviewed. `sourceAccess` requires the lock-only continuation and captures an independently approved directory plus physical inspection limits; its store integration is independently reviewed, including generated-state refusal remediation. Current root shares the lock-only serializer; strict `sourceAccess` and sender-admitted/prepared consumer wiring remain absent. - `Evidence`: Real isolated probes show an outer observation plus existing admitted append times out on nested config acquisition. Current-token admission can reject an otherwise valid old-source receipt completion after token rotation; a lock-only transaction still permits exact receipt CAS while rejecting a wrong acquisition ID. Current observation also permits profile-switch/revocation cases, so it is not a lifetime fence. A journal `read()` can repair an empty foreign snapshot while another process holds config, proving append-only coverage is insufficient. These are storage/order witnesses, not permission for obsolete handlers to execute. - `Remaining gates`: Serialization does not provide exact reference reconciliation, old-token migration policy, settled-handler or legacy-snapshot barriers, executable receipt freshness, whole-root quiescence, all-writer closure or final-grant readiness. The whole-root census cannot run inside a journal transaction. Final grant requires an internal already-in-config-transaction check, not reacquisition of this wrapper. Sharing the source mutex does not activate strict source consumption, prepared consumers, inspectors or grant UI. #### Production Journal Reference Inventory The current composition has one factory owner: `createTelegramUpdateJournalBindingRuntime()` in `lib/extension.ts`, and it always constructs the legacy `createTelegramUpdateJournalStore()`. Its leader resolver is retained by lifecycle worker assembly, Workspace retirement protection, polling offset reads/cutover, and bootstrap entry inspection. Its follower resolver is retained by follower lifecycle assembly. Recipient/path resolver factories are retained by Workspace retirement discovery and queue-handoff reconciliation. These are readers and/or writers sharing dynamically selected profile paths; none exposes a close acknowledgement, and resolver creation itself is not a lifetime lease. This inventory closes only repository-visible production composition references. It does not prove external package callers, old running builds, arbitrary injected resolvers, or historical path consumers are absent. Consequently no component may mint `writer-exclusion: excluded` yet. Closure requires explicit lifecycle-owned reference registration/release for each listed class plus mixed-version process evidence; a source census, singleton role, or process-local inventory is insufficient. #### Strict Source Consumption Gate Read-only design probes establish that reference admission must precede journal transaction staging: the existing transaction helper can create a missing parent before an inspector invoked in its callback rejects a relative or out-of-anchor reference. An absent anchor/intermediate directory is not absent-source proof. Any bootstrap is caller-owned; the journal reference check does not establish Workspace-ledger path authority. Strict consumption cannot be implemented as inspection followed by ordinary reading. Probes reproduced empty-profile rebinding, replay/publication enrichment of a token-only snapshot, and different computed receipt scopes despite compatible inspector constraints. Conversely, token rotation can preserve a known-ID receipt scope while failing exact token inspection. The opt-in store consumer now rejects selected-schema/scope mismatch and consumes acquired evidence directly, preserving stored identity rather than merging it during publication. Before any write, the generated complete file passes the existing schema validator for both v1 and v2; an invalid cursor or overflowed attempt count refuses the transition rather than adjusting authority or corrupting subsequent reads. Legacy mode retains its existing validation behavior. Logical-state capacity and `serializedBytes` include the resulting revision and remain separate from physical inspection accounting. Validated operation-local segment names/sizes/raw work and snapshot revision drive compaction planning without ordinary rescans. Before publication, budgets cover segment-first state and snapshot replacement with complete cleanup-failure residue; every subset of that residue is bounded. Existing compaction triggers remain, and an existing redundant segment is retained when it is the bot-ID witness absent from a token-only snapshot. Segment staging is a sibling of the snapshot, outside the strictly enumerated segment directory. These siblings do not establish namespace readiness. Capacity refusal preserves evidence but does not promise progress under insufficient limits. This consumer is independently reviewed but remains unwired; migration is not implemented. A fault-injected unrelated entry creation invalidated family inspection while both config and journal locks were held. Independent review also reproduced refusal after intermediate permissions changed and were restored, and after an initially absent snapshot was created and deleted. A `dev`/`ino`/`mode`-only ancestor comparison would lose these metadata witnesses; inode equality does not establish continuous identity, and directory descriptors alone do not freeze names, permissions or ACLs. Current checks remain sequential endpoint evidence, not continuous absence or immutable namespace proof. Keeping the current observation contract requires externally established exclusion of relevant ancestor metadata/namespace changes through consumption, including already-issued asynchronous staging and contenders. Authorized publication changes metadata intentionally and retains its own authority boundary. No production mechanism currently establishes this exclusion for the shared root. Infrastructure errors latch worker blocking; an explicit live-worker signal clears that latch, but retry timers do not, and failed receipt completion is not automatically retried. Byte preservation alone does not establish progress. The approved direction separates controlled recovery/migration from live source consumption. Existing full family and whole-profile inspectors retain their current evidence contracts. The locally implemented, independently reviewed and unwired `readTelegramUpdateJournalSource()` shares their family decoder/acquisition machinery and requires selected version `1 | 2`, exact profile/token constraints, and equality between expected and unchanged stored receipt scopes. Its caller must serialize relevant cooperating writers through consumption. Snapshot/segment evidence remains strict; ancestor observations establish canonical directory type and endpoint `dev`/`ino`/`mode`/`uid`/`gid`, plus a final anchor realpath check, not detection of every sibling-entry mutation. Concurrent manual relocation, backup restoration, permission/ACL changes or other storage manipulation outside the protocol is unsupported; transient ancestor-change detection is deliberately not promised. This is a declared narrower contract, not equivalent protection inferred from inode equality. No reader alone proves whole-profile readiness or permits activation. `/telegram-connect` has no artifact-classifying retry path: the former standalone owners/state/transaction recovery handler could not establish shared-envelope or sibling-profile authority and has been removed. Current `/telegram-connect` uses the separate [damaged-state reset](#damaged-state-reset-operator-approved). Being first or becoming leader does not establish shared-root quiescence. Future journal recovery/preparation belongs in an explicit, authority-fenced startup stage, not incidental live reads; existing journal recovery inside ordinary `readCurrent()` remains unchanged until the new path is integrated. Preserve unknown accepted source evidence rather than treating runtime-artifact recovery as journal migration permission. #### Bus/Journal Design Acceptance The operator requires reliability and elegance together: minimize independent mechanisms and states while retaining explicit owners and demonstrable safety/progress. The earlier syntax-only comparison favored cursor-ordered, exclusion-bearing polling v2 and cursorless, paired-only follower v1: uniform syntax removes neither admission policy, consent checks nor receipt ownership. That finding constrains rollout but does not resolve custody; the approved ownership correction below supersedes its no-redesign recommendation. A new discriminator, version, ledger or wrapper must remove more conceptual burden than it introduces, including rollout and recovery; superficial uniformity is insufficient. The comparison exposed a delivery-guarantee boundary independent of schema: retained follower entries deduplicate, but exact receipt completion can remove that evidence and a later identical delivery can be admitted after store reconstruction. Coordinator probes first verified re-admission with actual config, paired admission, journal and follower admission components. A subsequent owned IPC proxy dropped actual ACK bytes between the real forwarder and authenticated receiver; real admission workers/update routing then invoked the authorized callback sink twice for one source, with the leader retaining retry-wait until its successful retry. A queued-message variant also committed a real worker receipt, completed its prompt handoff, and admitted the retry under a new acquisition for the same source. Both variants used injected authorized handlers; actual Pi queue dispatch, model execution and Telegram API effects were not exercised. Uniform entry syntax would not fix the independently settled copies. The next contract must preserve one execution owner across retries, restart and role changes; a fabricated follower watermark, expiry or memory-only set is insufficient. This is narrower than exactly-once external effects across a crash before completion is recorded. Inline counterexamples reject two standalone remedies: follower completion retention, and delaying follower execution until the polling origin disappears. Both work in a narrow model where only an accepted ACK retires the origin, but both fail when replay may instead execute locally. An owned IPC variant changed the routing runtime's current instance to the same stable recipient before retry: real routing bypassed the receiver, executed the primary source locally and removed it; draining the still-pending follower copy then invoked its sink again. This simulates the role-dependent routing branch, not actual election or process promotion. Origin absence proves neither a specific delivery handoff nor that another source copy remains unexecuted. The probe-only gate/sentinel and explicit wake must not be copied into runtime code; independent waiting-entry progress was not implemented. A further owned probe uses the actual runtime binding and owner/lifecycle/worker assembly, rather than changing an existing routing runtime's identity. After one lost ACK, the recipient finishes its follower source; the old leader stops; registration becomes false and leader authority becomes true for the same recipient instance/context. Starting the assembly's leader lifecycle executes the retained primary source locally. Both journals finish empty after two sink invocations and only one forwarding request. Transport/election authority remains fixture-supplied: this is not OS election, live promotion, Pi model or Telegram API evidence. The inspected production promotion path stops registration and starts locked polling; the assembly independently binds the two journals and does not reconcile their delivery custody. The correction therefore needs durable delivery custody, not merely a completion cache or an origin-presence predicate. Existing queue handoff already changes exact ownership in one journal: offer freezes the donor, acceptance CAS installs the recipient, and an ambiguous ACK cannot restore donor authority. Its API requires an already queued receipt; raw input must not masquerade as a queued Pi prompt/control. The operator approved continuing with one authoritative input record and explicit execution ownership, with bus delivery transferring/reference-waking that authority instead of creating a second executable copy. This is logical uniqueness per input, not a requirement to combine every profile into one physical file. Legacy journals and their receipts remain intact until separately authorized reconciliation. The ownership contract below governs the next local implementation slice; storage encoding, raw-owner recovery and lifecycle integration remain separately evidenced, and no production activation is implied. A disconnected worker-facing adapter now proves the first integration seam: acquire and start precede handler execution; complete removes exact custody; a single-input queued outcome atomically becomes its durable queue receipt; deferred returns the running receipt; and an ambiguous running claim never executes again. A session-scoped extension retains deferred receipts and atomically groups them into one queue receipt; consumed raw receipts cannot later settle. Late deferred complete/grouped-queue outcomes require that same retained session receipt, so stale or missing callbacks fail closed. Handler failure and fresh-session observation of retained `running` discard local settlement capability, preventing synthetic completion of outcome-unknown work. A disconnected custodied admission handle now runs the existing registry/default routing inside that session; immediate and late reports settle through the same exact receipt authority. Lifecycle bindings may opt into a strict v3 worker port: v3 snapshots require custodied execution, legacy raw completion/queue/failure methods throw, and custodied handler failure remains blocked running work rather than legacy retry state. A gated resolver reads no v3 dependency while disabled; when enabled, its runtime identity binds both source runtime and recipient execution binding so either change forces lifecycle replacement. Real-v3 assembly evidence preserves retained running input across follower registration-generation replacement and follower-to-leader promotion without another handler call or settlement. Worker selection skips running, foreign-ready, and handoff-frozen inputs while draining independent tail; each custodied commit yields and rereads durable state before unresolved work reports `execution` or `input-custody`. Diagnostics expose only update ID and `running-outcome-unknown`, `foreign-ready`, `handoff-frozen`, or `legacy-retry-state`, never owner, acquisition, binding, payload, path, or token details. Running outcome-unknown wins mixed-class priority. Legacy retry/failed state under v3 is quarantined while independent pending tail drains; it is never replayed through the legacy failure policy. A standalone disposition authority now hashes immutable failure metadata without retaining update payload and permits only exact `requeue-v3|discard` operator intent. Claimed/provenanced entries and generic terminal `retry` are excluded. The bounded segmented operator-disposition audit now accepts a discriminated legacy-custody record, avoiding a second log. Its v3-only mutation is reachable only through an injected operator authorization seam and profile admission: exact evidence atomically becomes unclaimed pending for `requeue-v3` or is removed for `discard`; duplicate authority is idempotent and collisions fail closed. Production omits authorization. The strict worker port now constructs an explicit four-method custody projection rather than returning the structurally narrowed backing store; runtime reflection proves operator listing and disposition are absent. This closes a former capability leak hidden by TypeScript's width subtyping. The disconnected operator runtime requires a caller-owned exact binding-reference scope around every list/apply call and retains no store reference. The scope must span the operation, not only lookup, so retirement/pruning cannot race a stale binding; removal, replacement or recovery mismatch fails closed. The existing bounded reference registry now has an `operator-disposition` class for this composition, but remains process-local evidence only. No production or Telegram command owns this runtime. A source invariant forbids the composition root from acquiring writer closure, installing protocol mode, executing cutover or migration publication, supplying legacy disposition authorization, or constructing the operator runtime. A separate strict non-repairing source-inspection port returns only update ID, retry/failed state, attempt count, bounded failure class and evidence SHA-256; it does not enter writer/source mutation serialization; update payload, failure summary and execution authority remain inside the journal owner. Duplicate reconciliation normalizes exact retained authority before invoking the injected authorizer; malformed extra fields never cross that boundary. If snapshot publication is commit-unknown, exact retry finds the durable audit and performs no second transition; a new disposition cannot target the resulting pending entry. Running custody still has no admissible legacy evidence. A real-v3 replacement regression begins with retained `running` and proves neither the old nor replacement session can execute or settle it after recipient identity changes. Source `recoveryKey` and recipient execution binding are distinct mandatory identities. An assembled regression proves late reports from two deferred sources publish one grouped durable queue receipt. Grouped late reports retain one exact duplicate result for each remaining source callback; the worker accepts the same already-published queue authority idempotently and rejects conflicts. Lifecycle assembly selects this path only for an optional binding-owned custody port. Its strict v3 worker adapter permits exact queued completion but throws before legacy raw completion, queue, or failure mutation; handler errors remain running outcome-unknown. The worker consumes already-durable results without legacy completion/queue writes, synchronizes late claims, and lifecycle assembly selects this path only from an optional binding-owned custody port plus exact binding key. The strict v3 binding also exposes queued receipt offer/accept/cancel through serialized admission wrappers; lifecycle lookup now proves exact recipient acceptance and exact duplicate retries return the same owner. Recipient worker projection is queried only with the matching journal binding key and survives lifecycle replacement. These APIs transfer Pi queue authority and remain distinct from raw input handoff. Cancelling a frozen raw handoff and signaling the worker makes the input executable and clears its redacted blocked projection. A legacy journal writer cannot clear quarantined v3 retry evidence because strict source-version selection rejects that mutation; any future operator disposition therefore needs explicit v3 authority separate from worker settlement. A disconnected bus admission mode validates delivery, source and recipient identity, then wakes the existing durable source reference without journaling the forwarded carrier as a second executable copy. Duplicate delivery can repeat only the wake; stale registration generation cannot wake, and selection fails closed without wake authority rather than falling back to copy admission. The gated delivery identity carries an optional bounded source `recoveryKey` outside the unchanged legacy delivery hash. Reference mode requires that key, bounded exact acquisition/handoff IDs, and explicit authenticated-transport proof; missing or mixed legacy evidence is rejected before wake. Legacy copy mode does not require or infer these fields. Wake carries the complete reference into a disconnected binding-owned resolver. It requires exact recovery key, recipient binding/live owner, update, acquisition and accepted handoff on one unfrozen `ready` claim before signaling; stale, running, missing or mismatched evidence cannot wake or mutate. An authenticated receiver composition against a real shared v3 journal now proves exact and duplicate delivery only signal the accepted ready claim; stale acquisition or registration generation cannot wake or fall back to copy admission. A disconnected sender selector requires mutual `input-custody-reference-v1` capability, and its constructor accepts only an exact accepted handoff when producing recovery/acquisition/handoff evidence. The dedicated `leader.wakeInputCustody` envelope carries no executable Telegram carrier and is forced through authenticated reference admission; legacy durable admission rejects it. A shared-v3 regression composes accepted handoff, leader resolver, mutually capable forwarder, authenticated payload-free receiver and exact wake; exact request replay reuses the cached ACK without another signal. A recipient adapter resolves recovery/binding/live-owner authority, performs exact acceptance CAS, verifies the returned handoff, and only then exposes the reference and signals. The payload-free `leader.offerInputCustodyHandoff` envelope carries exact source/handoff and recipient lifetime evidence into it; parsing, authentication, capability, binding and handler gates fail closed, while duplicate acceptance returns durable duplicate evidence. A real-v3 composition runs donor offer-before-send through the authenticated handoff receiver; acceptance CAS signals once, and client replay reconciles locally without another request. No immediate wake follows acceptance because it would duplicate signaling; payload-free wake remains only an idempotent recovery nudge for already accepted custody. Unknown outcomes remain frozen; after recipient acceptance, retry first reconciles the accepted shared-journal reference and returns duplicate settlement without re-offer, transport, or new authority. Full handoff-then-wake request composition remains disconnected. Frozen pre-accept lookup yields no reference, preventing transport. Missing reference fails retryably before transport; mixed peers retain legacy carrier delivery. A disconnected leader resolver reads shared v3 state without mutation and returns a forward reference only for the exact recipient-owned unfrozen `ready` claim; donor-frozen, running, stale binding or owner mismatch returns no reference. A single optional custody bus bundle derives acceptance, wake and forward-reference resolution from one recovery-key lookup carrying the same recipient binding/live owner, journal and signal authority. Lifecycle assembly/runtime binding exposes that bundle only when supplied; losing its active authority disables lookup and makes acceptance/wake fail closed together. A follower transport adapter rereads the optional bundle for every capability check, acceptance, wake and forward lookup. Removing the bundle on downgrade/reconnect simultaneously disables capability/resolution and makes stale operations fail closed without cached authority. A disconnected receiver assembly rereads these ports across downgrade/reconnect: bundle removal rejects before handlers, replacement generation uses only the new bundle, and stale generation cannot call either bundle or legacy admission. Live target ownership now carries the exact current registration protocol identity into forwarder selection: capability upgrade enables reference mode and downgrade returns to legacy, while persisted records grant neither mode. Forwarders may additionally revalidate current ownership after reference resolution and immediately before transport. If generation, binding, or protocol changed, they return `recipient-ownership-stale` without sending, preventing an old capable snapshot from crossing reconnect. Production follower-client composition uses one canonical live-registry validator immediately before transport. Removal, same-generation protocol replacement, or generation replacement invalidates old ownership; only a fresh current projection passes. The receiver generation check remains an independent second fence. A post-accept retry using stale ownership is rejected before transport after registry replacement, so it cannot reach either receiver execution or its cached ACK. Production still omits the custody bundle and capability; A disconnected readiness evaluator requires requested absent/v3 source, proven legacy-writer exclusion, completed historical migration and capability-ready peers; all mixed, legacy, unsupported, ambiguous or unknown evidence returns a bounded blocker. A disconnected lazy resolver reads no source/peer evidence while disabled or blocked by writer/migration proof, maps inspection loss to source-unready and inventory loss to capability mismatch, and creates no journal/lifecycle binding. Read-only adapters now normalize real strict family inspection as absent/v3/legacy/ambiguous and live follower generation/protocol inventory as ready/legacy/unknown; corrupt source and missing live identity fail closed without mutation. A real disk/registry composition rereads on every call: absent/v3 plus peers advertising durable admission and custody reference enables; peer downgrade, source corruption, or missing identity blocks; replacement upgrade re-enables. Migration and writer exclusion now enter through typed versioned evidence bound to exact profile/recovery identity; missing, unknown, incomplete, present-writer or mismatched evidence blocks before source/peer inspection. A disconnected retained-evidence store adds a bounded strict v1 codec, revision CAS under injected serialization, kind-specific validation and injected publication authority. Malformed, stale, unauthorized or cross-kind evidence never reaches the persistence port. Writer and migration records in one snapshot must share exact profile/recovery identity; even authorized mixed-identity publication fails before persistence. No current component may mint writer exclusion because existing census/serialization cannot prove arbitrary writer or consumer absence. Lifecycle runtime now admits an injected logical source lease: bind acquires, replacement releases/reacquires, shutdown releases despite retaining a reusable binding object, and restart reacquires. Release failure cannot retain runtime authority. One bounded exact-release process-local registry now backs production leader/follower lifecycle leases; capacity and stale release fail closed, and shutdown/restart/replacement update inventory. It is neither durable nor whole-root proof. The registry also scopes sync/async operations and releases on return, throw or rejection. Production status/polling cursor reads, cursor cutover and bootstrap entry reads now use short-lived leader leases; missing binding acquires none. Workspace-retirement protection now scopes shared, retained-binding and discovered journal reads through the same registry and releases before planning continues, including read failure. A composition invariant now rejects direct resolver journal reads in the entrypoint. Remaining production resolver uses are leased lifecycle bindings, scoped polling/retirement operations, or queue-handoff recovery-key computation without journal I/O. Composition invariants reject raw store construction in `index.ts`, require follower durable writes through the leased lifecycle, scope the sole cursor append, and prove current root/API exports expose no journal mutation factory. Old-process exclusion now has a pure evaluator, but not an inventory authority: exact profile/recovery identity, caller-proven complete writer list and process-birth liveness are mandatory. Alive means present; mismatch/incomplete/unverifiable means unknown; only every listed birth proven dead means excluded. Registry absence is never death. The journal transaction owner now exposes an optional outer writer-admission seam through all binding factories. It gates append, mutation and ordinary read (which may repair) before source serialization/journal locking; denial writes nothing, while strict inspection remains read-only. Production leaves it unset. The approved preparation direction is one third Workspace-ledger destructive kind, `journal-writer-closure`, not another ledger and not a cleanup/retirement alias. Its discriminated payload binds profile/recovery identity and closure operation ID but has no target, deletion permit or absence phase. Acquisition requires zero ordinary leases; while held, ordinary profile admission fails. The journal writer seam will acquire/release one ordinary profile lease before config/journal locking, so closure and writers serialize through ledger transactions without nesting the config transaction. Current lock-order regression proves denial never enters pairing/source serialization and allowed append enters writer admission, then pairing (config) admission, then source serialization. Legacy missing-kind fences remain pressure retirement. The third kind and strict identity-only payload codec reject deletion fields and identity drift while retirement/cleanup fence types remain narrowed. The top-level ledger union is integrated across admission, retirement coordination, and cleanup ports: closure blocks ordinary admission and competing destructive work globally, owns no Thread slot, and every deletion operation narrows the kind before accessing deletion authority. Compile-time deletion fence/permit authority is also a dedicated retirement-or-cleanup union; `journal-writer-closure` cannot inhabit it. Exact closure acquisition/release is now available on the ledger but remains disconnected from production. Acquisition requires zero leases, resumes the exact durable authority after lost ACK without republishing, rejects same-operation drift, and blocks other destructive work; release requires exact current-owner authority. The optional journal-writer adapter acquires a profile lease before entering the journal seam and retains its ID after ambiguous acquisition. Release failure is diagnostic-only after the journal operation settles: retaining a possible lease blocks closure safely, while throwing from `finally` would falsely erase the known operation outcome. The existing binding runtime propagates one supplied adapter to leader, active follower, recipient and path-discovered journals; regression coverage closes all four classes. Production omission still means no writer closure activation. Writer-exclusion evidence cannot yet be minted truthfully inside this fence: releasing it allows a newly starting legacy writer, retaining it blocks v3 writers too, and retained v1 `excluded` evidence records neither closure operation nor startup authority. Closure publication therefore requires a prior durable operator-authorized startup-exclusion authority plus protocol-class admission semantics. A strict standalone authority schema now binds profile/recovery, closure operation, inventory SHA-256, operator authority ID, explicit enforced/revoked status, authorization time, and `custody-v3` as the sole allowed protocol. It is retained by the readiness store through strict revisioned CAS, injected publication authorization and cross-kind identity checks. The full candidate is decoded and normalized before authorization, so malformed/extra evidence never crosses the authority callback; enforced and revoked states are retained exactly. Proven readiness now consumes it fail-closed: `excluded` writer evidence must link the same enforced authority ID, closure operation and inventory digest. Legacy unlinked evidence, revocation or any link drift blocks activation, and the store rejects conflicting linked authorities. Proven readiness also requires the durable installed protocol mode to match the same profile/recovery, startup authority, closure and inventory digest. A crash before mode installation or before linked exclusion publication therefore remains disabled. The non-nesting operator coordinator now enforces the safe order: verify retained enforced authority → evaluate exact inventory/liveness under closure → atomically install mode → reread authority → CAS-publish linked exclusion. A pre-publication revocation or race leaves mode installed but no readiness evidence, so activation remains disabled; exact retry reconciles installed mode and existing evidence without duplicate authority. Production has no caller. Migration completion now has a standalone strict authority binding the same cutover identities plus a complete historical source/disposition digest, resulting `absent|v3` family, operator authorization time and explicit revocation. It is now retained through authorized revisioned CAS and consumed by proven readiness only when migration evidence links the same migration/startup/closure/inventory authority. Revocation, legacy unlinked evidence, or a live source family different from the authorized `absent|v3` result blocks activation on every resolution. The disconnected migration publisher rereads retained authority, compares the exact historical inventory digest and inspects the live source before CAS-publishing linked completion. Exact retry is revision-stable; it performs no migration or source mutation. Its strict standalone Workspace mode codec now binds `custody-v3` to exact profile/recovery, startup authority, closure operation, inventory digest, installer owner and install time. The ledger now retains it by atomically replacing the matching zero-lease closure; fence+mode state is invalid and exact lost-ACK installation resumes without republish. While mode exists, generic `journal-write` and new closure acquisition fail closed. Dedicated v3 writer admission must present matching recovery, startup authority, closure and inventory digest; operation kind alone never grants access. While mode is active, generic `journal-write` and `journal.*` admission requires an already-held same-owner dedicated v3 profile lease. This permits nested append/input admission under the outer writer seam but rejects caller-chosen journal operation names as authority. Production installs no mode. Mode→closure publication is crash-proven: after an acknowledged-unknown atomic rename, a fresh ledger resumes the exact closure without invoking authorization again or restoring mode. Re-closing an installed mode is possible only through an injected production-unset authorizer: with zero leases, one ledger transaction replaces the exact recovery-bound mode with a new closure; active writers block before authorization and denied callbacks leave mode unchanged. Exact closure retry handles lost publication ACK. A compile probe established that this must be one compatibility cohort across the ledger, retirement coordinator, and cleanup-manager ledger port; publishing a wider snapshot before those consumers narrow by kind is forbidden. Required slices are: generalize fence payload codec without changing existing kinds; add closure acquire/exact release only; wire writer admission; then allow complete inventory capture and evidence publication while the same fence remains held. No step may infer external writer absence. Exported legacy factories and arbitrary installed-package consumers remain outside process-local proof; writer-exclusion minting therefore requires package/API closure or explicit retirement, and rollout stays gated. Optional lifecycle exposure and replacement invalidation remain disconnected. Production bindings expose neither port. Its optional late-settlement callback lets the worker clear an exact deferred projection or register already-durable queue authority without repeating a legacy journal mutation. The real worker drain accepts an optional already-settled custody result: completion rereads durable state without legacy removal, while outcome-unknown blocks without creating retry authority. Production still selects only the legacy path. ##### Input Custody Contract - Identity: The actual source journal binding and update ID identify the input; an exact acquisition identifies its current execution owner. Neither current leader/follower role nor a request ID creates a new acquisition. Obtain source references from the worker's bound authority, never from a caller-supplied path or source-ID field alone. - Admission: Preserve the existing durable admission, immutable exclusion and ordered-source replay veto. A bus receiver validates sender, provenance, recipient binding and lifetime before it can accept ownership; source identity or lock possession is not consent. - Execution: Persist ownership before semantic processing. A local projection may schedule work but cannot independently authorize it. Role replacement must resume or reconcile the existing ownership, not reconstruct the original input as fresh local work. - Transfer: Reuse the existing owner/acquisition and offer/accept discipline. Freeze donor execution before offering; acceptance CAS changes ownership of the same source record. Preserve the exact forwarded execution payload and recipient binding. A missing ACK does not cancel an accepted transfer or restore donor execution; repeated requests observe the same acquisition rather than minting another. - Settlement: Only the exact current ownership and phase can record completion, failure, transfer or transition into a Pi queue receipt. Raw input is not a queued Pi prompt/control. Queue admission must preserve the source reference and remain atomic for grouped source IDs; stale raw-owner settlement cannot erase the resulting queue authority. - Completion: Once confirmed completion is recorded, the existing ordered-origin replay barrier prevents re-creation. A late reference/notification cannot recreate input from its payload. Missing, malformed or mismatched storage is not completion evidence. - Recovery: Distinguish work proven not to have started from work whose outcome is unknown. PID death, role replacement and a fresh registration do not prove an external action was unexecuted. Select and validate raw-owner recovery separately; do not inherit queued-owner discard or automatic raw replay merely because those paths already exist. - Progress: Waiting or foreign-owned entries must not block independent local input. Admission must leave logical and physical headroom for required ownership transitions; capacity refusal preserves data but does not prove drain progress. No mutex spans a handler/UI/transport await. Replacement must account for actual unsettled handlers and pending mutations; do not restore discarded prepared-worker readiness projections. - Compatibility: Ownership-aware storage/consumers must reject interpretations that would turn an owned input into ordinary executable pending work. Keep old formats, receipt scopes, files and production factories unchanged until explicit versioning, source-reference reconciliation and capability-gated rollout are validated. The guarantee does not cover exactly-once external effects across an unrecorded effect/commit crash. The custody storage codec is v3. It retains v2's required cursor and immutable exclusion evidence, adding an optional `inputClaim` with `ready`/`running` phase, existing exact owner/acquisition fields, a recipient binding bounded to 256 characters, an optional exact execution-update projection, and an optional handoff `{ handoffId, offeredAtMs, recipientOwner }`. A queued v3 entry may instead retain `inputProvenance` with the former exact owner, binding and projection; this is immutable transition evidence, not concurrent raw execution authority. Excluded input cannot carry a claim; raw and Pi queue authority cannot coexist on one entry; running claims cannot be retry-wait/failed. Snapshots and all retained segments share the decoder. Unsupported claim phases/fields remain rejected rather than speculatively interpreted. The opt-in `createTelegramInputJournalStore()` reuses the journal's private transaction/publication owner, not a second ledger. It requires strict source access, source serialization, polling admission, a captured process identity and a bound `getInputContext` port. Besides read/append, it exposes veto-only removal, acquisition, ready-claim release/recovery, offer/accept/cancel handoff, grouped input-to-queue transition, exact queue settlement/recovery, start and exact-receipt completion, not the legacy unowned mutation ports. Each input mutation takes optional profile-wide Workspace admission before config/source/journal access. Acquisition only claims admitted pending input; matching repeats retain the same acquisition and projection. Start checks the exact acquisition, originating session and recipient binding, and grants only one ready-to-running transition. Publication rechecks the captured execution context through an operation-local callback. Completion requires running authority and may settle the original exact receipt after its session disappears; its token fingerprint qualifies the fixed source/receipt binding without changing existing receipt scopes. Reading metadata or receiving `started: false` grants no execution or sender consent. A successful v3 append independently verifies the remaining publication chain for the worst bounded representative of every currently present next-transition class; `acquire` and `start` then bind that reserve to their exact update. The reserve covers logical journal bytes and strict source files/bytes/work, including both a durable segment whose snapshot replacement is commit-unknown and a replaced snapshot whose redundant-segment cleanup entirely fails. The acquisition envelope uses maximally encoded claim fields, a duplicate of the original update and 4 KiB of additional projection growth; a larger routed projection refuses without changing the raw input. Each v3 mutation requests immediate snapshot compaction. Admission covers either direct start/completion or one `ready → unclaimed → reacquire → start → complete` recovery branch across five retained transition segments. A successful offer separately reserves accept-to-completion, cancel-to-completion and dead-donor release/reacquire-to-completion resolution before freezing the donor. Branch reserves are reused rather than summed: this guarantees one operation-bound progress chain at a time, not simultaneous transitions, repeated ready-owner recovery under persistent cleanup failure, or recovery from unbounded filesystem failure. Settlements are never withheld merely to reserve the next unrelated input. `releaseInput()` uses the exact source/acquisition receipt and owning process identity to clear only a pending unoffered `ready` claim, preserving the original input. It needs no current session context, so the originating process can finish cancellation after replacement. An unclaimed exact source is a no-op postcondition; another acquisition, `running`, offered ownership, failure/queue state or absent input refuses. `recoverReadyInput()` additionally requires a recovery identity matching the store runtime and checks the exact stored claim before its synchronous process-birth liveness probe. `alive` and `unverifiable` retain authority; only `dead` clears it. An offered ready claim is still proven unstarted: accept and dead-owner recovery serialize on the same record, so acceptance first fences the stale donor receipt while recovery first leaves unclaimed input that a later accept cannot recreate. A liveness error fails closed. Commit-unknown release retries observe unclaimed state without claiming that a handler ran. `running` is rejected before liveness and remains outcome-unknown. `offerInputHandoff()` requires the exact ready donor receipt plus its current session/binding context. Its stable handoff ID binds fresh token entropy, source binding, update ID, exact donor owner, recipient owner and persisted recipient binding. The token is neither persisted nor needed after publication: the returned durable source reference plus stored handoff ID identifies later resolution, and an exact same-recipient offer retry with fresh entropy returns that existing ID. The persisted offer leaves owner, routed projection and original update unchanged while freezing donor start/release. `acceptInputHandoff()` requires only that source reference, stored ID, named recipient runtime and same persisted binding, then CAS-replaces the donor with one new ready acquisition carrying the handoff ID and removes the offer. A repeated accept before or after start returns that same acquisition; after recovery or recorded completion it refuses and cannot recreate input. `cancelInputHandoff()` requires the donor's exact receipt and stored ID and only removes the unaccepted offer under donor context; after acceptance the stale donor no longer matches, so cancellation cannot restore it. Commit-unknown offer/accept/cancel retries observe the durable phase. These primitives do not send IPC, ACK a bus delivery or invoke a handler. `queueInputs()` atomically replaces a non-empty exact set of `running` claims from the current process/session/binding with one prompt/control queue receipt. It sorts and de-duplicates source IDs, mints one queue acquisition for the whole group, removes every `inputClaim`, and retains each claim's owner, binding and routed projection only as `inputProvenance`. A retry after commit-unknown publication must match the complete receipt group and every former acquisition, then returns the same queue receipt; a stale owner, partial group, changed kind/receipt, offered/ready claim or foreign context refuses without mutation. Consequently raw completion, release, recovery and start cannot erase or regrant queued authority. The exact queue receipt may complete after input session context disappears, behind the same profile-wide Workspace admission. Queue publication reserves its exact grouped completion through segment-before-snapshot and complete cleanup-failure prefixes; it does not promise capacity for an unknown group before that operation is presented. `removeExcluded()` requires retained v3 source/cursor evidence and checks the complete requested ID set atomically. Every present requested entry must carry the immutable exclusion veto, including pending, retry-wait or failed entries; any non-excluded input, claimed work or Pi receipt rejects the batch. Missing IDs inside the retained cursor are no-ops, not evidence of prior execution; missing storage or IDs above the cursor refuse. Removal needs neither current pairing nor an execution context and preserves the cursor, all non-excluded work and its diagnostics/ownership. Source inspection and crash-visible publication budgets remain mandatory: a readable one-file budget can refuse the removal segment even though the final logical state would shrink. This path grants no capacity exemption or drain-progress guarantee. Project-native tests cover competing processes, reconstruction, stale owner/session/binding refusal, immutable exclusions, logical/physical headroom, commit-unknown publication, cleanup refusal, projection bounds, exact ready release/dead recovery, frozen-donor refusal, token-free offer reconstruction, cross-process accept/recovery races, grouped running-to-queue transition, exact provenance retention, stale raw settlement refusal and post-context queue completion. A compaction failure after segment publication can leave a durable running marker even when `startInput` throws: retry does not regrant it. This is commit-unknown, not proof that a user handler ran; no handler is invoked by these primitives. Non-excluded raw failure settlement, bus/worker integration of durable source references and queue receipts, v3 queue-handoff exposure, outcome-unknown running-owner recovery and production consumer support remain unimplemented. V1/v2 stores still refuse v3 before recovery or mutation; current workers, production factories and `index.ts` remain unchanged. The reproduced bus/lifecycle repeat is not fixed by these disconnected primitives. Read-only migration probes constrain that comparison. Publishing a v2 snapshot over retained v1 segments is unreadable. For a logically empty current v1 state with an existing cursor and no segment-only bot-ID witness, identity-preserving v1 consolidation at the existing final revision → verified redundant cleanup → v2 publication survived simulated interrupted prefixes and all eight cleanup subsets of a three-segment fixture. Dispositions, cursor, revision and recovery scope were preserved. This is a candidate, not an implemented migrator or process-crash suite. Nonempty/unknown authority, missing cursor and a segment-only identity witness require refusal; absent family produces no write or invented cursor. Sibling staging remains outside family evidence but blocks the current full-profile inspector. External references, held handlers, writer exclusion and startup authority remain caller-owned gates. #### Owners And Validation - A narrow `pairing` runtime is justified only for the shared candidate/dialog lifecycle used by updates and command/bootstrap paths. It owns bounded ephemeral requests, cancellation and decision state, not durable configuration, journal settlement, Telegram transport, or Pi SDK mechanics. `config` owns durable grants, `journal` owns admitted-input evidence, `updates` owns sender admission before routing, and existing Pi/binding/lifecycle owners supply native UI and session ports. Keep `index.ts` as a thin re-export and `lib/extension.ts` composition-only; approve the minimal import graph before extraction. - Independently verify the refined schema/migration and lock-seam design before implementing it. First prove durable entry exclusion with UI disconnected, then test the ephemeral lifecycle with an injected clock and controllable dialog/publication promises, integrate all admission paths, and run shared validation plus an independent post-integration review. - Required witnesses: blocked dialog with worker progress; duplicate and competing requesters; exact expiry and cooldown; reject/ESC/error/no-UI; shutdown/profile/token/owner replacement; late Yes; failed/ambiguous publication; competing configured owner; pre-approval journal backlog and restart; message/edit/callback/guest and unbound/foreign paths; configured-owner compatibility; redacted/sanitized UI; no model turn before grant. Mocked UI is not terminal keyboard/rendering acceptance. Live acceptance requires separately authorized disposable profiles and Threads. ### Runtime Ownership #### Corrective Session Auto-Start (Local, Unreleased) Stale same-CWD transport continuity is not permission to provision a Thread for a new unbound Pi session. The locked startup owner now asks the thread-aware owner's read-only eligibility port before acquiring/replacing stale continuity. It refreshes existing Workspace evidence and allows a remembered session or positively known classic mode; unknown/unbound Thread history holds without consuming the stale owner record. A subsequent real resume can still recover that record and its original Thread. Explicit connect and an already-connected same-process session handoff retain their separate authority. The original session ID is captured across the eligibility await, including reused context objects; observed loss spends that startup. Automatic stale-owner starts also carry `restoreWorkspaceOnly` through existing polling options. After the actual capability probe, missing remembered Thread binding refuses before bus leader startup; a positively classic result preserves classic startup. The composition root only wires the existing thread-aware port, with no new policy closure/state. No timers, arbitrary delays, same-CWD Thread reassignment, new registry or persisted schema is introduced. Existing native provisioning, snapshot publication, unknown-create no-retry and deletion fences remain unchanged. A controlled native Locks/Polling regression first reproduced an unbound temporary session entering provisioning, then proves refusal before lock mutation, original-session resume/reuse and explicit new-session connect. Mirrored tests cover enabled/disabled/unknown mode, binding loss during probing and session replacement during eligibility. These fixtures do not establish which manually removed live tab caused the report. Structured startup diagnostics include origin/session and skip reason; ordinary callback retirement separately logs finite reason/count/age/publication metadata and unavailable-callback status, never prompt/answer text or raw callback tokens. Logging failure cannot restore action authority. Independent and operator-controlled live acceptance remain open; no existing tab, binding, runtime journal or running process is changed by local validation. - `/telegram-connect` acquires or moves the active profile's owner slot before polling starts. `/telegram-disconnect` keeps its destructive confirmation, then stops polling and releases only that exact slot. In Threaded Mode it tears down the disconnecting instance's bound Telegram thread: leaders delete their own thread directly, and followers send an authenticated exact-generation disconnect envelope seeking confirmed leader cleanup before unregistering. If cleanup fails, explicit manual disconnect may instead stop its captured local transport without claiming Thread deletion. Graceful Pi `quit` always preserves the owner slot as restart intent, allowing a reopened same-`cwd` session to reclaim the stale lease. When `threads.automaticCleanup` is enabled, quit also deletes the bound Telegram tab without releasing that restart intent; disabling it preserves the tab. The first config publication stores `false` only if the config is still absent under its transaction and no explicit value was supplied. Existing config files retain their explicit choice or the legacy enabled fallback when the key is absent; neither ordinary reads nor adding a profile migrates that preference. After delivery, polling and inbound-worker shutdown complete, a quitting leader detaches its exact owner record under profile admission while retaining the Workspace, letter and restart ownership. Publication rechecks the captured session generation, profile, leader epoch and successful current-generation suspension; unfinished startup/teardown, unproven suspension and pending cleanup stay protected. Preparation/publication errors are diagnostic and cannot block remaining session cleanup. Failed automatic deletion likewise falls back to safe suspension. - Explicit manual disconnect captures one lifecycle-generation-bound stop before entering cleanup admission. The cleanup path rechecks that captured authority before observing a target, after intent publication, before API/store effects and after awaited reconciliation. A newer connection revokes old cleanup and fallback stop; teardown also checks its generation after suspension before durable lock release. Cleanup admission failure may trigger only the captured local stop, not an unguarded latest-runtime stop or new Thread mutations. Failed cleanup reports unconfirmed outcome with debug guidance rather than claiming deletion was skipped or exposing raw errors. A stop/release error propagates as incomplete without another teardown attempt. Session-restart cleanup remains fail-closed behind admission fences and never uses this manual fallback. - Without an explicit carried connection intent, session start schedules polling resume asynchronously only when the owner slot already points at the current `pid`/`cwd`, or when a stale same-`cwd` owner can be safely replaced after process restart. Under a live foreign leader, startup instead attempts capability-gated restore-only follower admission when the selected profile has a remembered exact-`cwd` Workspace binding; it never provisions an unremembered Workspace. Startup and `/resume` do not wait on leader election, Bot API probes, poller handoff, or thread reconciliation before restoring the Pi session. - On local `/resume`, an in-flight `/telegram-connect` or established connection supplies one process-local, 30-second intent containing the selected profile, exact CWD and target session file. The file matches only the lifecycle successor; the fresh public session ID still owns binding selection. Startup claims intent before asynchronous initialization and uses the normal connection path instead of concurrent auto-restore. Quit/reload/disconnect, mismatch, expiry or supersession cancel it. The predecessor carries no Pi context, callback, Thread or slot, and late completion can clear only its own attempt. Resume startup has no automatic forced takeover or repeated failure retry; errors remain diagnostic with a compact recovery notice. - The polling owner alone bounds `getUpdates`: each request derives its cancellation budget from Telegram's declared long-poll timeout plus 10 seconds of transport grace (10 seconds for the zero-timeout initial sync and 40 seconds for the normal 30-second poll). The request-local controller inherits poller cancellation, rejects its owner at the budget, and fences any late transport result. Ordinary Bot API and media operations do not receive speculative blanket deadlines. Existing caller signals remain authoritative through API retry waits, only retry-safe methods replay explicit retryable responses, and non-idempotent sends preserve commit-unknown evidence instead of risking duplicate mutation. - Ordinary non-conflict poll/admission failures retry with exponential pauses of `1s → 2s → 4s → 8s → 16s → 30s`, capped at 30 seconds without a retry-count ceiling. Only successful durable admission resets this backoff; a successful HTTP response followed by journal failure does not. Retry sleeps remain poller-abortable, and accepted inputs/cursor ordering are unchanged. Outages therefore recover through the existing poller without manual reconnect. - Ten consecutive `getUpdates` conflict responses, including initial cursor sync, terminate polling with `persistent-conflict`; a successful response or a different error resets the count. The controller detaches its inner promise before notifying the locked lifecycle, avoiding teardown waiting on itself. That lifecycle stops ownership checks, lease refresh, capability monitoring, typing, and classic or bus transport (including leader health, pruning, and IPC), withdraws local direct authority, and transactionally releases only its exact lock. A failed durable release leaves local authority revoked; explicit reacquisition mints a fresh epoch. Accepted queue receipts and local Pi dispatch survive. One terminal diagnostic distinguishes lost local ownership from a competing client despite an apparently owned lock and reports cleanup failures; ordinary status refreshes retain generic `error` until transport recovers. Remove the competing client, then use `/telegram-connect`; no automatic retry continues after the terminal threshold. - Manual and automatic polling starts share a lifecycle generation. A later suspend, disconnect, persistent-conflict stop, or accepted start invalidates older startup continuations; reconnect captures its generation before waiting for transport teardown and rechecks it before acquiring ownership and after awaited startup work. Obsolete completion or failure cannot report a successful connection or roll back a replacement. Admission rejects stale/unauthorized contexts before advancing its own startup generation, so a rejected call cannot cancel valid in-flight initialization. After awaited bus startup, thread-aware completion checks its generation before starting leader health or changing fallback/startup-option state; teardown clears health independently of the current mode flag. Startup probes, capability-monitor transitions, and observed-target transitions share an orchestration lifecycle fence and check it inside their effect-owning helpers after awaited queries, persistence, or transport work. Monitor stop also invalidates pending observations. These checks suppress subsequent state changes, fallback, health, and status effects; already-issued API/persistence calls retain their own transport/storage fencing. - `pollingActive` reports only whether this runtime still owns an unresolved polling lifecycle; it is not health evidence. A separate observable state records `starting`, `long-poll`, `persisting-journal`, `persisting-offset`, `retrying`, or `stopped`, together with phase start, current update id, last successful response time/count, and terminal stop reason. This distinguishes a stuck HTTP poll from downstream update work without a wall-clock stale heuristic. - Built-in read-only menu commands return after required local mutation and schedule context-fenced rendering and command synchronization independently, so those effects cannot withhold the next inbound offset. - Pi `print`/`json` run modes stay passive. Inherited child sessions that share `telegram.json` but do not own the exact `pid`/`cwd` slot must not poll or call `getUpdates` unless the operator force-takes ownership. - Session replacement through `reload`, `new`, `resume`, or `fork` suspends polling/watchers without releasing ownership or publishing inactivity so the next session in the same process can resume. Late shutdown cannot clear a replacement context even when its identity is reused: the captured session generation must still match. For replacements other than `/resume`, a registered follower snapshots its assigned target into a short-lived same-process handoff, stops the old receiver/heartbeat, and re-registers through the live leader without marking or replacing its Telegram thread. Local `/resume` suppresses that source-target handoff and selects the destination session's binding instead. Hard process termination cannot run graceful teardown, so stale recovery retains its restart-hint path. - Live external owners require explicit takeover confirmation. Long-lived timers compare against snapshotted owner identity and stop local transport work when the slot no longer matches. - The profile's `transport` section owns only Telegram transport control. Local extension and accepted queue state remain per Pi instance when ownership moves, but previews, final delivery, dispatch transport mutations, and delayed Bot API work fail closed until exact direct or follower authority becomes valid again. - Exact ownership remains checked every second and re-confirmed every two seconds by lock-free reads. A lock-free miss is confirmed through the serialized refresh path: a serialized not-owner answer records `ownership-lost` and stands down at once, while an observation that cannot be verified at all records `ownership-check-failed` and stands down only after two consecutive tolerated misses; the leader writes no heartbeat, and a live owner is replaceable only by dead-PID or bus liveness proof (see [Leader Election](./multi-instance-bus.md)). Every acquisition, entry migration, release, takeover, and stale recovery is one `transport`-section transaction through the shared `runtime/state.json.transaction` guard (see [Consolidated Runtime Root](#consolidated-runtime-root)); it fences stale recovery and delayed release against replacement-owner ABA and fails closed on malformed state, unverifiable ownership, contention timeout, or unsupported filesystem behavior. Publication uses private staging below `runtime/` and atomic rename. - `state.json` is authoritative and private: `transport` (ownership), `workspace` (canonical Workspace/Restore evidence) and `admission` per profile. The non-canonical runtime/roster/diagnostics projection is the `runtime` section, published only by the transport owner without touching canonical sections; it and `logs.jsonl` never grant routing authority. The leader reads optional follower slot hints from it; a missing or malformed projection is ignored. Followers remain authenticated bus registrations rather than transport/Workspace/runtime writers; they may publish their process-owned admission leases. - Ordinary ownership and state mutations fail closed on a malformed or foreign `state.json`; read-only ownership queries report no owner, not proof of process absence. The legacy whole-file reset is not wired for the shared envelope. A non-election leader start performs the [damaged-state reset](#damaged-state-reset-operator-approved); section-scoped recovery is not planned. Startup best-effort removes obsolete current-runtime root/session `recovery/` directories, never the pre-0.52.0 tree. ### Pre-release Module Seam Proposal This bounded structure design is applied locally: Workspace identity has a reusable lower owner, while Thread naming rules reuse the existing `thread-naming` owner rather than creating a second naming domain. The four large effect owners stay in place; every retained move requires its own tests and shared gates. A closed dependency set or file length alone does not justify extraction: show actual cross-domain reuse or a concrete dependency-direction/cycle problem, and prefer an existing cohesive owner. **Decision: shared value contracts under the smallest suitable owner, not domain folders or effect-kernel surgery.** - **Workspace identity → `lib/workspace-identity.ts` (implemented).** Own session/CWD normalization, directory/session keys, local instance-slot encoding and the `TelegramWorkspaceBindingIdentity` contract. The ten-declaration closure in `threads.ts` is about 130 source lines and depends only on its own declarations plus Node crypto/path and the existing platform/CWD defaults. It needs no store, admission, transport, callback bag or reverse import. Keep algorithms, byte limits, exact key spelling, legacy keys and platform behavior unchanged. `threads.ts` imports the lower owner and retains its existing export names as compatibility reexports; the precomputed-key constructor, session-key function and key-length bound remain available to the store without recomputing or reinterpreting canonical evidence. Allocation, reservation, target selection, mutation and protection remain in Threads. Normalization is not storage-reference or custody authority. - **Thread name policy → existing `lib/thread-naming.ts` (implemented).** Generated identity normalization, grapheme fallback, palette/entropy selection and distinct identity/manual-display validation share one owner with the existing manual-name dialog. The template formatter and pure title adapter use their actual value inputs, with no nominal import back to Threads. Internal rule consumers import Naming directly; old Threads exports, including the provision-request formatter signature, remain compatibility references to those same functions. Occupied-name collection, current-record policy, slot pressure and rename/provision effects stay in Threads; display projection stays in `thread-display`. Preserve random/entropy edges, palette order, limits, dialog target/scope/expiry semantics and UI-kit grammar. A separate name-policy domain buys no necessary boundary when this existing owner can provide the reusable contract. - **Updates: retain worker/admission/custody together for this epic.** The public registry/execution-fence section is a possible later boundary, but its private carrier symbol and admission wrapper are coupled to worker execution. Any future extraction must move the unique carrier owner rather than copy a symbol or borrow an ended grant. A new lower module must not import `updates.ts` for its flow types; registry lifetime, consume/pass order and stale/late settlement require their own cohort. Merely splitting the worker body would create a broad callback interface without clearer ownership. - **Journal: retain the transaction core.** `createJournalStoreCore` joins v1 and custody-v3 adapters with snapshot/segment acquisition, queue receipts, source references, compaction and unknown publication outcomes. Moving read/write helpers cannot split this authority. Reference-registry or codec extraction is deferred until its lifetime/type dependency closure improves the graph rather than routing callbacks back into the root. - **Routing: retain the chooser/Restore operation closure.** Pending source groups, selection, one-shot issuance, receipt callbacks, cleanup and previous-world disposal share one owner. Extracting visual fragments with the same large dependency bag is not a boundary. The separate assistant-output authority block is coherent but small; no new module is justified by its size alone. **Validation and stop boundary.** Keep the current flat DAG and composition-only `extension.ts`; avoid `types`/`utils` buckets and facade proliferation. Identity tests live with the identity owner; naming value/dialog tests share the Naming suite, while store/Restore tests remain in Threads. Explicit compatibility checks retain old exports and signatures; declaration/body equivalence and focused runtime tests guard behavior. Typecheck, focused and full tests, build/current dist, public API, Domain DAG, context and diff checks gate retained moves. Reassess after these two value-policy boundaries; if remaining splits increase interfaces or risk, finish the structural epic without forcing all four owners into smaller files. Release, reload and live-state work remain outside this proposal. ### Consolidated Runtime Root **Layout.** The runtime root `/tmp/pi-telegram` (default `~/.pi/agent/tmp/pi-telegram`) has exactly two persistent root files: `state.json` and `logs.jsonl`. `sessions//` holds session-owned polling/recipient journals and custody; `attachments/` holds flat download scratch; `journals/` holds non-session service journals (`thread-cleanup` and `channel-posts`, named `..json`); `logs/` holds the rotated previous log; `runtime/` holds transaction guards, private staging, provisioning-recovery sidecars and IPC endpoints. Configuration stays outside the root. **Fresh start, no migration.** Released versions wrote `tmp/telegram`; 0.52.0 starts consolidated state without importing, merging, deleting or replaying the old root. A live older-release owner there is still consulted read-only to refuse a second poller; malformed/unreadable older-owner evidence refuses acquisition rather than becoming absence. The unreleased development standalone layout is not an upgrade source either. Operator-reported Linux live smoke after removing the development root passed (clean two-file census, new Thread, cursor without history, followers, temporary tabs). Native Windows/macOS behavior is covered by the release CI matrix. Strict journal reads run on every platform: where no-follow and non-blocking opens are unavailable (Windows), the lstat-before/fstat-after identity binding guards each open, so Restore proofs, cleanup census and scoped queue receipts behave the same and the CI matrix exercises them. **Envelope.** `state.json` is `{ version: 2, profiles: { [profileName]: { transport?, workspace?, admission?, runtime? } } }`. Profile names are logical keys, not filename suffixes or session identities. `transport` owns the exact leader/epoch/generation and polling-journal pointer; `workspace` owns canonical bindings/Restore/temporary facts; `admission` owns ordinary leases and destructive fences; `runtime` is a non-authoritative observation. Section owners keep their strict payload parsers and permissions; diagnostics never create routing/deletion authority. **Kernel (Locks).** `readTelegramRuntimeState` and `mutateTelegramRuntimeStateSection` own physical authority. Reads neither create nor repair files and refuse unsupported/malformed envelopes, non-private/non-regular sources and changed physical observations; missing state is an empty envelope only when the initial observation positively reports absence. A publisher acquires one shared `runtime/.transaction`, reads the latest envelope, supplies detached current-section/sibling observations to one synchronous reducer and replaces only its named profile/section; semantic no-ops keep file identity. Authority is rechecked before mutation, after the reducer, before writing, immediately before atomic rename and before a positive acknowledgement. Nested transactions for the same path are refused. An opened-descriptor refusal preserves its first failed predicate as optional `TelegramRuntimeStateError.readCondition`: `device-mismatch`, `inode-mismatch`, `opened-links`, `opened-type` or `opened-mode` (the existing Windows mode exemption remains). If the final pathname observation differs, its original refusal instead reports the first comparison as `post-read-device-mismatch`, `post-read-inode-mismatch`, `post-read-size-mismatch`, `post-read-mtime-mismatch` or `post-read-ctime-mismatch`, in that order. The descriptor is already closed; no reread, changed-observation acceptance or writer attribution is added. Status projects only those finite Error/name/invalid-code combinations as `stateReadCondition` and `errorCode: invalid`, overriding conflicting caller labels without exposing file identities or cause bodies. This is diagnostic classification, not authenticated provenance, a global restriction on explicit caller details, or retry/reset authority; validation order, class/code/message, descriptor closure and original error propagation are unchanged. A lost rename reply or post-publication authority loss returns `publication-unknown`; the committed fact remains and never grants replay or rollback. **Transport.** `createTelegramLockRuntime({ statePath })` keeps acquire/election/expected-owner/unresponsive-owner/release semantics in its profile's `transport` section, preserving sibling fields and the polling pointer through release and succession. Read-only ownership queries fail closed (no owner) on unreadable state so unrelated Pi hooks never crash; acquisition/publication still validate and refuse without replacing it. `publishStateSectionIfOwned` publishes only Workspace or runtime data under exact retained owner and caller authority with an optional `expectedScope`; it never publishes transport/admission or borrows a surrounding `commitIfOwned` grant. **Session-bound grant.** `Locks.createTelegramOwnedStateAuthorityCapture(lock, session)` captures the exact current Pi context, session generation and owned leader epoch before the caller's first await through a structural session port (Locks does not import Lifecycle). The grant stays current only while that context/generation is current, the lock is owned for that context and the epoch is unchanged. Session replacement, same-context restart, clear, release and release-then-reacquire (a new epoch, as disconnect/connect does) revoke it; a successor captures a fresh grant and never renews the old one. Through the real Workspace store, a persist captured before a new session refuses without changing bytes while the successor publishes; an epoch-only capture would have committed that stale write. **Workspace (Threads).** `createTelegramTopicTargetStore({ consolidated })` uses `createTelegramConsolidatedWorkspaceStorage` and the lossless `parseTelegramWorkspaceStateSection` decoder: malformed/filtered records, unsupported headers, altered normalization, unknown fields or foreign profile evidence block rather than becoming empty state; missing section means absence and whole-section removal is not admitted. Publication captures path/profile/grant before the queue await; whole-Workspace writes compare the current section with the last loaded/committed baseline inside the reducer, so a concurrent canonical change requires refresh. Transaction frames supply Restore/temporary/registration observations to existing guards without nested ownership transactions. Complete-empty journal binding keys stay serialized as `[]` so completeness survives reload. Provisioning-target recovery sidecars use `runtime/.provision-recovery.<16-hex profile hash>.json` via `resolveTelegramWorkspaceProvisionRecoveryPath`. **Consistent Workspace loads.** A consolidated `loadFromDisk` observes its existing physical snapshot once under the canonical envelope publisher guard, released before the existing await continuation and projection/Restore processing. This is an infrastructure lease, not a filesystem-side-effect-free read: acquisition creates private guard staging and uses the existing bounded contention policy. Its `recoverAbandoned: false` policy validates conflicting guard evidence but never reclaims even a dead owner's guard; ordinary publishers retain their existing recovery behavior. Malformed/unknown guards refuse before the snapshot callback. Standalone storage, retained private Restore/protection readers and existing transaction-frame observations keep their original paths without reacquisition. Path/profile/revision checks and caller session/registration fences remain; no reader reconstruction, extra sample, failed-read retry, namespace rebase, reset, publication grant or renewed readiness clock is introduced. A refused original read still ends that attempt. Controlled publication demonstrates a mechanism and exclusion boundary, not the historical writer or whole-runtime recovery. **Admission.** `createTelegramWorkspaceAdmissionLedger({ path, stateProfile, profileKey, owner })` selects the shared `admission` section; the runtime binding selects exactly one `getStatePath` or legacy `getPath` identity. Admission stays process-owned: followers acquire/release exact ordinary leases while another process owns transport; destructive fences and `journal-write:custody-v3` permissions keep their predicates and one-shot issuance. Unknown fields are refused rather than dropped; only positively dead process/birth owners are pruned inside a mutation. The runtime resolver retains one current ledger for unchanged validated construction authority: path/storage mode, exact state profile, normalized profile key and exact token, semantic PID/birth owner, and effective clock/liveness callbacks. Validation precedes reuse; observed change, unavailability or failure clears/replaces the capability, and restoration never retrieves a historical ledger. Separate comparison metadata and the retained-owner check preserve existing mutable-owner/storage fences. Resolution performs no storage I/O; stable capability identity alone grants no lease, receipt or execution authority. **Runtime projection (Status).** `createTelegramRuntimeProjectionStore` publishes the non-authoritative runtime/roster/diagnostic projection through a structural storage port (Status imports no local nominal domain), omitting `recentRuntimeEvents`. Submission captures detached content and exact profile/path/grant before the queued await; malformed runtime observations may be replaced only under fresh owner authority; unknown post-rename replies are never re-published to recover an ACK. **Logging.** `createTelegramRuntimeDiagnosticsRuntime({ sharedFile: true })` writes one profile-labelled `logs.jsonl`. Scope resets append profile-tagged markers; the global 5 MiB threshold rotates the mixed segment to `logs/logs._prev.jsonl` under captured grant and the `runtime/logs.jsonl.transaction` guard. Event append is fail-soft and non-authoritative. **IPC.** Bus Transport's `layout: "consolidated"` maps leader `bus.<16hex>.sock` and follower `f.<16hex>.sock` (hashed raw profile and exact recipient) under `runtime/`; Windows uses hashed native named pipes. The local server publishes a colocated private `.pt-<16hex>.sock` listener behind an atomically renamed relative logical symlink. Logical addresses stay canonical; an over-budget Unix path uses the existing private external socket shortening only at socket resolution, never for state or journal relocation. **Validation.** Native fresh-root production tests start real leader plus follower for default and named profiles and observe one poller, the two-file root census, leader/follower publications under `runtime/`, channel success and lost-ACK issuance under `journals/` surviving a replacement extension instance without resend, rotation under `logs/`, preserved bindings and byte-identical released `tmp/telegram`. An authenticated polling callback traverses the production inactive-tab review, profile admission and strict protection observer to prepare exactly one inactive binding through `resolveTelegramServiceJournalStorage`; the cleanup journal shares `journals/` with channel records and leaves no staging files. Replacement and a repeated review retain byte-identical prepared work without issuance or deletion, and complete-empty journal keys/source tuples survive Workspace reload. These are fake-HTTP host-harness tests in one OS process, not real Pi/Telegram, whole production section-owner sequencing or native-platform acceptance. **Shared owner-port composition.** Native property tests compose the production session-bound grant and Thread store's Workspace/Restore/runtime ports with process/birth-owned nonleader admission and actual default/named section stores on one physical root. Context, same-context generation, epoch, owner, profile and path revocation refuse both queued publications. A concurrent Workspace change refuses its whole-section CAS while independent runtime publication succeeds; neither changes transport, admission, named-profile sections, issued Restore or complete-empty references. Registration uses the existing Workspace transaction frame without nesting a shared transaction, and the nonleader lease remains releasable after transport/session changes. Transport PIDs/liveness are supplied fixtures; this proves local owner-port composition, not actual extension sequencing under those races, real multi-process/profile runtime continuity, Pi startup or platform/live acceptance. **Production registration ownership race.** The fresh-root fixture also holds an authenticated native follower registration inside the actual leader provisioner while fake HTTP awaits a Thread-creation reply. Exact same-process owner succession changes the epoch before that reply returns. For default and named profiles separately, the late ACK cannot publish the new binding/owner, old diagnostics and teardown cannot overwrite the successor runtime/transport, and the held process/birth-owned admission lease releases. A real sibling-profile Workspace section and channel issuance bytes remain unchanged; no second creation, cleanup or model dispatch occurs. This is production composition with disposable native Linux storage and supplied Pi hooks in one OS process, not an actual Pi session change, interrupted Restore settlement, multi-process/profile continuity or platform/live acceptance. **Production follower session race.** The same default/named-profile fixture replaces the follower context (same session ID) or renews its generation (same context object) through composed `session_start` hooks while the initial authenticated registration awaits fake-HTTP Thread creation. The independent leader retains its acknowledged remote binding and slot; the stale local attempt grants no direct-delivery authority, makes no API call on refusal and leaves the recipient journal family absent. Only a fresh acknowledged connect grants local delivery, reusing the retained binding without a second creation. Admission releases; sibling-profile Workspace, channel issuance and released storage remain exact, with no cleanup or model dispatch. This is supplied-hook production composition in one OS process, not actual Pi lifecycle acceptance, interrupted Restore settlement or an inbound execution/readiness witness. #### Damaged-State Reset (Operator-Approved) **A working `/telegram-connect` outranks preserving damaged runtime state.** Validated explicit-connect profile activation first calls `createTelegramLockedPollingRuntime.prepareConnection` before old-profile teardown; non-election `start` calls the same preparation again before transport acquisition. `Locks.resetDamagedTelegramRuntimeState` takes the shared `state.json` transaction guard and validates the envelope, every profile's `transport` section and, through the composition root, every `workspace` and `admission` section. Valid state is never rewritten. Damaged JSON, an unsupported envelope, unknown sections, invalid section evidence or a non-private/non-regular file is atomically replaced with `{ version: 2, profiles: {} }`; acquisition then proceeds normally and one `lock`/`state-reset` diagnostic is recorded. Filesystem access errors are not damage and still refuse. Follower elections never reset. The reset deliberately forgets every profile's polling cursor/journal pointer, bindings/slots, unfinished Restore/temporary facts, admission/deletion fences and Workspace evidence; no backup, import, merge or replay is attempted. Pi history, `telegram.json` and the released `tmp/telegram` are untouched. Orphaned session journals follow the normal sweep. If another live leader was using the damaged file, its own ownership checks fail closed and stop its polling; any remaining competing `getUpdates` client is handled by the existing persistent-conflict stand-down rather than by another reset. Old Telegram tabs/messages may remain and are not cleaned up. Ordinary readers and section mutations still refuse damaged state without repair; only this pre-acquisition step resets it. #### Runtime Self-Healing (High Priority, Planned) **Status and ownership.** Self-healing is a runtime reliability property: a supported fault should converge through the existing domain owners to usable transport and acknowledged recipient readiness, or stop with an attributable protective refusal. This section defines the planned recovery boundary, not shipped general repair. Open work is owned by [Runtime self-healing](../BACKLOG.md#runtime-self-healing--high-priority). `locks` owns envelope/transport/guard decisions, `polling` owns Thread capability and transport startup, `bus-follower` owns authenticated registration, `lifecycle` owns session/connect cancellation, and `commands`/`bindings` connect their existing ports. Do not create a recovery registry, supervisor, second poller, shadow Pi process or broad coordination service. **Stable 0.59.0 registration-boundary negative (`cc62145`).** The original macOS integration 6/8 job executes 309 cases with 308 passes, one failure and no cancellation/skip. `Production original registration separates mode publication, IPC and ACK (source/work/connect-session)` fails in the existing two-second `entered` predicate before `producer-held` and before the intended session replacement. Its native child reports the original timeout Error and exits one after teardown checkpoints; neither the fifteen-second execution/drain cap nor the thirty-second parent cap expires. The original log and seven unrelated startup/Root snapshots survive, but no pre-cleanup counters or runtime log for this registration case were captured. This establishes the failed boundary, not a physical-read, transport, timing-load or common-cause explanation. The local successor adds only a failure catch in this existing fixture: primitive counters are copied before cleanup, the already-produced diagnostic JSONL is read without touching Workspace/Restore, and the original Error is rethrown. Existing CI artifact configuration receives an exclusive-create per-case JSON; capture refusal cannot overwrite prior evidence or replace the primary Error. Four source/compiled named-profile controls retain their normal path without artifact I/O. A synthetic client refusal demonstrates capture before the hold; a duplicate artifact demonstrates capture refusal with the same original outer Error after normal cleanup. Removing the twenty-line catch recovers the complete original file hash. These models qualify observation only, not the original cause; all original waits, native concurrency and semantic assertions remain. Exact-successor CI and diagnosis remain open. **Exact-head author platform checkpoint (`9b7fdd1`).** Validate completes all twenty jobs successfully on the candidate's exact tree `4d01cc326411fcf390482c61bc04fe1254c7862c`; all twenty native checkout logs identify synthetic merge `eb5c9459b788f631af1eb067c3bec5eeb2324842`, whose Git tree equals that candidate and whose parents are the unchanged main baseline and this candidate. Complete native integration output verifies 2,495/2,495 on Linux, 2,495/2,495 on macOS and 2,485 executed passes plus ten exact pre-existing Windows exclusions out of 2,495 registrations. Those ten `strictFileTest` exclusions remain skips, never executed passes; unexpected skip names fail verification. Every platform has zero failures/cancellations, all four new native queued-owner witnesses execute without skipping on every OS, and all 156 startup original-observation artifacts retain their real PID/poller tuples and no fixture failure. The last macOS shard closes at 309/309. Domain dot/spec logs are retained without invented aggregate case totals. All jobs stay within the unchanged thirty-minute cap; the slowest Windows job takes 1,740 seconds. The separate Recovery workflow also verifies all thirty fresh-process rounds/150 actual cases on Linux, Windows and macOS with Node 22.19.0: every round has native exit zero, no signal, exactly five executed semantic cases and no failure, skip or cancellation. All 150 original producer artifacts and actual checkouts match the same tree. This closes the author-controlled exact-head platform gate for the committed candidate, including the queued-owner diagnostic and fresh-registration/native-prune fixture checks. It does not explain the earlier `80da97c` one-creation startup failure, the unrecorded macOS prune phase, historical SDK compaction/import, cold-Root or JSONL failures. Independent integrated review, separately authorized operator-loaded/live acceptance, warm custody preservation and original SDK/follower/legacy writer closure remain open; no reset/replay/cleanup/release authority follows. A later candidate SHA still needs its own exact-head CI. The earlier local/failed cohorts below remain original evidence, not replaced by this successful run. **Successor candidate remains unaccepted (`07c8eb7`).** Its stronger native wait/expiry JSONL/debug assertions do not inherit the preceding checkpoint: Validate ends with eighteen successful jobs, one failure and one cancellation. The nineteen available native checkout logs match synthetic merge `d393ca7ab0cfbaab6d5292eb6c32487f6bc56211`, whose tree equals candidate `f5bcf738f5cf58368c881e81000b1d8e0c25ebd2`. Linux verifies 2,495 executed passes; Windows verifies 2,485 passes plus the same ten exact exclusions, with every job inside the unchanged thirty-minute cap. All twenty new early-follower cases execute successfully on both platforms. Seven macOS shards provide 2,176 registrations/2,175 passes/one failure, including sixteen successful new early-follower cases; the missing shard's four cases remain unobserved. The separate Recovery workflow retains 150/150 actual passes and producer artifacts on this tree, but does not execute those new assertions or replace the failed platform gate. The macOS 1/8 failure is `Production separate OS startup converges through original admission (source/work/cancel-before-ready-threaded)`: native 313 tests/312 passes/one failure, no skip or cancellation, parent exit one. Its original failure artifact is captured before teardown at `native-roots-ready`: neither child has acknowledged readiness or returned a connect result. Static-import checkpoints arrive at 446/460 ms; Root import begins only at 6,189/6,715 ms and has not completed when the original ten-second startup deadline expires. The first original Error survives diagnostic/cleanup failures. This identifies the pre-readiness boundary, not a stalled module, resource cause, cancellation failure or new wait/expiry assertion defect. Separately, macOS 8/8 has only the authoritative thirty-minute job-cap cancellation annotation: its individual log returns HTTP 404/`BlobNotFound`, the complete run archive omits that job and no recovery artifact exists. No last active case, native summary or shared cause can be inferred. Keep both failures original, retain existing startup/drain/job clocks and diagnose through bounded actual phases rather than unchanged healthy sampling or larger watchdogs. **Local startup-phase diagnostic successor (unaccepted).** The existing separate-process startup fixture now records entry/completion around its actual transport, Bus, Polling, Locks and Follower imports, retaining their order, original modules and delegating mocks before Root import. Each native PID supplies thirteen monotonic parent-observed checkpoints including static-import and Root boundaries; no checkpoint acknowledges readiness. The sixteen-record bound, original ten-second startup, twenty-second ordinary drain and separate enclosing/job caps are unchanged. Source/compiled default/named cancellation controls and damage/Classic/receiver/lost-ACK/actual thirty-second ACK-timeout controls preserve the original semantic assertions and before-teardown evidence. A real ten-second progress-only native child never acknowledges readiness, retains its original startup Error through close and cannot escape via repeated `id: 0` checkpoints. Omitted completion, foreign PID, clock-renewal and false-readiness countermodels fail their claimed boundaries and restore byte-for-byte. These local observations close the diagnostic blind spot between the existing pre-Root imports, not the original macOS stall's cause or the separate job-cap/log-availability gap; the successor still needs exact-head platform acceptance. **Diagnostic successor CI still unaccepted (`5bd838f`).** Validate ends with nineteen successful jobs and a macOS 3/8 cancellation. All nineteen available native checkout logs and the three Recovery logs identify synthetic merge `4635a46611d380a78fced6481e5e7226108863d5`, whose tree equals candidate `cf935ffcfc98b25e20f49103d0ae7e78fd24aa06`. Linux verifies 2,496/2,496 executed passes; Windows verifies 2,486 passes plus the same ten exact exclusions, all jobs within the unchanged thirty-minute cap. Seven macOS shards verify 2,180 executed passes; the cancelled shard's 316 registrations remain unobserved. The new startup-only control executes on all three OS at 10.010/10.025/10.008 seconds without false readiness or renewed clocks. All twenty early-follower wait/expiry cases execute on Linux/Windows; nineteen execute on macOS, with `source/default/timeout` unobserved. The available 148 original startup artifacts retain thirteen-phase PID/order/monotonicity and one-poller proofs. Recovery separately verifies all thirty rounds/150 cases and producer artifacts on this exact tree; neither these successes nor the later native macOS 1/8 pass attribute the original `07c8eb7` import failure. The cancelled macOS 3/8 job supplies only the authoritative thirty-minute cap annotation: its individual log is HTTP 404/`BlobNotFound`, the completed run archive contains nineteen jobs but omits this one, and no corresponding recovery artifact exists. It has no native summary, exit/signal, checkout witness or known last active case. This repeats the observation gap from the earlier cancelled macOS 8/8 job, not proof of a shared test/module/resource cause. Further preparation belongs to the existing CI/test-reporting owner: establish bounded original-progress evidence that survives loss of final log/artifact publication, without changing runtime recovery authority, inventing settlement, emitting prompt/secret bodies or enlarging startup/drain/job clocks. Allocation changes or another unchanged healthy sample cannot supply the missing original evidence; the full platform gate remains open. **Public native progress inquiry (local only).** A bounded Node 22.19.0 CLI probe uses documented multiple reporters beside unchanged TAP: `test:dequeue` is observable while an independently held test body has entered but not completed. `test:complete` is native test-runner completion, not callback/descendant settlement: an actual timeout probe emits failed completion while its original body is still held. Declaration-ordered `test:start`/`test:pass`/`test:fail` concern reporting and cannot supply an earlier execution boundary. Both healthy and failing native bodies preserve their original three-case TAP and exit 0/1 without copying assertion/error payloads into the projected event channel. Stopping the observing runner while the body is held retains dequeue evidence but no held-body completion or complete TAP summary. The initial assumption that SIGTERM must appear as a native signal is falsified: this Node CLI handles it as exit 1/signal null, whereas forced SIGKILL reports null/SIGKILL. Neither dequeue, observer exit nor a null signal certifies semantic completion or uncancelled execution. This establishes a public observational port without replacing `spawnSync`, native outcomes, existing reporters or deadlines; no maintained reporter, workflow or CI invocation is enabled by the inquiry. The documented GitHub notice command creates an annotation, but the local Node probes do not establish service-side receipt, quotas or retention when final job logs/artifacts disappear. A next bounded prototype must project finite body-free fields, keep original native completion/exit/signal and exact inventory separate, and falsify dropped/foreign/partial/cancelled evidence. Original annotation acceptance and survival across job-cap cancellation remain external evidence gates, not an assumed durable health store or permission to expand allocation/retry. **Finite CI progress reporter — observed receipt, bounded guarantees.** `scripts/ci-test-progress.mjs` is a public Node reporter module loaded by `run-ci-tests.mjs` only for integration with exact `GITHUB_ACTIONS=true`. The same native TAP reporter and stdout destination remain; a documented second Node reporter adds at most eight `::notice title=CI native progress::` command lines on stdout, GitHub's documented workflow-command channel. This is a mixed CI log, not a replacement or standalone clean TAP file. The constant command/title and toolkit-equivalent data escaping admit only the finite projection; no workflow permission or API client is added. Ordinary local runs and process/domain phases retain their existing reporters without loading this module. Its private file-scoped projection admits only serial top-level dequeue/completion and the original file summary. Node's file wrapper shares file/nesting/type with real tests and may use the relative CLI argument as its name; the original native shape is excluded explicitly rather than counted as a body. Foreign/nested/reporting/stdout events are ignored; missing, duplicate, mismatched or partial original sequence spends the projection as `unavailable`. Output is at most six dequeue milestones, one first native-test failure and one original native summary or unavailable record: eight records within 4 KiB, containing finite counters/booleans/enums and SHA-256 title digests, never raw names, paths, skip/error reasons or bodies. EOF does not fabricate a summary, and logical native completion remains separate from callback settlement and process outcome. Local Linux/Node 22.19 public-CLI controls preserve normal/failure/skip TAP and native outcomes, timeout completion before original-body drain, and partial progress without summary after SIGTERM/SIGKILL. Windows' documented forceful kill behavior has a separate expected outcome; the corrected head's successful unfiltered Windows domain suite now covers these unskipped guards, without publishing individual case counts through its dot reporter. Raw-label, unbounded-milestone and held-test-summary countermodels fail their claimed boundaries and restore byte-for-byte. A separate post-release natural-exit guard rejects a retained reporter handle before the outer fixture cap; its native countermodel preserves the original drain error rather than treating printed TAP as success. The same native healthy/failure/skip/timeout/TERM/KILL controls run in both local and GitHub-command modes. Existing CI-runner fixtures require original TAP failure details and its separate finite notice before releasing a held successor, retain native failure exit, and verify exact shard/filter forwarding. A file-only TAP pass emits no semantic progress notice; other phases succeed with this reporter file absent, proving they never load it. Wrong command, omitted wiring, replaced TAP, overridden native exit and cross-phase wiring countermodels each fail at their claimed boundary and restore byte-for-byte. One actual selected production integration registration also returns native 0/null with its original pass and exactly dequeue/summary notices. These are local stdout witnesses, not service receipt: public command documentation does not prove quota acceptance or annotation survival after cap. The reporter adds no timer or runner/controller and changes no deadline/allocation. The original service evidence below qualifies only the captured jobs and records; exact-head platform acceptance, severe evidence-loss durability and both historical cancellation causes remain open. The first wired candidate `f3c01dc` has a concrete new portability failure, separate from the historical import and cap faults: all four Windows integration jobs check out native merge `21b1622896bfd60e3558c19a350662f6e7bce714`, whose tree equals candidate `6499b50fc523282b343d2d949c1d06f0ff41b126`, then Node 22.19 throws `ERR_UNSUPPORTED_ESM_URL_SCHEME` with protocol `d:` before semantic tests or recovery producers run. Their original logs retain CI-step exit 1, no test summary and no recovery files; no native child signal is recorded. This is a reporter-specifier loader failure, not four failing runtime cases. The owning CLI and sibling native-reporter fixture now use Node's standard `pathToFileURL(...).href` at the module-specifier boundary, without converting ordinary executable/file arguments. Existing held-failure, shard-forwarding and native event fixtures use real temporary roots and a reporter filename containing spaces, `#`, `%` and Unicode: before conversion, all three original checks fail in native module resolution because `#` is interpreted as a URL fragment; after conversion they preserve original callbacks, TAP and outcomes. Removing either conversion or substituting an unescaped `file://` prefix fails the actual loader boundary and restores byte-for-byte. The original Windows domain log additionally retains four CI-owner failures: three reproduce that module-loader boundary, while the synthetic file-wrapper check compares `/fixture/...` against native drive-qualified resolution and therefore misclassifies its fixture wrapper. Its file scope now uses native `resolve(...)`; the projection guard and all assertions stay unchanged. One shard-forwarding fixture also records native child status 7, which remains separate from the outer CI-step exit 1. No Windows-shaped string mock, URL normalizer, new controller, clock growth or case/exclusion change is added; actual Windows acceptance of the corrected candidate remains open. At the first service observation, one running Linux and one running macOS integration check each return HTTP 200 with zero annotations; the failed Windows check contains only the platform warning and native process-exit failure. Empty in-flight annotation responses establish neither notice rejection nor receipt; other jobs and independent Recovery remain unaccepted until their original evidence is consumed. Do not discard this head's red evidence or infer a cause for either old cancellation from it. **Observed service receipt and one natural-cap survivor.** On original `f3c01dc` jobs, later HTTP 200 annotation responses contain seven native-progress notices for Linux 3/4 and six for macOS 1/8. They exactly match each job's original logged records and native 625/625 and 313/313 passed verdicts with zero fail/cancel/skip. The earlier in-flight HTTP 200 empty responses therefore prove neither rejection nor guaranteed in-flight visibility. The API returns notices in reverse reporting order; original logs and ordinals, not API list position, establish sequence. The same head's macOS 3/8 job naturally exceeds its unchanged thirty-minute cap and retains six matched native-progress annotations after terminal cancellation: dequeue milestones 1/64/128/192/256 and the first native failure at ordinal 161. All seventeen digest-bearing notices across these three jobs match the SHA-256 of their original native TAP titles. This establishes actual service receipt and retention after this particular cap, not general quota acceptance or survival on the earlier paths that lost logs and artifacts. Here the original log and recovery artifact also survive: the native prefix contains 287 verdicts (262 pass/25 fail), 29 planned registrations without a reported verdict and no final native summary or process-exit/signal evidence. Milestone 256 and last reported verdict 287 are not the last active case or callback/descendant-drain proof. Eight startup snapshots retain sixteen distinct native Roots with all thirteen ordered import phases; their pre-teardown snapshots do not certify process closure. The first retained failure is `Production question root uses original SDK binding at birth, not ACK (source/false/partial-retained/rich=true)`, at the original ten-second startup boundary with native PID 25332. Its outbound import phase spans 1198→7309 ms, bindings import spans 7334→9337 ms and the final recorded phase is bus-leader import at 9339 ms; no readiness appears. These original timings narrow this failure's boundary without identifying the underlying module/resource cause, explaining all twenty-five failures, attributing the old missing-output cancellations or authorizing larger clocks/reallocation. The separate `c6b31f0` file-URL correction changes no runtime/import policy; its own platform/native evidence remains required. **Corrected-head terminal native qualification — platform gate failed.** On `c6b31f0`, twenty-three consumed native job logs (all twenty Validate jobs and three Recovery jobs) identify actual merge `9a407a5e551daa53dae877deaafcc10a8c6c4a04`; its tree is exactly candidate `0bf4e5532aef9fda4caec71769778aba6925d8b5`, with parents main `40bc9e0` and `c6b31f0`. Four Linux integration shards execute all 2496 registrations with zero fail/cancel/skip and all twenty early-follower wait cases. Their ordered verdict inventories match the actual native registration lists, including the one repeated title: test-name uniqueness is not registration identity, and the existing shard invariant deliberately preserves duplicates in one owner shard. The Windows and Linux 72-file domain suites and both macOS domain shards succeed; dot output does not supply an individual case total, but the Windows suite includes all four unconditional CI-owner guards that failed on the original head. All four Windows integration shards now preserve the exact ordered 2496-registration inventory: 2486 executed passes plus exactly the ten historical named exclusions in distribution 2/3/3/2, zero fail/cancel and all twenty early-follower waits executed. The longest Windows job takes 28m34s within the unchanged thirty-minute cap, and its original startup deadline-control case returns at 10014.1614 ms. All eight macOS integration shards provide the exact ordered 2496-registration inventory: 2495 passed and one failed, with zero cancel/skip. Validate terminates with nineteen successful jobs and one failed macOS 8/8 job, not a job-cap cancellation. The formerly failing predecessor's first SDK startup case passes in the corrected head's complete macOS 3/8 native 316-case result, which does not identify the predecessor's cause. Three Recovery artifacts independently validate Linux/Windows/macOS ten rounds each: all 150 actual executions and 150 original late-publication producers, exact five names/order per round, native 0/null, zero fail/cancel/skip and original merge identity. The completed macOS workflow badge alone is not the proof: its original fifty TAP cases, native per-round outcomes and fifty producer JSON records are validated against the same original merge. Separately, all sixteen integration artifact bundles retain 156 startup snapshots and 312 native Root snapshots, each with thirteen exact ordered monotonic import phases; these captured pre-teardown records do not establish actual process closure or erase the separate SDK startup failure. The corrected head also has original HTTP 200 service receipts for all seven notices of completed Linux integration 3/4 and Windows integration 1/4, each matching its native log. The Windows summary explicitly retains 631 registrations as 629 passed and two skipped, not 631 executed passes. These normal completed-job receipts are not another cap-survival witness. The original failed macOS 8/8 job also has seven HTTP 200 service notice receipts, exactly matched to its native log, including the first-failure digest and the final unsuccessful summary; API list order is not execution order. Exact-head platform acceptance is refused, and the older failure attributions remain separate. The sole `c6b31f0` failure is SDK case 180, `Production question root uses original SDK binding at birth, not ACK (source/true/timed-direct-parent-loss/rich=true)`. The original `Node eval child did not exit (startup)` Error returns after 10007.615582 ms; PID 28467 records outbound mock import at 1126 ms, installation at 8865 ms (7739 ms span), and bindings import at 8876 ms, with no later phase or readiness. Its shard still reports all 319 native verdicts (318 pass/one fail), zero cancelled/skipped/todo and an unsuccessful native summary; the CI step reports exit 1, without a separately recorded native child signal. This is a fresh original startup-boundary failure, not proof of CPU/storage/module cause, semantic SDK-policy execution, the earlier missing-log cap cause or permission to rerun/raise clocks. Its recorded import/mock closure is the causal investigation boundary; the independent Recovery 150/150 result does not replace it. **Cold import dependency correction — local evidence, platform acceptance pending.** The actual dependency path `outbound → outbound-buttons → queue → pi` eagerly imports the coding-agent SDK barrel solely for `SettingsManager`, although the adapter otherwise needs only erased SDK types and local context helpers. `createSettingsManager()` is already asynchronous; it now imports that public SDK export at first settings use, retaining the same factory, cwd, normalization and failure propagation. No host-private subpath, replacement provider, cache, Root wiring or timeout changes are introduced. Fresh source/compiled child probes reject any SDK-barrel resolution during adapter/outbound/bindings/Root imports, then require the original refusal at the first settings call. Both probes fail the original eager adapter before readiness. A separate isolated child exercises the installed SDK through both adapters and actual bidirectional enabled-model flush/reload persistence; omitting the native factory fails that proof. The six source/compiled SDK cases covering the new failure, retained-text recurrence and predecessor's partial-retained boundary also pass locally with their original clocks and assertions. This proves removal of an unnecessary cold dependency, not the historical module/CPU/storage cause or changed-head native macOS acceptance. **Changed-head author qualification — pre-test build cap, no full acceptance.** `1aaf93d` has twenty-two consumed actual checkout logs: nineteen successful Validate jobs and all three Recovery jobs identify merge `df394e2a07ae889d1cb165290ec57d7b6196fc9c`, whose tree exactly equals candidate `d1a44c2fab05b536b6ef225e8711408253ac2ec9`. Linux executes all 2496 integration registrations; Windows executes 2486 plus the same ten named skips, and both retain all twenty early-follower waits. All domain jobs pass, including the unconditional cold-import/settings and prerelease guards; dot output supplies no individual numeric case inventory. macOS shards 1–7 execute 2177 passes with no fail/cancel/skip; shard 8's 319 registrations are unobserved. Original Recovery artifacts validate all 150 cases/producers against this merge. Fifteen integration bundles retain 152 startup snapshots and 304 native Root snapshots, each with thirteen exact ordered monotonic phases and unchanged per-bundle filename inventories. They do not prove process closure. An initial observer aggregate of 143 was a mistaken count guess; comparison with exact original bundle inventories proves 147 for fourteen bundles, then five more from macOS 2/8. No product assertion or allocation changed. The final macOS 8/8 job starts at 20:39:50 UTC, publishes `Build distributive` as active from 20:40:54, and settles cancelled at 21:14:50 with the exact annotation `The job has exceeded the maximum execution time of 30m0s`. Last retained API metadata leaves that step active and later typecheck/integration steps pending; metadata did not immediately publish a terminal result at the nominal thirty-minute boundary. The individual log API returns HTTP 404 and a 215-byte `BlobNotFound` XML body both while pending and after cancellation. Its complete run archive contains nineteen job folders and omits macOS 8/8; the fifteen-artifact inventory has no corresponding startup bundle. There is no native checkout witness, compiler child result/signal, integration verdict or progress receipt for this job. `scripts/build-dist.mjs` runs local TypeScript through existing `spawnSync`, then synchronous candidate normalization/copies, syntax check and rollback-safe publication; it performs no package download or SDK runtime startup itself. Without original phase evidence, neither that source inspection nor an operational public Actions status identifies the stalled native operation or runner/CPU/filesystem cause. This cap precedes the last published test stage and must not be relabelled as the earlier SDK startup failure or repaired through a larger clock, unchanged rerun or guessed state reset. The earlier local full-suite attempt also remains an incomplete external tool-cap observation, not a pass. Full exact-head platform acceptance is refused. **Bounded build observation — changed candidate, native service qualification pending.** The existing `scripts/build-dist.mjs` owner captures exact `GITHUB_ACTIONS === "true"` once and emits at most eight body-free `CI native build` notices per invocation: six parent records and two from a public Node `--import` data-URL preload in the original compiler child. Each framed record is bounded to 384 bytes, below 4 KiB in aggregate. A fresh sixteen-hex build identity links parent and child across multiple builds in one job; native PID/PPID and process-local monotonic uptime remain observations, not lifetime or clean-tree authority. A literal detached `.git/HEAD` hash is reported only when positively read; symbolic refs, absent/unreadable metadata stay null, and an API/env head never substitutes for actual checkout proof. Records distinguish build entry, compiler invocation, child Node entry/exit event, original `spawnSync` result, prepared assets and publication invocation/completion. Preload entry is not TypeScript main execution; its exit event is not parent settlement or descendant drain. Publication completion follows successful exact comparison or rollback-safe swap, and precedes final candidate cleanup. Missing records or failed diagnostic writes grant no success/retry inference. No new runner, timer, package download, subprocess supervisor or live runtime mutation is introduced. The same compiler executable/body, original TypeScript arguments and inherited stdio run through the original `spawnSync`, with the additional public Node preload only under the captured CI flag; ordinary builds retain their original compiler argv. Native compiler errors, status/signal and parent error handling stay separate from best-effort observations. Source-native fake-compiler fixtures cover success/check/stale refusal, exit seven, actual native SIGTERM outcome comparison, special-character/Unicode paths, bounded private-field-free records, per-invocation identity and no-CI/uppercase-flag fallback. An original held compiler body already has its Node-entry checkpoint while exit/parent-return/publication remain absent; release must then produce natural parent close within a separate two-second drain guard. Countermodels overriding native code/signal, leaking a private path, reporting premature child exit/publication or retaining the original compiler after release fail the owning guards; restored bytes are verified. The shared invariant suite passes all 51 cases. A real installed TypeScript compiler under Node 22 emits all eight original scoped records, its parent observes `0/null` and publication succeeds; a local symbolic HEAD remains null. This closes the local observability correction only, not three-OS native service/cap durability, attribution of the earlier missing-log cap or full platform/release acceptance. **Native build qualification and corrected fixture inputs — no full acceptance.** `80191a6` finishes eighteen successful Validate jobs/two failures, with no cap cancellation. Twelve consumed actual checkout logs bind nine successful Validate jobs and all three Recovery jobs to merge `5892a1e8755a9bb79e34133a20898249e9442095`, tree `68f47eb65703539e2aa68ed4b7b68cbcc8daeea8`, exactly the candidate tree. Twenty-one original build invocations expose eight ordered records and native compiler `0/null` each; sixty-four three-OS service receipts from five jobs exactly match their original native records, not API list order. Accepted partial integration inventories cover Linux 1871 and macOS 947 passes; macOS 8/8 includes all 319 original registrations and former SDK case 180. Three domain jobs pass, but dot output supplies no individual numeric inventory. Fresh Recovery verifies all 150 actual executions/producers at Node 22. Six integration bundles match original filename inventories and retain fifty pre-teardown startup snapshots/one hundred Roots with thirteen ordered monotonic phases; `closed:false` is not process closure. The full native platform gate remains refused. The Windows domain job's two new build fixtures observe parent native exit `3221226505` after the original compiler exits `0/null`, before `assets-prepared`; ordinary Windows builds in the same candidate succeed. This narrows the fault, but identifies neither the actual crashing filesystem call nor the earlier missing-log cap. Node 22's published directory-copy implementation uses its native directory traversal without a filter and JavaScript traversal with one. The candidate uses public `cpSync(..., { recursive:true, filter:()=>true })` for bundled Skills, retaining every path, file and rollback assertion. A public filesystem-port probe rejects implicit native directory traversal before the correction; the corrected path copies nested Unicode/space/hash/percent assets. Restoring the implicit path or returning false from the filter fails the owning guard. No ASCII-only workaround, skip, Node-version/deadline increase, private native binding or catch-and-retry is introduced. The subsequent `92a9762` Windows domains receipt runs the original 72-file allocation successfully, confirming the corrected fixtures; its dot reporter supplies no per-case numeric inventory. The separate macOS 1/8 failure is `Production Root Restore chooser separates native source ACK from issued menu publication (source/missing)`: its original source is removed once and canonical live-rebind is `finished`/accepted/confirmed, while `menus` and `menuReturned` remain zero at the unchanged wait. No original settings-provider phase was recorded, so its physical delay remains unattributed. This fixture already owns a fake Pi/model registry; its now-explicit settings factory uses the existing normalizer and read-only enabled-model contract, consumes the exact context once, and never persists settings. Actual installed-SDK loading/persistence stays in its separate source/compiled Pi suites. All six Root variants still exercise real chooser/menu/HTTP publication, original warm ACK, held menu, missing/conflicting history and actual teardown assertions. Holding that settings provider for 5.5 seconds reproduces the original five-second menu refusal after source removal/finished rebind; it cannot be relabelled as a source-settlement failure or prove the historical SDK import cost. Waits and public factory behavior are unchanged. The subsequent `92a9762` macOS 1/8 original verdict passes the corrected `source/missing` case at ordinal 265; the separate SDK-root execution failure below still refuses full acceptance. **SDK-root execution partition — local author correction, native acceptance pending.** `92a9762` finishes nineteen successful Validate jobs and one failed macOS 1/8 job, with no cap cancellation; fresh three-OS Recovery verifies 150 actual executions/producers. The failed shard retains all 313 ordered registrations, 312 passes and one failure: `Production question root uses original SDK binding at birth, not ACK (compiled/true/partial-retained/rich=true)`, ordinal 204, expires at the unchanged execution/drain boundary after imports already finish at 646 ms. Original PID-tagged phases show separate app co-head initialization and mutation inside every callback variant's clock, followed by callback initialization/admission near expiry. This is not the earlier startup fault, and it does not establish the underlying native CPU/filesystem cost. The fixture now partitions those independent app co-head assertions into eight explicit Source/compiled × Classic/Threaded × HTML/Rich controls. Every original assertion remains; all 156 original callback variants retain their initial SDK birth/held-ACK checks, the same SDK renewal before callback capture, actual worker/publication/admission/editor paths and teardown, without constructing/mutating the unrelated app first. The controls exercise the real app worker, original SDK co-head admission, SDK-only survival and app-state invalidation, then drain without the separate callback scenario. Parent phase guards reject repeated co-head setup in callback cases, and the existing registration invariant requires all eight control configurations. Restoring repeated setup, dropping Rich controls or omitting actual SDK admission fails the owning boundary; restored bytes match the validated candidate. All 164 Root cases and 51 invariants pass locally. The ordered 2496-registration baseline, including its duplicate title, is retained with eight additional controls; four/eight-way hashing and every startup/execution/drain/enclosing clock stay unchanged. This narrows fixture work, not runtime authority or historic cost attribution; exact changed-head native acceptance remains required. **Follower producer diagnostics — original refusal, not cause attribution.** `98811d2` finishes eighteen successful Validate jobs, one failure and one natural-cap cancellation; three-OS Recovery verifies 150 actual executions/producers. Original Linux has 2504 passes and Windows 2494 plus the same ten named skips. macOS 1/8 and 8/8 pass their former SDK-root regressions. The separate macOS 5/8 `app-mixed-feedback-child-pure-queued-editor-admission/rich=false` follower case, ordinal 202, reaches `two-production-roots-native-carrier-checked` but exceeds the existing twenty-second Node execution/drain bound. That marker precedes `finally`; without original elapsed phases it identifies neither body cost nor a hung shutdown, cleanup or resource. The candidate records at most forty body-free PID/monotonic phase/resource records within 6 KiB across original imports, connect returns, actual publication/editor observations and both shutdown/cleanup returns. One public `getActiveResourcesInfo()` census projects only eight fixed resource types and an `other` count; no path, error, body or resource identity is exposed. Counts and completion markers are observations, not descendant/writer drain or new authority. Parent guards require original phase order, one PID, monotonic clocks, finite enums/keys/counters and bounded output. No readiness option, new timer, runner or runtime API is added; the child remains twenty seconds and parent twenty-five seconds. Fifty-four source/compiled representative cases pass locally. Omitted cleanup and private-field/phase countermodels fail the guards; a deliberately retained post-cleanup timer still fails the original watchdog after both shutdowns and cleanup return, with its finite timeout count observed. Original bytes are restored. This establishes the producer diagnostic boundary only, not the historical native cause, full native acceptance or permission to rerun unchanged healthy inputs as attribution. **Missing-output recurrence — no native execution witness.** The separate `98811d2` macOS 2/8 job starts at 00:09:46 UTC and settles cancelled at 00:44:46 with `The job has exceeded the maximum execution time of 30m0s`. Its last API metadata leaves integration active, but no actual test/compiler issuance or active case follows from that step label. Both pre-terminal and terminal individual log requests return HTTP 404/`BlobNotFound`; bounded live annotations are empty before the final cap annotation. The complete run archive has nineteen jobs and omits this job, and the fifteen-artifact index has no matching startup bundle. No native checkout, compiler outcome, test verdict, progress/body record or CPU/filesystem/runner cause is accepted. Keep this loss separate from the earlier pre-test build cap, ordinary follower test failure and later healthy samples. Build/test notices and follower stdout phases cannot certify severe evidence-loss durability when their original channels are absent. **Original attempt-1 terminal boundary — retained evidence.** `b154dbc` completes nineteen successful Validate jobs and one natural-cap cancellation. Twenty-two original checkout logs bind those nineteen jobs and all three Recovery jobs to merge `62cbd4053636586ca0c613e18957325fbebec071`, whose tree `0e3fce66c5169e5b53e073c46b89bf1dda841e4f` exactly equals the candidate. Linux executes 2504 passes, Windows 2494 plus the ten exact old named skips, and seven macOS shards execute 2190 passes. All domain allocations pass; their dot output supplies no per-case numeric inventory. Fresh Recovery retains 150 actual executions/producers. Forty-one build invocations and 427 service records match original native evidence; fifteen integration bundles retain their full original filename inventories and 150 pre-teardown startup snapshots/300 Roots with thirteen PID-bound monotonic import phases. The follower case passes with its phase/resource guards, but does not attribute the old twenty-second cost or prove descendant/writer drain. The remaining macOS 1/8 job starts at 01:35:39 UTC, settles cancelled at 02:10:39 and carries `The job has exceeded the maximum execution time of 30m0s`. Its last API step remains checkout; both pre-terminal and terminal individual log requests return HTTP 404/`BlobNotFound`. The complete archive contains nineteen jobs and omits this one; the fifteen-artifact inventory has no corresponding bundle. No original native checkout, compiler/test issuance, active test case or runner/network/filesystem cause is established, and the missing 314 verdicts cannot be replaced by another platform or previous head. Existing source diagnostics cannot repair an unobserved checkout-stage job. No additional project change is admitted from this evidence alone: retain the exact candidate and reopen from new original evidence or an explicit operator-approved infrastructure retry exception. No metadata-only CI trigger, unchanged retry-to-green, larger timeout, force cancellation, full native acceptance or release readiness follows. Independent integrated review and operator-live gates remain separate. **One-shot infrastructure retry admission.** The operator subsequently explicitly approves retrying only the cancelled macOS 1/8 job on unchanged `b154dbc`. One job-rerun request returns HTTP 201 at 11:13:23 UTC; attempt 2 starts that job at 11:13:28. GitHub's attempt view allocates new alias IDs to all nineteen retained successes, whose original start/completion timestamps remain identical; those aliases are not new executions or fresh native receipts. Only the target has a new execution start. The exception is spent at issuance, preserves the original cap/missing-evidence record and grants neither further retries nor new runtime/release authority. Admission itself supplies neither the retry's actual original checkout/tree, 314 ordered verdicts nor producer evidence; the prior nineteen receipts and current-head Recovery remain reusable, not substitutes for that result. **Validated `b154dbc` native platform checkpoint.** The approved macOS 1/8 retry completes successfully at 11:23:24 UTC. Its original checkout binds the same merge/tree as the nineteen retained bodies; all 314 ordered registrations pass, including the original `compiled/true/partial-retained/rich=true` SDK case and independent `compiled/false/app-coheads/rich=true` control. Two original build invocations and 22 service receipts match native output. The native uploader binds its attempt-2 artifact ID, whose full filenames match the original shard inventory and whose six startup snapshots retain twelve distinct-pair Roots with thirteen monotonic import checkpoints each. These are pre-teardown observations, not writer drain. The accepted `b154dbc` platform checkpoint is nineteen original successful bodies plus the one explicitly approved retry, not twenty newly executed attempt-2 aliases: all twenty logical Validate jobs are successful, Linux and macOS each execute 2504 passes, and Windows executes 2494 plus the same ten named skips. All domain allocations pass, with no per-case numeric claim from dot output. Across Validate and current-head Recovery, 23 actual checkout logs bind the exact merge/tree, 43 original build invocations and 449 service records match, Recovery retains 150 executions/producers, and sixteen integration bundles retain 156 startup snapshots/312 Roots. No package code, selector, clock or assertion changed for the retry. The original cap and earlier SDK costs remain unattributed. This closes native platform qualification for this exact code candidate only; independent integrated review, operator-loaded live acceptance, custody/writer closure and guarded publication are separate gates. Context-only local edits are not part of the admitted `b154dbc` CI tree, and any subsequent candidate head still needs its own exact-head gate. **Independent integrated review checkpoint.** The `telegram-rc2-independent-integrated-review` Run reviews `b154dbc` against main `40bc9e0` plus the three intentional local context amendments. Three clean-context medium-reasoning reviewers independently cover authority/custody/lifecycle, composed SDK/public interactions, and release/portability/operator safety. All three return bounded APPROVE WITH NOTES with no confirmed blocking code defect; an independent verifier and merger spot-check the cited implementation/fixtures, and the judge preserves qualifications and dissent. The retained substantive references are `execution.json#command-005` through `command-010`; four startup-only preflights are not reviewer votes. The coordinator reads those six actual reports, rather than treating the final normalizer's report-fidelity verdict as a fresh implementation audit. This closes the bounded independent review checkpoint, not exhaustive review of every changed line, historical-cause attribution, live acceptance or original publisher/writer retirement. Same-process exclusion, callback spending, sticky native binding invalidation and post-await shutdown fencing retain only the inspected guarantees. The release workflow verifies exact tag/event/package identity but not approved-main ancestry: the release coordinator must positively bind the approved main merge immediately before issuing the immutable tag. Subsequent implementation changes require affected independent review again; final context/package changes still require their applicable checks and exact-head CI. Operator approval grants permission to act, not evidence that a build was loaded or client behavior accepted. **Follower fixture clock accounting correction.** Final-head `6178a3b` retains a distinct macOS 6/8 failure: 309 ordered verdicts are reported, with 308 passes and one original `app-mixed-feedback-child-pure-mixed-origin/rich=true` child timeout. PID 24131 reaches import-complete at 9944 ms and worker-exit/feedback-release at 19171 ms, but no checks-complete, shutdown or cleanup phase. Two independent diagnostic lenses confirm that required imports, SDK/parent/worker/termination-ACK witnesses share the old twenty-second whole-child timer; they establish neither removable work, settings-factory activity, the operation at expiry nor a native CPU/filesystem cause. The original negative result is preserved, not relabeled fixed by another healthy sample. That review recommended leaving source and fixture unchanged under its fixed-clock mandate; it did not approve the following separate test-policy change. Under the operator's already-granted restriction lift, the coordinator separately changes this fixture to use the existing process-fixture contract: cold imports/mocks have a twenty-second startup bound, the single `follower-carrier-phase:import-complete:` checkpoint arms the original twenty-second execution/drain guard, and a fixed forty-second child total plus forty-five-second outer guard remain. The marker follows actual Root module import and precedes Root construction, connect, SDK admission, callback/worker work and both shutdowns; it grants no Telegram readiness or authority. This explicitly changes the old total/outer test budget rather than claiming unchanged acceptance conditions. Runtime connection, ACK, staleness and dispatch clocks are untouched. An injected seventeen-second cold delay completes the same real authority chain under the separated profile, while restoring the old shared clock rejects it. Missing and premature checkpoints still refuse; a retained interval after real cleanup still expires under the post-import execution guard. Repeated marker output cannot renew that guard. These countermodels establish clock accounting and retained-handle protection, not the old PID's physical performance cause or original-writer closure. **Linux CI allocation correction.** Candidate `e952242` has a distinct original Linux integration 3/4 cancellation under the thirty-minute whole-job cap. Its native log reports 427 ordered passes from the expected 627-registration allocation, no reported assertion failure and no final suite summary; the remaining registrations are not accepted as executed. Initial build and typecheck also occupy substantial elapsed time, but these locations do not identify physical CPU/filesystem cost or the operation active at cancellation. A bounded eight-case Node 22 compile-cache experiment gives 32.870 seconds disabled versus 32.766 seconds enabled, with all eight real source/compiled authority chains passing in both conditions; that negligible local difference does not justify a cache setting or diagnose the original host, so no compile-cache change is retained. The resource-policy correction instead uses the existing SHA-256 eight-way selector for Linux as already used by macOS. Each original four-way bucket is exactly the union of its two eight-way refinements; the cancelled bucket 2/4 becomes 2/8 and 6/8 with 317 and 310 registrations. All 2504 ordered registrations/2503 unique titles, assertions and native per-case semantics remain; Windows keeps four-way allocation and its exact ten platform skips. Validate becomes 24 jobs, rather than 20, without increasing the thirty-minute job cap or changing fixture/runtime clocks, retries, filtering or reporter authority. This is declared CI work allocation, not reduced coverage, a production fix, a claim that the old job completed, or proof of its physical slowdown. A changed candidate needs its own complete native platform gate; the prior head's nineteen successful statuses cannot fill it. **RC.2 development CI acceptance.** Candidate `800699a70d3636fe486aa3deb375204a2a88b683` satisfies the operator's all-green development gate through original attempt-one evidence: all 24 Validate jobs and all three Recovery jobs succeed. Their 27 native checkouts bind merge `d48b3bd37db1227a6986108042dcde3c78a9ec64` to candidate tree `4da009ae90993018781a7ee73dbdfe1e286d5ce2`; 51 build invocations supply 408 build records, with 534 exact native/service records matched overall. Linux and macOS each execute all 2504 ordered integration registrations; Windows executes 2494 passes plus the same ten exact named skips. Domain file allocation remains 72 per platform, including macOS's separate process file; its native dot reporter supplies no numeric per-case inventory. Recovery provides 150 actual executions and 150 original producer artifacts, with native exit zero/null signal and no failed, cancelled or skipped cases. All 20 startup bundles retain exact filename/uploader identity and 156 snapshots/312 Root observations, with distinct paired native PIDs and thirteen ordered PID-bound phases per Root; these are explicitly pre-teardown observations, not original-writer or descendant closure. No retry or earlier-head receipt fills this gate. RC.3 development may now proceed separately while preserving this RC.2 candidate. Historical failure causes, operator-loaded live acceptance, custody/writer closure and merge/main/tag/publication policy remain separate; no release or live mutation follows from green CI alone. Release automation independently classifies a hyphenated version tag as a prerelease: npm uses `next`, and both GitHub create/edit paths explicitly set prerelease true/latest false. Stable tags retain npm latest and GitHub latest. Ownership remains the tag-triggered Release workflow; no manual publisher races it. The guarded release still requires its exact platform, independent and operator acceptance evidence before tagging. **Current evidence and gaps.** Isolated Linux/Node 22 source and actual-dist production-root probes on baseline `69bb079` reset malformed JSON and invalid Workspace/admission state through default connect, then admit a second root through native IPC. They observe one reset, one poller, distinct committed Thread bindings and successful exact-target delivery from both roots. These two roots share an OS process and use fixture HTTP/Pi hooks. Separate native two-process lock races observe one reset and one transport acquisition with natural child exit; they do not establish whole production multi-process startup or live Telegram acceptance. Those probes exposed a named-profile activation gap, now corrected locally: old-profile cleanup previously read damaged JSON before locked startup could reset it. The source/actual-dist `Production connect resets damaged shared runtime state` family now covers default/named activation, malformed JSON/NUL and invalid Workspace/admission; refused-profile/guard controls preserve the original bytes without HTTP. `Production damaged-state profile switch` starts a real old Thread/poller in the disposable host, corrupts only its fixture envelope, then proves one replacement poller after actual old transport drain, a fresh target and no invented old-Thread deletion. These are supplied-hook/fake-HTTP acceptance, not real Pi/Telegram or whole multi-process/Restore/custody continuity. **Warm reconnect after namespace loss (live report, unresolved).** An operator-reported follower cannot reconnect and repeats `Workspace Restore evidence moved backwards or changed without revision`. Its supplied status listed an older 17-binding view; a later bounded read of the selected shared root found a valid version-2 envelope with three Workspace bindings and no Restore snapshot, while the same refusal recurred in recent `follower-register` events. This supports a surviving warm projection versus changed/missing canonical evidence; it does not identify the original cached revision, prove which process owns it, or attribute the earlier disconnect to network failure or directory deletion. A healthy leader or current absent Restore field is not proof that the displaced original work/effects are spent. `observeWorkspaceRestore` deliberately refuses missing/foreign/decreasing or same-revision-conflicting evidence after a snapshot has been observed. Native `Warm relocation evidence cannot be forgotten`, `Workspace relocation evidence cannot be silently overwritten` and final-record ABA cases retain those protections. Valid recreated JSON will not trigger damaged-envelope preflight; ordinary refresh alone cannot bless the old cache against that new observation. Before implementing warm-reconnect recovery, reproduce the actual producer lifetime in a disposable production-root host, distinguish local refresh from remote leader rejection, and establish original source/publication drain and explicit scope authority for any cache retirement/fresh observation. Unconditional cache clearing, fresh flags, equal fields, empty queues, reload or elapsed time must not be treated as recovery proof. Live process maintenance and namespace repair remain separate operator actions. **Refusal attribution (implemented locally, not recovery).** The Threads-owned `TelegramWorkspaceRestoreEvidenceError` retains only a finite `missing-snapshot`/`profile-changed`/`token-changed`/`revision-regressed`/`same-revision-conflict` reason and retained/observed revision numbers; it stores no snapshot, token value, source body or original operation. Existing monotonic checks still refuse without rewriting canonical data, including nonempty and retired empty-operation histories. Polling records `follower-readiness-refresh-refused` with `source: local` before rethrowing the exact local refresh error without delegation. An unexpected matched, protocol-checked negative registration ACK records `follower-register-rejected` with `source: leader`; it retains the original rejection and cleanup. Expected restore-only startup without a remembered Workspace keeps its existing quiet `follower-auto-connect-skip` path instead. Logging failure cannot replace either original failure. **Connection warning (implemented locally).** The existing Status formatter maps the finite Restore diagnostic carried by a local Error or a correlated leader's wrapped failure string to an allowlisted cause and a protective connection warning. Missing history, changed profile/bot identity, regressed revision and same-revision conflict no longer become the generic unavailable-leader warning. Legacy/unknown reasons use safe generic Restore-conflict copy, never raw token, path, owner or unknown reason text; known explicit authentication/network/protocol causes keep their separate notices. The only suggested action is `/telegram-status --debug`. This is presentation, not a new wire/error envelope, reset, retry, takeover, readiness, work-disposition or drain grant. Production-root source/dist cases capture the actual command UI notification for both local and leader refusal, with healthy/no-warning controls and no takeover; notifier-hook assertions are not rendered TUI or operator-loaded acceptance. **Genuinely awaited callback teardown (local corrective witness).** `Production shutdown awaits native button I/O without retiring a successor` runs a production Root in a naturally exiting native child for source/actual-dist and default/named profiles. The real callback store issues its native publication editor while `session_shutdown` clears the original button; fixture HTTP holds that issued edit before its response returns. An observational wrapper delegates the unchanged `waitForPublicationIdle` with no extra gate: it entered but has not returned, the HTTP completion count is zero, and the actual shutdown promise remains unsettled. A positively observed original Root journal binding supplies strict serialized family inspection; the full accepted queued receipt and the actual queue-item object remain protected. Explicit fixture cursor zero avoids mistaking bootstrap backlog exclusion for durable acceptance. The current-generation control releases exactly one original edit, drains the real wait, durably disposes its waiting receipt through ordinary shutdown and stops its poller. The race control invokes actual `session_start` and connect hooks with the same context object and session ID before releasing the edit. Before correction, the late old shutdown entered the successor's composed teardown and cleared its session. Bindings now captures the generation before its first shutdown effect and rechecks it after callback/diagnostic drain, after quit cleanup-preference resolution and before composed teardown after disconnect. The race retains the original exact receipt and original queued object without re-key/replay, preserves the newer generation, one poller and the newly published callback's original authority, and permits a fresh exact-Thread tool send. Restored countermodels omit that generation fence or the original HTTP hold and fail; focused binding models also reject destructive cleanup after a superseded preference read and composed teardown after a superseded disconnect completion. This is actual pending editor/teardown composition, not a delayed return of settled refresh or unrelated SDK HTTP surviving returned reload. It uses supplied Pi hooks and fake HTTP in one native child, not a real SDK reload, independent leader/follower OS processes, real Telegram or warm custody-preserving recovery. The intentionally overlapped start retains an old-generation receipt; fixture cleanup suspends only the native transport rather than manufacturing a new disposition owner. No queue authority is reconstructed, forgotten or made executable by this witness. Synchronous damaged-state reset, other multi-root/profile-switch teardown awaits, follower custody, whole-writer closure and supported-platform/operator-loaded acceptance remain separate gates. The completed integrated author gate below remains failed; these focused witnesses do not replace it. **Bounded recovery diagnostic audit (local).** Existing poller phase/progress, follower readiness/refusal events and `lock`/`state-reset` events remain separate observations, not one derived health state. The Status-owned recorder now preserves finite `guard-unverifiable` reason and acquire/release phase as `errorCode`/`guardReason`/`guardPhase`, native API/IPC authority errors' boolean `requestIssued`, and API `commit-unknown` as `outcome`. Caller details cannot downgrade these original fields. Existing debug rendering and Logging's JSONL append consume that same event; no cause, request body, resource object, transport method or retry authority is copied into the added fields. The command warning distinguishes an unverifiable guard from a network outage even when its private resource path contains network-like prose. An issued authority refusal or native commit-unknown error reports an unconfirmed request and advises against repetition; an unissued authority refusal does not claim an issued effect. Authentication and known ordinary network notices retain their existing paths. Native Error constructors through both config and polling command ports cover all three guard reasons, both guard phases, API/IPC issued/unissued errors and commit-unknown, with exact original-error retention, redaction, one diagnostic event and no second start/stop. These are command-port/recorder witnesses, not actual HTTP/IPC issuance provenance, dead-owner recovery, every remote/wrapped error carrier or operator-loaded acceptance. Startup/backoff producer coverage remains a separate backlog gate. Two restored semantic countermodels remove the issued warning or producer detail forwarding and fail; the pre-fix guard case incorrectly advised network reconnect. The earlier 13,241-test full Linux gate predates these diagnostic/shutdown additions; the later completed integrated gate below remains failed. **Unknown-mode wait/expiry producer evidence (local native).** The existing twenty early-follower cases now retain exact native diagnostic provenance for source/actual-dist, default/named profiles and ready, positive Classic, actual deadline expiry, explicit disconnect and transport-owner replacement. They hold the real leader `getMe` response, keep the follower's one original connect pending and use the unchanged eight-second observation budget; the timeout variants do not inject a clock offset or expiry error, and the existing fifteen-second enclosing case cap is unchanged. One `bus`/`follower-readiness-wait` JSONL event carries the original phase/message/profile. Only the actual deadline produces one `follower-readiness-expired` event with `reason: readiness-deadline`; successful readiness, Classic refusal, disconnect and owner loss must not be mislabeled as expiry. No state-reset event follows. The real registered `telegram-status --debug` command displays the same fresh original event timestamp/category/message/details once while capability is held, and displays the real terminal expiry before the leader response is released. It redacts the token, leaves the entire fake Bot API method trace unchanged and cannot append or renew either event. Late capability/publication and final observation preserve the original wait record and never revive a canceled/expired recipient. Existing exact-target, one-poller, no-takeover and acknowledged-registration delivery assertions remain. A duplicate native wait producer fails `2 !== 1`; omitting only the expiry debug renderer fails `0 !== 1` after the actual deadline while its JSONL evidence remains. Both temporary models restore byte/hash. All twenty cases pass locally, with fresh exact-head platform acceptance still required for these stronger assertions. The bounded recent-event window is not extended to retain diagnostics forever. This is unknown-mode observation in supplied-Pi/fake-HTTP Roots, not every unissued IPC connection-wait/backoff carrier, real Telegram/network causality or a new recovery/issuance grant. **Approved reset producer evidence (local native).** The existing sixteen cold-damage cases now require one exact `lock`/`state-reset` JSONL event after a genuinely returned reset, not merely a matching substring: source/actual-dist, default/named connect and malformed JSON, NUL envelope, invalid Workspace or invalid admission. The real `/telegram-status --debug` command must display that same timestamp/category/message/phase once, redact the configured token and issue no additional Bot API request. Debug followed by healthy explicit reconnect must leave the original reset event unchanged, without a second reset claim. Reset happens before named-profile activation and affects the whole envelope, so its persisted origin profile remains `default`; it is not a claim that the requested named profile was already active. Existing native polling, fresh admission and authorized outbound checks remain. A duplicate successful-reset event and a debug renderer omitting only reset evidence each fail their exact new boundary under the real source Root, with byte/hash restoration. All sixteen cases pass locally. No reset policy or runtime code changes, new health state, accepted-work disposal, independent/platform/live acceptance or whole-writer closure follows. **Selected-status native prune clock (local corrective witness).** The Root variants of `Selected follower status composes real source disposition/menu/render/IPC owners` previously dated a registration at `connectedAtMs: 1` while the real leader used native time and its unchanged one-second prune interval/eight-second staleness limit. A true native first pass removes that already-stale registry row even with a live-process predicate: process presence does not renew registration authority. Holding the existing render promise until that pass reproduces the original `No native API attempt` through a real `follower-pruned` event and the command's original issued-IPC/commit-unknown diagnostic, with zero HTTP attempts. That is not permission to replay the command or treat the issued IPC outcome as unissued HTTP. The fixture now dates its original registration on the leader's native clock rather than the Workspace fixture's frozen clock. All four Root variants wait for the real `afterFollowerPrune` completion before rendering, require the exact original registration including incarnation to survive unchanged and reject a prune event. A five-second observation guard fails a missing completion callback; it neither delays pruning nor expands the existing response, readiness or eight-second registration limit. Native API attempts, original source disposition, recipient/session-loss refusals, ownership, once-only effects and teardown assertions remain. Restoring only the stale birth fails the new registration-survival boundary; byte/hash restoration and all twenty-four composed variants/full command suite pass locally. The original macOS CI log retained only `No native API attempt`, not its prune phase, so the native causal counterexample identifies a concrete fixture defect without inventing that missing historical observation. Fresh exact-head platform acceptance and the separate Linux startup creation-count failure remain open; no runtime policy or recovery authority changed. **Native startup failure observations (local).** The separate-OS startup family now writes into the existing optional recovery-diagnostics artifact directory before teardown. It retains the already-returned connect results, guarded startup/publication snapshots, original Error identity fields, both native child streams/checkpoints and at most two MiB of the existing fixture JSONL; it issues no extra RPC, status command, Bot API probe, state/config/journal dump or recovery effect. Scenario/phase-qualified files are exclusive and redact the fixture token. Connect-return progress is not convergence: a healthy leader may return with one own Thread before its follower's later registration creates the second. The later captured startup assertions still require both distinct acknowledged targets and exactly one poller. An actual native authentication rejection in the fixture's delegating registration observer produces a correlated negative ACK, zero accepted follower ACKs and the unchanged `1 !== 2` creation failure. Its saved native `follower-register-rejected` event attributes that controlled failure, while a supplied secondary cleanup error after actual child close cannot replace the original assertion in TAP or the artifact. The temporary faults are byte/hash restored; this is a diagnostic countermodel, not an explanation of the older Linux CI failure whose original follower snapshots were not saved. Source/actual-dist default/named malformed/invalid-Workspace cases plus Classic, cancellation, held ACK and the actual thirty-second ACK deadline validate the retained capture. Teardown awaits actual child close before deleting its own fixture files, and preserves the primary assertion over diagnostic/cleanup errors. No startup/admission/transport policy or clock changed. Further unchanged healthy local samples cannot establish the old cause; the next genuine native failure must be judged from its original evidence. **Confirmed-dead queued-owner producer (local native).** Four source/actual-dist default/named cases now use separate native Root process lifetimes and the actual journal CAS. A busy donor admits one ordinary source through real polling/admission and owns its complete queued receipt. Public transport disconnect drains its request but retains that same source and owner tuple. While the donor remains alive, a separate native journal recovery call returns protected (`owner-alive` locally; inaccessible birth metadata must remain `owner-unverifiable`) without changing the receipt. Only then does the fixture disconnect its host IPC and observe natural code-zero/no-signal process close without session shutdown; the source remains queued after exit. A fresh native PID/birth liveness read must establish death before the replacement Root starts. This is not an elapsed-time, empty-reference or transport-staleness proof. The replacement selects the original owner-named journal, terminally removes exactly that receipt without inference/replay and emits one existing `inbound-worker`/`dead-queue-owner-cleanup` event with its original receipt ID and removed-source count. The actual registered debug command exposes the same timestamp/message/receipt; healthy reconnect cannot renew that event. No damaged-envelope reset is claimed. A graceful-shutdown substitution fails the source-survival boundary before replacement, and omitting only the native producer event fails after real CAS removal. Both models are byte/hash restored. Successful process paths never force-kill or call `process.exit`; the existing fixture keeps separate ten-second import/start and twenty-second execution/drain bounds per child plus a sixty-five-second enclosing case cap. Teardown waits for actual close before removing fixture files and preserves the primary assertion over cleanup failure. The initial named controls correctly refused a fixture reader incorrectly configured as default; the reader's owning `profileName` option was corrected without relaxing journal identity checks. All four corrected cases pass locally. These fake-Pi/fake-HTTP Root witnesses do not establish actual SDK or follower/legacy whole-writer closure, live acceptance or authority to replay queued work. Transport heartbeat/unresponsive recovery, transaction-guard reclamation and queued-owner death remain different owners and evidence classes. The source/actual-dist `Production warm Restore refusal attributes its original reader` family constructs a retired tombstone through native domain transitions with fixture-owned source settlement. Disposable production roots use real local IPC and fake HTTP to distinguish a warm local reader from a warm leader rejecting a cold reader, while intact-evidence controls register successfully. Refusal adds no Thread creation/deletion, poller or delivery grant and leaves the canonical Workspace unchanged. This is single-process reader/diagnostic acceptance, not whole-root deletion/recreation, an actual dropped registration, a live source ACK, the reported process's original memory or safe namespace rebase. Those original-lifetime and native multi-process gates remain open. **Independent original lifetimes (local native witness).** The private `workspaceRestore` handle also retains its own `observed` history; its missing/decreasing/same-revision checks now use the same body-free error classification without changing refusal ordering or foreign-scope checks. `Private Restore reader retains its original history without a loaded parent projection` exercises that independent reader, rather than borrowing a warm parent's guard. `Production warm namespace loss preserves independent original lifetimes` captures the actual leader-owned consolidated store by wrapping only its factory. Source/actual-dist children host two production roots with native IPC/fake HTTP, unspent or recipient-issued Restore history on an independent dormant binding, a real accepted journal source and an already issued follower publication whose native HTTP response is held. Fault partitions replace the canonical Workspace section, install an entire native-written envelope containing only the exact original transport plus a valid empty Workspace, or synchronously displace the whole shared-runtime directory and install that envelope under a fresh canonical root. These are fixture-owned faults, not recovery writers or copied-owner acquisition permission. In-memory registry and the already-connected issued publication remain separate from canonical storage. Root displacement retains the physical original journal family and envelope in a named fixture directory; the fresh root gets no accepted-family clone. The new connect refuses locally without an envelope reset, and late private Restore continuation cannot write. The independently authorized old HTTP publication can still complete exactly once under its original registration, without republishing either namespace, provisioning, deletion or source disposition. An intact-namespace control admits the original private transition. Strict bounded family inspection and byte hashes cover the retained snapshot and segments; physical inspection of the displaced family is not a replacement source handle, receipt re-keying or writer-closure proof. The fresh canonical family stays absent after late completion and the displaced Workspace remains intact. Native HTTP response and caller both actually drain before completion assertions; an unsettled IPC acknowledgement alone is not the HTTP-hold witness. These are distinct originals, not a fabricated Restore-to-publication/source-ACK join. Private Restore inputs and the surviving transport tuple are fixture-controlled; this family is not producer-requested Restore UI, real recipient/source ACK, queue/worker drain or two OS processes sharing production authority. Its directory-fault installation is synchronous in one isolated child, so it does not prove cross-process directory replacement/exclusion, live missing-directory repair, historical source completeness or supported-platform behavior. It proves why failed connect, missing current bindings, physical source survival or an accepted-journal count cannot certify old publisher/reader retirement. No fresh-observation or cache-forgetting grant follows; actual original-lifetime closure and safe operator action remain open. **Separate OS-root namespace witness (local).** `Production separate OS roots retain original lifetimes across namespace loss` runs the real source/actual-dist composition root in two different Node processes over one isolated agent directory. Each process has its own fake Pi host and HTTP implementation; production leader/follower IPC, storage and process identities are native. Parent IPC only coordinates the fixture. Declared ready PIDs must equal actual child PIDs, and the leader independently observes that follower PID in the real registration envelope. Default/named controls establish one leader poller, no follower poller, one registration and delivery to the acknowledged exact Thread. Native profile-qualified owner keys identify the independent dormant Restore source. The leader process owns an accepted journal input, its private recipient-issued Restore and a native HTTP publication held after the follower's actual API request. Fault modes install a valid full envelope, or physically displace the shared-runtime directory and install that envelope under a fresh canonical root; both retain the original transport tuple and empty Workspace. The other process's reconnect attributes local missing Restore history and cannot issue another registration, provision, delete or take over. Instrumentation counts an actual call to the native original `confirmReady`, not only a supplied missing-history label. That private continuation refuses while the original HTTP request and follower caller drain exactly once. For directory displacement the original logical journal path is never re-opened as an executable source. Bounded native read-only inspection of the physically retained family validates original data; byte hashes additionally protect snapshot and segments, including equal-JSON rewrites. The canonical family remains absent and the displaced original Workspace stays intact. This physical inspection is not a renewed source handle or receipt/namespace re-key. Controls retain ordinary native journal reads. Both roots complete normal teardown, disconnect the fixture IPC channel and exit naturally with code zero—no successful-path force kill or `process.exit`. Startup and post-readiness execution/drain have separate bounds plus a hard total cap. **Damaged-envelope variant and plain API fence (local).** The same OS-root family also corrupts the canonical envelope after the native publication has issued and while the accepted source/private Restore are retained. The follower's explicit connect performs exactly one positively returned native reset. The original journal bytes survive, no source is rebound/replayed/disposed, and the private continuation still refuses missing history. The already-issued physical HTTP request completes once; its caller may receive its actual native Message or a protective authority-loss result, not fresh mutation permission. A separate fresh plaintext tool send must fail with no additional native HTTP effect. This is approved envelope reset alongside independent retained originals, not their drain or a safe warm cache-retirement boundary. That fresh probe exposed a retained-IPC admission gap: an old leader's in-memory follower registry and socket could admit an unmarked API call after durable transport ownership disappeared. `bus-leader` now uses its configured original `captureApiTransport` for ordinary unmarked calls as well as the stronger pre-existing guarded paths. It pins that provider and `callApi` identity, spends observed loss/reentry, clones the wire envelope before adding local callbacks, and carries the guard/issuance marker into native `call`/`callMultipart` options while preserving ordinary options. A configured-but-unavailable authority refuses; an embedder without this optional port retains its legacy behavior. No wire field/capability, registration membership, publication proof or replay permission is invented. Native lock/polling/API unit cases distinguish missing authority, authorization-time loss, last-HTTP-boundary loss, post-issue loss and provider replacement. Restored falsifiers remove capture, drop native options or stop pinning the provider; a production-source falsifier reproduces the fresh-send leak. The expanded local source/actual-dist default/named OS cohort passes 64 cases (including four damaged-envelope cases), excluding the four separately timed silent-ACK cases. Affected-domain validation passes 2244 tests with one platform skip. This runtime change supersedes the former unchanged-runtime full-suite baseline; the corrected frozen-input full run below now covers it locally. These author tests still grant no platform/live or independent acceptance. The next full Linux attempt, `telegram-unmarked-api-linux-full`, ended naturally with native exit 1 (`killed: false`): 13208 tests, 13202 passed, one failed and five platform skips, with all 402 frozen hashes matching. The failure was `source/default/cancel-receiver-threaded` in the fixture's `stats` command: the strict envelope reader detected file identity changing during observation. Startup statistics had read outside the shared writer serializer while the other real process could publish. Fixture statistics now perform one strict read under the artifact-matched native `state.json.transaction` guard; no retry, empty fallback or production-reader relaxation is introduced. A temporary native-writer probe cannot enter during that observation; substituting an unrelated guard makes the probe enter and the test fail. Probe edits are hash-restored. The neighboring namespace witness likewise uses one serialized raw Workspace snapshot for both target and hash, rather than two independently racing reads; it still hashes the whole raw section, not its normalized projection. Separate focused runs pass all 52 startup cases (including the four unchanged native 30-second ACK deadlines) and all 16 namespace-loss/reset cases. These observations identify a fixture read-serialization gap, not failure of the cancellation assertions or proof of the earlier live incident. Production runtime/dist remain identical to the failed full attempt. **Corrected full Linux gate (local).** `telegram-unmarked-api-linux-full-observer`, instance `dad7ad3d-182f-4388-81d4-7dc9d3a772a8`, completed naturally with native/effective exit 0 and `killed: false`: 13208 tests, 13203 passed, zero failures/cancellations and five platform skips, in 3198988.714825 ms. All 402 frozen input hashes matched after completion, before context reconciliation. The recorded complete command stdout is 1475716 bytes, SHA-256 `3a8e9a459b194e7bf5f66e3d21e846419f53fadf67c4158064facc8dbcaeb797`; the separately selected primary text is upstream-clipped and is not the completeness proof. This closes the local full native regression gate for the retained runtime/tests, not safe warm cache retirement, independent review, exact-head platform CI or operator-loaded live acceptance. Context-only reconciliation does not require another unchanged full run. **Held post-reset refresh return (local).** The OS-root namespace family adds source/actual-dist, default/named `refresh-held`, `refresh-cancel` and `refresh-config` variants. For these variants only, the acknowledged follower precedes creation of the independent dormant Restore: it never loaded that later history before reset. The original warm cases keep the opposite order and still refuse missing history. This distinction is not cache clearing, retirement of an observed history or a fabricated healthy refresh. After exactly one native reset, the observer calls the original store refresh once and records its real settlement before delaying return to Bindings. The empty loaded binding projection corroborates that native refresh; skipping delegation fails. Native I/O settlement, held return, a fresh `start` invocation and successful native start remain separate observations. While return is held, a fresh tool send refuses, the separate accepted journal is byte-exact and the already-issued HTTP is still physically pending. Public disconnect or a native equal-value config-object replacement (same selected profile/token) spends the original command; releasing the real refresh result cannot invoke another startup. Without either loss, that same original connect starts successfully with fresh transport authority. The original HTTP completes physically once, with an actual native Message or protective caller uncertainty kept distinct, and no replay. The independent private Restore refuses both before and after late refresh return/startup; it cannot republish the lost namespace. Every observed HTTP issue checks the actual durable owner PID, not the fixture role. This is a new admitted startup versus a spent command, not proof that every old poll/worker/SDK publisher has drained. The first broad fixture run attempted full `stats` reads while its deliberate malformed JSON still awaited reset. The coordinator now observes only native phase counters in that window, then uses strict serialized state reads after positive native refresh settlement; it neither catches parser refusal nor labels counters as storage health. The final family passes 28/28, including 12 new variants and 16 retained controls. Six hash-restored countermodels bypass the return hold, skip the native refresh, omit public cancellation/config replacement, substitute a warm reader as the positive control, or bypass the original HTTP hold; each fails. Runtime/dist remain identical to the corrected full Linux baseline above; these later test/doc additions are separately focused-validated, not retroactively included in that frozen full run. Actual unsettled reset/teardown, current Root producer/source-ACK/SDK closure, safe warm cache retirement, platform and operator-live acceptance remain open. These are real separate processes but still fake hosts/HTTP, a fixture-controlled independent Restore recipient, and a surviving original registration/already-connected request. The leader's directory-fault sequence is synchronous only within that process: these observations do not prove atomic cross-process directory replacement, every peer interleaving or writer-lifetime exclusion. They also do not prove simultaneous/early startup, operator-started Pi/live Telegram, producer-requested Restore/source ACK or queue/worker custody drain. They add no namespace-forgetting or cache-retirement authority; those remain the unresolved warm recovery boundary. **Native legacy producer/source-ACK witness (local).** The `Restore button uses durable relocation at full capacity` cases `history-before-recipient-ack` and `history-after-source-ack` let the actual routing chooser create its operation from the admission worker's original message; they do not call a private `commit` with invented source IDs. Native follower Restore/control and durable admission use real local IPC. One fault removes only the legacy snapshot's Restore history after recipient journal admission while its reply is held; the other removes it after `removeCompletedExact` has co-published the actual source-removal ACK. The latter marker is read through the original native journal binding and matches the original update ID/full-entry SHA-256. Callback processing drain preserves the pending original in the first case and the immutable scoped ACK in the second. The admitted recipient remains separately pending. Its real worker enters a held fixture handler, stays undrained until release, then completes once through native disposal. A subsequent chooser callback still refuses with `missing-snapshot`, retains its own retry-wait source and cannot apply, forward, delete or republish the lost history. These barriers distinguish recipient admission/reply, exact source ACK, callback processing drain and actual recipient-worker drain. Four restored countermodels bypass reply/work holds, forge the ACK's completion scope, or omit the history fault; the foreign scope is rejected by the native journal reader itself. This is a legacy-domain composition with supplied protocol/session authority, standalone storage and a fixture semantic handler, not source/dist production roots, separate processes, real Pi execution or SDK publisher-lifetime closure. The current Root's ownership/local-capability gates prefer live-rebind for a fresh Restore chooser; withholding that port in a test must not masquerade as current Root behavior or attribution of an old live reader. Composing the actual producer's original lifetimes with production-root namespace loss remains open. Even demonstrated source/recipient drain does not exclude other writers/readers or grant cache retirement, namespace forgetting, source re-keying or replay. **Current Root producer and warm ACK (local).** `Production Root Restore chooser separates native source ACK from issued menu publication` drives real source/actual-dist composition roots through native `getUpdates`, a fresh All `/start`, the emitted Restore selector and its actual callback IDs. No legacy capability is withheld and no operation is manually committed. Root's `hasWorkspaceLiveRebindAuthority` selects Routing's live coordinator through the existing Workspace/source/admission ports. The native canonical row is `kind: live-rebind`, with no legacy `operations`, and its source names the actual session-journal binding and original update. The same `workspaceRestore` namespace can therefore hold current live-rebind history; the namespace name alone does not establish a legacy producer or explain the reported live cache. Observers delegate the actual binding resolver's journal and `Updates.inspectTelegramDeferredSourceCompletion`, rather than assuming internal store creation calls an exported factory. Native exact removal is matched to the full entry digest; Routing observes the original carrier's warm ACK with that exact binding/update/digest. This leader `/start` path does not request the legacy caller-scoped durable `completionSha256`: source absence and a copied payload cannot substitute for the warm carrier, and actual worker shutdown revokes its observation. At the same boundary, the canonical live row is already `finished` while one actual menu HTTP request is still held in the restored Thread. Old-target deletion names only the former Thread and there is no LLM prompt. Releasing HTTP completes it once, independently from the earlier source ACK. Neither `finished`, native source removal nor an ended chooser establishes publisher/SDK or filesystem-writer drain. Two new source/dist producer cases and seven retained follower-capability cases pass together (9/9). Four hash-restored falsifiers bypass the HTTP hold, substitute a foreign full-entry digest/binding, or replace the original carrier with its clone. Initial fixture attempts used an intentionally stale All-command timestamp or lacked native menu-host ports; those were corrected, not production routing. The legacy durable-ACK assumption was rejected in favor of the actual warm contract, not emulated. These are isolated single-Root child processes with fake Pi/HTTP, not two live peers, a follower source handoff, real SDK execution, namespace loss during this producer or operator acceptance. Runtime/dist are unchanged from the full Linux baseline; these later tests are separately focused-validated. No cache retirement, re-keying or replay grant follows. **Actual Root history fault after warm ACK (local).** The same producer now covers intact control, missing `workspaceRestore` and valid same-revision conflict in source/actual-dist. The observer captures the exact resolver-produced view used by Root, and the actual Activity publication owner. After native source removal/ACK and canonical `finished`, the real menu HTTP and publication work remain pending. The fixture then removes the shared snapshot, or omits its last live row without changing snapshot revision; both injected Workspace sections pass the native parser. An empty optional live array is not a valid codec instance, so the initial fixture using one was corrected rather than accepting a parser error as same-revision evidence. The original Root view refuses with exact `missing-snapshot` or `same-revision-conflict` before and after the real publication owner's pending observation clears. That reader refusal neither creates nor spends the independent original carrier's warm ACK. The issued HTTP completes once, no menu/source/delete is reissued, and publisher-work drain cannot republish the displaced history. Canonical Workspace stays equal to the injected section; actual worker shutdown then revokes the warm ACK. This captures distinct native source, cached reader, HTTP and publication-work boundaries for one actual producer, not a generic SDK or filesystem-writer drain certificate. All six producer cases plus seven retained follower-capability controls pass together (13/13). Six hash-restored falsifiers replace the injected fault with original data, substitute a fresh read-only cold view for the original reader, clone the warm carrier after loss, republish old history after HTTP, bypass the HTTP hold, or increase the revision instead of preserving the conflict. The cold-reader and higher-revision substitutions specifically fail with a missing expected exception: a new observer or legitimate advancing history is not the original warm conflict. No runtime/dist change or live repair is made. Public reconnect, actual follower/SDK publisher custody and positive closure of every old reader/writer remain open; source ACK plus this one publication-work drain cannot by themselves authorize cache retirement or namespace forgetting. These later focused tests are not part of the earlier frozen full run. **Warm-cutover port assessment.** The inspected Root path has three distinct retained-history layers: the resolver's active view identity, the parent Thread store's `workspaceRestore`, and each private view's `observed` snapshot. Replacing the resolver alone retires none of the other original references. The Thread store's `captureReadScope` is a currentness veto, while guarded `refresh` and `forgetPreviousWorld` still read original history; none is a terminal reader-disposal port. Activity publication counters and Bindings' target-work flags observe admitted work without sealing future admission. Delivery shutdown unbinds its logical runtime, not all issued HTTP; journal-reference release does not revoke store callables. Thus no existing composition of these observations grants a custody-preserving fresh-namespace cutover, and current refusal remains correct. The RC.2 original CI evidence is reused for the unchanged code: six Root producer variants and three real-SDK reload variants pass per platform, without new healthy reruns. The next distinct proof is the current Root follower recipient's original source and brokered menu lifetime under the same history faults, not another leader sample or an unrelated SDK question presented as the Restore publisher. Actual SDK follower custody, terminal original-reader/all-writer closure and the reported live reader's provenance remain separate; no recovery design, cache reset, new capability or runtime behavior is selected here. **Follower witness process boundary.** A temporary extension of that producer fixture put two real Roots in one native child. The second Root registered through native IPC with normal live-rebind capabilities, but its actual delegated lock-reader repeatedly returned `active-here`. `createTelegramBusFollowerRestoreContextGetter` requires `active-elsewhere`, so selected-command preparation refused with `Selected command preparation owner is unavailable.` before source removal, a canonical live-rebind row or menu HTTP issuance. The original input remained pending; no history fault was injected. This is a rejected fixture topology, not a production warm-reconnect failure or permission to weaken the PID/currentness guard. Original native logs and a bounded delegated lock-state observation retain the negative; the temporary test changes were restored byte-for-byte. Registration and negotiated capabilities alone do not establish execution ownership; no synthetic lock/PID, retry, new authority or timeout expansion is introduced. **Separate-OS follower control candidate (unqualified).** The new source/actual-dist `Production separate OS Restore follower separates original ACK from menu publication` cases use the unchanged native OS-root launcher, distinct observed child PIDs and the original follower lock-reader's `active-elsewhere` result. Normal capabilities, actual chooser callbacks and native live-rebind/selected-menu RPC remain enabled. The observer retains the actual `TelegramPreparedHeldCommand` returned through Bindings: its `inspectCompletion()` supplies the original recipient ACK, distinct from the donor inline carrier and from caller-scoped durable completion. Exact original donor/recipient binding/update/digest removals, both retained Restore views, actual brokered menu HTTP and Activity publication work are separately observed. Stop acknowledgements remain separate from natural child close; no history fault or production change is introduced. The isolated source and compiled controls passed, but the later affected-family run failed the source case: 17/18 passed, and after one physical menu return the follower had no pending publication work but retained `publicationUnconfirmed: true`. Both once-only removals and the original recipient ACK remained observed; the shared runtime log recorded `Telegram API sendMessage may have committed before transport failed.` with `menu-render`/`commit-unknown`. The original inner cause and precise issuance/ACK/return timing were not captured, so no deadline, runner, authority-loss or production-recovery cause is established. A temporary delegating selected-menu error observer later passed 18/18 without reproducing that failure; its patch/log are retained and the probe was restored to the candidate hash. This passing probe neither fixes nor attributes the original failure. A subsequent Active Drying candidate moved guarded original-view reads/history serialization out of routine `stats` polling into an explicit inspection phase, without changing production code, ACK/HTTP/uncertainty assertions or clocks. Its focused compiled case passed, but the source case failed before reaching that inspection: the native selected-menu request reached the leader, both source removals and the recipient ACK remained observed, yet the fixture observed zero matching held-menu HTTP entries and publication became unconfirmed. That boundary counter is not a certificate of no other effect or transport issuance. A delegating caller observer installed after the other mocks later passed without reproducing that failure. Neither pass identifies the original cause; delay after issued menu HTTP is not a sufficient explanation for the additional pre-HTTP negative. The refinement and diagnostic probe were restored to the original candidate hash rather than claiming unverified surplus. Inspection of `Threads.workspaceRestore.read` also shows that `listLiveRebindings()` is not a passive sample: it can replace the private `observed` snapshot, then checks the separately retained parent Restore guard; this read does not itself advance the parent projection. Moving or dropping a first read therefore requires original reader-birth/revision characterization, not only equal returned rows in an intact case. Publication pending/unconfirmed states and Bindings' original-port/currentness checks likewise retain distinct lifecycle and reentry guarantees and were kept. The retained fixture now observes selected-menu call/reply/error facts through the existing Bus module/server boundary, without preloading or mocking a new follower module. It delegates the original client options, handler, response and exceptions; sixteen body-free records per child carry exact request correlation, per-child elapsed time and bounded ACK/error facts, not credentials, payloads or new authority. Trace clipping cannot veto transport or replace an original error. Call entry is not physical issuance; an observed server request is distinct evidence. The affected family passes 18/18 before the final ACK-ID projection; the final source/compiled carrier checks then pass 2/2 with the actual ACK request ID separately matched to its originating request. The other sixteen cases are unchanged. Compiled countermodels reject a missing server-reply observation, a foreign correlation ID and a foreign projected ACK ID, without changing the actual native reply. The first source countermodel instead stopped before registration, with an original `follower-readiness-refresh-refused`/`follower-register` runtime-state identity refusal and no selected-menu request; it is not credited as the intended falsifier and does not attribute either historical selected-menu failure. Read-only tracing places that pre-registration error at `Locks.readTelegramRuntimeSource`, after initial private-file validation but before `readFileSync` or JSON parsing: one refusal combines opened-file device/inode identity, link count, regular-file type and private-mode checks. The Root readiness chain is Polling refresh → Threads `refresh`/`loadFromDisk` → consolidated `readRaw` → strict Locks envelope read; the local persistence queue is not a cross-process read transaction. Publishers serialize under `runtime/state.json.transaction` and atomically rename, while this refresh read does not acquire that guard; the fixture's guarded Restore-view inspection does use that exact publisher guard. This establishes a possible overlap mechanism, not which condition failed or which writer acted in the original run. No before/opened metadata was retained, so atomic replacement remains a hypothesis alongside the other rejected physical conditions; it is neither a Restore `missing-snapshot` proof nor reset/retry permission. Blindly locking every kernel read would also need nested-publication/frame analysis, so no generic read wrapper or tolerance is selected. The local diagnostic-only condition projection is now tested with six descriptor/order projections plus an actual guarded same-process atomic publication between native `lstat` and `open`, in source and compiled children; that controlled interleaving is not separate-process Root concurrency or attribution of the original refusal. Focused controls, four affected domain suites and the retained Root family pass locally; actual compiled Status classification also has accepted/rejected controls. Two source reviewers approve the frozen four-file delta with limits, separately from the degraded synthesis-only judgment; platform, loaded-runtime and original-cause gates stay open. Future original negative records, not more unchanged healthy sampling, must settle the remaining cause. No measured performance improvement or recovery fix is claimed. Two source reviewers and a source-inspecting verifier approved the frozen test-only candidate with limits; their raw reports were read separately from the degraded synthesis-only judge/normalizer. That earlier 260-line approval predates consideration of the affected-family failure, does not cover the subsequent IPC-observer delta and cannot qualify the control. A separate frozen 305-line source review now finds no blocking defect in the IPC observations and exact returned-view comparisons: two independent reviewers and a source-inspecting verifier checked the current code and original negatives without executing tests. The coordinator read their primary reports and the downstream reports directly; merger/judge/normalizer remain degraded secondhand syntheses, not additional implementation votes. No corrective code change is required within that scope. Surfaced errors stay delegated, but production can convert an internal exception into a negative ACK before this observer sees it; the trace omits structured native error fields and its child-local clocks do not establish cross-process ordering. This review neither attributes the original failures nor qualifies the intact follower, first private installation, custody, terminal closure or platform/live/release acceptance. The former count-only coverage gap is now addressed by parent assertions comparing both retained views' complete original request (operation, source, binding/owner and target) and recipient, including generation. The destination is fixed to the actual replacement Thread, while recipient kind/instance/session are anchored to the actual registered follower; equal saved generations alone are not fresh registration authority. Source and compiled controls pass; parent-result-only countermodels reject a foreign source binding with unchanged operation/update IDs and a foreign generation with unchanged recipient instance/session. They do not alter native records, journals, ACKs or RPCs. The original child program, observation points and clocks are unchanged. This closes that comparison gap, not reader-birth/revision characterization or intact-control qualification. Three guarded countermodel logs reject a foreign ACK, bypassed HTTP hold and cached post-shutdown ACK; historical mutation/final-digest associations were not independently reconstructed. The first foreign-ACK attempt instead refused a concurrent view read and is not credited as that falsifier. Original negatives remain authoritative. Intact-control qualification and original failure attribution precede follower history faults; SDK custody, terminal reader/all-writer retirement, live provenance and release/platform gates remain open. **Original reader birth/observation assessment (local, read-only).** Root's resolver caches one view per profile/token and the fixture retains that returned object, but view creation performs no snapshot read: private `observed` starts undefined. `read()` clones a valid incoming snapshot into that cursor before checking the separate parent guard, so a later parent refusal is not proof that the private cursor stayed untouched. An absent snapshot leaves that cursor undefined while returning a synthetic empty revision-zero value. Successful legacy/consolidated updates can also install `next` into the cursor; parent history is separately installed by load/publication. A returned operation's revision is not the enclosing Restore revision. Existing list methods perform fresh reads and omit that enclosing revision; scope predicates, compatibility requirements and exact snapshot callbacks do not expose the original cursor's first installation. Publication hooks neither cover first reads nor mark the consolidated post-commit cursor assignment, and Root's resolver supplies no such hook. Raw IO returns can precede later view rejection or be bypassed by the owned publication frame. These inspected ports therefore do not passively certify first installation in the original reader. No extra read, wrapper, getter, callback retrofit or new observer was introduced; such evidence needs its own admissible producer-owned contract before any read-phase drying. This is not a terminal-lifetime proof. **Retained Root store closure assessment (local).** Inspection of `lib/threads.ts` and its actual Root wiring distinguishes the remaining owners; this is not a complete transitive or cross-process writer census: - `captureReadScope` pins selected path/profile/provider and selection-version currentness, not namespace-history validity or writer retirement. Coordinate currentness can survive a missing-history refusal. - Parent `load`/`refresh` and ordinary persistence retain the projection, observed semantic snapshot, Restore history and private persistence queue. Canonical publication captures transport authority and checks semantic/current Restore evidence under the shared transaction. Those guards refuse an incompatible snapshot; neither queue serialization nor refusal certifies that every holder has ended. - `workspaceRestore` views independently retain observed history and their scoped transactional update path. Exact read-only Workspace/live-rebind snapshot helpers and reader-compatibility requirements are observations, not a publication grant or a certificate that other writers stopped. - Session actions, Workspace protection/pruning/cleanup, routing and selected menus, follower target handlers and leader registration, topic/capability synchronization, rename/reset, disconnect and quit preservation retain the parent store through their existing Root ports. Their own original authority and asynchronous lifetimes cannot be collapsed into one Activity publication count. - `persistStatus` uses the separate runtime projection in consolidated storage. Legitimate runtime/status publication can continue without granting canonical Workspace mutation; the shared envelope's continued writing or silence is not Workspace/source retirement evidence. Three temporary native assessment pairs extend the actual source/dist Root producer after its original source ACK and real menu/publication-work drain. First, the retained parent persistence method refuses missing history with the native evidence error and preserves canonical Workspace and the independent warm ACK, although the original coordinate guard still reports current. Second, a deliberately counterfactual restoration of the exact original raw Workspace value makes the same original view readable again; retained parent method references can publish a fixture metadata change under the still-current original transport owner. This is a new ordinary publication with call-time authority capture, not revival of a spent one-shot operation grant. No production path restores that value, repeats an input/delete/menu or gains recovery permission from this experiment. It demonstrates that refusal and publication-work drain did not retire the shared service or all future calls through it. Third, the fixture actually shuts down the original Root before constructing a separate Root with its own store/lock runtime. Native canonical ownership has a distinct instance and leader epoch despite the same PID and session ID. The old store's retained mutation/persistence references then fail on publication authority and cannot change the successor's canonical Workspace; the original worker's warm ACK remains revoked. This supplies a positive owner boundary for that inspected Workspace writer, not a fresh cold reader substituted for the original. It does not certify every journal/SDK publisher or retained accepted-work lifetime, actual public Pi resource reload, follower custody or operator acceptance. Separate-Root reconstruction is therefore a candidate to investigate, not automatic reload behavior or a universal reload recommendation. All three source/dist pairs pass (6/6). Temporary instrumentation is removed byte-for-byte with SHA-256 verification; all 402 predecessor inputs match before context reconciliation. The assessment does not retain a regression contract requiring counterfactual restoration to resume writing. Runtime/dist and retained tests are unchanged, and these probes are not additions to the earlier frozen full run. The next gate is actual public Pi lifecycle composition with accepted-work custody and remaining writer/publisher closure, not an in-place cache clear or a proxy that silently selects new authority for old callers. **Public Pi reload and waiting custody (local).** `Real Pi SDK reload disposes waiting custody without replay` uses an actual `AgentSession`, `DefaultResourceLoader` and compiled Root with the existing local canned provider and fake HTTP. A held native tool keeps three later Telegram inputs waiting: two prompts and a pressed prompt button. Read-only family inspection under the original journal serializer observes their actual queued owner/receipt records. The tool finishes normally; the documented `agent_settled` command-dispatch path then enters a command with SDK idle and no Pi pending messages, while all three Root sources are still queued. That command calls public `ctx.reload()` through the actual SDK reload action, not manually emitted replacement events. The existing Root shutdown durably disposes all three waiting groups before the post-shutdown observer runs; only then does resource loading construct the second Root. Native lifecycle order is old shutdown, new `session_start` with `reason: reload`, then continuation of the old command call frame. The Pi session ID is unchanged, but the old command's guarded SDK getter refuses. Reconnection and actual watchdog waits produce no replay or user-history entries for the disposed work. SDK idle/no pending messages therefore does not certify that accepted Telegram custody has ended. The four retained held-tool/compaction cases plus this reload case pass together (5/5). Three hash-restored falsifiers replace public reload with a manual shutdown event, bypass actual waiting-input admission, or omit durable queue disposition while retaining the memory clear. They respectively fail old-context invalidation, genuine queued-source observations or the post-shutdown source check. The compiled countermodel is restored exactly; retained runtime/dist are unchanged. This test protects documented ordinary reload semantics, not an automatic recovery permission. Unmodified public reload is rejected as a custody-preserving warm-reconnect mechanism when accepted work waits; its operator-controlled role and README queue-loss warning are unchanged. This default-profile fixture does not inject Workspace history loss, cover follower custody or certify all SDK/source/filesystem writers. Held native teardown/publication completion and a separately justified custody-preserving cutover remain open; a new cold Root alone cannot supply them. These focused checks are not part of the earlier frozen full run. **Issued SDK question spanning reload (local).** The SDK family additionally opens a producer-owned Confirm through the public API to the paired private chat and holds its actual first HTTP response. Actual public reload still returns and the second Root starts while that HTTP remains pending. The original opening result is already `invalidated`, the old SDK context is stale, and ordinary shutdown has disposed the three waiting receipt groups. This distinguishes logical SDK invalidation, Root teardown return and physical issued I/O; it does not make ordinary reload custody-preserving or certify that every original publisher/file writer ended. The new Root publishes a fresh question with the same producer identity and target while the old HTTP remains held. Returning the old response once and delivering its original callback cannot settle the fresh question, re-enter model admission or acquire new cleanup transport. Only the fresh question's own exact callback confirms it. Two actual watchdog intervals still show one old issuance/return, zero old-message cleanup API calls and no queued-input replay. The observed HTTP return is not a broader publisher-drain certificate. All six real-SDK cases pass together. The fixture now supplies positive `has_topics_enabled: false` evidence: initial attempts without it were correctly refused by the native SDK target policy, and no runtime authorization was weakened to force issuance. Three additional hash-restored falsifiers bypass the HTTP hold, substitute the fresh callback and message for the old pair, or omit native question invalidation during shutdown. They fail the physical-pending observation, independent fresh result or bounded logical completion. Runtime/dist are restored and unchanged; this is a focused default/Classic public-SDK witness, not missing-history recovery, a follower handoff or live acceptance. Genuinely outstanding inbound-worker/source teardown and a custody-preserving cutover remain separate gates. **Cross-Root inbound replay and execution exclusion (local correction, integrated acceptance pending).** The original counterexample used a temporary extension of the real-SDK fixture with an ordinary public update handler per resource birth and normal shutdown unregistration. After three earlier inputs acquired queued receipts, one further authorized input remained durably pending while its first handler awaited a fixture gate. Actual public reload aborted that execution's fence and returned without the handler settling. The post-old-Root shutdown observer still saw the pending source. Before the original handler returned, the new Root invoked its own handler for the same entry and consumed it: resource and handler births were `[1, 2]`, original return count was zero, and the canonical pending entry then disappeared. Both invocations observed the identical complete entry digest and exact payload. Fake `getUpdates` delivered the input only once; no retry command, copied completion ACK or direct registry dispatch supplied the second call. The original explicit nonconcurrency assertion failed natively with `[1, 2]` instead of `[1]`. The worker-local unsettled-execution index protected replacement generations of that object, but not a reconstructed Root's new worker. `stop()` aborted and awaited its drain race, not every actual handler settlement. The original execution remained correctly aborted/not-current; no old-authority resurrection was demonstrated. The handler was a pure delayed consumer, proving concurrent invocation rather than two real external effects or a live incident's cause. The original RED overlay/output remain isolated evidence. The Updates-owned correction adds a private same-process index over the exact native journal binding and update ID. It references the actual unsettled execution promises, not their cancellation races, and survives participating source/compiled module copies and Root reconstruction. The original binding reader, owner scope and update ID are retained before delegation; claim cleanup and late diagnostics never reread a handler-mutated DTO identity. Opaque legacy labels stay worker-local instead of joining unrelated sources by ID. This is only an additional veto: neither an index entry nor its absence grants custody, readiness, source completeness, replay or namespace retirement. Unknown private index shapes refuse rather than resetting evidence. Actual settlement alone removes the corresponding claim and empty source bucket; stop and elapsed time cannot do so. Waiters race their own cancellation without releasing another worker's claim. A final synchronous check/register closes competing snapshots after asynchronous preparation; a new claim invalidates the old entry snapshot before any delegate runs. Expiry and prepared-live-source checks observe the same exclusion. The promoted public-SDK reproducer now retains source 5 as pending, admits only the first handler while it is unsettled, and permits the successor's handler/settlement only after actual original completion. Original authority stays spent. Domain controls cover late success/failure, canceled waiter then another successor, independent profile/bot/journal namespaces, source/compiled copies, handler mutation of `update_id`, claim cleanup and the asynchronous-preparation race. That fixture uses a scheduler matching its bounded observer rather than racing a zero-delay timer against a fixed immediate-tick budget; production scheduling/deadlines are unchanged. Four hash-restored falsifiers remove shared lookup, cancellation racing, full namespace qualification or final atomic recheck; a fifth restores DTO-based cleanup and fails both mutated success/error controls. The first completed corrected-runtime full Node 22 run naturally exited 1: 13,234 tests, 13,223 pass, six fail and five platform skips; all 402 frozen input hashes matched. All six failures belonged to `Follower registration fences native binding readiness`, whose fixture incorrectly depended on a waiting worker's stop blocking until another generation's actual handler settled. The focused family reproduced that obsolete assumption; it was not resolved by weakening production cancellation/readiness fences. The preceding canceled attempt supplies no completed gate. The readiness fixture now awaits actual native binding preparation and independently holds its callback return while the old handler remains unsettled. Native forwarded packets refuse before callback completion; fresh readiness is granted only after success, while context loss and preparation failure retain refusal and original journal bytes. Registration can complete for the distinct new binding without borrowing old-handler completion, and the aborted handler cannot settle its retained source later. All six focused outcomes pass. Three hash-restored falsifiers remove the readiness await, skip actual native binding preparation or bypass the callback hold; they fail actual forwarding refusal or the native binding observation. Production readiness fences and worker cancellation policy are unchanged. This is a callback-readiness witness, not proof of an unsettled teardown/reset or whole-source writer closure. After the fixture correction, the complete Linux Node 22 suite passed: 13,234 tests, 13,229 pass, zero failures/cancellations and five platform skips, with natural native/effective exit 0 and `killed: false`. Run `telegram-source-exclusion-linux-full-corrected` (instance `e1814737-dbcd-439f-941e-3099a285b03e`) ran from 2026-11-09T15:55:17.248Z to 16:51:55.365Z. All 402 frozen inputs matched before context reconciliation. The complete saved stdout is 1,479,551 bytes, SHA-256 `f8b65b6a8de502d6bd191f02a7f97ded08b478cea2c0bb051b623aa5af96f7c6`; the clipped Actor packet is not completeness evidence. The readiness-related native family also passed 36/36. This supplies fresh author Linux full-suite evidence for the retained runtime/test correction, including the public-SDK and source/compiled exclusion regressions. The correction remains local, not a release-ready or lossless warm-reconnect claim. Independent review, exact-current-head package/platform CI and separately operator-authorized loaded acceptance remain required. Capturing the original ID has retained mutated success/error regressions. Existing ordinary reload still disposes waiting queue receipts. Unparticipating legacy builds, separate OS processes, whole-writer closure and actual preservation of accepted custody remain independent gates. **Source-owner reference and callable lifetime assessment (local).** Two isolated source/actual-compiled probes compose the real journal binding resolver, source serializer, reference registry and admission lifecycle through the same reference port used by Root. A native handler holds pending source 5. The live lifecycle owns a positive `leader-lifecycle` reference. After `onSessionShutdown()` returns, that census is empty and the original signal is aborted, while the original worker still has one actual unsettled execution and source-qualified exclusion remains held. The original journal object's retained `read` method still returns that pending source. After actual handler settlement, exclusion clears but the source remains pending and the same original reader is still callable; the canceled handler has not completed/discarded it. All isolated source-family byte hashes remain unchanged at both checkpoints. Three false-closure claims fail natively: empty references imply actual settlement, stop revokes the retained reader, and an empty execution index certifies empty durable work. These standalone domain-owner probes are negative witnesses, not positive writer exclusion or a new normal unleased-read contract. They deliberately invoke retained low-level readers to test callability; production retained observations must still use their existing scoped references. No post-stop writer is issued or source rebased. The registry accounts participating leases rather than closing native store objects; the execution index excludes actual calls rather than certifying source completeness. That assessment restored temporary instrumentation byte-for-byte with all 402 predecessor hashes matching and retained no regression requiring unrevoked readers. **Root reference-port correction (local).** Follow-up clarified the unsuccessful SDK observation: the actual Root factory was observed, but its configured binding-acquisition callback was never called. `createTelegramUpdateAdmissionRuntimeAssembly` accepted `acquireSourceReference` yet omitted it when constructing the lower lifecycle assembly. Thus Root's explicit reference wiring did not reach leader/follower worker lifecycles. The correction forwards that existing optional port unchanged; it adds no registry, public API, authority or blocking drain. New leader/follower facade regressions first fail under the omission, then verify that refused reference admission prevents worker source I/O/construction, a successful lease covers actual execution, and native lifecycle stop releases its own lease. Binding-preparation hooks retain their separately owned admission contracts. **Actual public-SDK source lifetime composition (local).** With forwarding restored, observers delegate the actual compiled Root factories, registry and source acquisition during the existing real-SDK public reload fixture. Root 1 holds a positive `leader-lifecycle` reference before reload while source 5's original handler waits. After its shutdown and after Root 2 starts, the original registry is empty, its execution fence is aborted/not-current and the original handler has not returned; source-qualified exclusion still protects the pending source. Root 2 owns its own positive lease and a different store object for the same binding. The exact captured Root 1 reader remains callable and preserves source-family bytes at each healthy read. After actual old-handler settlement, Root 2 consumes source 5 under its own current execution; the old reader then sees the updated canonical empty file, not an old-owner settlement or renewed custody grant. Ordinary reload still disposes the three waiting receipt groups, so this is not lossless recovery. Omitting only the forwarding in the compiled facade reproduces the missing actual binding observation; substituting Root 2's object for the original reader observation also fails even though binding keys match. Both countermodels and the temporary SDK instrumentation are restored with SHA-256 checks. Only the narrow forwarding fix and facade regressions remain in runtime/tests; no test requires the current retained-reader behavior or installs a new production observation surface. The affected Updates/Journal/Polling/Lifecycle family passes 1,248/1,248, and 46 selected SDK/Root/readiness/live-rebind cases pass together. Typecheck, synchronized build/build-check, package import, offline pack, Domain DAG and context validation pass locally. The 13,229-pass full baseline above predates this forwarding correction and does not cover it. The subsequent full run `telegram-root-reference-forwarding-linux-full` (instance `82b014f5-b7ab-4adb-80b9-832b46593997`) naturally exited 1, without being killed: 13,236 tests, 13,226 pass, five fail and five platform skips. Its complete stdout is 1,484,726 bytes, SHA-256 `1aefe9faf87ba56d45c537091ece4bb3ec8564502eaf3f7866a010d660ad6de6`. Failures comprise two child SIGKILL exits, one held plaintext caller rejection after root displacement and two registration-child exit deadlines; one of the latter already printed its semantic-pass marker. That failed run supplies no green gate; the later corrected candidate's complete evidence is recorded below, not inherited from focused reruns. Default/Classic leader SDK evidence does not certify actual follower source ownership, irrevocable original-caller retirement or fenced use, genuinely outstanding teardown/I/O or whole-writer closure. Neither census can authorize clearing Restore history, changing namespaces or forgetting accepted custody. **Failure attribution boundary (local).** The OS-root fixture's close path could replace its first deadline failure with a generic `closed … SIGKILL` error during cleanup. A native child control reproduces that loss; the fixture now retains the exact first Error through close. PID-correlated diagnostic checkpoints neither acknowledge readiness nor renew its unchanged startup, execution/drain or total bounds. Registration-child markers record native-process timing and public active-resource types after semantic completion; a marker alone is not a positive natural-exit or post-readiness drain proof. Root-loss assertion failures now include the original held-caller error without admitting a new error outcome. All five original failures pass in one isolated selection, but a later seven-case diagnostic selection still fails two cases: source/default early Threaded startup expires at `root-import`, and source/work protocol refusal reaches the entry marker but not semantic completion before its exit deadline. Thus at least one current startup refusal precedes return of the actual Root import; it is not evidence that registration or source-reference admission began. Neither observation attributes the historical failures or establishes a production fix. The narrow first-failure control passes in both selections. At that diagnostic checkpoint, runtime authority/cancellation policy, source bytes and delivery assertions remain unchanged; the failed run supplies no completed acceptance. The registration fixture had applied its 15-second `execution/drain` bound to the entire child, including module loading and Root initialization. It now uses the existing node-eval readiness contract: both real Roots must finish `session_start` with no polling, provisioning, leader startup or registration before the `contexts-ready` checkpoint. Fixture startup is bounded by 10 seconds; the existing 15-second execution/natural-exit bound starts only at that checkpoint, with a separate 25-second child total cap and 30-second enclosing test cap. The whole-process allowance changes explicitly; production readiness/ACK clocks and CI job budgets do not. Additional phase markers never renew readiness or grant Telegram authority. Three source/actual-compiled default/named native observations reach actual command completion and both shutdown returns before natural exit. A hash-restored missing-checkpoint model refuses a naturally exiting child even after its semantic-pass marker. A second model retains only the fixture's referenced interval: native startup reaches `contexts-ready` at about 3.8 seconds and the process still fails its execution/drain guard at about 18.8 seconds, rather than spending another startup allowance. Public resource evidence includes that injected `Timeout`; it is not a production leak diagnosis. The retained three-case selection and both existing node-eval readiness invariants pass 5/5. The complete corrected source/actual-compiled, default/named registration family and those invariants then pass 102/102, without failures, skips or cancellation, under run `telegram-registration-readiness-gate` (instance `82ae76f1-45c5-4beb-ad76-24957eb2758d`); its test command naturally exits 0, `killed: false`, and all 402 frozen inputs match. Typecheck, build, build-check and diff checks also exit 0. That Run's separate context command prints zero errors/369 warnings but is killed at its 180-second outer limit, so its output alone is not a clean-exit gate. The same validator on the explicit Node 22 test baseline subsequently exits naturally 0 with the same counts; the prior termination remains unattributed, not relabeled success or proof of a Node-version cause. These controls establish fixture budget composition, not the causes of all five historical failures, a green full gate or warm recovery. **Held plaintext call attribution (local, unresolved).** A temporary observer delegates the actual Root follower-client factory and records native registration captures without replacing the captured objects or methods. Both compiled/named controls capture a current registration scope, but the proposed association with a registration-marked held request fails natively. A separate actual-server observer then sees `follower.callApi` with method `call`, exactly two arguments, no single-attempt/retry-safety options and no API registration incarnation. This holds for source/default and actual-compiled/named, with intact state or a displaced root; all four controls still require and receive the original successful Message and retain the existing once-only HTTP, exact-target and accepted-family-byte checks. Both temporary overlays are restored byte-for-byte, with all 402 predecessor hashes matching. No regression freezes the current unmarked ABI or treats a captured registration scope as post-response execution proof. The pre-publication registration capture alone cannot attribute the historical held-caller rejection or justify allowing arbitrary errors after root loss. The broker's original transport veto and HTTP issuance/unknown outcome remain separate from follower membership, copied transport fields and surviving accepted bytes. **Actual unmarked transport witness (local fixture correction).** A request-local observer delegates Root's actual leader assembly, transport capture and direct API call. It records only real evaluations of the returned original native predicate, rather than polling that predicate or substituting another registration/store. The delegated assembly loads after the transport mocks, preserving the actual server observation. Before HTTP return, the held request has exactly one capture and positive original checks. An intact control then returns its native Message under a positive predicate and correlated positive ACK. Neither physical root displacement nor a copied transport record itself grants that predicate's future validity. A separate `root/ownership-read-refusal` case injects one error through the original Locked Polling dependency's ownership-read port during the actual post-response guard check. It does not replace the predicate after capture, force transport takeover or alter runtime files to manufacture new authority. HTTP physically completes once; the actual native predicate becomes false, the direct API throws its own `TelegramApiAuthorityError` with `requestIssued: true`, and the original correlated negative ACK reaches the caller. The former unconditional root-loss success assertion fails natively on this protective outcome. This is an injected ownership-observation fault, not a reproduced filesystem cause of the historical failure. That original root-loss refusal correction admitted an error through the original false post-HTTP predicate, native issued-authority error and exact correlated negative ACK. The later issued-IPC-loss witness below adds its separately proven native commit-unknown outcome, not an arbitrary error allowance. Other errors still fail, while the intact/success path requires native return and positive original checks. The injected case additionally requires exactly one consumed read fault and refusal of a fresh send without HTTP. Existing exact-target, one-issued/one-completed HTTP, no extra polling/provisioning/deletion/reset, unchanged namespace and accepted-family-byte assertions remain. Source/actual-compiled default/named selected cases pass 6/6 and typecheck passes. The complete namespace family subsequently passes 32/32 with natural native/effective exit 0, no failures, skips or cancellations and `killed: false` under run `telegram-held-transport-gate` (instance `fb5ae006-c4f9-4082-9861-2ba9c1b77892`). Build/build-check, explicit Node 22 context validation and diff checks also naturally exit 0; all 402 frozen inputs match. Context reports zero errors/369 warnings and still skips link/list scanning of this large architecture document. The full native gate below validates the corrected candidate without attributing the older failures by inference. Two hash-restored runtime falsifiers omit either the configured broker transport capture or the API's actual post-response authority check; they fail original-capture or consumed-read-fault observations. No runtime/dist change, wire capability, retry policy, timer change or arbitrary root-loss error allowance is retained. The historical full-run cause and warm source/writer closure remain unproved. **Complete pre-diagnostics/shutdown candidate Linux gate (local).** Run `telegram-self-healing-corrected-boundaries-linux-full` (instance `747d2175-9e5b-47bb-a1cd-2f96feac1326`) completes the entire Node 22 suite with concurrency 4: 13,241 tests, 13,236 pass, zero failures/cancellations and five skips. It runs from 2026-11-09T23:06:20.378Z to 2026-11-10T00:07:37.369Z with natural native/effective exit 0 and `killed: false`. All 402 frozen input hashes match before context reconciliation. Complete saved stdout is 1,480,884 bytes, SHA-256 `9ca14b955bd10c04069e063c94204acb495c5365325d39b5f6de6bf772df1fef`; neither the clipped/redacted completion packet nor the earlier failed run supplies that completeness proof. This closes the author Linux full gate for that execution-exclusion/reference-forwarding candidate and corrected fixture boundaries, not the later diagnostics/shutdown additions. It does not establish the causes of the prior five failures, independent review, exact-current-head package/platform CI or operator-loaded live acceptance. Warm custody-preserving reconnect, original source-callable/writer retirement and other unsettled reset/teardown compositions remain open beyond the callback-editor witness above; ordinary reload still disposes waiting queue receipts. Package version and live runtime are unchanged. **Integrated diagnostics/shutdown Linux gate (completed, failed).** Run `telegram-rc2-awaited-teardown-linux-full` (instance `05ad72c2-3fe3-47c7-bb41-13cac63c7c95`) runs the entire Node 22 suite with concurrency 4 from 2026-11-10T00:52:50.714Z to 2026-11-10T01:54:47.471Z: 13,251 tests, 13,245 pass, one failure, five skips and zero cancellations. Native/effective exit is 1 with `killed: false`; all 402 frozen input hashes match. Complete saved stdout is 1,482,707 bytes, SHA-256 `a94a1b5466ce36ef5882693af19cf8d6354d08dfb46354f0d8b5e051d60a017c`; native stderr is empty. The eight new source/dist default/named callback-teardown cases and diagnostic regressions pass within this full run, but that does not make the full gate green. The sole failure is `Production separate OS roots retain original lifetimes across namespace loss (compiled/work/damaged/refresh-cancel)`: initial follower-connect stats have no canonical Workspace target, before the fixture prepares its retained history, damages state or issues cancellation. This observation does not establish a negative ACK, its reason or a reset/cancellation defect. The original assertion omitted the returned stats, and those notices/start-result observations are not retained in the failure capture; its historical cause remains unattributed. The assertion now includes its exact initial-connect stage and returned fixture stats without relaxing the target requirement or changing production behavior. A single isolated diagnostic cohort passes all four source/dist default/named cancel variants and an intact compiled/named control (5/5); this neither attributes the failure nor closes the gate. No unchanged full retry is treated as corrective evidence. Remaining acceptance requires attributable original producer/ACK/currentness evidence and a genuinely validated correction, rather than inferring cause from later success. **Bounded CI attribution (candidate preparation).** The unpublished `0.59.0-rc.2` candidate adds `Recovery diagnostics` alongside the ordinary validation workflow. Each Linux/Windows/macOS job observes ten fresh-process cohorts with four source/dist default/named `damaged/refresh-cancel` cases and an intact compiled/named control. `scripts/run-recovery-diagnostics.mjs` requires all five cases to pass in every cohort; missing/skipped coverage, native launch failure, signal or nonzero exit keeps the entire job red even after later passes. The bounded series investigates reproducibility; it is not retry-until-green or an attribution of the earlier failure. Each invocation owns a new evidence directory and refuses to overwrite another summary. The native parent fixture retains both child streams, checkpoints and first failures. Its actual leader registration-handler observer records only returned correlated ACK fields, without issuing another request or manufacturing a negative ACK from absence. Before fixture teardown, the optional `PI_TELEGRAM_RECOVERY_DIAGNOSTICS_DIR` test-only sink saves the stage, original initial-connect observations, bounded existing runtime log and both child observations, redacting the fixed fixture token. It copies neither config nor state/journal bodies and grants no runtime authority. Primary assertion failure survives secondary artifact/cleanup failure. Ordinary integration CI and the focused workflow upload this evidence on both success and failure. Local sampler contracts reject later-success masking and missing coverage; a two-cohort native probe passes ten cases with retained distinct process identities and correlated positive registration replies. Those observations are preparation for exact-head CI, not a fix attribution, platform acceptance or release permission. A native failure model removes only the returned target projection after a real positive registration ACK and adds a secondary cleanup failure; the saved evidence retains the original initial-connect assertion and correlated ACK without the cleanup replacing it. This validates evidence retention, not the historical cause. Native healthy-close regression also exposed and corrected a diagnostic-only harness bug: successful exit 0 must not manufacture a first failure; the original deadline failure still survives failed close exactly. **First platform CI attribution (not acceptance).** The focused series for candidate `a9f781b` completes 30 cohorts/150 cases across Linux, Windows and macOS with native exit 0 and no signals. Its synthetic merge checkout and candidate have the same Git tree; this does not attribute the earlier initial-target failure. Ordinary Windows validation instead records a real `listen EADDRINUSE` during `source/work/damaged/refresh-held`, after successful initial registration: the original process still holds its named-pipe listener. The fixture retained its prior successful `lastStartOk` when the later start threw; that stale observation and a prepared target are not a successful new connection. The restarting process issues zero polling requests. Original listener quiescence or an exact attributable protective refusal remains to be established, without granting warm cutover or discarding accepted work. A macOS integration shard reaches the configured 30-minute job boundary with three unnamed dot-reporter failures and no terminal suite result; it is not a passing gate. Integration CI now emits native TAP failure details as each test settles, before a later test or job deadline can hide them. Its regression holds a later native test, requires the original failure details before release, then requires natural exit 1 without a signal or kill. Artifact terminal snapshots retain already-returned reconnect/inspect/stats results, without another request or new recovery authority. Complete current-head platform validation and underlying failure corrections remain open. The follow-up candidate `94f5883` passes the corrected release invariants and native pending-start fixture in all four domain jobs across the three platforms, but is still not accepted. Its complete macOS recovery series retains 16 startup failures in eight cohorts out of ten, with natural native exit 1 and no signals; the final two passing cohorts do not erase them. The original failure checkpoints are eleven `static-imports-complete`, four `root-import-complete` and one `root-import` expiries, before the first fixture connect, not a negative registration ACK or post-damage failure. Their underlying startup cost/boundary remains to be diagnosed without enlarging production readiness clocks. All four Windows source/dist default/named held-refresh controls also fail their post-reset polling requirement. These observations stay distinct from the historical missing initial target and from each other; later successful observations establish neither cause nor correction. **Occupied listener and fixture-bootstrap correction (local).** The original owner detects definitive ownership loss on its existing one-second watcher, aborts/drains transport and closes its native listener. A Windows restart may otherwise bind the canonical pipe before that closure. `bus` now applies the existing two-second local endpoint-drain ceiling to a reachable previous pipe, as well as a legacy Unix socket, before consulting publication authority. The clock is monotonic and captured once, and original startup guards fence every probe/wait. Reachability is only a veto, never ownership or publication authority: an unreleased listener times out protectively and remains untouched, while a later bind race still fails without replay. No listener is deleted or forcibly closed, no publication grant repeats and registration/ACK clocks are unchanged. Native source/dist controls cover actual retirement, cancellation, replacement, caller loss and persistent occupancy; omitting the wait fails at publication while the original listener is still live. Namespace-loss witnesses now await the leader's actual native readiness before launching the follower module bootstrap; they require two live roots before connect, not simultaneous module imports. The separate synchronized-startup matrix is unchanged. Native launch/readiness ordinals prove the admission order without renewing any startup/execution/drain watchdog. An early-follower model fails that causal boundary, and a leader-bootstrap failure retains the original error with an explicitly unstarted follower. Per-attempt fixture start observations clear the prior result before awaiting a new call; a throwing restart cannot retain the earlier success. Local affected validation passes 2,498 tests with one skip, plus 94 native namespace/startup/teardown cases (excluding the four unchanged real 30-second silent-ACK cases). Countermodels are restored byte-for-byte. Physical Windows/macOS and complete exact-head CI acceptance remain open; these corrections neither attribute the historical missing initial target nor establish custody-preserving warm reconnect or whole-writer closure. **Subsequent platform observation, not whole-matrix acceptance.** Candidate `9e43541` passes all 36 Windows namespace-loss cases, including all four held-refresh controls, and its Windows native occupied-endpoint probes/domain suite. The macOS recovery series passes all 50 cases and three integration shards pass; the remaining shard's storage-reference alias fixture reaches its five-second child bound without a terminal result. Windows instead retains one cold startup expiry before first connect in the focused series and separate cached-forwarding/held-connect observer failures in ordinary integration. Those failures stay red; lifecycle endpoint probes must not be confused with semantic request attempts. Native fixture diagnostics now retain at most 16 PID-bound phase/elapsed observations and distinguish Root construction from `session_start`, without acknowledging readiness or renewing a watchdog. Full current-head validation, the storage-reference/observer boundaries and historical initial-target attribution remain open. **Semantic observer and alias-fixture boundaries (local correction).** The new Windows endpoint occupancy probe is a transport lifecycle connection, not a guarded forwarding request. Cached-forwarding and held-connect fixtures now arm interception only after actual receiver/server startup and a positive native probe. The probe must use exactly one additional lifecycle connection without any semantic ownership check, write, issuance or receipt; all later three-attempt forwarding and one-socket held-request assertions remain unchanged. Explicit native-probe regressions reproduce both formerly global-observer failures on Linux, and early-arming countermodels still fail their claimed boundaries. This changes test observation, not production transport or wire authority. The storage-reference alias child now emits readiness immediately after its static imports and before any fixture/domain operation. It has an explicit ten-second import-startup allowance, the original five-second post-readiness execution/drain bound, a separate fifteen-second child total and a twenty-second parent bound. This adds startup allowance; it does not enlarge the semantic budget or any production clock. Natural exit with no readiness marker still refuses; an interval retained after the success marker still fails execution/drain at five seconds. A controlled six-second pre-readiness delay completes with natural exit 0, while all alias/custody/reference assertions stay exact. Countermodels are hash-restored. This corrects a proven observation/budget boundary, not the unretained historical cause of the macOS five-second timeout; complete platform validation and any remaining cold-Root startup attribution remain open. **Exact-head platform checkpoint and remaining SDK import evidence.** Candidate `ea8f04a` completes the focused three-platform series with 150/150 cases, all thirty cohorts at native exit 0 with no signal, skip or cancellation. The GitHub synthetic merge and candidate trees are identical. All five Linux and five Windows validation jobs, both macOS domain jobs and macOS integration shards two/four pass. This validates the guard/JSONL, Windows semantic-observer and macOS alias-fixture corrections in their affected platform closure, without attributing the historical 25/50 JSONL loss, missing initial target or Windows cold-start failure. The complete matrix is still red: macOS integration shard one records 630/631 with the sole `source/true/retained-text/rich=false` SDK-root startup failure; only `import-start` is retained before its ten-second readiness gate expires. That does not identify the incomplete import/mock or prove the historical cause. Shard three is cancelled with the authoritative annotation that the job exceeded thirty minutes; the job-log endpoint returns `BlobNotFound`, not a native test summary. Preserve that unavailability instead of treating its error body as a complete raw log or inferring the last active test. The SDK-root fixture now streams a fixed sequence around the actual app/module imports, mock installations and Root import, with one native PID and a captured monotonic elapsed clock. The import order, real modules, factories, temporary-directory preparation, semantic assertions and readiness boundary do not change. Intermediate phases cannot acknowledge readiness or renew the ten-second startup, ordinary/timed twelve/twenty-second post-ready bound, hard total or parent caps. Local source/dist retained-text, pure and timed-direct-pure controls pass; a native interval producing ongoing import progress still fails the original startup gate, and one foreign PID makes otherwise successful semantic output fail diagnostic correlation. Countermodels are hash-restored. These are attribution improvements, not a startup fix or whole-matrix acceptance. Deterministic macOS repartition within the unchanged job cap and complete new-head platform evidence remain required before release; no replay, SDK/custody or live-maintenance authority follows. **Deterministic macOS job-budget allocation (local).** The confirmed thirty-minute interruption is addressed by refining the four existing macOS integration buckets into eight, not by increasing any job or test deadline. The same SHA-256 name hash uses one additional modulus bit: buckets `i` and `i+4` together reproduce original bucket `i`, including every duplicate-name registration. Linux/Windows retain the original four-way mapping. The runner keeps legacy integer shorthand for four-way callers and accepts explicit bounded `index/4` or `index/8`; the workflow always supplies index/count and uses the numeric index for artifact names. Domain allocation, serial integration execution and native TAP diagnostics remain unchanged. The actual registration inventory has 2,491 entries. Original bucket sizes are 631/608/622/630; eight-way sizes are 313/301/313/312/318/307/309/318. Invariants execute the real registration-only path for both layouts, verify exhaustive/disjoint coverage and exact pair refinement, reject malformed/out-of-range specifications, and inspect the complete workflow matrix. A native sandbox runs the actual CLI with integer/explicit four-way and explicit eight-way arguments, requiring the original spec in the child and no inherited inventory filter. These are allocation/correlation proofs, not guarantees about physical runner speed or the cause of the intermittent SDK import timeout. New-head full platform CI, unchanged startup/drain boundaries and actual completion inside the thirty-minute cap remain required. **Actual SDK compaction observation (local diagnostic checkpoint).** The `9cad3de` macOS integration bucket three completes naturally with 312/313 passing and one separate `auto-overflow` actual Pi SDK failure: the two-second observation after tool release does not see the expected compaction event. It is not the earlier SDK-root importer failure. The retained native error has no original producer state, so it does not establish whether SDK compaction had started, was still inside the deliberately held extension handler, had been cancelled/refused or never began. The refined bucket completes its test phase in about fourteen minutes, below the unchanged thirty-minute job cap, but that does not turn a semantic failure green. Later bucket four retains three separate synthetic-Root two-second waits (ordinary-message queue admission, stop and immediate model menu); bucket six retains a busy-Next/follower test cancellation at its original twenty-second cap. Their complete native logs are saved; neither SDK timing nor a shared cause may be inferred across these different native processes. Their fixture/state/transport attribution remains a separate bounded checkpoint. The existing real SDK fixture now keeps at most 64 body-free monotonic phase records plus a dropped-record count, using only the original faux overflow producer, public `AgentSession.subscribe` events and its existing public compaction handler. On the original wait failure, it records those observations and current public streaming/compacting/retrying booleans before teardown, then throws the exact original error even if diagnostics fail. It issues no status/network/storage requests for that snapshot. The two-second wait, intentional 1.1-second hold, thirty-second test cap, fake provider payload, original queue assertions and actual SDK cleanup remain unchanged; the observer unregisters in `finally`. Seven actual SDK/held-publication/inbound-reload controls pass locally. A native longer-held handler still fails the same observation with compaction active and no native completion; a public extension cancellation fails it with native aborted completion and no compaction commit. Both models preserve the original timeout and are hash-restored. A third native model disables automatic compaction through the public session setting before the original tool release: the faux provider still emits its real overflow response, but no native compaction start/end or extension compaction handler occurs. The original two-second wait fails with zero commits, empty compaction reasons, all three public work flags false and four observed dispatch calls; this distinguishes a never-started compaction from a blocked handler and an aborted compaction without treating missing compaction as proof of absent dispatch activity. Dispatch-call counts alone do not certify SDK persistence or custody settlement. The source is restored byte-for-byte and hash-checked. Throwing from the extension handler is not a valid cancellation model: the SDK can report that extension error and continue through its default compaction path. No historical failure is attributed by these countermodels, and no execution/custody or warm-reload authority follows. **Owned proactive fixture transport isolation (local correction).** The same native registration-order pairs from macOS CI reproduce on Linux: the rapid-message case passes alone but fails immediately after the proactive session-replacement case; busy Next passes alone but reaches its twenty-second cap after the stale-same-CWD proactive case. The first pair observes zero `getUpdates` in the next Root, the prior Root's exact live PID/instance/epoch in the fixture transport section and a connect attempt reaching takeover confirmation. The prior fixture's own session startup/shutdown completed, but its PID did not exit. Replacement-only suspension or a returned quit hook is not proof that transport ownership was released; a later independent Root must not silently inherit or overwrite that owner. This is a reproduced fixture-lifetime boundary, not evidence that production takeover/currentness rules should be relaxed. The two owning proactive fixtures now end through their own registered `telegram-disconnect` command, require that their default transport record no longer names an owner PID (the polling-journal reference may remain), and then invoke the actual quit hook. The replacement fixture keeps the real reload boundary between old and successor sessions. Teardown releases its held publication before disconnect, retains its active context, runs before fetch/config restoration and preserves a primary assertion failure if cleanup also fails. A narrow shared test helper serves these two actual callers; it performs no raw lock deletion, forced takeover, journal reset or repair. The original one-send/proactive and queue/transition assertions and every wait remain unchanged. Both minimal pairs and their broader original-bucket controls pass locally (13 cases in bucket four and seven in bucket six). Omitting the owned disconnect fails the native owner-release assertion; a simultaneous subject assertion failure remains primary when cleanup also fails. Models are hash-restored. A nine-case bucket-eight control also passes, but excludes some earlier registrations and therefore neither attributes nor closes the separate full-prefix failures there. Exact-head physical CI, the separate SDK compaction/import questions and independent/operator acceptance remain open. Transport release does not certify every retained publisher, SDK/file writer or custody holder's closure. **Retained legacy Workspace fixture isolation (local correction).** Bucket eight has a separate reproduced boundary: the graceful-upgrade fixture and the immediate-connect/resume fixture each pass their own Threaded continuity assertions, but either followed by the accepted-work/ownership fixture makes the latter fail its original two-second dispatch wait. The retained native snapshot records the preceding `/repo/graceful-leader` Workspace with `threadMode: enabled`; the successor receives two `getUpdates` calls, while its original worker retains the input in `retry-wait` with `All is input-only in Threaded Mode; a routing Thread could not be prepared.` Its Classic fake API also refuses the native `getMe` probe. Transport-record clearing is not a Workspace reset, and a capability-probe error must not erase retained Threaded evidence or admit All input as Classic work. This differs from the zero-poll/live-owner fixture fault above. The two legacy scenarios now select fresh temporary agent directories for their whole native lifecycle, restoring both the helper's directory selection and the original `PI_CODING_AGENT_DIR` through the test's after-hook. One shared helper has these two actual callers. Each scenario's sessions still share their own original directory; no Workspace, owner, journal or mode is reset to accommodate the next fixture. The sandbox files remain available rather than being treated as disposable custody proof. The graceful fixture additionally requires retained enabled mode and its original pending journal update after shutdown, preserving its native owner/auto-connect and topic-deletion assertions. Production routing, guards, admission, source identity, currentness and all clocks remain unchanged. Omitting either scenario's isolation makes its minimal pair fail again at the original successor dispatch wait; both native models are hash-restored. Isolating only the graceful scenario leaves the expanded control red with the same seven late failures/cancellations; isolating the resume scenario too makes all fourteen selected registrations pass in their original eight-way order, including ownership, both commentary modes, compaction ordering, media grouping and long-session queue controls. This control adds the actual legacy predecessors to the earlier nine-case passing subset; it is not all 318 bucket-eight registrations or independent/operator acceptance. Complete exact-head platform CI and the separate SDK compaction/import attribution remain required, with no new reset, replay or whole-writer closure authority. **Issued IPC loss after native HTTP success (local fixture correction).** The first artifact-enabled 40-case Linux cohort records one different failure in `compiled/default/root`: the caller refuses, but the leader's native API method returned. Its retained runtime log reports commit-unknown and endpoint loss/recovery; this is not the earlier missing initial target. The old assertion incorrectly required every root-loss caller error to be the leader's API authority refusal. The added `issued-ipc-loss` partition observes the exact original follower request's real Node socket, half-closes it only after the leader has issued the held HTTP call, and waits for actual peer close and caller settlement while HTTP completion remains zero. The native caller's `TelegramApiCommitUnknownError` is observed through its existing pre-formatting diagnostic port under the same request-local AsyncLocalStorage; the public tool's formatted Error is not constructor provenance. Releasing the original HTTP later yields one native return with positive original transport checks and the actual correlated positive ACK prepared by the leader, although the original physical reply channel is gone. The fixture admits that error only with the native class, matching original HTTP method, closed original socket, one issued/completed HTTP call, positive original post-response checks and positive correlated leader ACK. The earlier issued-authority/negative-ACK branch remains distinct. Existing source bytes, missing-history refusal, no fresh sends, no replay, no extra poller/deletion/reset and exact target checks remain mandatory. Countermodels omit the native class observation or actual socket half-close and fail. No production guard, retry policy, wire ABI, timer or recovery authority changes; this corrects a demonstrably over-strong fixture expectation and still does not attribute the earlier initial-connect failure. **Separate OS-root startup (local).** `Production separate OS startup converges through original admission` covers source/actual-dist, default/named profiles, early Threaded follower, synchronized Threaded connect, early positive Classic mode, peer cancellation before readiness in both modes, a held positive registration result with or without post-issuance cancellation, synchronized cold startup with malformed JSON or invalid Workspace evidence, a genuinely lost registration reply, receiver publication held with or without cancellation, and a silent native registration-response timeout. Each isolated child runs the real Root with its own fake Pi host/HTTP. Early cases hold the leader's native `getMe` response. The follower's own forwarded diagnostic port observes actual `follower-readiness-wait` inside Polling; an outer registration return is not that boundary because the bounded original call remains pending internally. Before release, neither process polls/provisions, the follower has no target/issued registration/ACK/takeover, and its explicit tool send refuses without HTTP. Synchronized cases admit both fixture commands before either public connect handler enters, then release both; this coordinates admissions, not every possible OS interleaving. One command per child converges to one actual transport-owner PID/poller. In uncanceled Threaded controls, native server observations retain the other child's real registration PID; its client observes one conservative issuance and one positive native ACK. Both Threaded roots then deliver once to their respective acknowledged targets through that one owner's HTTP, never the follower's HTTP. Positive Classic mode instead asks the second process once about takeover, declines it, leaves that process unregistered/unable to send and permits the sole leader's ordinary private-chat output without a Thread. Early-cancel cases call that peer's public disconnect while the leader response remains held. An observer delegates the actual locked-runtime start and requires its exact protective cancellation result (`ok: false`, `canTakeover: false`), not expiry or a fixture command-completion label. The peer command actually ends before response release. The original leader PID/epoch survives; its later capability response starts only that leader, while the canceled peer still cannot send, register, acquire a binding, prompt takeover or poll. Threaded/Classic late results retain their distinct provisioning/private-chat behavior. These use no forced takeover, retry command, readiness-clock override or native transport replacement. Observers delegate original factories/ports and record only their actual boundaries. Receiver cases hold the actual forwarded receiver's `beforeEndpointPublication` callback and preserve any original callback. On Unix the private generation listener may already exist, but the canonical link is still unissued; on Windows the gate precedes pipe listening. Native endpoint probing observes canonical reachability. Unix `lstat` independently excludes a late canonical alias, even if dangling and therefore invisible to a reachability-only check. The public disconnect revokes the local startup attempt while that original callback is still unsettled; after actual callback return, original guards refuse publication and no registration packet, binding, readiness or takeover follows. The original leader PID/epoch and sole poller survive. Without cancellation the same callback publishes a reachable receiver, then the native registration ACK permits delivery. Callback entry, local stop and callback settlement remain distinct observations. Issued-result cases hold the actual positive leader registration result after its canonical binding commit and before the native server returns it. The fixture observes the original registration state separately from native canonical storage: target/key/slot can already exist while local registration and local target remain absent. A tool send still refuses. Public disconnect spends the original caller before the held result is released; afterward its native start reports cancellation, never publishes observed local readiness or gains send authority, and neither deletes nor re-keys the exact remote binding. No retry command or second issuance is allowed. Without cancellation, the same held result produces one actual positive client ACK, local registration/target and delivery. Native Bus observers must be installed before importing the follower implementation, whose lexical imports would otherwise bypass that observer; an empty observation counter alone never proves no issuance. The lost-reply case holds that real committed leader result, then destroys only the original caller's actual native registration socket. A delegating native connection observer is enabled only for this fault; no copied errno, provider exception, fake timeout or replacement transport supplies the failure. The caller's original send actually rejects and connect ends while the leader result is still held. The leader IPC remains usable: no takeover, second command, registration retry or new poller follows. After releasing the late leader handler, the exact remote target/key/slot remains retained and the caller has no local target or observed readiness and still cannot send. The sole leader can send through its normal HTTP path. This is a connected-socket-loss witness, not a silent half-open connection, a response-deadline expiry, real Telegram/VPN behavior or attribution of the reported live incident. The silent-ACK case keeps the issued socket intact and holds the same real committed leader result until the original native response timer rejects. The delegating client observes the unchanged response deadline (30 seconds in these Root fixtures), native `ETIMEDOUT`/timeout classification and monotonic elapsed issued wait; a shortened observer timer fails the elapsed check. Socket-loss count and cancellation count remain zero. The caller ends before the original leader result is released, then still has no local readiness/target, retry or takeover; the exact remote binding remains and the sole leader can deliver. Sequential long-poll HTTP renewals over this longer wait are not a second poller: only the leader polls, with one active/max loop throughout. No timeout, clock or transport override supplies expiry. Only that new case gets a 45-second post-readiness execution/drain guard, 55-second hard total and 65-second enclosing test bound to accommodate the actual native timer. Startup stays bounded at 10 seconds; every prior case retains its 20-second execution/drain, 30-second total and 40-second enclosing bound. Startup allowance cannot hide retained post-readiness handles, and successful roots still require natural zero exits. This is local native deadline evidence without accepted queue/Restore work, not platform/live acceptance or namespace-retirement authority. Damaged-start cases install malformed JSON or a valid envelope with invalid default-profile Workspace evidence only after both commands are admitted and before either handler enters. This also exercises a selected named profile while a different profile is damaged. The fixture's gate-release reply carries no storage read: trying to produce a status DTO from malformed bytes before native preflight runs would test the coordinator instead of recovery. Delegating reset observers count only positively returned native resets. One process reports one such reset; both original commands then converge to one owner/poller, two distinct targets, one native follower registration/ACK and exact-target delivery through the leader. Healthy, canceled and issued controls report zero resets. Bot token/paired operator in config remain unchanged. The invalid-Workspace partition includes a sibling runtime marker: its removal is the existing approved whole-envelope continuity loss, not a new selective repair or permission to discard accepted journal bodies. These cases start without pre-existing Restore/queue work and do not prove its drain or safe namespace retirement. Both startup and namespace-loss families share the local process fixture's separate startup/execution-drain/total bounds and require normal SDK-hook teardown plus natural zero exits. Startup countermodels omit the capability/start barriers, substitute the parent PID, return a negative native registration ACK or send to the wrong explicit Thread. Cancellation countermodels omit disconnect (the original readiness budget expires instead), release the leader response prematurely, introduce a second connect command, or substitute Threaded for the late Classic response. Issued-result countermodels bypass the ACK hold or disconnect, hide a committed canonical target until local readiness, or pass a new connect off as completion of the spent original. Damaged-start countermodels replace either fault with healthy data, retain a sibling after whole-envelope reset or rewrite the persisted paired operator. Lost-reply countermodels deliver a positive ACK instead of socket loss, fabricate a positive handler result without its binding commit, issue a fresh connect, or never release the late leader handler. Receiver countermodels bypass the hold or disconnect, label callback entry as settlement, or leave a dangling canonical alias that fails `lstat` despite an unreachable probe. Silent-ACK countermodels substitute an early positive ACK or actual socket loss for timer expiry, or shorten the delegated timer while claiming the original deadline. All fail at their actual boundary and restore exact original bytes. This is local multi-process healthy/damaged/early-start plus receiver/unissued/issued cancellation, connected-socket loss and native response-timeout evidence, not held reset/refresh/teardown or receiver publication with pre-existing work, accepted-work/Restore custody drain, warm namespace retirement, real operator Pi/Telegram or supported-platform CI. Those gates remain separate; no recovery permission follows from a healthy startup control. Concurrent explicit connects can observe unknown Thread mode before the first leader finishes capability publication/IPC startup. The private `TelegramFollowerRegistrationResult` retains `pending` for unknown/missing mode, `undefined` only for positively disabled mode and literal booleans after actual registration. `locks.start` accepts only literal `true` as registration success. The bounded original-readiness and native startup sections below define the implemented one-attempt wait; unknown mode itself never starts another poller, grants delivery or authorizes takeover. The source/actual-dist `Production early follower waits for original leader readiness without manual retry` family holds capability publication and proves eventual acknowledged delivery under the same original attempt. These local roots do not establish whole-runtime multi-process or live convergence. **Recovery classes.** Choose a response from evidence supplied by the existing owner, not from the compact `error` status, elapsed time or a successful previous reconnect: - Approved envelope damage: use only the [existing whole-envelope reset](#damaged-state-reset-operator-approved), under its shared guard and valid connection authority. Its deliberate all-profile continuity loss remains explicit; this work does not turn it into a lossless repair or extend it to journals, guards, ordinary disconnect or background readers. - Pending leader readiness: distinguish unknown capability/startup from positively classic operation and authentication/protocol refusal. A bounded retry/observation belongs to one captured connect attempt and exact owner; authenticated registration and recipient preparation, not liveness or a stored hint, establish follower readiness. Keep restore-only startup separate from explicit provisioning. - Transient transport failure: retain existing owner-fenced polling/network backoff and exact source custody. Do not reset storage, transfer work or replay an uncertain send because a network/VPN error is suspected. - Identifiable dead ownership: use only the existing exact native liveness and transaction contracts. A stale timestamp, missing roster entry or restored equal fields is not death or continuation authority. - Unverifiable storage/ownership: retain protective refusal and bounded redacted diagnostics. Native source/dist probes confirm that an empty owner in `state.json.transaction` blocks envelope repair, and envelope repair cannot release an empty `journals.transaction` owner. The [guard hardening contract](#transaction-guard-hardening-proposed) owns that separate unresolved recovery problem; its Windows claim-primitive and legacy-maintenance gates remain intact. **Profile preparation (implemented locally).** `bindings` resolves the selected token through the original Config store without activating that profile, captures the selected config/profile/token and passes its current connection intent into `locks.prepareConnection`. The Locks owner captures its polling generation and actual session ID; caught provider failures, observed loss and reentry spend the preparation even after equal fields return. The reset owner rechecks that guard before guarded observation, after validation, immediately before every rename attempt and after publication. Lost post-rename authority retains the committed empty envelope without a success/retry or rollback claim. Old-profile teardown still completes under the old identity before activation. Only this call's positively returned reset result selects `refreshProfileStateAfterReset`, wired to the existing Thread store's canonical refresh after teardown and selected-profile activation; it is an observational cache refresh, not cleanup or execution authority. This avoids an out-of-scope dirty projection blocking warm recovery without making ordinary cleanup failures discard projections. Selection/session/config/token checks run after teardown, refresh and transport-change awaits. Healthy connects do not enter the reset-only refresh; unconfigured or unresolved selected tokens never authorize preflight reset. Ordinary disconnect and elections gain no repair path. State publication, old transport suspension, acquisition and recipient readiness remain separate outcomes; reset cannot prove Thread deletion, dispose of accepted work, clear an unknown effect or resurrect old bindings. **Original caller fence (prerequisite implemented locally).** Locked startup now passes a process-local `assertAuthority` for its original polling generation/session through Polling's refresh/delegation port to Bus follower registration. Polling also pins the store/delegation methods, capability lifecycle and its own registration generation; stop, supersession, replaced ports, caller loss or caught reentry cannot resume the old attempt. The private `TelegramFollowerRegistrationCancelledError` returns the existing cancelled startup result instead of treating cancellation as membership failure, owner unresponsiveness or takeover evidence. Ordinary negative registration ACKs and transport/protocol errors keep their existing handling. The bus captures the original callback before receiving startup, checks it around startup/ACK publication and carries it into the existing native transport's immediate-before-write guard. It is never a wire field or acknowledged membership authority; a later valid registration keeps its independently captured lifetime. Native socket `connect` loss sends no registration packet; a loss after issuance refuses local readiness without undoing a possible remote effect or replaying the source. Held refresh, session/context/stop, supersession, original callback/port replacement and caught-loss/reentry cases cover these boundaries. The bounded readiness observer below consumes that same original fence. Production-root/native-IPC fixtures remain distinct from full multi-process or live acceptance. **Selected registration scope (implemented locally).** Commands capture the actual session ID before profile-activation awaits and pass original command-intent currentness into Locked startup. A caught producer refusal followed by a successful return cannot publish connected context. Config's read-only `captureConnectionScope` pins its original config reference, selected profile generation and environment-resolved token; a profile ABA or observed token loss cannot renew it. Threads' `captureReadScope` pins logical path/profile selection and provider identity, independently from the already loaded cache. A legitimate newly selected named profile can refresh its old cache, while observed scope replacement/ABA invalidates old readers. These guards neither write data nor forget Restore history; same-path file replacement remains subject to the existing monotonic-history checks, not a new namespace grant. Locks captures both scope callbacks at startup before awaits and validates them throughout follower refresh/native registration. Its read-only consolidated `getStorageScope` coordinates also cross-bind Config's expected profile and Threads' expected path/profile: individually current closures from different roots or profiles are not one valid selection. The independent legacy owners-file backend returns no consolidated coordinates and gains no stronger namespace/readiness proof. Its `captureFollowerRegistrationScope` pins the original profile key, owner tuple, endpoint and auth fields while permitting ordinary heartbeat/journal publication. The selected owner is copied/frozen, not retained as a mutable provider object. If startup must await an existing ownership drain, foreign-owner selection precedes that await; a replacement needs fresh admission. Root wiring supplies the Config/Threads owner methods directly, without new orchestration policy. Own-leader capability preparation may still make its expected config updates; follower selection scopes do not become long-lived acknowledged-membership authority. Native source/compiled storage/domain cases hold registration, change config/profile/path/owner or original intent, then prove refusal before the fixture producer's effect. Separate native ownership-drain cases reject post-drain owner adoption; primitive cases preserve heartbeat/no-op observations, cold named-profile reads and independent history guards. These are not an actual held production registration ACK, queue/worker drain or full multi-process readiness proof. The bounded waiter consumes the complete original scope; incomplete evidence retains the existing one-observation protective fallback, not a new wait or namespace grant. **Bounded original readiness (implemented locally).** Locks captures a monotonic eight-second observation budget before the first startup await, including any existing transport drain. Only a complete original command/session, cross-bound config/storage and immutable owner/epoch/auth scope may lend that process-local budget to Polling. Root supplies its existing profile-derived leader locator directly when a transport row omits an endpoint; provider replacement or changed locator spends the attempt. This locator is not peer liveness or registration authority, and the original owner-row comparison is not relaxed. Invalid/backwards clocks and caught reentry cannot renew a budget. Polling holds one original registration generation/store/lifecycle/delegation capture while refreshing unknown Thread mode. It consumes a narrow process-local remaining/wait port; Locks owns the existing bus registration delay, non-renewable deadline and finite original observation count. Polling remains a local-import-free leaf; only read-only unknown capability is re-observed. The `follower-readiness-wait` record appears once. Deadline expiry returns private `readiness-expired`, records `follower-readiness-expired` and shows an allowlisted readiness-timeout warning, with no status success, takeover proof, native delegation or replay. A held refresh is still awaited through actual settlement; elapsed budget fences its late result before delegation rather than claiming its work drained early. Positive Classic mode keeps explicit competing-owner takeover. Positive Thread mode delegates exactly once under the original guard, lending the same remaining/wait port only to native connection readiness. Native request issuance ends that budget's authority over the ACK; acknowledged membership retains its independent lifetime. Negative ACKs, auth/protocol refusals and Restore conflicts are never reclassified as pending. No wire or durable startup-authority field is added. Source/actual-dist default/named production roots hold the leader's native `getMe`, prove the original follower command remains pending without delivery/polling/provisioning, then release capability and establish one poller plus acknowledged Thread delivery without another command. Their timeout, Classic, disconnect and epoch-replacement variants refuse late resurrection; native domain cases cover clock bounds/birth before drain, scope loss, protected refresh failure, one-shot negative registration and independent long ACK lifetime. **Native publication/IPC/ACK boundary witnesses (local).** Additional source/actual-dist default/named roots independently hold the actual leader store's enabled-mode persistence, native local-server start and the actual native leader handler's successful registration result before its socket ACK. Capability held before persistence causes no native registration; an unavailable listener has one producer call and no immediate-before-write issuance. Releasing the listener within the original shared readiness budget produces one native packet/leader receipt, one poller and exact acknowledged-Thread delivery. Holding a prepared ACK grants no local delivery. Advancing only the injected monotonic observation clock beyond eight seconds while that ACK is held does not cancel its independent native ACK lifetime. Replacing the actual original config reference with equal fields before ACK release instead refuses local readiness while preserving the leader's already committed binding; neither case reissues registration or deletes the remote result. Native `onRequestIssued`, receipt/prepared/returned counters, actual command settlement and source-marked API targets distinguish issuance, handler result, caller completion and delivery from unrelated startup notices. **Native pre-listen convergence (implemented locally).** The original Locks-owned budget now crosses Polling's leaf port into follower registration solely as process-local connection readiness. The native client captures its methods and original caller guard before connection. A private, non-exported proof class is constructed only by the native socket error callback before that attempt's issuance marker. Another connect observation requires this exact origin, no prior request issuance, `connect` syscall and the existing transient-transport classification. Copied errno/message fields from callbacks are not that proof. The same original wait counter/deadline, not a fresh timestamp or a larger global retry policy, bounds the wait; diagnostics identify readiness-bounded attempts instead of displaying the obsolete fixed-attempt maximum. Legacy callers without this port keep their existing retry policy. A connection-only deadline timer and original guard run before connection and immediately before the actual write, including after the issuance callback. Issuance is marked conservatively before that callback/write; a callback failure or last-moment veto may therefore retain an issued/unknown hazard without writing. Once marked, no failure, timeout or lost ACK is retried by this readiness path, and the observation timer never governs the request's independent ACK. A transport expiry is translated by the follower adapter into a private product deadline signal, not membership failure or unresponsiveness/takeover proof; receiver-stop failure is diagnosed without replacing that protective outcome or claiming actual drain. No clock, callbacks or new authority fields enter the registration packet. Source/actual-dist default/named roots now hold the native listener beyond the old ten-attempt window, then release it within the same budget: one producer call issues one packet and gains exact Thread delivery without another command. Expiring the original injected clock instead ends with zero issuance/receipts and cannot revive when the endpoint later starts. Native tests also cover forged connect-shaped errors, post-marker scope/clock loss, one-shot lost/negative ACKs, long ACK independence, correlated refusal/protocol mismatches and deadline cleanup failure. These positive native markers describe only the captured attempts; missing delivery remains no general no-effect certificate. **Native receiver start lifetime (implemented locally).** A stopped local-server start previously resumed endpoint publication after its await, and a concurrent start returned before the first publication completed. The server now captures the original stop generation, raw endpoint provider/value and publication callbacks before asynchronous startup. Concurrent callers join the same in-flight result, not the merely allocated listener. Stop revokes that result without waiting for a held publication, so a later start gets its own result; obsolete completion cannot clear a successor's in-flight start, listener or registry entry. Generation/provider loss and caught commit-callback loss stay spent. Checks bracket startup awaits and run inside the one-use actual publication callback, rather than accepting a callback's claimed success as issuance. Each attempt retains its exact native listener, accepted sockets and unpublished generation-link path. Failure closes/removes only those owned resources; it never substitutes the current global listener or rolls back an already issued canonical endpoint. Normal stop retains its existing generation-link behavior. Source/actual-dist native cases cover stop, same-instance restart, replacement, concurrent readiness, changed endpoint providers and caught publication loss. Separate default/named production roots hold the actual follower receiver immediately before endpoint publication: a valid release permits one packet/ACK and exact Thread delivery, while harness session shutdown before release leaves no late alias, registration packet, binding or delivery. These are native startup and caller-settlement proofs, not a real operator reload, full session/profile-switch composition or worker/custody drain. **Held native connect and ACK clocks (implemented locally).** Holding dispatch of a real socket's connect event exposed the generic response timer running before issuance. Bounded registration now uses only its original readiness deadline while unissued, then arms its independent response timer at the conservative issuance marker. It does not renew the readiness budget, reuse that clock after issuance, or retry an issued/unknown request. Legacy clients without a readiness port retain their existing connection-to-response timeout semantics and buffered-I/O timeout grace. Source/actual-dist native cases hold the actual connect callback longer than the response timeout, then release one write and retain the full ACK window; a separate case expires the connection timer while that callback is held and proves socket destruction before harmless late dispatch. Scope loss, original budget-method replacement, marker-time expiry and lost ACK retain their separate refusal/uncertainty outcomes without a second connection or retry observation. The ACK-after-connect case advances only the observation clock after the server receives the request, preserving the already-issued response lifetime. Default/named production roots independently hold the actual registration socket callback and observe native writes, leader entry, correlated ACK/refusal, binding creation and exact Thread delivery. Replacing original config, active profile, session ID, raw locator or native budget methods before dispatch prevents issuance. Caught guard reentry inside the issuance callback instead spends the conservative marker but writes zero packets: the immediate-before-write guard is still required. Real native leader auth/protocol refusals each retain one packet/refusal and no binding/readiness, rather than entering connection waiting, takeover or replay. These socket cases are separate from the receiver-preparation boundary below. **Original receiver-publication scope (implemented locally).** A held receiver could publish its endpoint after original config loss, then fail the existing post-startup check and leave a dangling alias. Registration now captures its receiving producer before providers and passes a synchronous original request/session/config/owner fence through the existing receiver's `start` port into the native server. That fence also consumes the same original remaining budget during preparation. The server checks it around startup work and inside its one-use actual publication callback; merely refusing registration after the receiver await is insufficient. No wire field, durable readiness marker, registry or membership grant is introduced, and Root keeps its existing direct owner wiring. Producer-method replacement, caught reentry and an observed loss stay spent after equal restoration. Expiry during receiver preparation uses the same private product deadline outcome as native connection expiry; cleanup or diagnostics failure cannot convert it into membership failure/takeover evidence or claim actual drain. Legacy producers may ignore the optional local callback and keep surrounding checks, but production's native receiver actually consumes it at the effect boundary. Concurrent native starts retain the original publisher's guard while checking each joining caller's own completion; an already-published independent receiver is not stopped by a new rejected caller. Actual startup settlement drops the captured guard, and inbound handling never projects it into acknowledged receiver authority. Source/actual-dist default/named roots hold actual receiver publication and replace config, active profile, session ID, leader locator or the publication method, expire the original budget or catch guard reentry inside commit. Each ends with no late canonical alias, registration packet, binding, delivery or takeover. Native cases separately prove producer-method loss cannot be revived, concurrent callers cannot adopt another guard, completed startup leaves independently authorized receiver requests useful, and cleanup/diagnostic failures preserve the typed expiry. These are original startup/endpoint and command-settlement witnesses, not publisher/worker or accepted-source custody drain. These are two production roots in one isolated child process with real local IPC and fake HTTP, not whole-root replacement, actual multi-process production authority or supported-platform/live acceptance. The connect harness holds dispatch of an event from a physically connected native socket, not an OS-stalled connect syscall or a slow Windows named pipe. Observation-clock advancement is injected, not a real long wall-clock ACK stall or publisher/worker drain. The broader integrated acceptance boundaries remain open in the canonical backlog. **Acceptance.** Production regressions must cover default/named activation, healthy byte-preservation controls, malformed envelopes and invalid owned sections, invalid profiles/access errors/damaged guards, same-process and native multi-process startup races, held capability/IPC/registration preparation, Classic/Threaded mode, owner/protocol/auth changes and session/config cancellation before and after effects. Preserve accepted journal/queue custody and issued/unknown effects outside the documented reset boundary; no absence after reset is a no-effect certificate. Keep original actual worker/process drain and source/actual-dist checks. Independent integrated review, supported-platform CI and separately authorized disposable live acceptance remain mandatory; creating damage in an active agent directory, reloading Pi or publishing is not part of local preparation. ### Transaction Guard Hardening (Proposed) **Scope and evidence.** A live source serializer repeatedly refused `runtime/journals.transaction` while its sole legacy `owner..json` was empty. This proves unavailable guard ownership, not damaged journal payloads, an abandoned operation, the identity of the creator or the cause of the empty file. Current `Locks.createLockTransactionGuard()` already writes owner metadata in a private staging directory before publishing that directory by rename. Preserve this ordering; adding it again is not a fix for the observed incident. The refusal/classification slice is implemented locally; the owner-locator and maintenance directions below remain proposed. No shipped recovery, live storage modification or new locator format is implied. **Owners and non-goals.** `locks` owns guard inspection, acquisition, exact release and reclamation; `process-identity` owns process-liveness evidence. `journal` continues to own source serialization and journal/custody semantics. Polling and diagnostics consume a narrow failure reason without gaining storage-repair authority. Keep existing paths, synchronous callback boundaries and lock ordering. Do not add another registry, coordination domain, public package entrypoint, polling loop or generic recovery framework. Guard repair never completes, discards or replays an update, settles a receipt, clears a Workspace fence or proves a remote effect did not happen. **Local first slice: distinguish damage from contention.** The existing owner reader now distinguishes absent/concurrently changed evidence, a valid potentially live owner, a proven dead owner, damaged identity, and unavailable observation. It uses the existing owner-private, single-link no-follow reader with a 4 KiB metadata bound. PID validation precedes liveness probes: only positive signed-32-bit safe integers are accepted; malformed values cannot become dead-owner proof. Admission time is a nonnegative safe integer and generation retains the existing owner-name alphabet. An empty or malformed legacy owner, conflicting identity, unexpected entries, links or unsupported layout must refuse the callback and all repair. Filesystem access failures are not metadata damage. Preserve native errors and distinguish concurrent disappearance from persistent unreadability. A structurally unusable observation, including empty legacy owner metadata, must produce a typed, resource-specific refusal without spending the ordinary 80 synchronous 25 ms contention waits. It establishes unverifiable ownership, not abandonment or necessarily permanent corruption: a legacy writer may still be publishing. A later independent attempt may observe valid evidence; do not install a permanent global damage latch. Legitimate contention retains its existing bounded policy in this slice. Retain outer polling backoff, journal-first offset publication, source/current-generation checks and accepted local work. Diagnostics report the resource, classification and operation phase without prompt bodies or secrets; a stable reconciliation snapshot and empty worker queue do not certify healthy polling. The package-private `TelegramFileTransactionGuardError` records `code: "guard-unverifiable"`, the exact resource, `invalid-layout`/`invalid-owner`/`unavailable-owner`, and `acquire` versus `release`; its message retains that phase for ordinary diagnostics and its private cause retains underlying I/O errors. A release refusal occurs after the operation may have committed effects and is never a no-execution or replay certificate. This slice improves refusal and responsiveness; it cannot free the existing unidentifiable guard. **Changed directory enumeration (local v1 correction).** An observer can open the original guard directory just before its owner natively renames/releases and removes it. Enumeration through that real old directory descriptor then returns no entries even though the canonical path has disappeared or names a different live guard. Before classifying the layout, the reader now re-observes the canonical directory's type, device/inode and modification/change stamps. Positive change yields no owner observation, not an invalid-layout diagnosis or acquisition authority; ordinary acquisition must still win its own atomic publication, and a live replacement remains protected. Stable empty/malformed/unsafe layouts retain immediate typed refusal without contention sleeps or repair. The publisher, release/reclaim primitives, marker grammar and v2 review-only boundary are unchanged. Native source/dist POSIX witnesses hold a real owner process and opened directory descriptor across actual release, with absent-path, live-replacement and real 25-record logger-batch outcomes. Without recensus, the logger witness captures original `guard-unverifiable`/`invalid-layout`/`acquire` before best-effort containment and loses all 25 records; restoring recensus preserves them. The source model was hash-restored. Existing cross-process logging tests now delegate and retain their actual native transaction failures before containment rather than reporting only a final line count. This demonstrates one failure class, not the historical cause of the separate Linux CI 25/50 result, whose original error was not retained. Focused locks/logging validation passes 361 tests and six source/dist guard witnesses plus ten production-root/fixture cases pass natively. An attempted broader local domain run reaches its 330-second enclosing command bound without a terminal suite result; it remains incomplete, not a passing gate. No participant is still running from that attempt. Full exact-head CI remains required. **Subsequent direction: reserve a distinct protocol namespace.** The initially suggested `owner.v2-p-.json` encoding is rejected: it fits the existing opaque generation grammar, so an unaware reader may trust contradictory JSON instead of the apparent locator. Native source/actual-dist witnesses prove that a live PID encoded in that spelling does not prevent reclaim when its otherwise valid body names an absent PID. The encoded PID has no meaning in the current protocol; treating the spelling as a new independent owner proof would therefore be an unsafe mixed-reader interpretation, not a compatible format extension. Use a marker namespace that current v1 readers actually refuse before interpreting the body, such as `owner.v2...json`. Keep that reserved version boundary during recovery, for example `owner.reclaim.v2...`; do not downgrade into the recognized legacy `owner.reclaim...json` namespace. Sixteen source/actual-dist cases refuse proposed owner/claim markers with live, absent, empty and conflicting body evidence, preserve exact markers/bytes and execute no operation or contention sleep. Restored spelling models for an opaque owner generation and a legacy claim both execute the callback and assertion-fail the protected conflicting-body case. These are current-reader namespace assessments, not proof for every historical binary, a v2 reader, a production v2 writer or metadata-loss recovery. **Blocked claim primitive; codec remains review-only.** The first RC's Windows filesystem model reported two successful concurrent renames of the same original source marker. A source-name rename is therefore not a proven portable compare-and-swap. The earlier single-winner assumption is withdrawn: do not enable a v2 reader/writer, locator recovery or claimed execution authority from these examples. Select and falsify a genuinely exclusive cross-platform claim primitive before implementation. Audit the existing v1 composition separately; this raw-primitive witness does not by itself prove duplicate protected execution in the production kernel. **Proposed codec for review, not runtime activation.** Keep the original owner `O = (pid, nonce)` immutable and name a recoverer separately as `R = (pid, nonce)`. Both PIDs use canonical positive signed-32-bit decimal spelling; nonces are fresh lowercase UUIDv4 values generated by the native acquisition/claim, never supplied by an external locator. Use these role-specific names: | Role | Marker | | --- | --- | | Original owner | `owner.v2...json` | | Recovery claim | `owner.reclaim.v2.....json` | The proposed complete body is `{"version":2,"owner":{"pid":O.pid,"nonce":O.nonce,"acquiredAtMs":...}}`; its clock is diagnostic, not a lease. Stage the complete private body before owner publication. A claim renames the exact observed marker inside the still-occupied guard directory without rewriting that body. Repeated claim `claim(O,R1) → claim(O,R2)` retains `O`, replacing only the recoverer pair. The original body therefore matches `O`, not `R`; a differing recoverer PID is not a body contradiction. The fixed-width components keep the basename below ordinary Windows/POSIX component limits. This selects the review candidate, not a shipped v2 parser or writer. Automatic claim requires fresh native proof that the original owner is absent and, for an existing claim, that its prior recoverer is absent too. A live/current-process, inaccessible or reused-live PID stays protective: missing membership in an in-memory reclaim set is not process death or permission for a new observer to adopt the claim. The original creator may continue only through its still-current private claim context; a filename, copied object, equal fields or a new call cannot recreate that context. Revalidate the actual resource/marker observation, not a caller-provided locator. Unsupported, conflicting or unstable evidence refuses. Stable empty/truncated v2 metadata remains the separately gated locator-only recovery case; unavailable/unsafe private-file identity and a complete foreign or conflicting body are not metadata-loss certificates. Eight native filesystem-model cases use real naturally exited publisher/claimant processes, complete or empty metadata, competing and repeated observations, and current source/actual-dist readers. Claimants derive both identities from the observed marker and verify PID absence. Original bytes survive the modeled transitions, but concurrent rename reports are observations, never authority: the contended path retains its guard, invokes no protected callback and performs no retirement or fresh acquisition, including when Windows reports two successes. Only the separately sole-writer-controlled sequence exercises repeated identity preservation, a live-parent refusal and fixture-owned retirement followed by a fresh native transaction; a delayed old marker rename then fails without touching its replacement. Restored original-rebase, liveness-bypass and unguarded-root-removal models falsify that sequential evidence. None proves a portable exclusive claim, production v2 decoder, private claim lifetime, filesystem identity revalidation or all interrupted release/reclaim behavior; those gates remain open. Do not put source bodies, tokens or session custody in filenames. Avoid a mandatory OS subprocess or new native dependency on every successful transaction. Stronger PID-reuse progress may use the existing native birth-proof contract only after its platform cost and compatibility are established; a fallback generation is never a birth proof. For that new format only, automatic reclamation after metadata loss may be considered when the independently valid locator proves its process absent, the exact occupied guard/marker is still the observed one, and no readable evidence contradicts that identity. Valid-but-conflicting JSON, unexpected members, links, unsupported versions and uncertain liveness remain protective. This fallback is within the existing private-filesystem trust boundary, not protection against a same-user adversary replacing arbitrary files. A PID or filename is a locator, not an acquisition, release or semantic execution grant. Only the original private acquisition may release its guard; a new observer must earn reclamation separately. Whether an original acquired scope may release after body damage requires its own exact-marker proof and fault tests, not a permissive fallback in the ordinary release reader. **Preserve the reclamation barrier.** Never remove the stable guard path after an earlier liveness read. Require a proven exclusive claim of the exact observed guard while its stable path remains occupied, then acquire a fresh guard before invoking any operation. A successful source-marker rename alone cannot establish that exclusive claim on Windows. Owner markers, active/dead recovery markers and same-process inactive reclaim attempts must be distinguished consistently, including when the inherited JSON is damaged. Cover crashes before/after that claim, before/after directory retirement, rollback failure and lost publication acknowledgement. A fresh replacement generation must survive delayed recovery and delayed release. No format change may create a second unfenced recovery path or treat a failed publication reply as proof that nothing was published. **Archived-reader evidence, Linux/Node 22.19.0.** `scripts/probe-transaction-guard-compat.mjs` captures exact compiled Git modules plus their recursive dependency closures, preflights imports to refuse non-native dependencies, and imports byte/hash-verified snapshots only in an isolated fixture process/agent directory. It does not load Pi, fetch tags or use configured runtime storage. All 34 locally available release tags from v0.52.0 through v0.58.3 resolve to eight distinct closures. Each closure passes 15 cases: fresh native acquisition, absent/live legacy-file controls, six reserved owner/claim admission cases with complete/empty/contradictory legacy-shaped bodies, four delayed old-release cases and two classified unsafe-namespace counterexamples. Reserved admission executes no callback and preserves fixture bytes/layout; both unsafe counterexamples execute in every archived closure. Delayed release retains a replacement owner/claim marker's exact root/marker inodes and bytes, both with empty metadata and with a body identical to the old acquisition. Those release cases have already executed one callback and report an error; preserved replacement storage is not a no-effect or retry certificate. This is actual historical code evidence, not a rewritten legacy algorithm or an assertion that every unknown build is compatible. | Local release tags | Count | Closure SHA-256 prefix | | --- | --- | --- | | v0.52.0–v0.52.1 | 2 | `43248caea0ef` | | v0.52.2 | 1 | `aa947e7ddf1e` | | v0.53.0–v0.53.2 | 3 | `da6af6b0729d` | | v0.54.0 | 1 | `498855b2d31a` | | v0.54.1 | 1 | `b8022689fcdb` | | v0.54.2–v0.56.0 | 6 | `9e078016fd8d` | | v0.56.1–v0.57.1 | 6 | `74746befe8d3` | | v0.57.2–v0.58.3 | 14 | `74e25863bd2f` | The rows describe available release tags, not hypothetical intermediate versions. The probe's JSON includes full commit/blob/SHA-256 evidence; it deduplicates only identical complete closures. Restored fixture mutations assertion-fail: reserved-to-opaque spelling executes one protected callback instead of zero, while reusing the old acquisition's marker for an equal-body replacement permits its removal by old release. That forbidden marker/nonce reuse is a countermodel, not compliant v2 publication. Run the eight representatives with this portable command, or supply every locally available tag to re-establish the complete equivalence grouping: ```text node scripts/probe-transaction-guard-compat.mjs v0.52.0 v0.52.2 v0.53.0 v0.54.0 v0.54.1 v0.54.2 v0.56.1 v0.57.2 ``` **Legacy and deployment boundary.** A legacy marker with no verifiable owner cannot be upgraded by guessing a PID, applying an age threshold or using leader/Workspace membership. It remains refused. An already live process might have an original private acquisition, but an observer cannot reconstruct it from equal fields. Before writing a new locator format, prove old/new reader, writer, release and recovery behavior with actual legacy implementations. Fitting the old owner-name alphabet is explicitly insufficient and the opaque-prefix proposal fails the native conflicting-body control above. Keep unknown readers fail-closed throughout acquisition, claim, release and interrupted recovery. The original reserved-namespace witness covers current source/dist; the separate archived probe above adds the exact tagged closures on local Linux. Neither covers unobserved loaded/forked builds, native Windows/macOS behavior or the future v2 kernel. Bot capabilities do not upgrade filesystem participants, and a registry census is not closure of all source writers. **Existing damaged guard.** Its recovery is a separate operator-controlled maintenance task: preserve journals, offsets, accepted work, originals, bindings and issued/unknown effect fences. Any repair must be scoped to one exact observed guard and positively exclusive against every participating writer; age, empty queue, missing bot registrations or operator consent alone is not that exclusion. No live repair command or automatic startup reset is introduced by this design. If complete exclusion cannot be established, retain the guard. This boundary is separate from the operator-approved damaged-state-envelope reset above, which is not a transaction-guard repair contract. **Local evidence.** Source/actual-dist cases preserve empty/truncated or malformed legacy/directory owners and unsafe layouts without operation calls or contention sleeps; native live-owner controls retain their bounded waits. A real journal-source serializer plus polling loop retains the earlier accepted entry and cursor, reports the refusal, keeps outer backoff and signals work only after a fixture-owned exclusive repair and successful durable append. A release-after-work witness preserves the damaged guard and distinguishes the next acquisition refusal. Restored models falsify damage-as-contention, fractional-PID-as-death, link-as-owner and bypassed recovery-marker metadata. Recovery-marker PIDs also require canonical positive signed-32-bit spelling before liveness; a dead-looking marker cannot excuse empty or contradictory inherited ownership evidence. Valid historical file guards were published with mode `0600`; the legacy recovery fixture now models those writer permissions. Protected links and non-private owner metadata remain refused, not silently upgraded. The full native suite passes locally on Linux/Node 22.19.0 with the candidate hashes unchanged; independent review and supported-platform/operator-live acceptance remain separate gates. **Acceptance and falsification.** Require native disposable-storage cases for empty/truncated legacy metadata, malformed PID, unavailable reads, valid live/dead ownership, marker/body disagreement, links and extra entries; unchanged protected bytes and zero operation calls are mandatory on refusal. The damaged case must make no contention sleep, while a real competing writer retains exclusion. Before enabling locator recovery, add actual cross-process owner-death/reclaim races, mixed-format readers, same-process reentry, replacement during observation/release, pre/post-rename loss and interrupted recovery on Linux/Windows/macOS. Compose the real journal serializer and polling worker to prove no premature offset advance, no accepted-work loss and later progress only after valid acquisition. Restore falsifiers for damage-as-contention, age-as-death, filename-as-grant and unguarded path removal. Local fixtures are not operator-loaded live acceptance or independent review. ### Persistence I/O Baseline The runtime sections and log have different authority and write pressure. Preserve that distinction when optimizing them: - The `transport` section is safety-critical authority. Acquire, release, takeover, stale recovery, and entry migration mutate it. Since 0.54 the steady-state baseline is zero rewrites: the one- and two-second ownership checks are lock-free reads. Every mutation serializes the full cross-process read/check/write through the shared `runtime/state.json.transaction` guard and replaces only that profile's section. - The `workspace` section holds recovery-critical thread/capability state. Every explicit thread-store `persist()` builds a semantic snapshot, but an unchanged payload skips directory preparation, temporary-name generation, file creation, and rename after comparing JSON values independently of object-key order and ignoring `writtenAtMs`; array order, value types, and explicit null remain significant, and changed snapshots retain the full atomic replacement path. No-op saves still read and compare current disk state, rather than trusting a cache that could hide another owner's publication. Diagnostics scheduling coalesces requests across a bounded 100 ms window and writes only the `runtime` section (`persistStatus()`, skipped when the JSON value is unchanged), so an idle leader's polling snapshots never rewrite the canonical `workspace` section. Only the exact transport owner commits either section; non-owners reload current state instead of publishing. - `logs.jsonl` is fail-soft observational evidence, never routing authority. Runtime events admitted in one JavaScript turn batch by captured profile path into one size check, one profile-wide file transaction, and one append while preserving event order. Batching adds no timer or shutdown-loss window; separate profiles remain isolated, and one failed group does not drop another. Scope reset and rotation retain their serialized copy/replace path. The 5 MiB value is a rotation threshold: an authorized writer rotates between batched records before the next record crosses it, so overshoot is bounded to one admitted record plus reset metadata; a writer without reset authority defers rotation to the owner. This baseline counts write-producing code paths rather than filesystem implementation details that vary between ext4, APFS, NTFS, and network-backed home directories. Optimization evidence should compare these deterministic triggers first, then use platform smoke evidence for rename, named-pipe, crash, and cleanup behavior. Recovery-critical fields inside `profiles..workspace` are `bot`, `identities`, `workspaceBindings`, `reservations`, `pendingProvisions`, `syncObservations`, and `threads`; `profiles..runtime` (runtime, live roster and diagnostics) is observational and may use bounded coalescing when authority checks remain unchanged. Run `node --experimental-strip-types scripts/measure-bus.mjs` for an isolated, assertion-backed synchronous bus-registry work baseline. At 1/13/26 entries, re-registration visits each entry once; heartbeat performs one Map get and set without scanning; target lookup visits one entry for the first target and at most the fixture size for the last or a different-chat miss; roster listing visits every entry. Returned target/protocol views are mutation-isolated from registry authority. The script counts Map calls and visited entries, not allocations or time, and restores its process-local instrumentation before exit. Two repeated runs produced identical counts. This bounded result supplies no demonstrated need for a secondary target index, shared mutable views, or persistent IPC multiplexing. Escalate to full transport/provisioning measurement only when attributable latency, event-loop blocking, or unexpectedly growing work supplies a concrete performance claim to test. Version `0.24.0` intentionally does not read or migrate the former agent-level `locks.json`; upgrading resets Telegram ownership. Run `/telegram-connect` when a fresh owner is not elected automatically. Damaged shared-envelope handling is owned by [Consolidated Runtime Root](#consolidated-runtime-root) and its [damaged-state reset](#damaged-state-reset-operator-approved), not the legacy whole-file deletion/retry handler. Earlier releases left `recovery/` quarantine folders; startup now removes them from the current runtime root and session folders, and strict inspection ignores them. ### Threaded Mode Multi-Instance Bus Telegram private-chat Threaded Mode is the public switch for multi-instance Telegram operation. Classic single-DM polling is the base mode. When Telegram private-chat threads are available for the bot, the bridge enables the local leader/follower bus automatically; when threads are unavailable or later disabled, the bridge returns to classic single-DM polling as a first-class mode. Before a non-owner `/telegram-connect` chooses follower registration or singleton takeover, it discards process-local status/capability projections and reads the current owner-published mode: `enabled` registers a follower without a takeover prompt, while `disabled` uses the classic confirmation flow. Named Telegram profiles are orthogonal to Threaded Mode. The selected profile chooses the bot/session slice (`botToken`, `botId`, `botUsername`, `allowedUserId`) and scopes its durable journal cursor, its `state.json` profile entry (transport, Workspace, admission, runtime), its log labels, thread/bus ownership, and leader/follower IPC endpoints; it must not change the Threaded Mode rules. Within one selected profile, leader/follower election, bus transport, thread provisioning, routing, ownership forwarding, cleanup, and runtime diagnostics behave exactly as they do for the `default` slot. A different selected profile is a parallel bot runtime: its `state.json` profile entry, profile-labelled log records, hashed service journals, thread bindings, Unix sockets, and Windows named pipes are isolated from the default profile and other named profiles while shared bridge settings remain top-level/global. Profile reality follows three explicit storage classes. `telegram.json` shared settings and extension registries are process-global platform configuration; `profiles.default` and `profiles.` bot/session fields plus observable transport/routing authority are profile-scoped; queues, active turns, ownership caches, menu state, and runtime controllers are session-local memory. Config persistence serializes cross-process writers and applies each recursive mutation delta to the latest disk snapshot, so unrelated global/profile updates do not stale-replace one another. Each profile's journal transaction independently publishes its monotonic admission cursor together with admitted work; polling never writes runtime state through config persistence. Runtime profile switching follows stop-old/commit-new ordering: reload keeps the selected identity stable, old polling/lock/bus teardown finishes while all dynamic resolvers still point at the old profile, and only then may activation expose the new token, lock key, state path, target namespace, and IPC endpoint. Downloaded attachments are flat `kind-scope-messageId[-index][-name|.ext]` files under `tmp/pi-telegram/attachments` and are session artifacts rather than identity or routing authority. The scope is the bot username (else bot ID) for the bot's private chat, a group username or numeric ID, and for Guest Mode the remote peer's username or numeric ID, because guest message IDs belong to the peer chat. Scratch cleanup removes regular files older than 24 hours. It never age-deletes journals, ownership, state, logs, or other top-level runtime files and therefore cannot redirect live traffic or orphan immutable journal segments. When Threaded Mode is active, the current polling owner is also the Telegram bus leader. The leader owns the local bus endpoint (Unix-domain socket on Unix-like platforms, named pipe on native Windows), polls `getUpdates`, performs direct Bot API calls, records follower heartbeats, prunes stale followers, and provisions Telegram UI thread targets through live runtime/bus state. Followers heartbeat every `1s`; the leader uses a `15s` stale grace and a `1s` prune loop so transient IPC stalls do not create false routing gaps while active forwarded updates/API calls still refresh liveness. Heartbeat pruning is silent liveness bookkeeping and does not send a Telegram-visible disconnected notice, because the common cause may be leader reload or IPC handoff rather than a dead follower. Heartbeat pruning alone preserves stored owner records and Workspace bindings. The same leader can retain bounded, non-routing observations of actually registered PID/generation/target tuples for later absence proof and retry of uncommitted preservation; the [pruning contract](./multi-instance-bus.md#follower-heartbeat-is-missed) owns cancellation, admission identity and lifetime limits. When Thread cleanup is enabled, only a subsequent OS check that confirms the exact registered PID absent may create fenced cleanup intent, serialized ahead of replacement registration. With cleanup disabled, that proof instead permits a profile-admitted, fenced non-destructive detachment: the store removes the uniquely matching owner record and records first inactivity while retaining the exact Workspace binding and its letter. Publication rechecks PID absence, runtime generation, profile, leader epoch, replacement registrations and the record snapshot; missing or ambiguous restoration identity blocks it. The Thread and its messages remain untouched, accepted-work protection remains independent, and no deleted-Thread observation is invented. Successful follower target reuse refreshes the binding and clears inactivity. Durable Workspace bindings remain restoration hints after detachment; heartbeat silence or unverifiable process evidence cannot stamp inactivity. If an authenticated live follower carries an exact target that is absent from current bindings, the leader recovers it only behind a synchronous visibility probe: success activates it, explicit stale evidence provisions a replacement, and ambiguous failure rejects registration. A carried slot is restored only when it is not already occupied. `tmp/pi-telegram/logs.jsonl` is a session-local redacted runtime evidence stream for race debugging; it resets on extension start and runtime scope changes, and must not become routing/provisioning authority. `tmp/pi-telegram/state.json` is an extension+bot observable/debug snapshot aligned with status diagnostics: `source: "snapshot"` and `writtenAtMs` mark it as observational, not authoritative. All instances on one Telegram profile read the same snapshot, but only the active transport lock owner persists it; followers become writers only after promotion. Status-only persistence reloads current disk bindings before serialization, preventing a stale follower/status view from erasing newer leader-owned targets. Fresh capability observations may skip redundant startup probes, but stale snapshots re-probe before suppressing bus/thread behavior. Top-level `bot` mirrors bot-wide capabilities such as thread mode, `runtime` describes process role/status, `liveRoster` mirrors followers/current targets/reservations, `diagnostics` mirrors recent status/debug signals including the latest thread-reconciler phase/counts, `threads` stores current routeable bindings, `workspaceBindings` stores profile-scoped normalized exact-`cwd` target/name/slot reuse hints, TTL-bounded reservations explain short-lived slot collision guards, and TTL-pruned `pendingProvisions` protects in-flight topic creation slots from cleanup/allocation races. Fresh provisioning writes pending state before the Bot API create call, adds the returned target to the pending record, persists a `starting` binding, then promotes it to `active` and clears pending state. If final binding persistence fails after Telegram returns a thread id, the targeted pending provision remains as cleanup/retry evidence. Once targeted pending provisions expire, they are retained for `thread-reconciler` close/delete cleanup and pending scratchpad removal after a successful cleanup apply; untargeted expired pending records can prune without cleanup because no Telegram thread id exists. Runtime events coalesce status-snapshot writes so transient bus/API/update failures remain inspectable even when the operator has not opened `/telegram-status`. The bridge must not keep a durable `telegram-targets.json` target history; stale/offline/failed thread observations are pruned instead of reused. Previous-process leader bindings that still probe alive become reservations/collision guards, not routeable active threads, so a reloaded leader can take the next free slot without duplicating the same visible tab name. The thread chat is always the private bot DM with the paired owner (`allowedUserId`). In Telegram private-chat Threaded Mode, the leader creates/reuses its own thread before polling — it is a real bound instance, not a dispatcher. Followers authenticate bus envelopes with the leader-minted capability secret stored in the active lock entry. Bot capability monitoring does not probe through the bus until the process either owns that direct lock or has completed authenticated follower registration. A retained `enabled` capability is not proof of a running local bus: after a startup probe timeout leaves classic polling active, a fresh positive monitor result restarts Threaded transport under the current lock owner even when the persisted mode is unchanged. Unknown results do not certify this recovery, healthy buses are not restarted, and followers do not acquire leader authority through the monitor. Leader lock entries also carry a stable `leaderEpoch` minted on acquisition and preserved across heartbeat refreshes; leader-owned cleanup/provisioning plans stamp that epoch, and Thread Reconciler apply skips destructive work if leadership has moved on before side effects run. Followers own their own Pi session state, queue, active turns, previews, menus, and lifecycle hooks, but route allowlisted, target-scoped Telegram API calls through the leader. When a follower promotes after heartbeat loss, status/state diagnostics expose only the transient `electing` lifecycle phase; stable `leader`/`follower` identity stays in the bus role so diagnostics do not duplicate role state. The TUI status bar and `/telegram-status` report `leader` or `follower` role so a registered follower is not shown as generically disconnected. Terminal status identity and the `[telegram|thread:name]` prompt label use the same target-aware current-instance resolver: registered local metadata wins over a stale shared binding for the matching target, while the binding remains a fallback for partial metadata. Fresh follower binding is manual and process-first: the operator starts another Pi process, then runs `/telegram-connect`; only then may that process allocate a profile-scoped normalized exact-`cwd` Workspace identity and cause the leader to create a Thread. A later process reopening that remembered Workspace automatically sends capability-gated restore-only admission under a live leader. The leader may reclaim, visibility-probe, or stale-replace the remembered target, but an absent binding returns quietly without creating a Thread. `/telegram-connect [profile] as=Name` supplies a unique capitalized Latin-word identity only to fresh Workspace provisioning; an existing Workspace keeps its persisted name. Telegram `/name Name` stores the owning Thread's durable `manualThreadName` and immediately applies it over the active automatic display projection; bare `/name` opens five-minute exact-target input whose next valid text is consumed before agent dispatch. Name input, cancel, and reset are consume-once; stale scope, target, message ID, expiry, and duplicate callbacks cannot mutate. Reset clears only the override and restores the current automatic projection. Leader command routing reuses its already-held profile admission for the rename body rather than recursively entering the non-reentrant Workspace gate; standalone leader renames acquire their own admission. Followers send an authenticated exact-generation `workspace-thread-rename-v1` request, and the leader owns any Bot API mutation plus durable binding persistence. Concurrent processes from one directory receive deterministic Workspace suffixes, while leader/follower roles remain transient projections over that durable identity. Telegram does not expose `/thread`, auto-spawn arbitrary unbound threads, or launch hidden follower subprocesses. In Threaded Mode, `/telegram-connect` does not offer manual takeover while a live leader exists; takeover is reserved for stale-leader election/recovery. Leadership remains an ephemeral transport role that another live follower can take over after stale heartbeat detection. A confirmed runtime transition from Threaded to Singleton stops threaded transport and suspends the process-local leader target before classic polling can accept new work; durable Workspace slot, generated name, manual display name, and binding evidence remain retained. Re-enabling Threaded Mode restores or replaces that logical binding before publishing one new live target. Already-admitted turns keep their captured destination and are never silently retargeted or duplicated. ### Unbound Thread Detection For ordinary unbound prompts outside the source-bound temporary lifecycle below, Threaded Mode can expose a new thread without an existing instance binding when the owner writes in `All`. The bridge detects this during update execution: if a message from the owner has a `message_thread_id` that no instance owns, the message is routed to the unbound-thread handler instead of the leader's normal message handler. In the default runtime, this handler first reclaims the thread for the leader when the leader has no active bound thread, assigns the current leader thread identity, persists the active binding, and serves the prompt locally. When the leader session already owns a Workspace binding, that binding moves to the reclaimed tab with its slot and name (no second slot), loses its stale acknowledged title and inactivity mark, and the tab is renamed once to its display-mode title. A binding whose tab has no acknowledged title shows its display-mode title, never only its generated name. If the leader already has an active thread, the handler preserves the prompt in the source Telegram thread and shows the complete forward plus replace/restore chooser. Successful forward deletes the chooser and closes/deletes the confirmed temporary source through `thread-reconciler` proof-before-delete planning and stale-epoch fencing. Successful restore always deletes the chooser, rebinds the source thread to the selected Pi instance, and closes/deletes only that instance's replaced old thread. If foreign batch forwarding partially fails, retry sends only the remaining messages before cleanup. If Telegram cannot confirm thread or chooser deletion, the chooser becomes a cleanup-only or deletion-only retry control so already-routed content never dispatches twice and no visible button expires prematurely. Unknown `forum_topic_created` service events are recorded as observations and are not destructive cleanup proof, because Telegram can deliver creation events before local provisioning/binding writes become visible across reloads. If Threaded Mode is unavailable, the message is processed normally through classic routing. Unsettled plain-text choosers retain their route control while the journal source is deferred: creating a later chooser does not prune them after 30 minutes. Selected routes that still owe cleanup likewise keep their retry control. Age alone neither abandons nor dispatches a source; only the positively armed source-only lifetime below permits its exact expiry disposition. The existing 100-chooser capacity bound refuses additional allocation rather than evicting unresolved work. The production source-bound All-command path keeps its original deferred after chooser publication and uses the temporary lifecycle below. Callers without required temporary-Thread composition fail closed and retain their source; no compatibility chooser is published in All. Historical orphaned originals stay held; no owner recovery path is scheduled. The journal owns the `abandonPending` primitive for exact unclaimed v1 sources. It first writes the original entry and requested operator disposition to a private, content-addressed `.retained/abandon-.json` evidence copy, then atomically removes the active entry and publishes the existing `legacy-custody` discard tombstone in the journal. The copy alone is not proof of cancellation: the journal disposition is the commit authority. The tombstone prevents duplicate admission by current and 0.51.6 v1 readers without a schema change, fabricated execution failure, or task-completion claim. Retention survives journal compaction; archives are not executable journal sources. On POSIX, copies use mode `0600` and newly created directories `0700`; Windows uses the existing journal permission mechanism and inherited ACL boundary. Abandonment checks exact source binding and entry evidence, caller authority at publication boundaries, and existing discard/retention agreement on retry. It refuses queued, failed, retrying, foreign, changed or absent sources, does not repair corrupt evidence, and is not exposed by the v3 custody store. Retention/publication failure leaves original authority intact unless strict read-back proves the exact tombstone committed before a later compaction failure. The worker now exposes source-bound abandonment only for a captured v1 pending entry with its exact live deferred claim, session signal, journal binding and transport/context authority. `abandonTelegramDeferredUpdate` is the admission-carrier entrypoint; raw journal cancellation is not a substitute for worker coordination. The carrier suspends its execution fence during cancellation, including forwarded clones and late completion/queue reports. A failed or unknown acknowledgement leaves that source's claim suspended for exact cancellation retry while unrelated inputs can drain. Successful abandonment releases the claim without publishing task completion; its discard tombstone prevents restart replay. An unattempted request that fails eligibility leaves dispatch authority unchanged. Each pending chooser carries one routing phase: `waiting`, `selected`, `released` (a selection that routed nothing; All-command expiry re-arms), `forward-unknown`, `cleanup` (with its cleanup intent) or `finalizing` (with its pending confirmation). Only `waiting` with no command dispatch in flight counts as untouched, which is what Cancel, Restore sibling retention and cancellation review require. Thread selection reserves the source before awaiting Workspace admission or destination lookup, and releases the reservation after routing settles. Cancellation cannot win against this in-flight reservation or an already reported queue/completion outcome, even before its late journal settlement runs. Conversely, old destination buttons refuse a suspended or abandoned source before routing effects. Every unbound chooser whose sources can all be retained privately offers Cancel routing, whatever the content kind or group size. Admission publishes this capability only for a captured v1 pending original, copied before handler projections can mutate execution input; capability publication is not cancellation authority. The click binds the current paired owner, source sender, profile/journal, session signal, leader epoch and exact chooser target/message under profile-wide Workspace admission. Eligibility needs only an exact whole-source capability for every source of the chooser; content kind and group size do not matter. One tap retains each source once and keeps per-source receipts, so a retry finishes only the remainder; confirmed temporary tabs also permit command cancellation through their captured source. Unsupported journals, prior selection, partial forwarding, unknown issuance and cleanup-only states remain excluded. Ordinary source-only Cancel never deletes the original Telegram message. For a Thread that is not a temporary tab, a completed Cancel (including its recovery review) removes the tab through the same `thread-reconciler` unbound-topic plan once no other chooser, queue, live owner, Workspace/Restore record or retained journal arrival (strict namespace census, exempting only its own cancelled group) still names it; missing census authority, protection or any failure keeps the tab, reports a diagnostic, never retries and never changes the Cancel outcome. Temporary-tab cancellation has the separate conditional all-resolved cleanup contract below. After the discard acknowledgement, the chooser becomes an HTML cancellation notice with an empty keyboard; an edit failure retains the committed receipt so retry updates the UI without repeating abandonment. Uncertain storage results retain only cancellation retry, not destination/restore authority. Owner-facing recovery after restart uses the Status surface below; historical orphaned inputs remain held internally, without a historical-review menu. Before executing a pending v1 entry, the worker uses the journal's read-only `inspectPendingRetention` port to inspect only that entry's deterministic private retention path. An intact matching copy, or an unreadable/invalid candidate at that path, parks the source in an `abandoning` claim before routing. `abandoningClaimCount` exposes the protected subset of deferred claims. Other independently verifiable inputs continue draining; repeated wake-ups do not replay the parked source. Inspection validates bounded regular-file evidence and the full entry/binding/disposition match without repairing the archive, publishing a journal revision, or treating the requested disposition as committed. A fresh authorized caller may retry the exact journal abandonment through the worker; corrupt evidence stays protected and is never silently overwritten. The package-private `inspectTelegramAbandoningUpdates` carrier port prepares this handoff: it returns at most 20 update-id-ordered protected sources per page, detached original evidence, and exact-source retry closures. Observation reads only the worker's protected claims, not archive directories or journal files; it neither proves current eligibility/archive integrity nor authorizes dispatch. Page access and retries require the captured live worker generation, journal binding, transport/context and caller authority. Retry reuses the journal CAS, cannot be retargeted by editing display metadata, and caches an acknowledged receipt for presentation retries only while authority remains current. Ordinary deferred, queued and executing inputs are not candidates. Human-owner/source-kind filtering and the recovery control surface remain routing-owned. The leader's Status menu offers a Pending cancellations review only while its active worker reports protected attempts. Routing projects up to five originals of any input kind per review page ([row copy](./ui-style.md#route-chooser)), confined to the current paired owner/chat, journal binding, session and leader epoch. Business inputs, forwarded envelopes and sources with a live selected/partially forwarded chooser are withheld. A chooser whose every originating carrier has a proven aborted signal is obsolete evidence, not a veto on a current source-only recovery capability; missing or live fences remain protective. Ordinary Cancel routing never gains this relaxation. The review holds one bounded current surface, with fresh random callback identities so even editing the same message after router recreation cannot revive an old indexed action. Refresh, navigation and generation/authority changes invalidate earlier controls. Each retry reacquires profile-wide Workspace admission, checks the exact current chooser and source, and commits through the worker capability. Acknowledged results retire matching old reroute controls and remove the recovery action without claiming task completion; failed edits retain the exact receipt for retry. Read-only review does not probe or recreate the original Thread. Corrupt evidence and unsupported sources stay protected and never fall through to agent dispatch. This restart barrier applies once the retention copy is atomically published and to workers that implement retention inspection. A failed attempt before any copy publication has no durable cancellation intent and must not be acknowledged as cancelled. Older 0.51.6 readers respect a committed discard tombstone, but do not recognize an interrupted pre-commit retention attempt; the latter is not a downgrade-safe completed cancellation. Status recovery handles these parked attempts; it is not a general historical-pending-input recovery API. Historical classification cannot rely on a clean v1 pending entry alone. The native integration test `Historical pending source alone cannot prove no follower acceptance` holds the acknowledgement after durable recipient admission, then revokes the source generation: reopening the source yields exactly its pre-forward snapshot, with no queue receipt, owner, input claim or provenance, while the recipient still owns admitted input. A topic-created reply marker does not distinguish those histories either. This demonstrates an information boundary, not that the reporter's particular inputs were forwarded. Recreating a chooser after startup cannot supply the missing historical evidence. Each worker generation now records all update IDs in its first fully validated journal snapshot before batching or execution. Without retention evidence, those sources cannot acquire ordinary fresh-cancellation capabilities, including through a newly published chooser or direct worker call. The baseline is not advanced on read/validation failure and is renewed for every generation; entries arriving before the first valid snapshot are conservatively included. Later admitted pending inputs retain normal cancellation, and independently protected retention attempts retain exact recovery. This fresh-cancellation fence does not establish non-delivery. Historical prior recipient acceptance remains unknown; removal of its review UI grants neither cancellation nor replay. Production leader admission composes routing's narrow historical classifier; follower custody never enters this classifier. It selects supported private plain-text startup inputs with no currently live bound Thread (also protecting them when Threaded Mode is unavailable). It does not infer deletion or repair bindings. Eligible raw unsupported commands/media/unknown historical private-Thread originals without receipt/claim/provenance authority receive a distinct `retain` verdict regardless of whether their target is bound or Restore/temporary membership survives. This operator-approved policy stops ordinary bound startup dispatch for that subset; same-kind live arrivals stay outside the startup census and dispatch normally. Business, forwarded and known owner-bearing sources keep their existing owner paths. Holding is evidence protection, not sender authorization; it exposes no historical-review UI. Missing routing authority or unreadable Thread state fails closed. The domain-owned `shouldReviewHistoricalInput` classifier receives detached v1 pending evidence, the context and abort signal before any companion/default handler runs. Generation, context, journal binding, transport and exact source evidence are rechecked across its await; classification/read failure does not fall through to dispatch. Boolean true selects legacy `historical` review/spending; `retain` installs a separate `retained` claim, also included in `historicalClaimCount`, without a journal mutation or invented cancellation intent. Retain-only sources cannot be cold-spent, recovered through historical retry, generically cancelled or claimed by grouped queue outcomes. An exact acknowledged chooser clock has its own operator-approved expiry policy below; no clock is inferred from age alone. Each classifier receives detached evidence and its verdict is source-rechecked before installation. Each new generation must classify them again. Routing can also report a last-boundary historical hold if ownership changes after early classification: this suspends the carrier, refuses prior selection/queue reports, and cannot be requested retroactively after the handler returns. Its source-kind predicate receives detached original evidence through the current worker capability; a handler projection that strips forwarding/media metadata cannot manufacture eligibility. Predicate calls and their results remain generation-fenced. The native update-plan boundary recognizes only that exact carrier's acknowledged terminal hold; intentional suspension must not become a retryable execution error. `inspectTelegramHistoricalInputs` remains a package-private bounded worker capability requiring a fresh current carrier and caller authority; it scans neither archive directories nor journal files. Ordinary abandonment still rejects historical sources, and late or grouped queue outcomes cannot steal their claims. The Historical inputs main-menu entry and historical review/Stop retrying submenu are removed. The reserved `reroutecancel:history:` prefix consumes old controls with an unavailable answer, never forwarding them to companion handlers or Pi, reopening a view, acquiring mutation admission, or abandoning a source. Held originals remain unchanged; this UI removal adds no expiry, retention intent or Thread deletion. Existing interrupted private-retention attempts still use the separate Pending cancellations review, which warns that previously accepted work may continue. Native worker and cold-router tests cover retired list, selection, confirmation, paging and refresh controls. Cross-domain IPC fixtures lose an ACK after recipient admission and prove that removal leaves uncertain source evidence and independently accepted recipient work intact. Protected-attempt recovery is tested with a supplied interrupted-retention precondition, not a retired UI grant. A production-root fixture proves that the normal menu omits Historical inputs while retained Restore originals remain held. Newly confirmed eligible prompt choosers now use the source-only lifetime described below; historical evidence never acquires a fabricated deadline. Elapsed time never proves non-delivery; the explicit chooser expiry policy below may end donor attempts without that claim and separately license fully resolved disposable-tab cleanup. The operator accepted this behavior in the operator's 0.52.0 live smoke. Acknowledged private-owner routing choosers, including commands and grouped prompts, own one fixed 60-minute lifetime from their first positive publication. `journal.routingInputs.arm` retains each exact v1 source's operator, `publishedAtMs`, `expiresAtMs` and `waiting` phase; refresh/restart never renews it. Destination validation precedes atomic `select` under Workspace admission. Selection still prevents another issuance, but does not extend the donor deadline: an unclaimed selected source with an unknown delivery outcome also expires. Queue admission carries the selected clock into the queued entry; queued/running recipient work is outside donor expiry. Unsupported carriers, unconfirmed clocks and historical originals without lifetime metadata acquire no invented deadline. The operator-approved optimistic chooser policy accepts nondelivery after the fixed deadline. Expiry reacquires profile-wide Workspace admission and exact owner/context/leader/source authority, then CAS-removes the unclaimed donor pending source and writes a body-free legacy-compatible discard tombstone. It creates no private prompt archive, execution completion or recipient cancellation. Exact tombstone readback reconciles lost ACKs; changed/queued/owner-bearing sources refuse. The originating carrier loses authority, old controls are retired, and late reports cannot revive the input or block unrelated work. Expiry edits the saved journal chooser even after cold reconstruction. If that view is unavailable, or its temporary tab is about to be removed, one best-effort notice goes to this leader instance's current owned Thread in the same private chat, without replying to a possibly deleted original. A proven unissued input says it was not delivered; selected/issued or legacy-uncertain work says delivery is unconfirmed and previously accepted work may continue. Notification has independent profile/journal/session/leader/target fences after donor revocation, never writes to All and never authorizes source replay or deletion. Missing owned destinations and failed delivery remain diagnostics. A bounded body-free warm view cache suppresses duplicate album notices. A lost selection ACK may reconcile only the waiting-to-selected phase of an otherwise identical source, never grant another send. Clock-bearing historical sources survive cold spending until the same deadline; positively unbound temporary frames associated with them survive new-world forgetting. The saved clock also records where its chooser was published. At startup the routing classifier returns `revive` only for a still-`waiting`, unexpired clock with a recorded chooser, from the current owner, whose tab is unbound while live threads exist; the worker re-checks that proof, drops the source from its startup set and handles it as this generation's live input, and routing edits the recorded chooser in place (or posts a fresh one if that message is gone) without renewing the deadline. Every other clock-bearing source keeps the protective hold. The worker retries only unconfirmed source disposition. A positive expiry ACK immediately drops its deferred source and claim, before observer/UI awaits. Failed cleanup metadata is retried once per minute by the existing one-timer-per-tab scheduler, reconstructing known groups from body-free journal evidence rather than retaining prompt bodies. Future metadata retries do not join settlement waits; only running attempts do. Same-instance session replacement may reprepare unissued expiry frames under fresh authority without resurrecting a source. Missing/unknown grant state or an issued destructive cleanup forbids retry. With confirmed Threaded Mode, live bindings or a retained temporary entry, a known command or a fresh private plain-text prompt from All first enters the shared source-bound temporary-Thread path under current owner/profile/journal/context/leader authority and profile-wide Workspace admission. Threads atomically reserves a source/token intent before one `createForumTopic` attempt and records only its exact acknowledged target. The tab owns no Pi binding or A–Z slot; its presentation target is separate from the original All source. A creation error, missing target or lost publication result leaves unknown custody held, never a second creation attempt. A `created` entry can republish its chooser while its source is still pending after restart; a `creating` entry supplies no creation or dispatch grant. The acknowledged tab offers the shared Forward/Restore chooser and Cancel only when the current source has fresh private-abandonment capability. Publication defers rather than completes the original command; selection retains command semantics, and no current Pi is chosen automatically. Commands already completed by the compatibility path are not reconstructed. Unpresented expired commands keep the existing command-expiry fence; a confirmed retained tab is not evidence of expiry. Fresh threadless plain-text prompts use `New chat` with the same source-bound routing menu; unavailable creation authority records failure and retains the source without All guidance or unguarded dispatch. Recognized commands include built-in handlers (not only bot-menu entries), registered Telegram extension commands regardless of menu visibility, and discovered prompt-template commands. Bound-Thread and classic routing are unchanged. Local candidate composition is default with the required stores and owned epoch; there is no temporary-tab feature flag. Actual Pi/Telegram behavior was accepted in the operator's 0.52.0 live smoke; no owner-visible uncertainty recovery is scheduled. #### Temporary Thread Multi-Input Lifecycle (Approved Design) Every temporary routing tab carries one fixed routing name ([copy](./ui-style.md#route-chooser)), never its first input, because later prompts may join it: the bot creates its own tabs with that name and renames a native tab once, best-effort, when it adopts it. Commands and prompts share the same mode chooser. A command delivered with a Telegram-provided unbound private target uses the same chooser and fresh exact-source Cancel capability in that tab, without renaming it or creating another one. Mobile clients sending from `All` first create an implicitly named native tab and then deliver the input without a thread ID, although the client shows it inside that tab: an `All` input whose text starts with the name of such an observation (mobile names the tab after the input), or whose update immediately follows it (generic names such as desktop's `New Chat`), from the same exact scope and created at most ten seconds earlier, registers that native tab as its temporary tab through `registerImplicitTemporaryThread` instead of creating a second one, and renames it once to the routing name. A received target or successful rename alone never manufactures temporary authority. A fresh owner-authenticated private `forum_topic_created` with literal `is_name_implicit: true` supplies native creation evidence: routing retains a bounded process-local observation tied to the exact context, session generation, admission scope, operator, journal binding and executor. The next live input group in that exact target, of any content kind and either one message or an album, registers it through Threads `registerImplicitTemporaryThread` under profile admission, with that group as the entry's first input (its smallest update ID is the source), without calling or fabricating `createForumTopic` (adoption renames it once, best-effort); the publication CAS refuses any binding, owner record, reservation, provisioning, cleanup or Restore conflict. Normal grouped membership, one-shot Forward, source disposition, last-Cancel quiet period and cleanup issuance then apply identically. Historical creation signals, context/epoch changes, manual names, string flags, foreign creators and missing observations grant nothing. The observation is consumed on registration, never reconstructed from a title or restart. Existing bindings/reservations and acknowledged temporary targets retain their protections. Their root chooser offers Reroute, Restore and eligible Cancel; each mode opens its own submenu of live thread targets without dispatching the held input. A submenu Back returns to the mode chooser with its exact original description, retained on that pending chooser; navigation never substitutes or recomputes the root copy. Copy, emoji and button layout live in [UI Style](./ui-style.md#route-chooser). Cancel appears only at the root. After cancellation, the immediate cleanup remains proof-gated. Private-chat temporary tabs skip the unsupported `closeForumTopic` call and issue only one `deleteForumTopic` attempt; only literal `true` or the client's parsed exact-target `deleteForumTopic` HTTP 400 response confirming deletion/absence closes the issued temporary grant. Method, HTTP/error code, missing-target vocabulary and request target must all match; closed, denied, foreign, malformed or forged errors remain uncertain and never authorize a retry. Every kind of input sent from All takes this path: a lone text message may carry a command, while a voice note, file or sticker is held untouched as a prompt, and an album first gathers through the shared pending-group machine into one input whose whole update group the tab records as its creating input (`reserveTemporaryThread` with a group starting at the source update). All is input-only: no assistant answer, chooser, fallback guidance, draft or activity is emitted there. A failed routing-tab creation retains the source, including a coalesced album, rather than silently settling it. A stale Thread does not prove Classic Mode. The transport/API fence rejects private output without a valid top-level Thread, including retained aggregate markers; Classic DM and explicit channel/business namespaces remain separate. No historical All-output cleanup is scheduled. The Bot API files every threadless All input in All, a desktop menu-picked command as well as a mobile input its client first draws inside its new native tab. So a tab opened for such an input (bot-created or adopted, never on restart re-entry) first receives one silent best-effort `forwardMessage` of it, its chooser replies to that copy, and only a confirmed copy lets the bot delete the All original at once: the input moves into its tab on every client. That opening forward has one unretried, generation-fenced API attempt. Only a complete set of distinct positive safe-integer copy IDs acknowledged under current authority permits removal of the All originals. The live chooser retains the exact target and full source/copy ID mapping as display provenance, not input acceptance or cleanup authority; this warm mapping is not a cold-recovery grant and never rewrites journal originals. Temporary Reroute resolves its forwarding addresses from fresh worker-owned original snapshots before selecting the destination: exact source binding/update, paired sender, bot-chat message namespace and positive unique original IDs must all match. Complete warm copies take precedence; original All IDs may be reused only when this live opening attempt is known not to have removed them. A revived chooser cannot reconstruct that fact from journal IDs or its saved location. Unknown cold All copies, unavailable readers, partial group proof and synthetic zero IDs refuse Reroute before native issuance, leaving the source waiting with its exact Cancel capability; actual native-Thread originals may still be recovered. Warm target projection is not proof of an original message location. Restore retains its separate held-input path. Ended authority stops subsequent original-removal delegation and chooser publication; already issued requests cannot be unsent. A failed forward keeps the original in All; it is then deleted best-effort when the input is consumed by Forward, Cancel or expiry, which remove the tab too, but never by Restore, which keeps the tab as the Thread and must not leave it without its input. Failure is recorded and never retried. Pending-cancellation recovery deletes nothing, and typed All inputs already live in their own tab and leave with it. This multi-input lifecycle is implemented in the local candidate, not authority for live deletion. It supersedes unconditional per-chooser tab removal. The reject-only guard prevents cleanup/retirement while another known same-tab chooser remains, including unresolved cleanup-only work. `temporaryThreads.inputs` now records bounded append-only journal source groups through the unbound producer before chooser publication; duplicates are read-only, partial/foreign/overlapping groups refuse, and faults retain the source without a new chooser. Cold reads preserve this protection without process-local chooser memory. A group has no readiness or disposition flag, and an absent legacy field does not prove complete coverage. `cancelledInputs` records exact whole known donor groups after either same-journal/operator retained-cancellation evidence or the separate body-free expiry tombstone. Expiry recording may clear a group's unknown Forward issuance or its expired Restore intent, but never mutates a canonical binding, recipient queue or immutable scoped settlement proof. If Restore already bound the tab, expiry releases the temporary frame without deletion. Otherwise fully resolved groups enter the existing one-second quiet-period cleanup. A partially acknowledged known cohort may finish donor disposition when every member is absent from that exact source journal and at least one member has same-operator expiry proof; this is not recipient completion or non-delivery proof. Fresh strict namespace/protection evidence still gates deletion; independent work and bound Threads remain protected. Store publication and returned/retained acknowledgement recheck that proof and operator/executor authority; a lost reply reconciles the exact fact read-only, while missing/foreign/corrupt proof stays protective. The producer composes this into explicit Cancel before temporary cleanup or chooser retirement. Cancelled groups cannot Restore; independent sources remain untouched. More than one known group still blocks cleanup and raw retirement, including all-cancelled membership: these facts grant no deletion. Each successful Cancel retires only its own chooser. If durable membership is fully resolved by exact cancellation/completion facts and no chooser remains, a process-local cleanup is queued with no grace delay (it still waits behind the resolving operation's Workspace admission, which Cancel releases right after its notice, answering the toast and deleting any All copy alongside the cleanup; new input in the tab before it runs cancels it). Its single attempt, under profile admission, rechecks authority, whole-group cancellation/expiry evidence, exact entry CAS, a strict per-Thread journal census (every namespace source must read strictly; any retained update naming the Thread in any state, any of its own groups, and any custody-bearing, failed or non-plain entry anywhere still protect; only an unrelated waiting plain message, edit, callback or reaction elsewhere is exempt, so a chooser held in another tab cannot pin every temporary tab, and so is a plain button tap in this tab, since it carries no input and the in-flight Cancel itself may outlast the quiet period), absence of choosers and the normal reconciler protections. `issueTemporaryThreadCleanup` publishes canonical `cleanupIssued: true` only for an exact fully resolved entry with strict unbound canonical evidence checked inside the publication transaction; the normal target/source guards precede issuance and run again at API boundaries. The reconciler requires that exact retained issued frame and limits its plan to this tab; unrelated expired-provision cleanup never borrows the grant. Close/delete calls disable retries and transport fallback and require a positive acknowledgement. Confirmed current deletion alone permits entry retirement; skip, negative/lost reply, authority loss or post-rename publication interruption retains the marker. Cold reads classify already-issued entries as unknown, new membership refuses, and executor adoption never renews the grant. Missing evidence only refuses; an unpublished grant issues no API call and may still receive its first grant. The quiet period remains process-local, but issued uncertainty survives restart. The census cannot see updates in transit before journal append. Restore from a multi-input tab is allowed only when each other known group is durably cancelled, Forward-completed or a live unselected chooser that supports private abandonment. A previously completed Forward never supplies a new selection or cancellation grant. After positive settlement of every selected source, such siblings are abandoned with cancellation facts and their controls edited to cancelled, then `retireTemporaryThread(expected, authority, completed)` releases the entry (one newly completed selected group, all others durably cancelled or previously Forward-completed). Missing authority/proof or an unproven Restore leaves siblings pending and protected. On startup, a retained journal input recorded in a created temporary tab whose target a Workspace binding now owns is held as historical, never rerouted; an exact saved chooser clock may expire its unclaimed donor attempt without affecting the binding. Live pending sources and due retry-wait sources (including startup retries) use the same fresh membership/binding predicate through `shouldHoldPendingInput` before execution, with source/context/binding/transport checks after classification awaits. The hold grants neither cancellation nor delivery and does not block unrelated inputs. Recipient custody never uses this direct-source classifier. A native production witness admits a recorded command after the worker has already processed an unrelated command, proving it cannot fall through to ordinary bound dispatch. A production retry witness keeps recorded failure metadata intact without command execution, cancellation or deletion. Claimed retries cannot schedule repeated due-time wakes; independent due and future retries remain executable. Real-IPC Forward/Restore sibling witnesses now include recipient journal drain through the real worker and follower router: only the selected message executes, source disposal is observed, and repeated controls do not replay the command. Existing message-ownership composition keeps a locally published chooser's callbacks at its leader publisher after follower rebinding; the native fixture now records publication ownership rather than relying only on target ownership. Four native delivery-reply-loss witnesses cover both routing actions (Forward/Restore), before recipient execution and after worker disposal: the leader source remains unresolved without ACK, independent sibling Cancel preserves the selected group/tab, and a late reply or repeated issued Restore click cannot settle/replay it. Explicit Forward retry after a lost ACK reproduced command duplication when the recipient worker had already disposed its journal record; stable delivery identity alone was not terminal deduplication. The follower's bounded process-local delivery window now acknowledges such a retry without re-execution while it retains that delivery. Ordinary Forward from a temporary tab first publishes a durable per-group `forwardedInputs` issuance fact in the canonical Threads owner under current authority, before either local command handling/prompt preparation/queue admission or follower RPC. Only positively unpublished issuance may receive its first grant; a published fact (even if its reply is ambiguous) is never retried, including after reload, restart or leader replacement. Local repeated selection refuses the retained grant before handler or queue re-entry. Captured All-tab provenance and acknowledged typed-input membership remain protective if the metadata reader disappears; unavailable evidence never falls back to unguarded generic dispatch. Restore retains its separate canonical routing grant. Native local fixtures interrupt source completion before/after commit, prompt preparation and issuance publication/authority; issued sources stay nonterminal, independent siblings remain cancellable and cold restart never manufactures completion or another attempt. A process-local `forward-unknown` chooser phase gates the live chooser. An issued group is refused by repeat Forward, explicit Cancel and Restore (the store also rejects them); before its fixed chooser deadline it keeps sibling accounting protective, while body-free donor expiry or positive `completedInputs` may resolve it; independent siblings remain operable and a restarted chooser cannot resend. Issuance is not proof of delivery, and recipient-side deduplication is limited to the bounded process-local delivery window; the chooser deadline supplies a loss-accepting exit for unclaimed unknown issued groups; generic journal forwarding and non-chooser retry policy are unchanged. Canonical Restore keeps its existing durable grants. Mixed native witnesses prove that a completed Forward allows Restore of another group without replay/recancellation, while an unknown Forward prevents sibling Restore before an intent is created. Prompt Restore leaves a command sibling pending at queue admission, then privately cancels it only after exact scoped worker receipt disposition. Independently Forwarded queued input is neither unassigned nor cancellation-capable: either receipt may dispose first, the other retains custody, and only both positive dispositions release temporary membership while keeping the bound tab/slot. An ordinary queued ACK emits the existing source-completion hint only after whole acknowledged removal and fresh context, owner, generation and originating journal-binding checks; it creates no immutable Restore marker. A published independent Forward group fact wakes pure inspection of already settled Restore only after its Workspace admission releases. The store refuses both Forward facts and cancellation for any source overlapping a retained Restore grant, regardless of target; malformed partial selected groups stay protective. Native ordinary prompt Forward plus sibling Cancel also delays deletion until receipt disposition and fresh all-resolved cleanup. Pi handoff is supplied by the fixture, not observed model/task completion. The retained All-command fixture registers 84 scenarios across creation, Forward, Cancel, cleanup/membership and Restore, including full slots, publication faults, sibling protection, native Unix IPC and recipient worker drain through the real non-reentrant Workspace gate. Full-slot follower cases hold a real Unix response before apply, after apply, and after read-only inspection until client timeout. Fresh same-session registration/context generations reconcile only through inspection; late replies never publish readiness, repeat apply or dispatch, cancel siblings, release independent queued recipient work or delete the tab. Successful continuation retains exact scoped source-disposition proof. A separate cold-successor witness loads fresh stores and a journal binding after an issued command lost acceptance authority, then starts a fresh context/generation/epoch under supplied same-session owner publication. Original command and sibling stay pending, spent routing/canonical facts remain unchanged, and stale Restore/Forward/Cancel controls cannot replay or dispose them. No chooser is reconstructed: the protective hold is proven, not a usable cold recovery surface. Pi effects and startup registration remain supplied adapters/preconditions; actual Pi startup and live behavior were accepted in the operator's 0.52.0 live smoke. Forward completes only its own input: no Forward removes the tab, the worker's completion ACK records a durable `completedInputs` group (process-local accumulation across the group's sources), and when every known group is cancelled or completed the delayed, fully rechecked cleanup removes the tab once. Cancelled and completed groups are disjoint, cannot Restore, and a completed Forward queued prompt holds the tab until its receipt completes. The tab chooser discloses removal only when no other input remains; a failed removal no longer edits the original chooser. Source-only prompt Cancel remains unchanged. The candidate's temporary-tab chooser is the default under the owned leader epoch, not a configurable feature flag. Upgrade all prospective canonical readers/writers before live activation; the metadata (including `forwardProtocol`, `forwardedInputs` and `cleanupIssued`) is not downgrade-safe through older snapshot writers, which could drop issuance facts. Temporary Reroute publishes the prompt in its selected destination before local queue/command admission or follower IPC. The existing exact whole-group `forwardedInputs` grant precedes this one unretried Bot API request as well as native dispatch; complete distinct positive returned IDs provide display/reply anchors, never source acceptance or settlement. `forwardMessages` preserves albums and requires ascending source IDs, so the warm map correlates each destination ID with its immutable original source update ID rather than a routed zero ID or array position. Acknowledged routing copies are preferred; a proven still-retained All original or real native-Thread original may supply the source instead. Before issuance and after awaits, guards recheck source/executor/operator/context/generation/profile, exact issued group, live recipient record and Workspace session binding; followers also retain their exact registration/protocol ownership. API and IPC callbacks stay local. Reroute passes recipient/session authority plus each original execution fence to the existing socket connect/write/ACK checks, with one guarded transport attempt; a stale post-write ACK cannot settle donor custody or undo accepted recipient work. The input's warm projection uses the confirmed copy ID and clears former-tab reply suppression before carrying the original execution fence; donor journal originals remain untouched. A partial/malformed/lost API reply or revoked authority keeps the issued group nonterminal with no output or native retry, even after restart. A lost native IPC ACK similarly retains donor authority and cannot replay an already accepted recipient input or its display copies. Local receipt disposal and exact whole-group foreign source-removal ACKs still own temporary cleanup; neither a visible copy nor model completion grants deletion. A follower donor ACK may precede recipient receipt disposal, so a fully resolved but protected, unissued tab retains one metadata-only one-second recheck and accepts existing session-delivery drain wakes. Every attempt reacquires profile admission and fresh namespace/binding/source/authority proof; time is not a deletion grant. A fresh runtime drain can reobserve retained completed membership without replaying its input. Issued or unknown deletion never repeats. Restore's held-input sequencing and cleanup schedules are unchanged. A canonical temporary frame in phase `created` identifies its own independently created tab: either the exact one-shot `createForumTopic` response was acknowledged, or an owner-authenticated fresh implicit creation was admitted. An unrelated Workspace creation intent without a target therefore does not turn this positively identified tab into an unknown target. That uncertain intent is retained unchanged; this is neither age-based expiry nor permission to discard its recovery evidence. Any concrete provision targeting this tab, binding, owner, reservation, Restore operation, unresolved source or uncertain issued deletion retains its existing veto. `creating` frames never acquire this exemption, and generic unknown-target cleanup keeps its separate conservative rules. Restore old-target protection uses its exact binding/slot/owner/target conflict contract, including late recovered target evidence, rather than treating every unrelated targetless creation as a global veto; see the [Live-Rebind Channel](./multi-instance-bus.md#live-rebind-channel). Fresh local menu Reroute (`/start`, `/help`, `/status`, `/model`, `/thinking`, `/queue`, `/settings`) uses the existing selected-command owner with a release barrier captured during preparation. After acknowledged destination publication, exact worker completion readiness and paired-recipient validation permit one acceptance report, not immediate menu effects. The routing operation finalizes its chooser and releases profile admission while retaining its exact source references. A bounded subscription then requires the worker's exact removal ACK; absence, a thrown removal after commit, timeout or ended source authority is not completion. Cleanup acquires a new profile admission, behind source-completion bookkeeping, and rechecks every ordinary temporary-tab protection. Only then are the accepted menu effects released under the captured recipient/session/target guard. Siblings, live queue custody, unconfirmed deletion and other protection may retain the tab without cancelling the independently accepted menu. An issued deletion never repeats. Lost recipient authority or an unconfirmed source ACK suppresses effects without replay. Sources lacking fresh exact completion readiness, other command kinds, follower delivery and Restore retain their existing paths; neither queue-producing commands nor cold inputs are pre-completed to manufacture cleanup authority. Ordinary follower ACK proves durable custody but does not hold the recipient worker before execution. Restore's held-command RPCs additionally bind relocation, saved input and canonical release authority; they are not a negotiated Reroute release protocol. Mutating local commands complete after their semantic action, and queue-producing commands retain their separately acknowledged receipts. Startup/historical inputs are excluded by the worker's fresh-source readiness predicate. Those contracts cannot borrow the menu-only barrier by changing command classification or weakening source protection. - `Membership`: A positively source-linked disposable temporary Thread owns no Pi binding or A–Z slot and may contain multiple independent unassigned inputs, each with its own routing controls. Track exact journal source/group membership, including additional inputs, rather than treating the first chooser or a process-local count as the whole Thread. Serialize admission, selection, cancellation, Restore and cleanup through the existing Workspace admission and mutation owners; unreadable, incomplete, selected, accepted, running or unknown-issued evidence blocks deletion. - `Per-input Cancel`: Privately retain the exact original and positively commit source-only cancellation before acknowledging `Routing cancelled` and deleting its one-shot chooser message. Other unassigned inputs retain their choosers and custody; cancelling one input neither delivers nor cancels siblings. No separate Cancel-and-delete action or extra confirmation dialog is required, but the chooser must disclose the conditional whole-tab deletion consequence. - `Last-resolution cleanup`: Only an explicit Cancel or positive completion of an explicitly issued Forward that resolves the final known group may schedule deletion of the entire still-temporary Telegram tab, including all its messages. The operator-approved grace is now zero, superseding the earlier 1-second and 2–3-second designs: deletion is attempted right after the chooser is deleted. For Last Cancel, scheduling follows positively recorded whole-group cancellation and successful retirement of the final chooser, not the initial button tap. The timer establishes earliest eligibility for one proof-gated cleanup attempt, not an exact deletion time: Workspace admission, fresh protection checks and Bot API latency may delay or refuse it. Actual client timing was accepted in the operator's 0.52.0 live smoke. Mirrored native witnesses use shortened injected delays, not a production-default or Telegram-client timing measurement. This grace is presentation timing, not proof of emptiness or non-delivery. New input or a changed binding/authority cancels the scheduled cleanup. Immediately before issuance, reacquire current Workspace admission, recheck exact operator/profile/session/leader/source/target authority, positive disposable-tab provenance, complete source dispositions and all Thread protection, then publish the canonical one-shot temporary cleanup grant. A restored/bound Thread or any unresolved/unverifiable work remains protected. TTL, startup, silence and a zero chooser count do not manufacture this last-Cancel grant. Failed/unknown deletion cannot undo cancellation or cause automatic repeat issuance. - `Forward`: Forward only the selected input and preserve independently held siblings. Its existing source-tab cleanup cannot erase another unassigned or protected input; per-input completion is not whole-Thread deletion proof. - `Successful Restore`: Preserve this tab as the selected instance's bound Workspace Thread and keep its slot; only the selected input is delivered. Positive settlement of the selected input deletes its chooser message; protected old-Thread cleanup never holds the chooser back. Cancel the exact other still-unassigned inputs with private retention, positive source-only disposition and invalidated controls, without delivering them to Pi or physically removing the restored tab. Already selected, queued, running and unknown-issued work is outside sibling cancellation. Failed or unknown Restore does not cancel siblings. Composition must establish the exact sibling set under serialized membership and prevent held/partly-cancelled originals from falling through to normal bound-Thread execution after relocation; a retention/ACK fault preserves unresolved sources and cannot roll back independently accepted work. - `Validation and activation`: Native witnesses must cover two/three inputs, grouped sources, different cancellation orders, new admission during the grace, concurrent selection/Forward/Restore, stale controls, incomplete membership, retention/ACK faults, restart and one-shot unknown deletion. Operator-controlled live acceptance must explicitly authorize disposable test-tab deletion; it passed in the operator's 0.52.0 live smoke. #### Deferred Last-Cancel Cleanup Boundary (Native Assessment) Managed temporary tabs already retain the original resolved membership and unissued cleanup frame. If independent accepted work protects the first attempt, exact whole-receipt disposition through that work's native owner permits a later one-second recheck or the existing delivery-drain wake. Every attempt reacquires current profile Workspace admission, rereads the exact frame and native source-protection evidence under source serialization and participating references, and rechecks target/authority before issuance. Native witnesses independently disable the periodic retry and the drain path: the retry-only case fails without its timer, while a delivery wake still succeeds; disabling both makes the wake case fail. Ended session authority, an observed conflicting claim and issued/unknown deletion remain protective. No `/start` replay, fabricated receipt completion or weakening of journal protection is needed. Ordinary orphan tabs retain a distinct execution boundary. `deleteCancelledOrphanTab` keeps the immediate attempt under original Cancel authority. For the last chooser, Root retains an `orphan-cancelled` intent inside that Cancel's profile admission when independent work or unavailable namespace clearance blocks the immediate path, provided original retained-source facts, live leader/session authority and the compatible original reader roster remain valid. A clear original attempt keeps its existing immediate path without a new frame. The retained intent is not a creation certificate or an effect grant. Target protection prevents the original immediate branch from deleting around it, including exact receipt disposition during the cancellation toast. The private v1 Store reader `inspectAbandonedPending()` and Root's reference-owned `TelegramUpdateJournalBindingRuntime.inspectSourceAbandonment()` optionally return a frozen `originalTarget` containing original chat/Thread/message coordinates and the exact retained-entry `sourceSha256`. A shared pure projector admits only a sole ordinary human bot-chat message whose positive private chat identity matches the recorded `telegram-owner:`. Business, edited, callback, unknown/ambiguous envelopes, foreign/bot/missing senders and incomplete addresses retain their ordinary cancellation evidence without this stronger locator. Missing or altered retention still refuses; neither successful nor refused observations repair or mutate source bytes. The historical path produces these body-free facts inside the existing bounded native family acquisition, only after exact original/digest/disposition validation and committed classification. It carries the inspected facts through retention metadata rather than reopening the archive or creating another reader/registry. Root's caller reference, original source serializer, canonical source/profile/bot checks, complete family recheck and final post-serialization authority fence remain in force. Bot-ID discovery preserves the exact historical binding key; an unprepared successor may read historical facts without preparing any active execution. The Store's existing strict archive validation uses the same role/digest projector. These are observation data, not new wire/schema fields, source-reference leases, creation certificates, cancellation grants or deletion authority. Copies cannot change the retained origin. Body-free expiry has no archived original and does not gain this field. Original last-Cancel registration and fresh deferred execution consume these observations only under their respective live authorities. The private Workspace/temporary owner provides `registerCancelledOrphanThread()` as a storage-only CAS. Root's original last-Cancel path composes it for protected orphan cleanup, not creation, rerouting or deletion. While original Cancel/profile-admission authority is live, it captures the exact source group, target, operator, executor and session generation before observations, then requires fresh whole-group committed-retention facts at publication fences. The existing profile/token-scoped snapshot retains a distinct `orphan-cancelled` frame with cancelled membership, original executor/generation and body-free per-source message IDs, digests and canonical retained paths. It does not claim a creation request, implicit creation, Forward protocol or cleanup issuance. Duplicate exact registration is read-only and cannot change token or original scope; missing/changed observations and interrupted pre-rename publication preserve the old state. Explicit fresh-session replacement below is a separate registration, not adoption or rebasing of that grant. Lost post-rename acknowledgement may leave the exact unissued frame, never a replay/deletion grant. A fresh human Cancel may pass an exact `superseded` frame to the same private registration CAS when the native current session counter proves a strictly older generation in the same runtime instance. Only an unissued `orphan-cancelled` frame for the same operator/target qualifies; same/live or newer generation, foreign instance, created-tab provenance, source overlap, reused token and every issued/unknown marker refuse. The CAS validates both generations' whole original groups, including historical journal-binding keys and every saved old digest/path/message, through publication. It atomically replaces only the exact old row with a fresh token, birth, generation and new-source history; neither private archive is changed. Pre-rename loss keeps the old row; post-rename loss may leave the fresh unissued row without returning a grant. No source is replayed, and the old scope cannot issue or regain authority. Root uses this path even when the new cancellation's namespace is clear but the ended-generation frame would veto immediate deletion. A plain clear Cancel without such a frame keeps the existing immediate path. Still-protected receipts keep the new intent unissued, and subsequent deletion uses the existing fresh v2 capture, profile admission, original proofs and complete census. Fresh legal bindings/claims remain vetoes. This transition changes no storage codec or wire capability: both records have the existing unissued v1 shape, and an issued hazard is never replaced. Native journal/Workspace/admission fixtures prove clear and protected handoff, current-generation non-rebasing and issued uncertainty; source/compiled fault partitions retain exact archives and CAS behavior. Separate source/actual-dist Routing witnesses change the polling journal together with the generation and consume both bindings through the reference-owned native historical reader, never stopped worker callables. Equal numeric update IDs cannot substitute for the original source key. Queued custody, crossed proof, reader/session loss and post-rename acknowledgement loss retain their distinct protections; a later fresh compatible scope may proceed only from the retained unissued intent, never from an old or issued grant. Orphan registration requires positive canonical unbound classification, with warm owner/binding/provision state and incomplete local claims also protective; unknown-target provisions cannot borrow the exemption reserved for genuinely created temporary tabs. The new frame owns no target or slot: a later legal provision or binding remains possible and changes fresh classification to unknown/bound without erasing the intent. Existing temporary adoption, creation acknowledgement, input advancement, cleanup issuance and retirement APIs refuse this phase; strict cold decoding rejects creation downgrades, forged issuance and incomplete scope/proof metadata. The native fixture retains an actual independent queued receipt unchanged while registering the intent; this is not permission to delete around that receipt. The private `issueCancelledOrphanThreadCleanup()` CAS now publishes the existing `cleanupIssued` marker once for this phase, before any transport effect. It requires an exact retained unissued frame, fresh whole-group original facts matching every saved digest/path/message, the original runtime instance and session generation, fresh profile authority and positively unbound ownership. A new leader epoch in that same instance/session may issue without rewriting original history; another instance/session cannot. The caller must retain complete namespace clearance and v2 reader compatibility through its currentness fence. Native source/compiled fixtures hold actual profile admission and source references, retain real queued custody, remove only the exact owner's whole receipt, recapture complete namespace clearance, then issue under a fresh fence after the original Cancel has ended. No original callback is revived or stored. An issued or post-rename-unconfirmed frame cannot issue again. It survives cold reads and new-world forgetting, protects the target from provision/binding reuse while the destructive outcome is unknown, and cannot use ordinary temporary adoption/retirement. The cleanup-current query remains only a read-only veto for a separately obtained grant; orphan calls carry the original session generation. The issued shape independently requires `workspace-orphan-intent-reader-v2`, in addition to v1's unissued codec. Root advertises both and derives requirements from one canonical snapshot; v1-only peers cannot satisfy an issuance compatibility capture or join an issued-state roster. Deferred execution reuses the existing temporary-cleanup timer map and last-Cancel scheduling point, plus delivery/session-settled wakeups. A hint requests observation, never effect authority. Each attempt captures fresh native v2 reader compatibility, acquires fresh profile admission, pins leader/store/source/transport providers, and requires the retained original runtime instance and session generation. It rechecks every saved original and complete namespace/source-reference protection through issuance and the actual HTTP authority hook. Legal replacement bindings/claims and new accepted work remain vetoes. A same-instance/session leader epoch change may issue without rebasing original history; an ended/replaced session cannot. The issued entry goes through the existing guarded cleanup planner/transport: one non-idempotent request, no ordinary temporary grant and no retained Cancel fence. `retireCancelledOrphanThread()` removes only the exact issued frame after a positive exact-target deletion outcome under live authority. Missing/false/lost acknowledgement, post-publication reader loss and pre-HTTP refusal retain the issued hazard; timers, drain hints and cold reads cannot replay it. Failure to publish retirement also stays conservative. Native fixtures cover actual queued receipt disposition, periodic-only and immediate session wakeups, legal replacement, missing originals, new custody before rename, same-session epoch change, spent reader membership at publication/HTTP, false/lost ACK and cold uncertainty. Archived originals and independent custody remain unchanged. Reader compatibility remains separate from write/execution authority. Original last-Cancel registration captures the native roster before providers/chooser awaits; deferred attempts capture their own v2 roster before admission awaits. Registration, replacement, removal, prune and clear spend the native payload-free membership marker, including equal-field restoration; heartbeat does not. Captures pin protocol/provider identity and supported original registration generations. Leader registration reads canonical requirements before provisioning, after waiting for admission and again before live publication; followers cannot infer a write grant from an ACK or an empty local roster. Operator-controlled loading still requires upgrading every shared-state reader/potential successor under the [protocol compatibility contract](./multi-instance-bus.md#protocol-identity-and-compatibility). No fabricated creation evidence, parallel retry registry or elapsed-time grant is introduced. Broader orphan-to-fresh-tab routing, independent review, supported-platform/live acceptance and release remain separate gates; local fixtures are not live deletion acceptance. #### Restart As A New World (Operator-Approved, Implemented Locally) A Pi process restart starts a new routing world. Unfinished routing from the previous process is not restored, reconstructed or announced: - `Spent prompts`: Pending prompts that Pi never accepted into its queue — unselected, chooser-held, temporary-tab or Restore-held, including an issued but unconfirmed Forward — are spent: removed from pending custody without Pi delivery, a private retained copy, a notification or task completion. The polling cursor already prevents Telegram redelivery; spending is disposition, never replay. Implemented: the leader worker's `spendHistoricalInput` removes startup-census pending sources that carry a routing input or that the domain classifier marks boolean true, under current authority, through ordinary removal without completion observers. A distinct retain-only verdict takes precedence over an old routing clock and spending; unsupported protected originals remain unchanged. Retry-wait sources, interrupted private abandonments, queued receipts and live arrivals keep their existing holds; unknown classification spends nothing. Also implemented: the leader's startup hint, fenced by the owned polling generation, calls routing `forgetPreviousWorld`. Under profile admission it atomically removes this operator's Restore intents and temporary entries whose executor belongs to another runtime instance (a reload is a new instance), then makes one non-idempotent `deleteForumTopic` attempt per previously classified disposable created tab still unreferenced by bindings, active records, temporary entries or Restore intents, and only after a fresh strict source census returns complete-empty. Retained, unreadable or unavailable source evidence blocks that deletion without reconstructing the forgotten intent. - `Old temporary tabs`: An unbound tab with positive disposable provenance gets one silent deletion attempt. Failure or an unknown outcome leaves the tab without retry. - `Unfinished Restore`: The intent is forgotten. Already committed canonical binding changes stay as they are, without rollback. - `Old controls`: Choosers and buttons from the previous process answer with the shared expired-choice notice `TELEGRAM_ROUTING_CHOICE_EXPIRED`. A newly committed expiry uses the more specific undelivered/unconfirmed notice described above ([copy](./ui-style.md#route-chooser)). - `Untouched`: Committed Workspace tabs and bindings, prompts already accepted into the Pi queue (exact receipts), follower custody, and in-process `/new` succession, which is not a restart. The user recreates a temporary tab and restores again when needed. This superseded the earlier cold policy: working-tab attestation, held-source inspection/scope capabilities and strict per-group cold disposition/finalization were removed. The historical classifier, temporary-tab hold, one-shot startup hint and polling-generation fence remain as inputs to spending and forgetting. The routing identity split is deliberate: - Live routing owner: `instanceId` from the currently registered follower/leader runtime. A live instance may have only one active bound thread; provisioning a new target removes older current-state bindings for the same `instanceId` and closes duplicate Telegram threads when possible. - Current binding owner: explicit `owner` metadata (`leader`, `manual-follower`, or API-level pending thread creation) plus cwd/thread-name metadata; string compatibility keys are derived internally and must not be the persisted source of ownership truth. - Instance slot: extension-owned single-letter `A`-`Z` ordering metadata. New instances advance through the alphabet and wrap after `Z` only to a free slot; live concurrent instances are capped to available alphabet slots rather than duplicating occupied letters. The compact `bot.lastSlot` cursor persists while its binding remains live/recovering, including true `Z → A` wraparound. When post-grace follower compaction removes the binding represented by the cursor, the same reconciliation pass realigns it to the newest-created remaining live binding so removed historical followers cannot dictate fresh allocation; unexpired pending provisions and reservations remain collision guards. Other thread deletion paths may intentionally preserve an orphaned cursor to continue ring sequence. - Instance thread name: durable human-facing Workspace metadata that replaces slot-only thread titles. Fresh threads choose an unused baked 4-6 letter Latin-word name, excluding current records, dormant Workspace bindings, and pending provisions; exhausted per-slot palettes fall through the remaining curated names rather than duplicating a reserved identity. Telegram-originated prompt prefixes expose this label, never follower/leader roles or generic seeds. Renaming a live target updates its matching Workspace binding. - Telegram destination: `TelegramTarget` as `{ chatId, threadId? }`, where `threadId` is Telegram `message_thread_id` for UI thread targets. Guest-mode updates are owned by the current transport leader by default in Threaded Mode. Guest queries have no Telegram thread binding and no local follower identity, so the leader queues and answers them unless a future explicit guest-owner policy is added. Followers may still transport `answerGuestQuery` through the leader for replies to work if a guest turn is ever delegated deliberately, but implicit guest routing does not pick an arbitrary follower. All inbound updates are gated by the configured authorized user id. ## Core Flows ### Inbound Turn Flow 1. Poll updates through `getUpdates` under the polling owner's request budget. 2. Validate and atomically journal each complete response batch before advancing its offset once. 3. Signal the independent source-bound worker and begin the next poll without awaiting semantic execution. 4. Run stable public raw-update handlers in registration order, then authorize and route retained built-in traffic. 5. Coalesce media groups, likely split long text, and one adjacent forward-plus-comment pair in either order when needed. 6. Download files with size limits and partial-download cleanup, then run configured/programmatic inbound handlers. 7. Build a prompt or control queue item carrying an exact durable receipt for every contributing update id. 8. Remove local prompt journal authority synchronously immediately before `sendUserMessage`, so session/process replacement can lose an unstarted prompt at that narrow crash boundary but can never replay a prompt already admitted to Pi; controls and foreign forwarding retain their explicit settlement boundaries. 9. Handle `edited_message` updates separately while the original turn is still queued and dispatch only when all safety gates are clear. Attachments stream into private unique `.part` files and publish by rename only after complete, size-checked download. Windows `EPERM`/`EACCES` sharing failures allow at most six rename attempts, with abortable `50/100/200/400/800 ms` waits; no metadata/content HTTP request is replayed. Non-Windows, non-sharing and exhausted errors propagate, cancellation stops retries, and failure removes the partial file without deleting the existing target. This is attachment publication policy, not a journal/state recovery rule or strict Windows evidence. #### Durable Admission And Recovery Here, **durable** means recovery across ordinary process exit, crash, kill, and replacement after a successful atomic rename is visible to the filesystem. It does not promise survival across host, kernel, filesystem, storage-device, or power failure: journal and offset publication do not call `fsync`/`fdatasync`, and parent directories are not flushed. A host-level failure may therefore lose a recently acknowledged rename despite correct process-level ordering. Operators requiring that stronger boundary must place the agent directory on storage with an independently managed durability/backup policy; `0.28.0` must not be described as power-loss durable. The profile-scoped journal separates transport progress from semantic progress. Polling and local leader/classic admission use the owners-named journal, normally `tmp/pi-telegram/sessions//inbox[.].json`; active follower recipient custody uses `sessions//journal.[.].json`. Existing root custody and missing-session compatibility are retained, not migrated. See [Session-Owned Journal Storage](./multi-instance-bus.md#session-owned-journal-storage) for path selection, succession and sweeping. The selected post-v1 storage design is one revisioned compacted snapshot plus immutable atomic transaction segments beside it. Existing v1 files load as implicit revision `0`, while positive snapshot revisions are explicit. Immutable revision segments publish privately and atomically under the existing journal transaction lock; exact repeats are idempotent, while gaps and conflicting duplicate revisions fail closed. Each segment carries one complete mutation, and readers reconstruct ordered upserts, removals, and operator-disposition state only from revisions newer than the snapshot. Malformed or gapped segments, filename/revision disagreement, and foreign journal identity fail closed. Compatibility recovery for the former broad temp-cleanup bug rebuilds a missing snapshot when its complete revision-1 segment chain removes known base authority before any upsert and reconstructs to an empty journal, and repairs a revisionless snapshot when the first surviving segment supplies its exact positive predecessor revision and the reconstructed tail validates. If repair fails, the transaction-locked loader follows the operator-approved corruption policy: it deletes the damaged segment directory first, then atomically replaces the snapshot with a fresh empty private journal (a non-file snapshot path is deleted), records an informational recovery event listing the deleted paths, and continues startup. Damaged inputs are lost by design; no `recovery/` quarantine is created. Deleting segments first prevents stale segment replay beneath a fresh revisionless snapshot. A crash or failed publication can leave an absent snapshot or the old damaged regular snapshot; deleted segments are not restored, and a later read may reset again. Private `.retained` originals are not touched by this reset. After the initial snapshot, append, batch completion, queue receipt/owner/handoff, retry/terminal, recovery, and operator dispositions publish only changed upserts/removals and disposition replacement in one segment. This avoids rewriting retained raw updates during completion-heavy drains without splitting exact queue, failure, recovery, or disposition transactions. Compaction runs under the journal transaction lock when either 256 unapplied segments or 4 MiB of segment bytes is reached. It publishes the complete private (`0600`) snapshot at revision `R` before best-effort deletion of segments `<= R`; failed cleanup leaves redundant segments that readers ignore. Interrupted cleanup therefore leaves either an older snapshot plus newer authoritative segments or a newer snapshot plus harmless redundant older segments. Revision gaps, conflicting duplicates, malformed segments, and identity mismatches fail closed. The logical reconstructed journal and aggregate unapplied segment bytes are independently bounded at 10,000 entries and 32 MiB as applicable; rejected growth publishes neither snapshot nor segment bytes. Compaction may temporarily require exactly one private complete snapshot of at most 32 MiB. Capacity pauses polling without deleting or resetting valid authority. The separately approved slotless session-family sweep can delete valid recipient families; it is not a capacity-recovery or settlement path. Only a history that cannot be reconstructed safely uses the delete-and-reset fallback above. `pending` entries remain immediately executable while raw interception, routing, or grouping is incomplete. Execution failures become `retry-wait` with durable attempt count, next eligible time, failure class, bounded summary, and latest failure time, except that an exact HTTP 400 stale/deleted Telegram thread error carrying its proven request `{chatId, threadId}` terminally settles the currently executing source after shared binding invalidation; follower settlement remains idempotent when the leader already persisted that stale binding. The `failed` state remains schema-compatible only for legacy candidate journals and is converted to automatic retry during lifecycle startup. `queued` entries carry exact prompt/control receipts plus the acquiring Pi runtime instance, OS pid/birth identity, session generation, acquisition id, and acquisition time. Queueing alone is never completion. Queue receipt ownership is independent from the Telegram transport lock. A same-instance, same-process generation may reconstruct its local receipt across a fenced session replacement and may settle it after transport ownership moves. A different process reports the receipt as foreign, never republishes it into its local queue, and cannot complete it even if it reads the acquisition id. Startup no longer treats process replacement as proof that an owner died: foreign and legacy unowned receipts remain durable. Scoped queued completion retains the live issuer's immutable whole-receipt attempt before disposal. Refresh preserves that owner's frozen claims and committed receipt/prepared-scope prerequisites even when committed removal has made journal rows disappear, and never republishes issued receipts. Shared batch attempts are deduplicated during preservation. Issued attempts remain unavailable through execution-readiness getters, including unresolved pre-write failures with queued rows still present. Only the same current worker with matching reason, binding, identity and complete scopes may inspect exact retained markers and acknowledge local cleanup; missing, conflicting or unreadable proof stays held. Reconciliation never issues disposal again or re-enters a handler, queue publication or result. Stop/start creates a different owner and cannot inherit the attempt. Public signal/drain refresh and prepared mixed-settlement regressions exercise this boundary; temporary getter-metadata mismatch/restoration is same-owner revalidation, not global ABA or process-replacement proof. Cleanup and live handoff are compare-and-set under the journal transaction. Queue discard during exact queue-lifecycle cancellation requires the exact local owner/acquisition and removes all receipt sources atomically. Before admission worker start, the lifecycle groups each foreign receipt and asks the journal to recheck OS pid liveness plus process-birth identity under the same transaction; a live owner returns `owner-alive` and a live owner without stable birth proof returns `owner-unverifiable`, both without mutation, while exact negative proof atomically discards the complete session-owned receipt without replay. Replacement registration carries its exact pid/process-birth before this check; when registration and cleanup race, that live identity wins the liveness proof and the queued receipt remains untouched. A replacement or unrelated worker therefore never executes queue work whose prior owner is proven dead. Authenticated live handoff uses journal CAS plus bounded local IPC. The donor creates a one-time high-entropy token and durably offers the complete receipt to one exact recipient runtime/process/session identity; the journal stores only a digest bound to queue kind, receipt sources, donor acquisition, and recipient identity. While offered, donor completion/discard and dead-owner recovery fail closed, so authority cannot disappear during payload transfer. Prompt payloads carry all queue fields; control payloads carry only their stable `status`/`model` identity and rebuild executable closures locally. The separately negotiated `queue-handoff-v1` capability gates this envelope for leader and both peer generations. Each receipt carries its exact source journal binding; the donor derives the recipient follower-journal binding from the authenticated stable follower profile before routing. The bus validates payload shape/size and exact donor/recipient registration generations, and the recipient selects only that matching active lifecycle, stages one complete receipt idempotently, accepts the journal CAS, and returns the exact receipt plus newly minted owner in its ACK. Malformed, legacy-unbound, inactive-generation, or unavailable bindings fail closed. During recipient staging, presenting the token atomically replaces the journal owner with a fresh acquisition carrying the handoff digest, removes the offer, and permanently fences donor settlement. The donor treats only an ACK carrying that exact accepted owner as success and never repeats acceptance against a donor-bound journal runtime. The recipient can repeat the same acceptance idempotently; a different token cannot claim an already accepted receipt. The coordinator contract orders offer → stage/accept exact receipt-and-owner ACK → donor removal → recipient readiness for direct leader→follower and follower→follower routing. Before acceptance, negative or mismatched acknowledgement exactly cancels the offer and keeps donor work. After acceptance, a lost acknowledgement cannot roll authority back: cancellation fails closed and donor memory remains frozen until exact accepted-owner reconciliation removes it. Recipient registration carries exact process-birth/session identity, and staged payloads remain outside the live dispatch store until accepted journal authority has been reconstructed. Production advertises `queue-handoff-v1` only with this exact role/journal selection and uses the same coordinator ordering for direct leader→follower and follower→follower routes. Queued semantic authority has no elapsed-time lease. A timeout cannot prove either owner death or effect quiescence, so it cannot safely resolve a receipt. Resolution is limited to authenticated live handoff, exact owner discard/settlement, or transaction-rechecked negative PID plus process-birth evidence that permits terminal cleanup without replay. Live or unverifiable owners remain queued rather than risking duplicate or cross-session execution. Workspace pressure may request the same terminal dead-owner cleanup only after full `A`–`Z` allocation failure, current inactive-binding authority, complete strict source enumeration, no local/live/delivery authority, whole unoffered same-target receipt groups, and preflight death proof for every group. Journal CAS remains the mutation authority. Partial success or interruption is safe progress only: a fresh all-clear protection capture and normal retirement fence are still mandatory before Thread deletion. The initial `offset: -1` cursor bootstrap is allowed only when both cursor and journal are absent or empty. Thereafter process-level ordering is journal atomic rename → one monotonic offset atomic rename → worker signal. Failure before journal publication leaves the offset unchanged; failure after journal publication but before offset publication permits Telegram redelivery and journal dedupe; failure after offset publication but before worker signal replays from the journal on restart. Queue-owner, retry, terminal, handoff, and completion transitions use the same journal publication primitive and therefore share this process-crash boundary. The final completion window is at-least-once, so replay-sensitive external effects must use `update_id` or the stable delivery id as an idempotency key. Threaded Mode forwarding is a two-journal handoff. Only peers that share the current base protocol and mutually advertise `durable-follower-admission-v1` may route or become election-eligible. The follower validates its exact binding and registration generation, durably appends the source-bound delivery, and only then returns the exact receipt. The leader classifies each attempt as `accepted`, `retryable`, or `terminal-rejected` with its delivery identity and failure class; only `accepted` with the expected `deliveryId` and `sourceUpdateId` may complete leader journal authority. Missing, negative, stale-generation, or mismatched-receipt acknowledgements remain durable, and a callback error answer is only an operator-facing side effect. The follower's bounded [delivery replay window](./multi-instance-bus.md) acknowledges a repeated `deliveryId` without re-execution. Delivery ids derive only from envelope kind, source `update_id`, and stable recipient binding. Live registration generation remains a separate attempt fence. Message ownership carries the stable binding and rebinds to its current authenticated follower registration after replacement. `ownership.getForwardOwnership()` projects the protocol identity from the exact matching live instance, registration generation, and binding on every lookup; protocol is not cached with message history. The same port serves messages, edits, callbacks, and reactions, including callbacks without a Thread ID. If a cache lookup returns a foreign record but no matching durable-capable protocol can be projected, that record remains foreign and fails forwarding validation rather than falling through to local execution. The final bus validator independently rechecks generation, binding, and complete protocol identity before transport. Lost acknowledgements therefore retain the same delivery identity; only the exact durable receipt completes the source. Package build skew is allowed only while protocol version and capabilities remain compatible. Worker execution ownership is per `update_id` across same-runtime generations. Aborting a generation ends its authority but does not prove its handler settled; replacement replay remains blocked on that exact settlement. Late success and failure are both diagnostic events. Public and built-in handlers receive the same optional execution fence (`signal`, generation/update identity, and pre-effect assertion); the runtime binds it non-enumerably to every internal update carrier and checks it before routing-plan effects. Prompt construction rechecks after downloads and inbound handlers before queue mutation, pairing rechecks around persistence, command/menu and extension-command delegation retain the source fence across detached effects, lifecycle sync rechecks after store load before reconciliation, and reroute clones carry the source fence through forwarding, thread replacement, cleanup, persistence, and Bot API rename boundaries. Legacy handlers remain source-compatible but must not commit unfenced late effects. The canonical update transition contract is: - `pending → executing`: the generation-local worker selects an unclaimed source; `executing` is a runtime phase, not a separately persisted entry state. - `executing → completed | queued | pending | retry-wait`: exact local completion removes the entry, queue admission persists its receipt, deferred grouping retains replay authority, and every execution failure persists retry evidence. - `retry-wait → executing`: only after `nextRetryAtMs`; repeated signals before eligibility do not execute the entry. Automatic retries continue indefinitely with exponential `1s → 2s → 4s → 8s → 16s → 32s → 60s` delay capped at `60s`, while later independent updates continue draining. - Legacy `failed → retry-wait`: startup atomically resumes terminal entries written by earlier `0.28.0` candidates. Ordinary execution/retry policy never silently discards valid inbound authority and exposes no Pi command for manual retry/discard. Approved damaged-history reset and disposable-session sweeping are separate storage-loss policies, not successful execution or receipt settlement. - `queued → offered → staged → queued`: only the exact persisted donor may offer or cancel a live handoff; an offer preserves donor ownership but freezes ordinary settlement and recovery. Authenticated bounded IPC stages one exact payload/receipt outside the live queue. Exact recipient acceptance mints a fresh acquisition, reconstructs local ownership, removes donor work, then publishes recipient dispatch readiness. - `queued → completed`: only the exact persisted owner receipt may complete or discard queued sources; generic completion rejects queued state. Process-birth-proven owner death atomically discards the complete unoffered session-owned receipt without replay; live, unverifiable, or offered owners remain queued. The worker executes at most 64 eligible entries from one validated journal snapshot, commits ordinary completions through one journal transaction, then yields through a generation-checked event-loop boundary. Retry, queue, or prior-generation boundaries first flush completed ids and force a fresh snapshot, preserving exact state-transition atomicity without per-entry parse/rewrite churn. A deterministic 2,048-entry stress gate requires exactly 32 completion publications, 33 reads including the final empty snapshot, continued 1ms timer progress, and less than 250ms maximum observed heartbeat delay. Byte-capacity tests cover failed and retry-wait diagnostics, queue receipt/owner and handoff metadata, and operator dispositions; every rejected growth leaves the prior authority bytes unchanged. It still scans later independent entries after retry or terminal persistence. An unresolved reaction remains a queue-mutation dependency even in `retry-wait` or `failed`, but dispatch checks that dependency against the candidate queue item's exact chat and source message ids instead of globally blocking unrelated targets. Successful replay or an exact discard disposition releases the dependency. Worker state, debug status, state snapshots, and redacted runtime events expose journal depth, retry/terminal counts, the next retry, latest terminal identity, copyable operator commands, and the exact first foreign queued owner identity (instance, PID/birth, session, and acquisition) when semantic authority belongs to another process. The journal is the sole polling/admission authority. Each atomic journal revision publishes the admitted batch and monotonic `acceptedThroughUpdateId` together; cursor-only initial synchronization uses an empty batch revision. Existing config cursors are transferred once before polling: journal publication precedes config removal, restart retries are idempotent, established journal authority never regresses, and an unprovable non-empty journal fails closed. Upgrades create journals lazily before the first post-upgrade offset advance. A bot/profile identity change with unresolved authority fails closed. Once reconstructed authority is empty, the next read atomically rebinds profile and bot identity under the journal transaction and removes redundant old-identity segments best-effort; stable-`botId` token rotation remains valid even with entries. Downgrading below `0.37.0` with a cursor-schema journal is unsafe because an older runtime cannot recover `acceptedThroughUpdateId` and could repoll admitted updates. The pre-0.52.0 `tmp/telegram` tree remains untouched. Current-runtime corruption recovery is the distinct guarded delete/reset policy above; unsupported schemas and saved `telegram.json` stay preserved. Polling and inbound-worker diagnostics remain separate so an executing, deferred, locally queued, foreign-queued, or blocked journal head cannot masquerade as a stalled `getUpdates` request. Long-text split recovery remains conservative: only human text at or above the near-limit threshold opens its debounce window. Forward annotation has two semantic layers: the forward owns its source text/caption/media, while an optional separate owner-authored annotation normally precedes it. A bounded one-second pairing window joins that annotation and adjacent forward in either transport order, including a media-only forward without source caption text; the matching opposite-kind message flushes immediately. Same-kind rapid messages, commands, bots, ordinary non-forward captions, media groups, different senders/targets, reversed ids, and distant message ids do not enter this pairing path. Prompt construction always places the owner annotation first, followed by `[forward|from:...]` with the forward's own source text/caption, then source-attributed forwarded attachments, regardless of arrival order. ### Explicit Connection Recovery An explicit `/telegram-connect` is permission for one fresh connection attempt, not permission to take over a live leader or clear accepted input. Under the existing profile-wide Workspace admission and mutation gate, the leader resets only matching unfinished creation records without a known Thread target before claiming Workspace identity. The reset verifies the exact retained record and refuses sidecar target-recovery evidence; durable publication and current ownership are required before another create. Known targets and other owners' pending records remain intact. A late response is isolated by a fresh provisioning ID, independent of wall-clock resolution. If Telegram committed the abandoned create without returning its Thread ID, a spare tab may remain. This is the operator-approved availability trade-off: no unknown tab is deleted, and no journal, receipt, live binding or queued prompt is erased. A new API outage can still fail the new attempt; the command does not promise connectivity without a working Telegram transport. Followers carry this explicit intent only on authenticated `follower.register`, gated by `explicit-connect-recovery-v1` at caller and leader. Automatic heartbeat recovery and `follower.restoreWorkspace` do not reset creation evidence. A matching targeted pending provision contributes its original Workspace key/slot when the exact session is claimed again, so retry can complete known publication rather than allocate a conflicting identity. Cross-session targets never become recovery grants. ### Queue And Dispatch Safety The bridge keeps its own Telegram queue. The Pi status bar projects executable waiting work across Normal, Priority, Steer and Control into one warning-yellow `+N` suffix, omitted when zero. It uses Queue's executability filter, so Skip and frozen attempts never contribute; current agent work from Telegram, terminal, or autonomous sources never contributes either. The dispatched Telegram head is subtracted while retained pending `agent_start` consumption. Queue items have two explicit dimensions: - `kind`: `prompt` or `control`. - `queueLane`: `control`, `steer`, `priority`, or `default`. Dispatch rank (distinct from the ascending menu selector order): 1. `control` lane. 2. `steer` prompt lane, using its guarded active-boundary or idle-packet attempt. 3. `priority` prompt lane. 4. `default` prompt lane. #### Priority, Reactions, Keep, and Skip Bridge-owned Steer uses the existing public Pi SDK. Busy-run operator smoke coverage is established; broader live and native-Windows acceptance remains follow-up work in the [backlog](../BACKLOG.md). Waiting ordinary prompts expose two independent dimensions: - `Normal` / `Priority` / `Steer` selects the FIFO lane and scheduling opportunity in increasing intervention order. Control remains producer-owned. - `Keep` / `Skip` selects whether the prompt executes when dispatch reaches it. A prompt is one queue object with exactly one active lane membership and one current position. It has no duplicate, shadow entry, or reserved return slot in the other lane. Each prompt admitted directly to a lane joins that lane's tail. A `Normal → Priority` transition removes it from Normal and appends that same object to the Priority tail; a later `Priority → Normal` transition removes it from Priority and appends it to the current Normal tail rather than restoring any historical position. The immutable `queueOrder` records original admission identity only and is never a return address; `laneOrder` records the current destination-lane position. Keep/Skip changes and emoji changes within the same reaction category preserve both lane and lane position exactly. Telegram reactions are shortcut controls over those dimensions. Only fire selects Steer, thumbs-up selects Priority and thumbs-down selects Skip. Fire dominates thumbs-up; all other reactions are ignored, including former heart/dove and removal aliases. Lightning is now a Control marker only, not a reaction shortcut; the emoji sets live in the [queue reaction registry](./ui-style.md#queue-reaction-shortcuts). The runtime compares effective intent from complete old and new reaction sets and mutates only dimensions that changed. Weaker positives under fire and decorative changes cannot reset a menu lane choice; so adding or removing a negative reaction cannot silently change Priority, and changing a positive reaction cannot silently change Skip. Ignored emoji cannot retain a lane or Skip when its supported reaction is removed. Existing explicit queue state and receipts are not rewritten during upgrade; menu badges project that state as thumbs-up, fire or thumbs-down rather than reviving retired aliases. Steer or Priority and Skip may coexist when a prompt carries both positive and negative reactions. The prompt remains at its current lane position while waiting, and its durable journal receipts remain intact so Keep stays reversible and exact live handoff remains possible. Skip wins when dispatch reaches the prompt: the dispatcher first settles those receipts durably, then drops it without a model turn and continues; settlement failure retains the skipped head instead of allowing replay ambiguity. The prompt stays visible with only its negative emoji, is excluded immediately from the executable queue count shared by the Pi status bar and Telegram main menu, and keeps a struck-through physical ordinal. Returning it to Keep restores its contribution to the count without moving it. Graceful session shutdown discards all remaining queue receipts before clearing session-local memory, and startup discards receipts only after proving their former process dead, so a new or unrelated session never inherits queued work. Queue item detail exposes horizontal Normal/Priority/Steer and Keep/Skip selectors instead of irreversible Delete. Legacy published Priority callbacks retain explicit lane intent. Dispatched/frozen items expose inspection only; an oversized idle Steer item stays editable with a Priority/Normal escape and never splits its source group. Menu and reaction controls share the same canonical queue state. A menu Keep can clear internal Skip without changing Priority or queue position, but Telegram's Bot API cannot remove a reaction created by the user; the visible user reaction can therefore remain until that user removes it. Once a prompt is dispatched, frozen for an attempt, consumed or dropped, later reactions cannot change or reissue it. Steer freezes exact original objects before whole-receipt attempt disposition, which is not SDK/model-use proof. Active `turn_end` inserts one packet without resetting Telegram reply/preview ownership; packet content preserves original text/image blocks with blank-line separators only between prompts, without numbered Steer labels. Idle origin detection retains its Telegram prefix. Idle `sendUserMessage` pins the first original and its tail until `agent_start` projects one reply/voice/attachment owner. Partial/refused/unknown outcomes remain protected without replay, and Steer queue transfer requires independently negotiated `queue-steer-v1` plus base handoff support at every participant before custody changes. Frozen/pending work never transfers as unspent input; missing support or malformed attempted/projection fields fail closed. Guest Mode is the deliberate exception to deferred Keep/Skip semantics. A guest prompt has no source message reaction surface and may share zero-valued chat/message placeholders with other guest prompts, so queue-menu callbacks address it by immutable `queueOrder` and expose an immediate `Skip`. The leader settles its durable admission, removes it while other agent work may continue, stops placeholder animation, and replaces the inline globe placeholder with non-printing content. Bot API inline messages have no delete method, so this visual clear is the supported deletion equivalent. A successfully skipped waiting guest prompt never reaches a model turn. Once dispatched, its retained head is inspection-only until `agent_start` consumes that exact reply owner; stale Guest Skip callbacks refuse without receipt disposal or placeholder dismissal. Later waiting guests remain independently skippable. A standalone `/continue` is a source-addressed control-lane prompt, not a Normal/Priority prompt. An authorized thumbs-down reaction to its original chat/message immediately settles the exact waiting continuation's receipts before removing it, even while unrelated work is active. Failed or unknown settlement retains it for the existing reaction retry path; duplicate reactions cannot settle twice. Positive reactions and removal of the negative reaction neither change its control lane nor reconstruct cancelled work. The dispatched head awaiting `agent_start` and already-started work are never cancelled; appends and reorders preserve that Pi-owned head. Synthetic model-switch continuations have no source message IDs and are not reaction-addressable by their fallback reply anchor. Reaction authorization and chat/message namespace isolation remain unchanged. Admission and planning validate lane contracts. Invalid lane/kind pairings fail predictably instead of being silently coerced. Prompt preparation completes downloads, inbound handlers, and binary image reads before synchronous final assembly and queue commit. Enqueue captures only intended abort-history identities before preparation; afterward it reads the current queue, folds surviving selected prompts using their current text and receipts, allocates the new turn's order, and appends without another asynchronous boundary. The handed-off head remains in place until `agent_start` consumes it, even if preparation finishes first. Concurrent arrivals, removals, and lane/reaction edits remain intact; preparation failure or stale-generation completion leaves intervening queue changes untouched. Dispatch requires: - No active Telegram turn. - No pending Telegram dispatch already sent to Pi. - No compaction in progress. - `ctx.isIdle()` is true. - `ctx.hasPendingMessages()` is false. A dispatched prompt remains queued until `agent_start` consumes it. This keeps the active Telegram turn bound for previews, attachments, aborts, and final replies. A low-level `agent_end` error also retains that active turn because Pi may retry automatically; a later successful `agent_end` delivers through the original target and metadata, while `agent_settled` proves that an unrecovered error can be finalized once before queue dispatch resumes. Post-agent-end queue dispatch uses a session-bound deferred dispatcher. It is activated on session start, clears timers on shutdown, and skips callbacks from older generations before touching `ExtensionContext`. Dispatch stays session-bound after polling ownership moves elsewhere. When a queued Telegram prompt is forwarded into Pi, the bridge synchronously commits its exact durable receipt before calling normal `sendUserMessage(content)`; failed receipt commitment blocks dispatch, while the unavoidable crash window between commitment and Pi admission favors at-most-once execution over replay. It does not use Pi's `followUp` delivery option or inject terminal input. Settlement returns an explicit acknowledgement only after exact source removal is confirmed. Missing readiness, frozen/transferred ownership, observation failure and an unknown completion result are not acknowledgements. The mux resolves every unsettled receipt to its owning runtime before mutation, rejects unknown/conflicting ownership, and requires each completion result; a completed prefix is not whole-request success. A private weak acknowledgement keyed by the original receipt object and its unchanged normalized metadata lets later local discard clean up a confirmed prompt still awaiting `agent_start`, including after worker replacement. It is never execution authority: it neither re-arms dispatch nor survives cloning/serialization, and is not a durable completion ledger. Failed or ambiguous completion creates no acknowledgement: prompt dispatch and bulk clearing retain the local item rather than inferring success from an absent source. This does not establish retention for every internal mutation primitive: direct message-ID removal still updates memory before containing settlement failure. Its former automatic Business-deletion producer was invalid because Business and bot-chat namespaces are independent, and default routing now ignores it. Do not restore that producer or infer private-message deletion intent from matching numeric IDs. The internal explicit deletion plan and helper are not a new automatic deletion capability. One monotonic session generation also fences agent/tool/message events, compaction callbacks, preview state, scheduled final delivery, controls, and shutdown. Distinct Pi context objects observed within one session adopt that generation; contexts already observed under an older generation remain stale after replacement. Session start invalidates pending preview work, delayed finals check their captured context before delivery, and shutdown rechecks after asynchronous polling/preview boundaries with a bounded preview-clear wait. For a configured Rich response with final text and exactly one supported queued PNG/JPEG, MP4, or MP3 artifact, queue orchestration asks `outbound-attachments` for one reply-anchored multipart Rich result before finalizing ordinary text. A successful result clears the preview, records exact message ownership, and suppresses duplicate text/file delivery. A known-safe rejection returns to the established paths; an ambiguous send stops the turn without fallback or replay. HTML mode, multiple or unsupported files, Guest Mode, and all voice-policy outputs bypass this optimization. #### Queue Lifetime The prompt queue is session-local, not a restart-persistent inbox. Waiting prompts are discarded on shutdown and dead-owner cleanup, and dispatch stays connected-local as described above. The operator excluded restart-persistent prompt storage from 0.52.0 and future plans to avoid unnecessary complexity; it is cancelled, not deferred. Operator rule before any reload or restart: wait for the queue to drain, or knowingly accept losing the waiting work and re-send what still matters afterwards. Nothing is preserved or replayed automatically. Existing durable admission, receipt ownership, custody and anti-replay protections remain unchanged and do not promise reconstruction of the waiting prompt queue. ### Controls And Menus Telegram controls execute through command/callback domains, not by entering the normal prompt queue unless they intentionally create a prompt turn. Built-in read-only menu commands are admitted once required local state mutation finishes: first-user pairing still persists before `/start` is accepted, while menu rendering and BotFather command synchronization run as context-fenced best-effort effects with diagnostic failure sinks. Their unresolved Telegram calls therefore cannot retain the durable polling offset or prevent the next `getUpdates` request. Detached effects, deferred dispatch/watchdog, typing, and diagnostics callbacks contain primary and diagnostic failure; stale typing context is ignored, while snapshot publication serializes one write plus one retained coalesced rerun. Raw companion handlers still run before durable built-in routing and should return quickly even though their execution no longer retains polling. Immediate controls: - `/start` opens the main inline application menu. - `/model`, `/thinking`, `/queue`, and `/settings` are hidden shortcuts to menu sections. - `/compact` opens an inline confirmation dialog and then runs compaction when the bridge is idle. - `/next` dispatches the next queued turn, aborting Pi first when needed. Target-bound command composition must forward the announcement request, exact-turn marker, superseding cancellation, and deferred-dispatch ports rather than silently dropping them. Active-turn settlement attempts its abort notice against the interrupted prompt before queue dispatch continues; definite or ambiguous notice failure is recorded but cannot block the selected turn. The queue owner then emits `Dispatching next queued turn.` against the exact selected prompt's chat/thread/reply id before its one model dispatch; skipped, inactive, pending-mutation, and admission-blocked candidates never receive it. A successful dispatch notice carries its reply-dedup anchor through the following agent-start reset, so later messages in that turn do not repeat the queued-prompt reply header. A later `/abort` or `/stop` cancels both pending `/next` notices before taking ownership, preventing duplicate abort results and stale future dispatch announcements. The `/next` command itself is never a lifecycle-notice reply target. Aborted pending assistant text is not projected as a second reply, while already completed intermediate output remains visible. - `/abort` aborts active work while preserving queued items. Abort-history preservation is enabled only for Telegram-owned active turns; later local/non-Telegram agent starts clear stale abort-history mode so the next Telegram prompt appends instead of absorbing old queued turns as history. - `/stop` aborts and clears waiting Telegram queue items. Queued controls: - `/continue` creates a Telegram-owned `continue` prompt in the highest-priority control lane. A negative reaction to the original standalone command cancels it only while waiting, with exact durable settlement as specified above. - Prompt-template commands expand Telegram-safe Pi template aliases before entering the prompt queue. - Model-switch continuation uses the control lane when any interruptible in-flight agent run in the current Pi session must be stopped and resumed. A Telegram-owned run retains its prompt target; otherwise the exact model-menu chat/Thread/message supplies continuation and reply ownership. Queue and menu mutations are reachable through Telegram updates handled by the current polling owner. After ownership moves, the old instance keeps processing its accepted local queue, but it no longer receives new menu callbacks or control updates for remote mutation. UI label, navigation, tab, toggle, card, and dialog rules are defined in [UI Style](./ui-style.md). Callback prefix ownership is defined in [Callback Namespaces](./callback-namespaces.md). ### Confirmation Requests (Planned) **Unreleased implementation; integrated review and release acceptance remain open.** The existing `delivery` domain provides the producer-requested binary-confirmation request/decision mechanism. Ordinary/selected `/new` and `/compact`, plus hidden `/quit`, use it. Settings cleanup and routing cancellation retain their native work-set/source protocols under the [local producer assessment](#native-confirmation-producer-assessment-local). Confirmation is a higher-level interaction over an operational view, not a separate domain or independently bound runtime: reuse Delivery's target resolution, generation, logical-view ownership and operation ordering, adding only the pending-answer substate. The public membrane remains `/delivery`; command and destructive-operation execution owners remain separate. The public request/handle/result shape is owned by [Confirm API](./public-api.md#confirm-api-unreleased), not a separate design document. The `/delivery` export, shared-runtime race tests and authorized callback routing establish local implementation, not released or live-session availability. Within Delivery, Confirm and Choice share one pending-question pool, operation queue and terminal transition mechanism. Public Choice has its own explicit request/result function, immutable option snapshot and reserved `tgchoice:` controls; it never accepts the private native-command mapping supplied to Confirm. Disabled or wrong-kind controls cannot consume a question. The shared capability owns dialog rendering, correlation and one-shot answer mechanics. Each request captures an immutable owner, runtime/session generation, profile, exact chat/Thread, published message and fresh random nonce. The allowed operator, current binding and callback eligibility are checked before acceptance. Session replacement or loss of authorized binding invalidates the request; old dialogs never retarget. Callback data contains only a short opaque identifier and choice within Telegram's byte limit. Producers retain the semantic action/target snapshot, approval policy, execution authorization and post-wait validity checks. This is opt-in reuse of bridge mechanics, never generic mirroring or resolution of foreign UI dialogs. The first eligible answer atomically settles the request before asynchronous UI cleanup. Repeated clicks cannot produce another decision. The lifetime starts at request admission, including delivery wait. Abort/expiry before publication forbids further sends; already-issued transport cannot be retroactively unsent. An unknown send outcome revokes the nonce without automatic replay, so a possibly remaining message is inert. Failed deletion/editing of a settled dialog cannot alter the decision or repeat an operation. Pending state belongs to the live runtime and is not revived after reload; this is not a durable workflow engine or an exactly-once business-effect guarantee. Opening must return without waiting for a human, and an original serialized Telegram update handler must not await the decision promise. A built-in adapter consumes accepted decisions within the existing callback execution path rather than replacing source custody or capturing a stale Pi command context: - `/new` retains callback admission, acknowledgement/confirmation cleanup, completion and removal of the exact durable update, then dispatch through the runtime-armed typed Pi gateway. Its pending continuation captures semantic session generation, profile/operator and the original source journal namespace; a foreign completion with the same numeric update ID cannot release it, and late owner loss cannot invoke `newSession`. Namespace correlation uses the existing worker-bound admission carrier, not deferred-input evidence or a completion grant. Session replacement never starts from an ordinary decision-promise continuation or while inbound authority is unsettled. Existing discriminated handoff, successor claim and exact leader/follower ownership remain authoritative. - Hidden `/quit` uses the same one-shot dialog and exact source-journal completion barrier, but does not publish replacement handoff or enqueue the `/new` gateway. Public `ExtensionContext.abort()` / `shutdown()` work outside command contexts, so the completion continuation resolves the fresh current SDK context directly; waiting for a command/model turn could defeat busy-instance rescue. Semantic session/profile/operator authority is checked before dispatch and again after cancellation. A local quitting flag fences normal and Steer dispatch from confirmed scheduling, including completion-observer dispatch before abort. It does not discard work early; the unchanged normal session-shutdown policy later disposes remaining queue authority before clearing memory. Abort errors remain diagnostic and do not prevent a still-authorized shutdown attempt; shutdown is single-attempt with no force-kill fallback or durable restart intent. Normal Pi shutdown hooks own resource release and configured Thread cleanup. Feedback says requested, never proves the process has exited. - `/compact` retains a fresh idle/queue check after confirmation. Compaction startup, completion/error handling, queue release and owned typing stay with the compaction domain. - Settings cleanup and routing cancellation are not additional Delivery decision waiters. Settings keeps exact reviewed work-set identity, Back navigation, fresh protection, Workspace deletion permits and commit-only recovery; Routing keeps original-source custody and its explicit action/recovery controls. A shared dialog answer cannot substitute for either protocol. Native command questions retain their original bold question, button order and callback feedback, expire after five minutes, and refuse old unbound `new:confirm|cancel` / `compact:confirm|cancel` controls. The private producer port supplies captured publication and command mapping separately from the public request; a producer name or extra request fields cannot grant native command authority. Native question publication and accepted feedback opt explicitly into caller-local UI issuance/ACK fences, carried through rendered send/edit overflow and callback acknowledgement. Direct transport promotes them to native API admission checks; followers keep callable checks in local IPC options while leader registration/target/message-ownership validation remains separate. Full transport authority still refuses follower serialization; no command/execution grant is weakened. Captured recipient/dialog/source predicates remain checked before and after API waits, then the existing producer takes over business execution and durable-source completion. Transport/view replacement does not by itself revoke an already admitted semantic session action. Remaining integrated review and release gates are tracked in [BACKLOG.md](../BACKLOG.md#declarative-interaction-apis-minor-release). The next minor release includes the [declarative interaction APIs](./public-api.md#planned-declarative-interaction-apis): Choice, Artifact Delivery and Task View have local unreleased implementations; Text Input and Attachment Request remain planned separate functions, not a public dialog factory. Reuse pending-answer/view lifecycle within Delivery where it fits; routing and inbound/media owners retain exact source classification, download and disposition. Text/attachment replies need proven association to the requesting extension before agent admission, including explicit ambiguity, late/reload and media-group rules. Outgoing artifacts reuse existing file transport/validation. Task View owns only progress projection and cancellation requests; producers own task execution, semantic validation and completion. The unimplemented functions remain planned boundaries, not permission to create a parallel registry, capture every next message, mirror foreign UI or expose raw Pi contexts. SDK question send/edit and generic callback acknowledgement distinguish full native API authority from explicitly local UI issuance/ACK checks. Direct transport promotes those local checks to native admission guards; followers keep them only in caller-owned IPC options, with plain single-attempt policy on the wire. Local checks never become leader authority: authenticated registration, generation and target checks stay leader-owned, and full transport callbacks still refuse follower serialization. #### Native Confirmation Producer Assessment (Local) The current built-in producer inventory is an ownership assessment, not independent integrated review or live acceptance. It selects no further migration merely to make every human action a binary question: - **Command questions — shared Delivery:** `commands.sendTelegramConfirmation()` publishes `/new`, `/compact` and hidden `/quit` through the existing confirmation port; Routing dispatches only their accepted native mappings. Delivery owns one-shot answers, while Commands/Runtime retain the semantic action and exact source-completion barriers. Ordinary and selected command paths keep their existing recipient guards; no generic command-name execution grant is added. - **Settings inactive-tab cleanup — retained domain review:** `menu-settings` renders the reviewed count, deletion consequences, Back and `settings:clean:`. Root composes `thread-cleanup-manager.review/clean`, not a Delivery answer continuation. The canonical work-set and manual deletion fence retain exact candidates, fresh authority/protection and sole permits. Repeating Clean may finish a known commit-ready outcome without another delete; an unknown deletion stays protected. A spent ephemeral Confirm nonce cannot replace that recovery identity, and an additional Yes/No would duplicate the existing explicit Clean action. Keep the current review/navigation controls and fenced coordinator. - **Per-input routing Cancel — source action, not another question:** `routing.handleUnboundRerouteCancelCallback()` requires the original untouched chooser, human owner, source/execution fences and profile admission before committed private cancellation. Chooser retirement and conditional tab cleanup follow that outcome; sibling custody remains independent. The adopted routing UX requires no extra confirmation. A Delivery decision must neither settle those sources nor supply created-tab/orphan deletion authority. - **Pending cancellation recovery — source-owned review:** `routing.handleCancellationReview()` binds a current review/message to exact native retained originals, supports refresh/pagination and retries only the selected source's original disposition capability under fresh profile admission. A view-update failure may leave cancellation committed and its original recovery result useful. Keep that status/retry protocol instead of replacing it with one-shot Yes/No state or reopening input as a new question. - **Connection takeover/disconnect — Pi UI:** the two `ctx.ui.confirm` producers in `commands` belong to the operator's local connection commands. Their currentness checks and transport/session consequences remain producer-owned. Do not automatically mirror or resolve them through Telegram Delivery. Planned pairing, agent `tgbtn` collectors and private Text/Attachment work remain separate scopes, not missing native-confirmation adapters. This boundary follows the existing Settings review/Back, exact slotless-target, changed/protected candidate, lost-ACK commit-only recovery, pending-cancellation review and unavailable-view custody regressions in `tests/menu-settings.test.ts`, `tests/thread-cleanup-manager.test.ts` and `tests/routing.test.ts`. The composed full-suite result supplies local regression evidence, not an independent reviewer or a live deletion grant. A future explicitly selected UX adaptation would need its own original producer/physical transition and preservation witnesses; this assessment adds no callback registry, durable workflow, waiter or execution authority. ### Attachment Request Preparation (Planned, Unwired) **Current-tree boundary:** retained private question/publication/privacy kernels are not an accepting Attachment collector. Removed source-ingress, capture/seal, consumer-lease and warm-disposition assemblies and their end-to-end checkpoints are held on `wip/private-input-foundations`; older checkpoint descriptions below are not current callable source owners or re-landing/readiness evidence. See the [public boundary](./public-api.md#attachment-request-boundary-planned). > **Release scope:** the private Attachment Request capture, file seal, lease accounting, staging and warm disposition code described in this section is not part of the current tree. The unreleased implementation, tests and the design records cut from here are preserved on local branch `wip/private-input-foundations`; remaining text records boundaries that still apply to the shipped code. See the re-landing item in [BACKLOG.md](../BACKLOG.md). **Private question/receiver observation, metadata preflight and native held capture are implemented here; no public Attachment opener, file collector, peer capability or production readiness is available.** The [frozen authoring limits](./public-api.md#element-specific-fields) remain unchanged. Reuse Delivery for question publication, receiver identity, deadline/abort, pending capacity and typed one-shot settlement; Updates/Routing retain early sender-authorized interception and exact source disposition; Media owns bounded attachment interpretation; API owns actual download/streaming and scratch files. Producers retain semantic validation, file-use authorization, execution and disposal. Add no interactions domain, global registry, poller, persistent root or generic workflow engine. #### Existing Owners Are Not Private Admission `collectTelegramFileInfos()` is an ordinary prompt helper: it walks Rich Message blocks, selects photo renditions and globally deduplicates by file ID. Two physical source messages with different request reply anchors can therefore become one file-info row. Count and correlate physical message/media occurrences before that projection; matching file IDs are not proof of a shared receiver or source disposition. Photo renditions are one attachment, not separate response files. Any legitimate native alias needs explicit interpretation, not a blanket permission to deduplicate ambiguous payloads. Sender MIME/name metadata is untrusted; MIME filters do not validate content and filename extensions are not filters. `createTelegramMediaGroupController()` and `transitionTelegramPendingGroups()` serialize bounded debounce batches, including later members of the same album in another dispatch. A quiet timer or closed worker batch does not certify Telegram album completeness. Do not accept a prefix or silently drop unsupported members. Whole-source membership and one exact receiver must be established before atomic request acceptance; otherwise use the private refusal/held disposition, never ordinary model/STT/handler fallback. This is not permission to capture unrelated next messages while a request waits. `downloadTelegramMessageFiles()` sequentially invokes a path-returning port and does not own rollback of earlier successful files. The current Bridge download port supplies its configured per-file cap, not a request-wide remaining budget or receiver lifetime. Low-level `downloadTelegramFile()` already checks metadata/header hints and actual streamed bytes, supports an AbortSignal and cleans its own failed `.part`; it publishes to a deterministic scoped name, not a unique request lease. Reuse those mechanisms through a reviewed private capture port, not by exposing raw client/options or broadening generic IPC/file-read authority. Two native four-byte downloads can both pass a four-byte per-file limit while exceeding a six-byte response budget. Metadata size is only a preflight refusal hint; success needs bounded actual sizes summed across the entire response. `cleanupTelegramTempFiles()` is an age-only regular-file janitor; it has no source-pin or consumer-lease contract. Scratch age cannot authorize deletion of held private input. Existing ordinary media behavior remains unchanged: these are integration gaps, not new guarantees silently assigned to legacy helpers. #### Required Capture And Lifetime Boundary Before any private getFile/content I/O, retain the exact live request, original publication, configured operator/bot/profile/session/chat/Thread, source membership and actual receiver/transport authority. Count/filter/shape failure leaves the question waiting under its original deadline and privately refuses the input without a partial result. Recheck around asynchronous boundaries and before handing any path/metadata to the original producer. Cancellation ends collection, never invokes Pi abort, transcribes audio, reroutes to a replacement receiver or grants business execution. An unknown download/submission/disposition outcome requires owner-specific reconciliation, not blind recapture or an ordinary prompt copy. One request-owned operation reserves the whole response budget. Lower configured limits win; each stream is bounded by the remaining total, with safe actual-byte accounting and no successful subset. Capture into uniquely owned scratch artifacts under the existing temp owner; failure/expiry/abort rolls back only those artifacts after actual I/O settles. Logical cancellation cannot release actual-work reservations or delete an in-flight writer prematurely. Preserve generation/source/operation identity and do not remove pre-existing or another request's deterministic cache path. Keep admission-owned files pinned while any exact source disposition remains held or uncertain. A positively delivered producer result carries explicit `expiresAt` and the existing ten-minute default consumer lease, clipped by runtime policy; consumers copy what they need longer. Consumer expiry/disposal alone cannot clear a still-held source pin, and pin release alone cannot delete an unexpired consumer lease. Generic scratch cleanup must not sweep these files; no secure-erasure, kernel-cancellation, global filesystem atomicity or exactly-once business-effect claim is made. #### Private Attachment Question/Receiver (Implemented, Unwired) Delivery's private `openAttachmentQuestion()` shares the existing 256-interaction pool, per-target actual queue, deadline/abort and one-shot retirement with Confirm/Choice/Text/Task. It is not `openTelegramAttachmentRequest` and grants no source admission, file I/O or business execution. Its native handle/result reports cancellation, expiry, abort or invalidation; the separate private SDK boundary below can now additionally settle a structured submitted-files result, without an accepting source collector or production composition. It snapshots bounded owner/question/cancel copy, scope and signal; private MIME/count/total limits match the frozen defaults and reuse Media's immutable constraint normalizer. Limits remain metadata, not validation of uploaded content or actual bytes. The kernel requires both an explicit complete-path `getAttachmentReceiverBotId` and dedicated `publishAttachmentQuestion` port. Production composition/Lifecycle leave both unbound. The Bridge supports private direct and scoped follower opt-ins below. The broker has separate authenticated opt-in support; neither is production readiness. The original-publication owner must supply the dedicated path; ordinary sendChunk cannot substitute for it. A positive native message ID creates a waiting question; opening and unknown-send attempts create no usable receiver and no guessed cleanup. Native publisher/authority/target/readiness callables retain their original identities. Readiness cannot mutate an authority object to retarget publication. UI uses a bold escaped question, an explicit reply-to-this-message instruction and the original cancel control, not a native file-picker promise. `captureAttachmentReceiver()` observes only an exact waiting native question: nonce, physical published message, operator/profile/bot/chat/Thread and original native ports. The frozen guard snapshots identity and exposes `assertCurrent`; Attachment additionally carries the fixed intake limits/deadline below. It neither settles/reserves an answer, installs/disposes timers/listeners nor mutates UI/Queue. Observed failure permanently ends that retained guard. Text and Attachment receivers share the non-settling mechanism, not identities or journal latches; a physical publication ambiguous across the two kinds refuses both. Private `captureTelegramAttachmentReceiver()` adds the existing registration membrane, shared with Text: it freezes the caller snapshot without creating a missing registry, captures the exact global registry/runtime/binding/capture callable and retains the returned guard callable. Binding/provider loss during capture or assertion refuses/ends that guard; same-object, same-generation and equal-value restoration cannot repair observed history. Absent/older Attachment receivers never fall back to Text or an accepting collector. This is non-settling receiver observation, not whole-source custody or original-publication adapter readiness. `tgattach::cancel` is reserved before ordinary callback/model routing, including malformed, stale or unbound controls. Exact current cancellation settles only the private question and retains a status marker; it never aborts Pi, disposes consumer file leases or releases source pins. Callback namespace reservation does not recognize/admit attachment message bodies. The direct original-publication adapter is privately implemented below; early reply provenance/privacy, genuine whole-source disposition, complete peer intake compatibility and positive producer handoff remain unimplemented. The tests exercise real kernel/Router code under trusted native test ports, not executed production publication or live Telegram clients. #### Attachment Native SDK Result (Implemented, Unwired) A native question reservation now optionally exposes a synchronous `handoff(materialize)` capability. This is an SDK-local boundary over the original pending producer's actual native result promise, not source admission, a public opener or IPC. The existing question record consumes the one handoff and takes custody of that exact native file provider before observing authority or invoking it. It does not introduce another registry/mailbox/executor. Competing/repeated attempts, caught reentry and decline after handoff cannot reopen the slot. The provider first receives a frozen SDK custody scope. Its current `assertAcknowledged()` witnesses native SDK ownership of the provider while the original question/reservation remains valid; it is not producer result delivery or source completion. Native assembly can use this read-only witness for the capture kernel's lease attestor after `beginHandoff`, without invoking delivery/business execution from that attestor. The provider synchronously returns a frozen `{ lease, dispose }` bundle backed by the native capture keeper. Delivery validates own data fields, frozen finite lease/rows, non-sparse bounded membership and actual-byte totals under the question's original limits. Promise/accessor/expired/malformed output refuses without a submitted result. These are trusted native assembly assumptions, not authentication of hostile JavaScript, a file sandbox or proof of content/file-use authorization. Only after final current reservation/receiver checks and a fresh lease-expiry observation does Delivery consume the question and resolve its original native SDK promise with frozen `{ status: "submitted", lease, dispose }`. The lease retains its original files/expiry/ended promise; explicit producer `dispose` projects only consumer disposal, not session/source disposal. A separate frozen `kind: "sdk-result"` receipt is returned only after actual native result settlement. That receipt is historical local-delivery truth, never business completion, a source-release grant or a reconstructed/durable receipt. The custody execution scope ends with the waiting receiver; an acknowledged result remains historical after cancellation probes, close or runtime shutdown. An accepted provider or issued lease followed by abort/loss is not this result receipt. The existing registration membrane preserves only an explicit own frozen handoff method and brackets materialization/custody observations with the original registry/runtime/binding/capture/reservation identities. Legacy reservation scopes without that optional capability do not gain it. After native submission, the membrane checks the retained binding rather than reviving the consumed waiting receiver. Late binding loss refuses its ACK even if the original producer may already have a result; no automatic retry/discard is inferred. Native Classic/Threaded raw/bound tests compose the real Delivery SDK owner with actual API streamed capture/files and lease accounting under fake HTTP. They observe original result settlement and exact captured paths, one-time materialization, scoped custody expiry, historical result acknowledgement, real bytes across native owner disposal and consumer end while source release is deliberately withheld. These tests issue no positive source-release grant and are not source-backed handoff acceptance. Reentry, same-object rebinding and abort after lease issuance give no submitted receipt. Removing actual SDK settlement produces four RED witnesses despite apparent receipt creation; restoration is hash-verified. A separate native-callback clock-advance RED/GREEN rejects a lease that expires during the final authority observations rather than delivering it under a still-live question deadline. Source-backed readiness still exposes counts only; the separate warm singleton handoff below now composes genuine local source disposition. Durable admission-owned pins and unknown/cold reconciliation remain gated, as do accepting interception and all public/production readiness. #### Direct Attachment Original Publication (Implemented, Unwired) Bridge's private `getAttachmentReceiverBotId` opt-in constructs the dedicated publisher only when a native caller explicitly supplies complete-path readiness. Production passes no such query, so both Attachment kernel ports remain unbound by default; Text readiness is not substituted. The adapter accepts only the exact single-control `tgattach` question and uses the existing native API/ownership owners. Ordinary sendView/sendChunk rejects that exact protected control instead of upgrading it to an ordinary publication. `getTelegramAttachmentControlId` and Text's control reader share only strict shape parsing; neither marker is authority. The direct adapter snapshots target, markup and text before native callouts, captures the original profile/bot/transport/target-policy/API/pinner callables and requires the direct policy for its direct branch. The separately scoped follower branch below never uses this direct send or a generic fallback. Scope checks bracket the native question guard, actual API boundary and positive receipt. It captures `Ownership.captureLocalPublication` before send, validates the positive message ID and writes the first immutable origin before the question becomes a waiting receiver. Missing hooks, source/provider loss, duplicate/pre-existing ownership and unknown replies cannot upgrade an ordinary projection or reconstruct a replacement receiver. Known origin is provenance, never submission or business permission. Failure after a native API invocation is conservatively commit-unknown unless a parsed rejection of that method or native `requestIssued:false` authority refusal certifies otherwise. Invocation is not claimed to prove HTTP issuance. A positive receipt followed by failed origin/currentness checks is always unknown; no retry or compensating guessed message mutation is issued. Native Classic/Threaded tests use actual API client, bus-aware direct dispatch and ownership writer with fail-closed fake HTTP, including raw connection loss, rejection, pre-issue refusal, profile/bot/mode/callable loss and duplicate receipts. These prove the opt-in direct adapter, not executed production, live Telegram, source disposition, file intake or follower compatibility. #### Broker Attachment Original Publication (Implemented, Unwired) The existing authenticated `follower.callApi` handler recognizes exact Attachment controls separately from Text. No ordinary API/projection fallback is allowed for that shape. Private broker opt-in requires a nonempty valid auth secret, the native follower API authorizer, explicit Attachment readiness, current leader epoch/profile/operator and a complete original-publication writer. Classic peers must have an explicitly authorized chat target; older/incomplete recipients, Text-only readiness, unbound peers and wire-supplied options cannot substitute. Production supplies no Attachment readiness and advertises no new capability. The Bridge's private consumer adapter below adds local pin and receiver lifetime; broker support alone is not a callable SDK feature or complete peer intake proof. Before callouts the broker snapshots the request body, full original registration and native port identities. Its origin-local scope composes the existing ownership writer's immutable `assertCurrent`, exact registration/process/session/endpoint/protocol/target comparison, original leader epoch/profile/operator, native authorizer, original bot readiness and unchanged descriptor. Native authority and issuance observers are installed locally in API call options after decoding, never serialized or accepted from a follower. Scope guards bracket actual HTTP issue/receipt and first-origin writing. The broker writes a known original before positive ACK; lifecycle/registration/profile loss, body mutation, missing scope, unknown send or malformed receipt cannot become a positive ACK or ordinary ownership upgrade. Calls use one non-idempotent native attempt and retain issuance uncertainty without replay. `Ownership.captureLocalPublication`/`captureFollowerPublication` now return the same callable writer plus a frozen, non-settling native `assertCurrent` scope. Observing it needs no message ID and writes nothing. Observed scope loss permanently revokes that guard and subsequent writes, even after equal restoration. Existing callers that do not use the new scope retain their original callable writer behavior, including original negative/partial-history semantics; this is not a new journal, mailbox or source-submission grant. Native Classic/Threaded tests traverse a real authenticated local socket, native authorizer/API proxy/client and genuine ownership writer with fail-closed fake HTTP. Wrong auth, absent readiness/authorizer/scope, old or unbound peers, serialized options, retargeted recipients and mutated bodies issue no HTTP. Pre-issue owner loss is refused; post-issue leader/profile/registration loss or connection failure remains commit-unknown with no receiver/source success. These establish only broker original publication. The subsequent private consumer/peer mechanisms add publication proof and local pin. Whole-source custody, file collection, privacy/terminal recovery and separately authorized live acceptance remain open. #### Attachment Publication Peer Proof (Implemented, Unwired) The private optional `attachment-original-publication-v1` protocol capability identifies the broker publication contract only. It is declared in Bus but is not in default/current production advertisement; protocol version remains 3. Package/runtimeBuild equality is not support evidence: unreleased and old peers can share 0.58.3. Both negotiated identities must explicitly carry the capability, alongside the existing readiness/auth/epoch/registration gates. This does not advertise Attachment intake or enable production Bridge publication. After known original pin and scope validation, the broker ACK carries `__piTelegramAttachmentPublication`: strict version 1, exact request ID/nonce/instance/registration generation/incarnation, positive bot/message IDs and original target. The shared decoded-data parser rejects missing/extra keys, invalid IDs/targets and malformed or over-512-unit scope strings, returning frozen copies. This transaction tuple is publication evidence, not full local session/process/endpoint lifetime, a receiver, file permission, source submission or business grant. Broker-side full recipient/process/protocol authority still comes from the retained native registration and original writer, never from re-presenting this DTO. The native follower API caller has private local/leader protocol metadata ports. For an exact Attachment send it snapshots their values/callables with auth, generation and endpoint, requires both capabilities before IPC, and never waits for/acquires a replacement registration. It checks scope at local dispatch/receipt; observed loss is sticky for that attempt. A positive response needs the exact outer request ID, unchanged negotiated protocol and a matching receipt/message/target tuple. Ordinary success, missing/mismatched receipts, lost ACK or post-dispatch generation/protocol loss remain commit-unknown without retry. Pre-IPC unsupported peers issue no request, even with matching version strings. These ports remain unwired in the production follower client assembly. Native tests join the actual caller to the authenticated socket/broker/API/ownership path for known Classic/Threaded receipts, and separately falsify protocol/receipt corruption using socket fixtures. The consumer adapter below supplies private local original pin and retained receiver lifetime. Complete peer intake readiness, file/source custody and terminal/privacy recovery remain required before public availability or production advertisement. #### Attachment Local Registration Capture (Implemented, Unwired) The existing native follower registration runtime now offers private `captureAttachmentPublicationRegistration()`. Only a complete acknowledged registration with both publication capabilities, exact request ID, positive broker-owned registration incarnation and explicit target can yield a frozen scope. It retains a canonical registration snapshot (profile, session/generation, process/birth, CWD, slot, follower endpoint and local protocol), leader endpoint/protocol and non-settling `assertCurrent`; it exposes no auth secret. Capture the canonical IPC leader address when selecting the original raw endpoint, before receiver startup or registration awaits. Scope-to-caller comparison uses that canonical address for Windows named pipes and shortened long Unix paths, while original raw endpoint/provider identities remain pinned by the native lifetime; normalization grants no replacement scope. Short/long endpoint Classic/Threaded caller and consumer witnesses retain the existing refusal/uncertainty cases. The broker returns its existing registration incarnation for either mutually negotiated Artifact delivery or mutually negotiated private Attachment publication. This is shared registration identity, not reuse of an Artifact consumer lease or Text/v4 latch. Native registration state returns the exact mutation lifetime before availability callouts. Reentrant or later `setRegistered`, including equal data/generation, ends that lifetime. Missing/legacy `void` returns cannot supply it. The runtime snapshots original reader identities before registration callouts, retains the original registration attempt, checks the native token on both sides of callouts, compares current context/target and the complete safety tuple/auth/endpoint/protocol, then rechecks original reader/owner identities. Callback error, observed loss, or caught guard reentry sticks; restoring equal values cannot mint a fresh scope. Same-session fresh context objects remain usable when canonical values are unchanged. Only another genuine acknowledged registration can issue a new scope; old scopes remain ended. The getter returns the same retained frozen scope while current or `undefined` after loss. Observation creates no listener, timer, UI effect or new IPC; normal pre-existing registration/heartbeat behavior is unchanged. Native tests use the authenticated socket/broker/registry path, including missing identity/incarnation, wrong ACK, same-generation rebinding, pre-callout reader replacement, provider error/reentry and late local authority loss. The full registration DTO is evidence, never callable authority by itself, publication proof, receiver readiness, input/source admission or file/business permission. Ports/decoded data remain trusted native assumptions, not hostile-JavaScript authentication or detection of every unobserved ABA. Production capability/readiness advertisement remains closed. The scoped caller and private consumer adapter below now retain this evidence through peer/receipt checks, consumer original pin and waiting receiver observation. #### Attachment Scoped Follower API Caller (Implemented, Unwired) The native follower API caller now requires private `captureAttachmentPublicationRegistration` for exact Attachment sends, in addition to negotiated local/leader protocol readers. It captures one genuine acknowledged runtime scope and its original guard/capture callable; it does not renew by querying for a replacement registration. Scope observation brackets protocol/auth/endpoint checks and ties the request to the captured instance/generation/target/local and leader protocols. Missing, ended, throwing or replaced scope providers fail before IPC, even when generation strings agree. The normal client assembly leaves these ports unbound. `follower.callApi` carries optional private `attachmentRegistrationIncarnation`, a strict 48-lowercase-hex data identity, not callable authority or a new generic API option. Protected broker publication requires it to equal the original registered recipient before any HTTP; guard observations also compare current incarnation after native callouts and before ACK. The strict nine-field publication receipt echoes that incarnation and the caller checks it against the held native scope. This closes same-generation recipient replacement without serializing native closures/context or inferring support from package versions. The private, never-advertised capability draft was tightened in place; protocol version and ordinary calls remain unchanged. Actual registered sockets join native caller → authenticated broker → native API/proxy → original ownership for known Classic/Threaded publication and same-generation pre-HTTP refusal. Socket fault fixtures separately corrupt receipts or end/rebind/restore the actual native local registration after dispatch. Missing scope or target/session/process/receiver-endpoint mismatch issues no private call and never waits for recovery. Lost/ordinary/mismatched ACK, receipt-incarnation mismatch and late local/remote lifetime loss remain unconfirmed/commit-unknown, not receiver success or retry permission. These are publication and local registration mechanisms only. The private consumer adapter below adds original pin and receiver lifetime; complete source/peer privacy, producer handoff and terminal/recovery ownership are not supplied by this caller, the DTO or a broker ACK. No production capability/readiness advertisement, public Attachment opener or file/source admission is enabled. #### Consumer Attachment Follower Publication (Implemented, Unwired) Bus API now provides private `captureAttachmentPublication(target)` only with an explicitly bound native registration owner and follower role. Its frozen capsule retains original role/send/capture/guard callables and exact target/registration scope, permits one protected send, and revalidates the bounded receipt against that scope. It sends exactly two wire arguments with an origin-local guard; it cannot use ordinary `sendMessage`, serialize authority or renew into another registration. Missing/ended scope refuses before IPC; uncertain or post-send loss is never retry permission. With explicit Attachment bot readiness, Delivery captures this capsule and the native local original writer before publication. A follower writer requires its retained non-settling origin scope, not a bare callback. The broker origin precedes ACK; the validated matching bot/message receipt precedes consumer original pin; pin and final currentness precede waiting receiver exposure. Missing hooks, duplicate/ordinary provenance, mismatched or ordinary ACK, provider/mode/bot loss and unknown native work cannot create a receiver or upgrade ordinary ownership. The direct branch and default production refusal remain intact. The dedicated kernel publisher may return a retained publication guard with the positive message ID. The existing pending question stores it and non-settling receiver observation checks it without calling the question's settling guard recursively. Same-generation rebind/stop, origin/transport/callable loss and caught reentry end the old scope; fresh readiness data cannot revive it. A native Classic/Threaded RED exposed caught readiness reentry returning success once; checking the sticky lost fence after callouts closes that first-observation hole. Observation neither settles the question nor releases file/source lifetimes. Native tests compose actual registration, authenticated socket, caller, Bus API capsule, broker/API proxy/client and both native original writers with fake HTTP. Pin instrumentation sees no receiver before or immediately after the pin; the waiting receiver appears only after publication returns. They also prove one-use sending, no generic fallback, missing hooks/scope, uncertain/ordinary ACK, duplicate origin, late lifetime loss and non-settling retained observation. Cleanup projection is stubbed outside that publication proof; live Telegram/UI cleanup and full intake/custody acceptance are not implied. Production ports/capability advertisement, public opener, accepting private input interception, whole-source pins, producer handoff and terminal/cold recovery remain gated. The reject-only marked-reply fence below is not those grants. #### Attachment Reply Privacy Fence (Implemented, Reject-Only) `readTelegramAttachmentReplySource(message, botId)` adds a minimized own-bot reply hint beside Text's reader. Both share bounded 65-row × 8-button scanning, configured positive bot identity, original bot-message/chat/Thread checks and business/guest/ephemeral refusal. Attachment hints return only kind/nonce/publication message/target; neither file IDs/names/captions nor input bodies are retained. Malformed reserved controls or mixed Text/Attachment controls return unavailable, never one arbitrarily selected receiver. Missing/foreign-bot markers are not authenticated Attachment evidence. This is routing evidence, not input/content validation, restored publication, sender admission or submission authority. Routing composes `createTelegramAttachmentReplyPrivacyGuard` ahead of its Text classifier in the existing sender-authorized private-reply hook. Any recognized Attachment hint, including unavailable/malformed/status or wrong-target evidence, throws `Private Attachment input disposition is unavailable.` before Text acceptance, original/ordinary ownership, foreign IPC, grouping, commands, media download/STT or model routing. It never returns a terminal handled acknowledgement. Original bot getter identity and the originating execution fence bracket observation; observed callable replacement cannot be repaired by equal restoration. Sender denial runs first and synthetic agent input retains the existing explicit bypass. Native Classic/Threaded tests use the actual Journal and admission worker, not a fake completion callback: document/photo/voice/command/edited/album/status/malformed/mixed/wrong-target updates throw through Routing, retain their unchanged original source and produce no completion/Queue/model work. Forbidden lookup/forward/download ports fail the test outside admission's error handling. Complete existing Text/Routing/Media/Delivery regressions also pass. This reject-only guard does not acquire a private destination, infer an album's membership/completeness, pin files, consume an answer or choose a terminal disposition. It protects recognized members only; unmarked siblings, absent/cold publication evidence, missing bot identity and unsupported peer intake still need whole-source privacy design. Production Attachment publication/readiness stays unbound. No v4 latch, journal/default/schema change, persistent root or accepting collector is introduced. #### Attachment Question Source Arbitration (Implemented, Unwired) The existing pending Delivery question owns at most one active runtime-only source reservation. Its native receiver adds an optional immutable `reserveSource(owner)` capability; capture/metadata observation never invokes it. The trusted Updates admission owner creates a fresh opaque empty owner object per native preparation, runs exact source/receiver/media selection under persisted sender admission, then reserves before Journal acquire/start. Equal-shaped or copied owner data is not identity. This token contains no message/file body and is not serialized, a source receipt, file pin or producer grant. Native Journal acquisition/start/reference remains independently required. The native kernel stores the reservation in that same question entry before authority callouts. Same-owner reads return the original frozen `TelegramAttachmentSourceReservation`; competing owners return unavailable without invalidating the winner. Observed receiver/provider loss or caught same-owner reentry permanently ends the scope. There is no generic release/reset method: failed/unknown capture or reservation acknowledgement, source close, a replacement admission factory or equal authority restoration cannot free the slot. A narrowly admitted definitive size refusal may retire only that reservation through `decline`, after native rollback has positively cleared all scratch ownership and while the original source/receiver is current. It permanently invalidates the refused source's prepared execution guard but neither acknowledges nor removes its persisted RUNNING input. A new physical reply may then reserve the still-waiting question at its original deadline. Per-question weak owner history prevents any retired opaque owner from reserving again, including through a fresh observer; no strong body retention/global registry is added. Known metadata refusal before reservation leaves the slot untouched. The question still uses its original waiting phase, deadline, shared capacity and cancel controls; reservation creates no listener, timer, UI edit, settlement, result or business effect. The existing Delivery registry membrane retains the original reservation callable, native scope and registry/runtime/binding lifetime. Only an own fixed function descriptor is admitted; accessors/mutable capabilities refuse without invocation. Older fixed-intake guards with no method are not upgraded. Wrapped assertions check the original native scope and binding before/after callbacks; old scopes cannot renew after rebind/method loss. The decline callable is also retained as own immutable native data; retirement consumes the old wrapper before callbacks and cannot clear a newer winner. Routing requires this capability and carries its retained selection through Updates; the genuine reserved scope is rechecked at native acquisition/start and throughout prepared/staged source work. No Text-specific destination latch or new registry/storage family is used. Native Classic/Threaded integration tests leave losing sources pending without input claims, preserve the winner across competing attempts, reject a fresh admission owner after source close and hold both sources after an injected lost acknowledgement following the actual native reservation. Kernel/membrane tests cover same-owner identity, distinct/copy owners, strict legacy/malformed refusal, original binding/callable loss, caught reentry, deadline/abort and unchanged UI/result observations. Definitive decline tests preserve the deadline and waiting result, reject retired owners across fresh observers and prove stale/reentrant decline cannot clear a newer or unconfirmed reservation. Cancel still ends the question but does not certify source/file release; the staging reference remains governed by actual I/O/owned cleanup. Mechanical reservation by itself is not an SDK submitted-files answer or positive producer receipt. Durable/cold reservation recovery, complete albums and accepting production interception remain unimplemented. Those gates remain open. #### Attachment Expiry and Abort SDK Facts (Implemented, Unwired) The native reservation additionally exposes optional `getEndReceipt()` with a frozen `{kind:"ended",reason:"expired"|"aborted",assertAcknowledged}`. Delivery retains it only after actual `finishQuestion` resolves the original SDK result with that reason on the current unpoisoned/non-observing reservation before any handoff attempt. A clock past the fixed declaration deadline, an observed dead receiver, signal flags, an absent question or a copied result cannot infer this fact. The reason is the actual SDK settlement, not a fresh classifier; cancelled results retain their separate cancellation purpose, and invalidation/context loss deliberately supplies no end proof. Declined predecessor owners and possibly handed/provider-exposed states receive no end receipt, including end during an in-flight provider. The original receiver membrane captures only an explicit own frozen end getter; legacy scopes gain none. Cancellation/end readers now share one local terminal-observation fence and shape validator, while retaining their exact getter/kind and descriptor-checked data: cancellation has two fields, end has three and only the two accepted reasons. Promise/accessor/extra/wrong-purpose/unsupported-reason/non-void assertions refuse. Same-reader or cross-reader recursion, even caught, poisons terminal observation. Original registry/runtime/binding/capture/reservation-provider lifetime is checked before and after read/assertion; observed equal restoration cannot renew it. Waiting/deadline execution stays retired, whereas an already-obtained receipt remains a historical fact after later binding/runtime end. No question answer, timer/listener, new reservation or source right is created by reading it. Expiry/producer abort alone neither deletes files nor acknowledges input. The unchanged native API's unhanded-disposal receipt independently requires explicit disposal, actual I/O/owned cleanup and no handoff barrier. Tests retain real files after SDK end, then dispose unhanded scratch; pending uncooperative reads keep disposal and its proof unavailable until the actual read settles. Source-release/handoff providers are never consulted by these facts. A submitted SDK result cannot later borrow unsubmitted end purpose; no consumer lease, secure-erasure or global no-copy claim is implied. Classic/Threaded × raw/bound tests use actual SDK/original/receiver behavior and streamed files under fake HTTP. They partition actual expiry/abort versus clock/observation, current/declined owners, cancelled/invalidation, end during/after handoff, before/during/after binding loss, equal callable restoration, malformed and cross-reader reentry. Omitting the native no-handoff predicate falsely mints an end during provider exposure; omitting the shared terminal-reader recursion fence falsely accepts caught cross-reader recursion. Both mutations go RED and are restored with hash checks. These remain private SDK evidence only: the explicit original-source expiry/abort composition below now additionally supplies exact native disposition/reconciliation, but SDK end alone is no source drop/ACK, business grant, public opener or peer/production readiness. Missing/unknown/cold evidence, durable pins and accepting intake remain separate gates. ### Task View (Unreleased) The [Task View API](./public-api.md#task-view-api-unreleased) is locally implemented through existing Delivery/API/Router owners, not released or activated. It snapshots plain producer state, renders one operational message, retains a genuine internal Delivery handle, and uses the same target queue, native UI transports, runtime membrane, pending-interaction capacity and lifecycle hooks. Runtime-local projection records do not create another global registry, persisted task store, poller, executor or package entrypoint. Public handles retain the exact binding incarnation and opening callable; authority/profile/operator/target/transport-callable loss is sticky. Native ports are trusted in-process assumptions, not hostile-JavaScript authentication or global atomicity. One current edit plus one latest pending snapshot coalesces updates without moving execution ownership into Delivery. Superseded callers receive an explicit non-display result. A terminal producer intent blocks further updates/cancellation before asynchronous publication; only a current acknowledged terminal edit settles the producer-reported projection status. Deadline, abort, close or invalidation end the local projection, never the producer's work. In-flight callers may settle before actual native work; target ordering/drain still retains that work. Known-message cleanup is separately fenced and single-attempt. Unknown publication never leaves a usable nonce; uncertain edits retire without replay or a compensating cleanup mutation, including disposal queued before the edit settled. Fence inside the actual target-queue operation before it releases its successor; an outer promise catch runs too late to protect queued cleanup. Conservative adapter-attempt effects are not Artifact's authenticated HTTP issuance/rejection provenance. `tgtask::cancel` is reserved ahead of normal callbacks. Exact operator/message/chat/Thread/profile/live binding and source-execution checks precede one-shot cancellation-request settlement. Consume before admitted callbacks to refuse reentry; rendering must not install new pending work after disposal. The request removes controls and announces pending producer acknowledgement, not successful cancellation. Only the producer reports completed/failed/cancelled after its own validation and execution. The Router toast says `Cancellation requested`; no Queue mutation, command execution or Pi abort/quit port is involved. Direct/follower local issuance and ACK fences reuse existing adapters; this adds no remote execution grant or private-input readiness. Task View is locally accepted through focused review, source/native and compiled-native fixtures, authenticated registered-socket output/ACK-loss/ownership-refusal checks in Classic and Threaded modes, and the full package. This is not an executed production composition root or foreign-callback socket end-to-end proof. Whole-release independent review and required platform/live acceptance remain in BACKLOG; deterministic fixtures are not live or independent acceptance. ### Agent Selection Markup The agent surface is declarative Markdown/HTML comments, not another model tool API. `outbound-markup` validates bounded Confirm/Choice JSON and normalizes Choice JSON/CML rows. `outbound-buttons` compiles them into the existing `tgbtn` store with a bare JSON question/answer prompt, never a mirrored SDK envelope, executable cell value or SDK Promise. Final rendering shows escaped bold question text and neutral footer controls in both rendering modes. The existing callback handler consumes the action before enqueueing, colors only the pressed control after acceptance and admits an ordinary prompt turn with the original reply/target context. No new callback namespace, waiter, dialog registry, task controller, poller or persistent record is introduced. SDK/app answers remain private and are not implicit agent input. See the [authoring contract](./public-api.md#agent-selection-markup). ### Artifact Delivery (Unreleased, Bounded) **Implemented and locally accepted in source/native and compiled-native fixtures; not in released 0.58.3 or activated in this running session.** The [public artifact contract](./public-api.md#artifact-delivery-contract-unreleased) provides one bounded document upload, distinct from attachment input, text-view handles and task execution. Delivery, outbound-attachments, API, existing bus/registration and lifecycle owners implement the vertical. It adds no artifact framework, domain/entrypoint, storage family, temporary-file lease, cancellation registry or durable retry journal. The downloaded-input ten-minute lease is unrelated. Supported-platform and live acceptance remain separate. Delivery snapshots declarations and captures genuine binding/session/route/profile/bot/transport/target authority before disclosure-relevant I/O. Active-turn scope captures the actual turn, not only an equal target projection. Reserve bounded operation capacity before descriptor capture; capture private bytes before existing per-target queue waiting, with pending/drain visibility through existing owners. Outbound-attachments owns source/name/effective-limit validation and regular-descriptor capture; API owns byte multipart encoding, activity, Workspace admission, diagnostics and actual HTTP issuance. Do not route around native adapters or broaden generic path-upload/photo/fallback defaults. Supported-platform identity/link/special-source/late-I/O behavior requires native proof; descriptor observations are not global atomicity or kernel cancellation. The local root advertises optional capability `artifact-document-v1` and implements the strict private follower API operation `sendArtifactDocument`. Its single argument is a strict v1 record: `{ version: 1, registrationIncarnation, target, fileName, byteLength, bytesBase64, caption?, expiresAt }`. Existing authenticated envelope/request identity supplies correlation; no caller-supplied SDK ID or arbitrary method/options. Validate complete keys, scalar/encoded bounds, canonical base64/length, exact target, original expiry and current negotiated identity. The follower captures already-acknowledged compatible registration before source capture; it cannot wait for/adopt a replacement registration, switch routes or fall back to generic multipart. Only bytes/metadata cross IPC, never source paths, callbacks, descriptors or Blob objects. Local issuance/ACK checks stay local; the leader supplies independent native registration/profile/session/binding/target/transport guards. Existing generic full-authority follower refusal is unchanged. Live incarnation capture belongs to the actual registration owners. Leader registry `register()` replacement—including equal metadata, rename/reset and Restore/rebind publication—creates a fresh opaque incarnation; heartbeat preserves it. Remove, overlap/stale pruning and clear invalidate captures. Capability-gated acknowledgement communicates the incarnation; the follower also captures its own acknowledged-state lifetime. A replacement path must communicate its newly acknowledged identity or leave artifact calls unavailable until genuine acknowledgement; it cannot refresh an admitted operation. Equal cloned projections/availability booleans are not continuity proof. Observed loss is sticky; no global unobserved-ABA promise. Direct transport/session and Delivery binding owners must supply equivalent real lifetime evidence rather than treating profile/token stamp equality as a lock epoch. Artifact authority admission runs before **every** artifact request-ledger lookup, including hits. Authenticate and validate the wire incarnation against the current registration/transport owner before memoization/dispatch; recheck authority before releasing a cached ACK. Preserve the existing request key and changed-payload collision rule: adding incarnation to the key alone must not turn one retained request ID into another upload. Exact in-flight duplicates under the same live authority attach to one attempt. Carrying incarnation on the wire also rejects old-registration replay after ledger eviction; a guard existing only in a retained entry cannot. Bounded existing-ledger lifetime is not durable exactly-once or arbitrary same-incarnation replay protection after eviction/restart/deadline; SDK operations never automatically replay. The existing ledger must retain a bounded content digest of the exact validated artifact wire identity, not raw JSON/base64/caption/source bodies. Settled results and failures contain only bounded receipt/provenance metadata, never payloads, paths or raw rejected errors. Keep in-flight/result memoization, collision refusal and no in-flight eviction; do not add another artifact ledger. One reservation belongs to the shared native API client; activity, Workspace and recording wrappers forward that same capability. Both leader-local direct and follower execution acquire it, with follower admission before base64 decode. Permits are owner-matched and single-use; early or repeated release cannot clear running or replacement work. Contention refuses; duplicates already attached to a retained attempt do not acquire a second upload slot. Per-Delivery and per-leader reservations last through corresponding actual work/cleanup even if public abort/deadline already settled. Pending reads settle before descriptor closure; late cleanup cannot upload/rebind/reopen. Release owned references rather than promising immediate GC/secure erasure. Newline framing still precedes decoding: this does not establish a global socket/heap bound against arbitrary flooding. Keep IPC write and HTTP `beforeRequest()` issuance distinct. One native attempt forces non-idempotence plus an attempt limit that disables the remaining 429 retry path and all family/anchor/media fallback. The leader clips the fixed expiry to its own finite budget and controls the original attempt; caller-local abort after IPC is not remote revocation. Project narrow operation-correlated outcomes, not generic message-only errors. `not-issued` requires evidence about the original attempt; refusing a duplicate after original publication cannot erase issuance history. Definitive Telegram rejection needs authenticated current correlation/provenance; inconclusive post-IPC/issued failures remain unknown. Real positive identity followed by failure is only diagnostic `observedReceipt`. Artifact-only observer handling retains the original native error and ordered secondary recovery/diagnostic causes in a private carrier; rejection classification unwraps only that trusted carrier, not arbitrary cause metadata. Positive direct HTTP issuance is monotonic; legitimate follower pre-IPC no-issuance proof remains distinct. Across JSON retain safe category/issuance/correlation, not object identity or raw secret/path/body text. No absence-as-completion/submission or business grant. Locks captures the current owned transport lifetime without lending the exact polling-startup context to Delivery. It retains that context internally and fences polling generation, leader epoch, session and ownership, with sticky observed invalidation across suspension/restart/conflict/loss. Same-session fresh caller contexts are not transport replacement. The context-bound `captureTransportAuthority(ctx)` API is unchanged. BusApi lazily combines this actual owner capture with Queue's profile/token generation stamp; a separately observed change/restoration cannot renew the operation. Lifecycle owns the captured session generation/ID guard. The composition root assembles these ports without local capture policy or eager access to the later-created Locks runtime. Artifact incarnation metadata is excluded from legacy Restore hint comparison, consistently with the bus observation owner. This compatibility normalization leaves registration generation, session, target, protocol and currentness checks intact and does not relax Artifact wire authority. Local mirrored/public/integration acceptance covers exact bytes/name/target, descriptor capture and late cleanup, bounded ledger nonretention, dedup/collision/incarnation/cache behavior, mixed direct/follower contention, original-operation IPC/HTTP outcomes and observer failures. Generated-package public-consumer fixtures load the compiled owners through actual package export resolution with no implementation-source fallback. The full native suite also passes. These are mocked-HTTP/local-IPC fixtures, not the entire compiled Pi production-root lifecycle, all supported-platform filesystem/socket behavior or live Bot API acceptance. Supported-platform and live acceptance remain gated in the canonical backlog; no entire compiled Pi lifecycle guarantee follows. Source implementation and current `dist` do not imply activation in the running session. ### Composable Interaction Surfaces (Planned) **Agent Confirm/Choice markup is implemented locally; broader text/file surfaces and live/release acceptance remain open.** The agent and companion SDK planes are distinct. The SDK batch/waiter contract does not govern agent selection: a completed answer creates ordinary user input, while multiselect intermediate clicks change only finite local UI state. Shared JSON/CML validation is not a requirement to use SDK collectors, native answer Promises or new model tools. #### Agent Composition And Results - **Markup:** Interleave Markdown with `telegram_confirm` / `telegram_choice` JSON fences or HTML comments. Choice matrices retain horizontal rows and disabled cells. The exact schema and supported envelopes live in [public-api.md](./public-api.md#agent-selection-markup). - **Interaction:** Each supported single-question button is an existing `tgbtn` action capturing only question and visible answer label for ordinary model input. No tags, version, kind, status or ID are forwarded. Bridge-local routing class prevents slash/app-like data from invoking methods. String choices and bare-string Confirm simplify authoring; richer SDK results stay separate. - **Feedback:** Buttons begin neutral even when a style is declared. The declared style selects post-click feedback only. New selection controls use footer keyboards in both rendering modes so the existing keyboard edit can show selection. Legacy in-body button behavior is unchanged. - **Admission:** The ordinary sender-authorized callback/routing/Queue path remains authoritative. Consume before callbacks, retain exact current target/reply context and preserve existing duplicate/failed-admission policy. No fake tool/system messages, private SDK-to-agent forwarding, hidden waiting model call or inspection tool. - **Collection direction (explicitly authorized):** A Choice object is one question; a question array is a sequential wizard. `select:N` requires exactly N enabled choices, with toggles/progress but no intermediate model prompt. Complete results are a plain question/answer object or ordered array, with multi-answers as label arrays. Exact-N collection is implemented locally: neutral buttons toggle checkmarks/pressed colors, the cancel control shows selected/required counts, and completion produces one label array. Question arrays are sequential wizards: retain one current step and collected immutable answer data, advance locally, then emit one ordered array at completion. A one-question array keeps aggregate shape. Cancel emits completed answers plus the current question/cancel label, never an uncompleted set or unseen question. Independent blocks remain independent. Skill recipes decide usage; no arbitrary branching workflow or mirrored SDK protocol is introduced. - **Bounds:** Validate a whole declaration before registering any of its cells. At most 16 recognized declarations and 64 selection cells activate per final answer; overflow creates no selection controls. Invalid blocks are bounded noninteractive diagnostics; incomplete fences publish nothing. Drafts suppress declaration bodies. Wizard projection bounds the whole composed view for every future question to one editable message before real callback registration. Unknown outcomes never spill into extra messages or retry. Existing button/comment literal and delimiter rules remain intact. - **Lifetime:** The existing button store enforces original deadlines, consumes attempts before callbacks and retires superseded collector keys. A scalar question has one completion group; selecting either branch removes all siblings synchronously. Terminal collectors remove remaining group entries before external transport/admission callbacks; unknown edits or owner loss purge the shared collector associations. Queue/display errors cannot reopen spent work. Completion metadata stays bridge-local, never in model input. Completed scalar controls are remembered in the response-local footer so a subsequent collector rebuild cannot republish their old callback IDs. A response-local footer revision serializes collector edits and refreshes all active groups, preserving independent controls without stale overwrite; one unref nearest-deadline timer owns memory expiry, without a persistent registry or polling loop. Capture the production session/profile/bot/operator, role/epoch or follower generation/target at initial registration. Loss is sticky across revisions and awaited edits. Local-only API guards cross no IPC as functions or execution grants. Missing ports, malformed/cross-message callbacks and unknown edits refuse; unknown UI outcomes close the shared collector footer. Only a positive guarded edit ACK permits final ordinary queue admission; an admission error cannot replay it. Wizard deadlines use the earliest declared timeout from original planning, never per-step renewal. Opaque compiler fragments materialize only the active heading in the cached delivery text; decoded data is never rescanned as markup. Variable row spans rebuild under the shared footer revision. Replies owns the bounded single-message Rich/HTML editor; Routing joins its original execution/selection guards to native UI authority. Production edits use existing guarded `editMessageText`, with rich content retained rather than downgraded or re-chunked. #### Independent Menu And Callback Retention System menu state is a separate session-local store: at most 60 saved menu messages across Status, Model, Thinking, Queue and Settings, with a sliding one-hour idle lifetime refreshed on lookup. Lazy store/read pruning expires idle entries and evicts the oldest access-ordered entries; it does not automatically edit old keyboards. Core menu access neither consumes nor renews `tgbtn` entries. Plain/app-bound prompt callbacks default to a fixed 24-hour lifetime, restoring the ordinary-button baseline rather than applying a question's one-hour default to every prompt. Production Confirm/Choice planners now default to 24 hours; raw compiler embedding that omits the private policy retains its one-hour compatibility default; explicit shorter deadlines still win and wizard progression never renews its original deadline. SDK Delivery timeout/capacity and private Text/Attachment defaults are unchanged. The separate callback store admits at most 60 retained associations. Each ordinary/app-bound action counts once; scalar question branches share a completion group and related collectors share a footer retirement owner. Capacity evicts the oldest complete group using its original creation age, not its newest callback generation. Drop every record before retirement hooks; retired identities cannot be reused. Registration reserves a slot before authority callbacks and rejects caught reentry without poisoning independent work. New app views remove superseded bound callback records and stale same-generation revisions cannot replace newer records. A no-effect compilation pass counts every callback kind and the sum of widest future wizard steps before real registration, rejecting a whole oversized publication rather than leaving partial controls. Disabled cells cost zero and future callback IDs are not retained. Timed memory expiry runs even with no further input. A single unref timer is re-armed to the earliest retained deadline, cancelled when empty/cleared and protected against stale timer generations. Exact legacy expiry is inclusive at its deadline; collector revisions retain their original declaration deadline. Retirement-hook/diagnostic failures cannot interrupt other cleanup. Lifecycle binding clears associations before session-start/shutdown awaits, but a stale shutdown never clears successor work. Actual in-flight edits remain awaited and their retired collector guards refuse late admission. Native Generative App owner observations now revoke stale app-bound callbacks without requiring a replacement view, including agent-only invocations. The native result fence and actual-execution ordering are specified in [Generative Apps lifecycle](./generative-apps.md#lifecycle-and-safety); independent live/platform/package acceptance remains separate. The Bus-aware API observes local send/edit attempts and positive acknowledgements through a narrow store-owned port; no functions or new authority facts cross IPC. First acknowledged numeric chat/message coordinates pin each callback; copied messages cannot retarget it. Supplied send Thread coordinates, including an explicitly absent Thread, are preserved rather than inferred from a configured default. Bot API edits identify a message by chat/message ID and may lack a Thread field; such an edit pins only its known coordinates, without inventing a Thread. A production callback without acknowledged publication is unavailable. Capture original session/transport/operator/role authority for ordinary callbacks as well as collectors; spend scalar groups before even invoking captured authority observations. The same store owns at most sixty indexed publication snapshots and a single coalescing footer-cleanup shell, not another interaction registry. Actual native sends/edits retain their attempts until settlement. A known publication serializes its native mutations, including cleanup, through a bounded sixty-attempt lane; cleanup cannot race an earlier edit or overwrite a later one. Consumption/closure marks spent `tgbtn` cells disabled. Known deadline retirement best-effort marks the label `Expired:` and replaces its executable ID with non-action `tgbtn:expired`; a delivered tap receives `Button action expired`. Capacity retirement instead shows `Unavailable:` with non-action `tgbtn:capacity`, whose toast explains removal by the control limit rather than claiming elapsed TTL. Both statuses consume no callback slot and store no prompt or retired-action registry. A missing original action or invalid publication address is unavailable, not evidence of a deadline; unknown history is never revived. Retirement diagnostics retain finite reason/count, action birth, configured store TTL, observed age and known publication coordinates; publication-unavailable/mismatch diagnostics do not spend a still-live action. Unrelated menu/SDK buttons, current history text and post-press feedback are preserved. Footer and canonical Rich-row snapshots are projected again immediately before native issuance after any queued predecessor; stale/unknown callback IDs cannot be restored by a late publication, and caller-owned snapshots are not mutated. Initial publication ACK after expiry may close the visible footer but cannot renew callbacks. Original-authority loss skips cleanup; an unknown edit invalidates the publication and its callback groups rather than authorizing a stale snapshot rewrite. Only a native method-bound rejection preserves the prior known snapshot/unspent IDs. Cleanup failures retire without replay. Store-resolved actions on managed publications carry only a bridge-local retirement marker: callback acknowledgement never re-edits a stale query keyboard after the publication owner has already taken visual cleanup. A delayed app result therefore cannot erase a newer independent collector footer or turn an uncertain cleanup into a second legacy attempt. Shutdown waits for actual publication work even if diagnostic stop fails; old shutdown continuations cannot act on successor state. Canonical in-body controls now retire through a guarded `editMessageText` using only the latest acknowledged plain-Markdown Rich snapshot and current footer, never a pre-edit body or an unknown outcome. Snapshot eligibility is at most 65,536 UTF-16 units with only `markdown`, `is_rtl` and `skip_entity_detection`; media, HTML/blocks and extra producer payloads are not cached/replayed for background cleanup. Original-authorized producer publications may still project their own Rich rows before issuance without transferring disclosure authority to cleanup. Canonical rows are opaque across multiline labels; fenced/inline/indented code and escaped markers remain literal. An acknowledged full-body replacement updates or clears the Rich cache and closes callback groups absent from the actual visible body/footer. Body and keyboard mutations share the same bounded native lane. This local source/mock/compiled evidence is not live client acceptance. #### Separate SDK And Future Input Work Companion extensions retain narrow Delivery functions, their private result/custody and exact transport/source authority. The private Text/Attachment foundations below remain unbound until their own privacy, source and resource guarantees are proved; they neither block ordinary agent selection markup nor authorize implicit model fallback. Future agent text/file formatting must explicitly define ordinary prompt/reply semantics rather than silently adopting SDK-private collectors. Artifact delivery and Task View remain separate SDK capabilities, not agent state-inspection commands. No production schema adoption, migration, new persistent root or general workflow engine is introduced. Preserve direct/follower authority, sender admission, existing durable input/Queue ownership, `/new` exact source completion, `/compact` rechecks and hidden `/quit` shutdown ordering. Local parser/planner/callback fixtures are not current-session loading or live client acceptance. Remaining work belongs only in [BACKLOG.md](../BACKLOG.md#composable-interaction-surfaces-delivery). #### Shared Input And Head/Tail Adoption (Approved, Partially Implemented) The [adopted authoring/UX standard](./public-api.md#shared-input-and-question-lifetime-standard-adopted) changes the target from exact-reply-only SDK input to one positively owned next-text Input per operator/profile/bot/target, with recognized commands remaining commands and `/name` consuming the same primitive. New Input replaces its predecessor; Confirm/Choice replacement is not inferred. Existing Delivery question ownership is the common kernel, not a new dialog domain or interaction registry. Text result/semantic validation/rename effects remain producer-owned. Old associated answers and controls never borrow a successor's Input, even with identical target values. The adopted [voice-as-text and consumer-value rules](./public-api.md#shared-input-and-question-lifetime-standard-adopted) extend that planned Input across built-in and companion consumers, not arbitrary mirrored Pi dialogs. Existing inbound/media/voice owners perform configured transcription; Delivery retains the originally selected Input/source/target across the await and rechecks its authority before value delivery, without selecting a successor or falling back to model admission. Consumer domains own field normalization and shortening, including Name's limit; Queue owns an editor's exact waiting-item identity, text mutation and dispatch guards. Queue Edit's pause policy remains an explicit open decision in BACKLOG. No second STT path, Input registry, public opener, accepting source or production readiness is enabled by this design adoption. The first checkpoint is implemented locally: optional SDK Input/Confirm/Choice `timeoutMs` defaults to 24 hours in `openQuestion()`, without changing explicit integer bounds, the admission-time deadline or required explicit Attachment timeout. Native boundary tests exercise the public Confirm/Choice membranes and private Text kernel; omission/short/invalid values, exact expiry and excluded Attachment behavior are covered, with a one-hour semantic falsifier restored by hash. That initial checkpoint did not change agent or `/name` lifetimes; production agent defaults are now 24 hours under the bounded direct composition below, while `/name` remains five minutes. Target-confined replacement is now implemented in the private kernel below. Remaining checkpoints are positively owned modal next-text selection, the built-in Name adapter, and agent/SDK head-tail coordination. A former otherwise-live head gets one hour from demotion; terminal state, lost original authority and producer deadlines still veto use. No promotion/resurrection of historical tail and no tap/edit renewal. Preserve existing finite numeric validation, original admission-time deadline anchoring, Name validation/reset/correction policy, source actual-I/O drain and capacity until their specific owner changes are validated. Unspecified media/voice/edit handling stays at existing restrictions rather than expanding capture. The legacy exact-reply foundation and v4 witnesses below are retained implementation evidence, not modal next-text readiness. A missing marker cannot authorize ordinary handling or select an active Input: next-text capture needs positive current original Input ownership before ordinary/foreign/model handling, and the physical source must retain that exact choice across replacement, await, ACK uncertainty and terminal disposition. The proposed head lifetime does not by itself explain observed early expiry; loaded build, completion/group retirement, capacity and owner/binding loss are distinct evidence questions. Root/public API, donor/Bus/private receiver IPC, persistent/wire changes, production adoption/readiness, reload/live and release gates remain explicit; this standard does not grant those activations. Current Routing command-priority preparation is implemented without changing Commands or opening SDK publication: the existing Name collector captures its original dialog, then uses `Commands.parseTelegramCommand()` on the text before name validation/consumption. Built-ins, ordinary extension commands, prompt templates and unknown-command fallback keep their normal dispatcher paths. Repeat `/name` opens a fresh dialog; other commands do not silently terminate its wait. A bare `/` or a slash inside a name remains subject to ordinary name policy rather than an ad-hoc slash ban. Private/historical reply fences still precede this collector; the change grants no SDK-reply-to-command fallback. SDK modal capture, common Name migration and shared head/tail remain separate checkpoints; the current Name dialog still has its own five-minute lifetime. #### SDK Head/Tail Kernel (Private Opt-In) The Delivery kernel now has a constructor-captured package-private `questionHeadTail?: true` mode; omission preserves existing production SDK behavior, while other runtime values refuse construction. It is not wired through the production bridge/root. The separate private first-send agent port below now exercises one direction; default agent callback assembly remains unchanged. These checkpoints do not implement the complete shared agent/SDK standard. Within this mode, a valid admitted Input/Confirm/Choice is head for at most 24 hours from original admission. Captured, otherwise-live previous SDK questions in the same profile/operator/exact chat/Thread scope are capped at one hour from this demotion or their earlier effective deadline. Existing tails already have the stricter deadline and are neither rewritten nor rearmed. The existing question entries own the effective deadline; irreversible shortening needs no separate head marker, second registry, persisted lifetime record or new SDK result surface. Explicit timeout validation remains 1–2,147,483,647 ms; longer valid requests are accepted but the private head policy caps effective lifetime. Attachment, Task View, Artifact and system-menu lifetimes are excluded. Admission reserves the successor and demotes only its captured predecessors before disposal/drain callbacks can reenter. Replaced Input is terminal, not a tail. Finishing a head never promotes history, and a later question cannot renew an existing tail. Final abort/authority/deadline and static/capacity rejection do not demote a valid head. Demotion is a valid-admission event, not a publication-receipt reconstruction or a rollback grant if the new publication later fails. Each question's original timer owner rearms against its shortened effective deadline and fences already-dequeued callbacks by generation. Native controls and SDK settlement consult that same deadline. Logical expiry still leaves original publication work/lane retained; it cannot release Text opening capacity before actual I/O drains. Mirrored native tests cover every cross-kind SDK demotion except terminal Input-to-Input replacement, late first demotion, no historical promotion, short producer deadlines, the 24-hour head cap, scope isolation, Attachment exclusion, final-preflight/capacity refusal, stale timer callbacks, captured opt-in, reentrant newer heads and held publication I/O. These are controlled same-runtime SDK facts, not agent membership, cross-owner IPC, source completion/ACK or live acceptance. The private first-send join below reuses this native lifetime owner under original scope; the private reciprocal subscriber and wider membership must preserve fixed edits/taps without a parallel interaction registry. Root/default/public Text/readiness, modal collection, `/name` migration, source recovery and reload/live/release gates remain separate. #### Original SDK Lifetime Owner (Private, Unwired) `captureQuestionLifetimeOwner()` is a package-private kernel port available only under the captured `questionHeadTail: true` opt-in. It captures the original active SDK runtime and exact current instance target/profile/operator, not an output-authorized foreign target or the global current-runtime registry. Its frozen target is copied from the receiver provider. Scope checks retain original generation and provider identities; observed loss, caught owner/acquisition reentry or equal-field restoration cannot revive that owner. Receiver observations reuse the existing reader, preserving sticky Text source loss rather than creating a parallel receiver-history path. The owner can make one `captureTail()` attempt. It captures the original clock and current matching non-Attachment SDK question references before authority callbacks can admit a newer head, then returns one guarded application. Application never reselects or rebases, including an empty candidate set; scope is rechecked against the original runtime and only still-current live original entries can shorten. Copied method references share the same spent state. The existing SDK admission path and this private operation reuse one shortening helper; no question/result inspection, second registry, new timer family or caller-supplied clock is introduced. Actual Text publication work retains its original I/O lane/capacity through logical tail expiry. This is local SDK-scope authority to shorten retained SDK lifetimes, not an agent publication proof, source ACK, answer permission or native bot/peer admission certificate. Production bridge/lifecycle/root do not enable or connect it. The private first-send integration below captures this owner at original group admission, retains its original selection/session/transport guard and deadline, validates native known-target positive publication once, and only then captures/applies SDK tails; production and wider integration must preserve these fences. Missing/unknown/retired/late publication cannot borrow a new owner or replay membership. Default reciprocal composition, general edit-first/multi-question footer membership, transport composition and live acceptance remain open. Mirrored tests cover Classic/Threaded, original time, one-shot aliases, empty/stale candidates, eight scope-loss axes, equal-field runtime replacement, reentry and retained publication I/O. #### Original SDK Lifetime Scope Matching (Private, No Admission) Every opt-in lifetime owner now exposes an opaque frozen native `scope` token and `assertScope(peerScope)`. A separate private class brand, constructor key and captured reader bind the token to its original runtime, profile/operator and exact receiver target. Copied owner method references may retain the same genuine token; token DTOs, prototype copies, proxies, forged constructors and substituted readers refuse. Distinct simultaneously live runtimes with equal fields never match. A scope token has no SDK question, admission clock, answer/result or publication authority; it cannot substitute for the separate native SDK admission type. Owners in one runtime share constructor-pinned SDK providers/generation. Matching validates the current head owner's original scope and reads the matching peer's local sticky-loss flag before and after the final current-scope check. It does not recursively enter a peer SDK guard already active on the stack. This allows a legitimately newer native agent publication to recognize and demote an older peer while that peer's independent SDK guard is in flight, without weakening that guard's own caught-reentry fencing. Observed peer loss cannot revive through another owner after equal-field restoration. Recursive matching, including invalid-token attempts inside that owner's already-active SDK guard, poisons its own owner; invalid/foreign/historical tuples outside an active guard do not spend unrelated valid ownership. This proves scope identity only, not native bot/peer readiness, agent publication or source completion. #### Native SDK Question Admission Scope (Private, Unwired) The private `questionHeadTail: true` kernel can capture one `onQuestionAdmission` callable at construction. Omitted/off kernels do not even read that port. For each successfully reserved Input/Confirm/Choice, after final preflight/capacity checks and SDK-tail demotion but before predecessor disposal and actual publication I/O, it issues one frozen native admission view. The original demotion clock and copied target are fixed. Attachment, Task View and Artifact are excluded. No callback is awaited, no actual-I/O lane is held by this scope, and the scope closes in `finally` as soon as the synchronous callback returns or throws. Promise returns cannot extend it; late rejection is observed without replay. Failed/unknown later publication cannot reissue admission or roll back a valid head. An original SDK lifetime owner now has `assertAdmission(value)`, which returns that native clock only for the same original runtime, profile/operator and exact chat/Thread. A private class brand, secret constructor key and captured native reader reject DTOs, copies, proxies, prototype/constructor forgeries and substituted static readers. Each runtime has one opaque in-memory identity, not a new registry or a caller-supplied generation string. Another simultaneously live runtime with identical fields cannot borrow the original owner. Foreign runtime/target and stale evidence refuse without spending valid unrelated ownership; a currently valid same-runtime native event proving changed profile/operator makes the original owner unavailable rather than renewing it after restoration. Validation checks the original SDK owner and actual reserved question entry under original provider/generation guards. Abort, terminal phase, map-identity loss, deadline before/after callbacks, shutdown, caught validation reentry and observed scope loss refuse; native admission loss remains sticky across clock restoration or another original owner. Reader validation neither selects nor shortens questions, inspects SDK results, releases publication work, grants answers/source ACKs nor proves agent publication. Controlled Classic/Threaded, cross-kind, distinct-live-runtime, forgery, reentry, asynchronous/held-I/O and scope-loss tests prove this private issuer/verifier only. The private store subscriber below now consumes this verifier; bridge/root/default activation and remote receiver IPC remain unconnected. #### Agent SDK First-Send Membership (Private) The button store has an optional constructor-captured `captureQuestionLifetimeOwner` port, deliberately unbound in production. For each original structured question `completionGroup`, it reserves existing group metadata before callbacks, captures the original SDK lifetime owner once during actual action admission, and retains the original selection/session/transport authority guard. Missing/throwing capture or unavailable agent authority stays unavailable for that group; later rows, wizard revisions or equal-field SDK replacements cannot acquire a successor owner. The existing group WeakMap now owns both birth facts and this private lifetime state, with no second registry. Footer revision/capacity ownership remains distinct from native question identity. The original single-group first-send path requires one complete completion-group lifetime in its first supported native text/Rich send; the bounded co-head path below additionally admits a complete originally scoped cohort. The known-parent edit exception remains single-group. A wizard sequence is one such group even with several semantic steps; adjacent independent declarations are several groups. Its first descriptor spends membership before actual I/O, including unknown/rejected, unproved edit-first, partial and unsupported multiple-completion-group cases. A positive safe message ACK must still find every original callback live, unexpired, unretired and not already pinned by another publication; the original exact SDK target must match the issued chat/Thread, with malformed Thread metadata refused. A late first-send ACK cannot borrow a group whose first acknowledged callback binding belongs to another message. Retries, duplicate finish calls, ordinary edits and collector revisions cannot mint new membership. These holds preserve existing legacy rendering/callback behavior rather than repairing or replaying messages. At the eligible ACK, original rows are first pinned to the actual native publication. SDK candidates and time are captured through the original owner before agent-authority callbacks can admit a newer SDK head. After exact native pinning/liveness passes and before authority callbacks can reenter, the existing group metadata retains a non-owning `WeakRef` to that actual positive first-send publication once; this is distinct from a spent descriptor attempt or an edit/history lookup. The head path still validates the original agent guard before its one-shot SDK application, which rechecks original SDK scope. Retaining the native fact early lets a reentrant newer head see this older acknowledged question; no consumer may treat that fact as current ownership without its original guards. Live actions and existing publication/work owners retain the real publication; the fact cannot keep retired UI/history alive by itself or reconstruct a lost reference. The retained fact is never sufficient authority alone: every later consumer must still validate the original SDK/agent scopes, current rows, deadline and original publication. Observed replacement, retirement or reentry never falls back to a current SDK runtime. These membership/tail operations only shorten question lifetimes: they do not inspect producer results, enqueue answers, release original SDK publication I/O or grant source completion/ACK. Direct/follower-wrapper, Classic/Threaded and HTML/Rich regressions use controlled native API receipts, not live Telegram or remote receiver-IPC acceptance. This private first-send fact supports the reciprocal subscriber below, not full shared lifetime adoption. Production 24-hour agent default activation, general edit-first and multiple-completion-group membership, cross-owner IPC and root/default/live composition remain open. The local question deadline owner below supplies only the monotone cutoff, not SDK admission authority. The publication observer is a trusted native adapter port, not a publicly accepted publication DTO or a durable/native source-ACK issuer. #### Agent Store/Collector Deadline Alignment (Local) Agent action expiry now has one store-owned cutoff calculation: the earlier of the original existing store-owner birth plus its TTL and the declaration deadline. Ordinary ungrouped callbacks retain their individual birth; structured revisions reuse original birth in the existing `groupFacts` owner, not a fresh token's creation time. Token `createdAt` remains diagnostic metadata. Cleanup, the nearest-deadline timer and native in-flight selection guards use this same cutoff. No registry, timer family, SDK waiter, public API or production TTL default is added. The selection wrapper checks the cutoff before and after preparation and before every guarded publication/commit. A delayed expiry timer cannot extend authority through a longer collector-local declaration deadline. Observed store expiry remains sticky even after logical callback retirement and equal-clock restoration. Regenerating wizard/selection rows cannot renew the original store TTL. Actual publication work still drains through its existing owner; logical retirement does not claim I/O completion or enqueue a late answer. Mirrored native tests cover partial, final and wizard edits, clock-only expiry, original timer scheduling and spent final updates. This closes a prerequisite, not common agent/SDK ownership. The existing selection authority capture is an opaque session/direct-or-follower/transport/operator/target guard; default/root assembly still supplies no original SDK runtime lifetime owner or readable authenticated profile scope. The private first-send port above now retains and validates an original SDK owner without making default assembly ready. A later publisher callback must never look up the then-current SDK runtime or infer original membership from chat/Thread numbers; keyboard edits, collector revisions and late ACKs remain distinct from first membership. Publication target must be known under that original guard; missing/ambiguous evidence cannot mint membership. Preserve distinct native question identity versus shared footer revision/capacity ownership, including multi-question surfaces; do not derive head membership from visible labels or callback DTOs. Cross-owner IPC, root/default activation and live acceptance remain separate gates. #### Agent Question Deadline Owner (Local Prerequisite) Each native structured question completion group now carries one frozen process-local deadline handle. Its numeric cutoff can only shorten; a longer request, infinity or NaN cannot extend it. Scalar Confirm/Choice and set/wizard collectors use this same original handle. Action `expiresAt` values remain deadline snapshots, not a second effective deadline authority. The store clips the handle to its original owner birth plus TTL at admission; cleanup, first-send membership, nearest expiry scheduling and guarded callbacks read the earlier shared cutoff. Raw native collector preparation and already-prepared update guards also read that handle, independently of timer dispatch or a store wrapper. Wizard steps and regenerated rows keep the original group and handle. The handle binds once to the original store's existing `armExpiry` callable. Every actual shortening rearms that same nearest-deadline timer; equal/later values neither renew nor rearm lifetime. No additional timer, subscription registry, SDK waiter or public API is introduced. A different store cannot replace the original callable. That refusal occurs before capacity eviction or action reservation, so a refused adoption cannot retire the original collector or spend another store's existing callback slots. Legacy ungrouped/custom groups retain the existing cutoff path. This closes mutable deadline ownership locally. The private SDK subscriber below joins it to native original-runtime admission scope and exact retained first-send agent membership; equal target fields or a private shortener reference cannot supply that authority. Independent-group/footer identity, production 24-hour agent default activation, general edit-first membership, receiver IPC and root/default/live adoption remain separately open. Shortening or terminalizing a question does not finish actual publication I/O, grant answer/source completion, or promote older history. #### SDK-To-Agent Question Tails (Private Subscriber, Unwired) The store's private `onQuestionAdmission` subscriber snapshots exact current rows of positively published original question groups before SDK/agent guard callbacks can reenter. It consumes only the retained native publication fact (first-send or bounded known-parent edit), original SDK owner, original agent authority, original physical publication/scope and original group deadline. A merely spent descriptor, pending/unknown publication, unproved general edit-first, partial/multiple-completion-group surface or a later successful retry cannot mint that fact. Original publication loss, retirement, consumption, capacity/clear or scope loss stays held. Current rows after a legitimate markup revision can use the same retained fact; the revision never acquires another owner or first membership. For each captured group, the original SDK owner verifies the native admission and fixes its SDK clock. The original agent guard then runs, followed by another native SDK-scope check and exact original-row/publication liveness check. Only that captured question deadline can shorten to the earlier producer cutoff or one hour from the native SDK admission. The policy constant is shared with Delivery, not duplicated. Newer positive groups or replacement rows admitted by callbacks are never reselected. Foreign live runtimes with equal fields, admission DTOs and closed/late scopes refuse without borrowing current SDK state. No SDK/model waiter, second registry, persisted record, result inspection or source ACK is added. This private kernel is not production shared-question adoption. Native store-producer tests use the existing process-local deadline factory with a producer-owned 24-hour upper bound to prove actual one-hour shortening; they do not widen agent markup's current one-hour declaration default or explicit-timeout validation. Real markup revisions separately prove retained membership and original owner reuse. The factory is package-private, already used by native Confirm/Choice/set/wizard compilation, and does not authenticate a producer, grant business effects or create public SDK interactions. Logical SDK-tail expiry retains an already-issued agent publication edit and its original queue until actual drain. The following agent-to-agent path now supplies native original-runtime matching/demotion; production default-24-hour authoring and bounded direct Root/lifecycle composition are now connected; unsupported physical histories, app/remote integration and live/remote receiver acceptance remain open. #### Agent-To-Agent Question Tails (Private, Unwired) A first eligible complete singleton native agent ACK also snapshots old positive agent groups, their exact rows and the original ACK clock before SDK/agent authority callbacks. The incoming head's real publication is pinned and retained as a fact before callbacks, so a newer reentrant head can recognize and demote it. The older head's snapshot can never select that newer group back. The incoming head's native lifetime scope must match each peer's original scope; equal chat/Thread/profile fields alone are insufficient, and no synthetic SDK question/admission is minted for an agent head. Both native SDK admissions and native agent heads use the same specific captured-question shortening helper. A native agent head additionally retains its original agent guard and exact live publication/rows throughout peer validation. Each old peer runs its own original agent guard between head-scope checks; only still-current captured rows can shorten to the earlier producer deadline or one hour from the original ACK. Finishing a head never promotes history; another head cannot renew an existing tail. Pending/unknown/retried/unproved-edit-first/partial/multiple-completion-group/foreign publications and lost original head/peer scopes refuse without consuming unrelated ownership. Controlled Classic/Threaded and text/Rich tests prove same-runtime agent-to-agent shortening, zero SDK admissions for agent heads, equal-field distinct-live-runtime refusal, peer sticky loss, original ACK time and reentrant newer-head ordering. Long native producer fixtures exercise actual 24h-to-1h transitions without changing markup defaults. This closes the private local direction, not full authoring adoption: production default-24-hour agent questions, general edit-first/multi-question ownership, root/lifecycle/transport assembly, authenticated remote receivers, independent review and live/release acceptance remain separate gates. No head registry, general workflow/executor, result inspector, new timer or source ACK is introduced. #### Agent 24-Hour Default (Private Opt-In) `parseTelegramUiDeclaration(element, source, true)`, the private planner dependency `questionHeadTail: true` and the private planner factory's optional third literal-true argument normalize omitted Confirm/Choice timeouts to 86,400,000 ms. These internal ports are not public exports or Markdown fields and do not grant publication, SDK scope, business authority or shared ownership. Omission preserves the released one-hour selection default. Explicit numeric validation remains 1–3,600,000; private Text/Attachment defaults stay five minutes. The Choice representation aggregate is capped at the selected default, while the actual wizard collector still uses the earliest original per-question producer cutoff, not that aggregate. The planner captures the literal policy before preflight, projection or registration callbacks and forwards the same primitive through compilation; callback reentry cannot change later questions' mode. The factory captures its primitive at construction. Invalid flags refuse before registration/rendering-provider effects. Existing single monotone deadlines, raw/prepared guards, regenerated rows and the nearest store timer enforce the actual cutoff; a shorter explicit deadline or original store TTL still wins. No timer, registry, waiter, wire field or tool is introduced. Real Confirm/Choice/exact-N/wizard markup collectors accept after one hour, retain the original deadline through steps, retire at 24 hours and refuse stale callbacks. Classic/Threaded text/Rich native singleton publications demonstrate SDK-admission-to-agent and agent-to-agent shortening from actual opted-in markup rather than a synthetic long-deadline producer. These controls originally proved only the private path. Production Root/Bindings now adopt the 24-hour default and bounded direct original-provider composition; app/remote integration, general unsupported physical histories and independent/live/platform/release acceptance remain separate. Reserved Text/Attachment normalization does not imply collection readiness. #### Question Versus Footer Identity (Native Assessment) A `completionGroup` is a semantic lifetime: one scalar question, one exact-N set, or the entire sequential wizard. It is not a count of visible headings or semantic wizard steps. A shared selection-footer owner instead serializes revisions, target pinning, authority and capacity across collectors. Controlled native API/Bridge/Bus/Delivery/store probes confirm a two-step wizard has one completion group and one original SDK capture, can demote an SDK head after its first positive send, and can itself be demoted by a native SDK admission. Two adjacent Confirm declarations have two groups/captures; their first multi-group descriptor is held. Answering one and positively editing the surviving original publication cannot replay first membership. This narrows older broad “multi-question held” wording: sequences are already single-group eligible; several independent groups are not. The pre-fix assessment exposed a distinct known-expiry coupling, not independent-question expiry correctness. Two exact-N collectors have two groups and two SDK captures but one footer/agent-authority owner. With planning at 1000, one 100-ms producer deadline and an otherwise-live 86,401,000 deadline, timer expiry at 1100 retired both collectors' callbacks while the long original deadline remained unchanged. Cleanup chose the selection owner and collector retirement marked the shared view lost. The local fix below closes known semantic expiry without widening multi-group membership or treating logical end as actual-I/O drain. The original disposable probe remains historical counterexample evidence, not the corrected-state acceptance check. Edit-first has a separate original-physical-scope gap. Native `editMessageText` normalizes its response to `edited|unchanged`; native reply-markup editing returns no message locator. Controlled edit responses can carry original Thread 99 while the caller body supplies Thread 7, yet the bridge returns only `edited`. Body fields or that success cannot certify the physical edited message's original receiver. Removing the edit-membership fence falsely demotes the SDK question in supplied Thread 7; removing the multi-group fence silently selects the last iterated group. Replacing question identity with the footer also loses a legitimate wizard's tail update. Each counterfactual is assertion-RED with exact source restoration. They are forbidden shortcuts, not proposed implementations or live Telegram exploit evidence. Positive edit-first membership therefore still requires native original-publication/physical-receiver evidence under original scopes, not a caller locator or normalized edit success. Multiple independent groups additionally need the now-adopted common co-head semantics below and closed whole-group publication evidence; incidental row/Map order supplies neither. This assessment changes no implementation, default, registry, timer, public API, source ACK or production binding. Reports use disposable local fixtures with no runtime writes, real network or model sends; independent/platform/live/release acceptance remains separate. #### Question-Local Known Expiry (Local, Unreleased) Known `deadline` retirement now selects the original `completionGroup`, falling back to legacy owner/key grouping only for ungrouped actions. Timer/lazy cleanup and wrapped cutoff guards use that same identity. Other reasons retain the existing footer owner: authority loss, capacity, supersession and uncertain publication do not gain question-local scope. All matching associations are removed before the existing private retirement hook receives the reason; no registry, timer, head history or public callback is added. A finite collector's known expiry terminalizes itself without marking the shared footer lost or freeing an occupied footer span. It retains an irreversible local expired fact for raw/prepared guards and row regeneration, including clock restoration. Regenerated expired enabled cells use the existing refusal-only `tgbtn:expired` status; deliberately disabled cells stay disabled. Successful earlier answers remain consumed/disabled rather than becoming expired when their old deadline later passes. The long neighbor keeps the same group, original authority, revision owner and deadline through regeneration; no recapture or renewal occurs. Known expiry alone cannot settle actual edit work. Native text/Rich tests hold expiry cleanup while a live neighbor's update queues behind it, then prove the neighbor completes after real drain. If an expiring update already occupies the footer, it keeps that span until settlement and late/stale completion still invokes footer-wide failure. Unknown cleanup invalidates the whole original publication, not merely the expired group. Source/actual-dist regressions cover set/wizard neighbors, timer and non-dispatched/raw/prepared cutoffs, capacity/authority failure, original SDK captures, consumed history and visible expiry. General edit-first/multiple-group membership, root/default activation, independent review and live/platform/release acceptance remain separate. #### Known-Question Publication Edit First (Private, Bounded) A fresh complete Confirm/Choice/exact-N/wizard completion group may acquire its one positive publication fact through native `editMessageText` on the exact retained positive parent-question publication, or the bounded direct positive reply-markup path below. The observer pins parent/publication/rows before original publisher callbacks and spends the fresh group's first descriptor before those callbacks or I/O. Only one unambiguous retained view/parent is eligible; same-coordinate legacy views remain serialized against their pre-captured valid owner, not a callback-created replacement. Ordinary-only, edit-born and untracked views cannot supply provenance. `threadKnown`, caller locators and normalized edit success alone are insufficient. The bounded region accepts text or Rich, a closed field set and the original physical chat/message. Caller Thread omission derives the head's target from the parent; a supplied Thread must match. Alternate/business/inline/direct-topic or unknown fields refuse membership, including fields introduced after lane waiting. The actual carrier still crosses the locator/serialization fence below. Only native normalized `edited`, not `unchanged` or an ambiguous boolean/result, can qualify. Every fresh callback must be present exactly once; partial, duplicate, independent multi-group and unproved reply-markup-only first edits stay held. A rejected/unknown first descriptor remains spent; a later successful send/edit cannot replay it. At ACK, the parent must still have its exact live preimage before supersession. All superseded associations and retirement facts are spent without external notifications; fresh rows are pinned and the positive fact is exposed before original guard callbacks, with a fixed ACK clock and SDK/agent snapshots. Only then are diagnostics/retirement hooks notified. Reentrant newer heads can see and demote the prior fact, but an older callback cannot capture them back. This reuses the existing retirement owner rather than a second queue/transaction. Issued edits and bounded publication lanes remain occupied until actual settlement even if the fresh group expires; unknown edits retain footer-wide fences. `QuestionLifetime.publicationScope` carries the physical publication's original native SDK scope across successive replacements; it never renews from the immediate parent or equal-field foreign runtime. The new group's original SDK scope must match it. Native SDK/agent tail consumers also check the original publication guard, their own agent authority and exact captured rows around guard callbacks. Parent semantic supersession does not invalidate that terminal-safe original binding, but observed publisher/ancestor-scope loss remains sticky and cannot be repaired by a fresh group's valid guard, another SDK admission or a later replacement. The retained publication fact stays non-owning. Fresh exact-N and wizard collectors use this same single-group path, not another registry. A wizard's currently complete step opens one lifetime for the full sequence. Actual keyboard/text updates regenerate rows in that original group with the original SDK owner/deadline/publication fact; intermediate steps emit no model prompt, and revision/finish cannot become another head or renew a tail. Collector-parent semantic supersession retires the old footer without poisoning its terminal-safe publisher binding. Expiry, producer-alias row replacement during issued first-edit I/O, unknown outcomes and original publisher loss cannot grant late membership. Later issued selection updates also retain their lane until actual drain after expiry/unknown failure. These boundaries are exercised through the real callback handler and native Bus methods in Classic/Threaded and text/Rich; a retained real collector group does not retain the drained native publication/cache. Native client/Bridge/Bus/Delivery/store and real-markup regressions prove this local subset in Classic/Threaded and text/Rich, SDK/agent directions, origin history, first-attempt/ACK reentry and actual drain. Controlled alternate-locator fixtures are adapter evidence, not live Telegram routing/acceptance. General/unproved reply-markup-only edit-first, multi-group edit membership, authenticated receiver IPC, root/default/lifecycle activation, independent review and live/platform/release acceptance remain separate. No public API, generic receipt, registry, timer, agent waiter, source ACK or runtime-data operation is added. #### Original Publication Locators (Local Actual-I/O Fence) Implementing the known-question edit-first candidate exposed an earlier I/O ownership prerequisite: Bus awaits an existing publication lane, then spreads the caller's still-mutable body. Previously a queued caller could change chat/message/Thread or introduce alternate/business/direct-topic locators while the observer continued settling the original publication. That prerequisite was closed before the bounded known-parent subset above; the locator fence itself grants no membership. The existing private publication observer now captures original data-scalar locator descriptors before original-view guard callbacks. For its tracked/native-button publications, accessor/non-scalar locators or inconsistent own chat/message identity refuse. After the lane wait and markup/Rich preparation, Bus invokes the observer's optional `assertPublicationBody` on the actual copied carrier immediately before its native method adapter. That carrier—not a re-read caller object—must match the original six locators: `chat_id`, `message_id`, `message_thread_id`, `inline_message_id`, `business_connection_id`, `direct_messages_topic_id`. The carrier's routing properties then become non-writable/non-configurable, including originally omitted fields, so a later adapter/recovery hook holding that same carrier cannot introduce a different route. Caller text/rendering data is not frozen or converted into a general executor contract. Whole-body `toJSON` can otherwise replace a sealed route at native encoding. A supplied callable serializer is refused and the actual carrier's serialization hook is sealed absent. Self-restoring caller getters cannot hide a wrong copied locator; conversely, a rendering getter changing only the original caller object does not invalidate a still-correct copied carrier. Unrelated callback-free traffic with no tracked publication remains outside this owner. This local function never crosses follower RPC serialization and is not a public SDK API, source receipt or receiver-IPC readiness certificate. Mirrored native tests prove the queued request is not issued on locator loss, existing issued I/O remains held until drain, direct/follower method adapters cannot alter the sealed local carrier, and the real API recovery hook/HTTP encoder retains the original route. Refusal drains the existing descriptor and conservatively holds/invalidates uncertain edit history; it grants no successful ACK, rollback or replay. The subset above additionally requires positive parent provenance, original publisher/SDK/agent guards after I/O, closed edit admission and fixed head snapshots. The locator fence itself adds no registry, timer, tool, membership/default/root activation or live Telegram operation. #### Known-Parent Reply-Markup Outcome (Assessed, Held) Native `editMessageReplyMarkup` does not have text edit's successful `unchanged` normalization. A parsed HTTP `message is not modified` error propagates through the method-bound rejection path; Bus observes unsuccessful/rejected settlement and preserves the prior publication. At assessment time, a controlled positive Message response, boolean true, boolean false or null all normalized to successful void because the native positional adapter discarded the raw result. The latter shape fixtures are adapter-region evidence, not a claim that live Telegram emits those malformed chat/message responses. Successful void alone cannot certify a complete native edited/physical-receiver fact. The assessment also found positional reconstruction of `{chat_id,message_id,reply_markup}` after Bus checks/seals its local carrier. Before the native prerequisite below, that fresh object reached recovery capture/HTTP without the earlier object's routing/serialization fence. Controlled hooks changing chat/message or installing whole-body `toJSON` cause encoded chat 99/message 909 while the original observer still settles chat 42/message 201. This is a local actual-I/O ownership gap; it is not proof the production recovery hook mutates requests, live Telegram routed such an operation, or follower IPC authenticates the receiver. Existing text/send same-carrier evidence does not cover this positional reconstruction. Eight source and eight actual-dist native client/Bridge/Bus/Delivery/store cases preserve real positive parent membership and exact native SDK-runtime scopes. The current reply-markup-only head hold remains effective, including original publisher loss. One temporary shortcut—extend the known-parent text method/payload/ACK gates and accept successful void as edited—falsely demotes SDK heads in four case partitions: false, null, recovery retarget and recovery serializer. These are four assertion-RED witnesses of one shortcut, not four independent mutants; source restoration is exact. No fabricated SDK admission, real network, model input or runtime-data write is involved. The native positional method now supplies the body-ownership prerequisite below. Outcome admission remained a separate prerequisite: method-bound not-modified rejection was already distinct; the bounded direct Message check below now closes only its stated positive region. Reuse existing owners; no generic receipt API or new registry is earned by this assessment. Unproved reply-markup/general edits, multi-group edit membership, receiver IPC, root/default/lifecycle, independent review and live/release gates remain held. The assessment itself granted no membership or public API. #### Native Positional Reply-Markup Body (Local Prerequisite) `editMessageReplyMarkup` freezes only its internally constructed top-level request before recovery capture. Original chat/message cannot change, absent alternate routing fields cannot be inserted, and the prototype cannot be replaced. An own undefined `toJSON` sentinel is enumerable so the client's shallow snapshot retains it; JSON omits its undefined value. This also blocks an inherited serializer installed on the existing prototype from replacing the snapshotted route. The caller's markup object/rows remain mutable and unrelated caller-owned send bodies are not frozen; this is not a global request freezer. Native client tests prove original encoded routing, own/prototype/inherited serializer refusal, strict hook mutation refusal before HTTP, retained method-bound not-modified rejection and caller markup mutability. The known-parent client/Bridge/Bus/Delivery/store probe now keeps original routing in all eight cases while reply-markup-only head membership remains held. Body ownership alone does not grant positive outcome authority; the bounded native Message check and direct marker path below are separate. Neither supplies a source ACK, generic receipt, receiver IPC or root/default/live activation. Actual I/O ownership/drain stays with existing lanes. #### Direct Positive Reply-Markup Head (Private, Bounded) The native positional adapter now requires an object Message whose `message_id` and `chat.id` echo the original frozen request. Boolean/false/null/array/incomplete or mismatched success envelopes fail as unknown issued results, not method-bound rejection/non-use authority; no optimistic ACK, retry or rollback follows. Redacted diagnostics contain no raw response. Only that native success returns the internal `edited` marker. The private native runtime signature admits the marker or legacy void; the Bus facade deliberately remains `Promise` and feeds the marker only from its direct branch to the existing publication observer. Legacy void and follower RPC markers are discarded rather than upgraded into local receiver evidence. The observer admits one complete fresh scalar/set/wizard lifetime on the same retained positive parent publication, reusing the text path's original physical SDK scope chain, publisher/new-group guards, descriptor spend, fixed ACK snapshots, row identity and actual-drain lanes. A reply-markup edit cannot remove embedded Rich callback controls, so their retention refuses fresh head membership rather than inventing multi-group ordering. Rich headings without retained embedded callback rows remain supported; producer-owned visible question/heading semantics are not inferred or rewritten by core. Same-group collector revisions and finish never mint another membership. Native client/Bridge/Bus/Delivery/store evidence covers Message echo, malformed/mismatched bodies, not-modified rejection, publisher loss, refused recovery retarget/serializer, legacy void, follower marker and embedded Rich controls. Real callback paths prove Classic/Threaded text/Rich collector updates, original SDK ownership/deadlines and no later-head demotion by revisions; same-runtime agent peers also shorten. The marker is not a public companion result/inspection tool, generic receipt or authenticated remote-bot certificate. Root/default/lifecycle/receiver-IPC and live/platform/independent release gates remain closed; multiple independent groups follow the bounded first-send co-head path below; multi-group edits still need their own whole-parent proof, never incidental row/Map order. #### Common Co-Head Batch (Private, Bounded First-Send) The owner selected a common head-batch for independent questions newly published by one positively owned footer ACK. All otherwise-live new members are co-heads, each up to its original 24-hour cap/earlier producer cutoff; only previously published otherwise-live questions become tails up to one hour from that ACK. No declared/rendered/Map order selects a privileged winner. Equal timestamps, separate messages/ACKs or label equality do not establish a batch. A sequential wizard remains one lifetime, not one head per future step. The batch shares a publication boundary, not answer/approval/cancellation state or a renewable deadline. Individual known completion/expiry stays local; finishing one co-head does not demote its siblings or promote history. A later positively admitted head demotes the otherwise-live former co-heads using each member's original monotone deadline. Unknown publication/authority remains a whole-footer fence; a known individual terminal outcome cannot be silently conflated with that uncertainty. Source ACKs, producer execution, default/root activation and receiver IPC are not granted by this policy choice. The private button-store path now reuses existing groupFacts/deadline/publication and SDK-scope owners for bounded first sends. It snapshots every complete original group/row and spends every first descriptor before SDK guards/I/O. All members require their original SDK owner, monotone deadline, common native runtime/profile/operator/exact chat/Thread and supported text/Rich body. Missing/duplicate/unknown callbacks, ordinary peers, alternate locators, unsupported fields, spent/foreign/unavailable scopes and unknown outcomes hold the whole cohort without prefix retry. This first-send path grants no edit authority by itself; the bounded known-parent co-head path below has its own original-parent gates. One positive ACK fixes one clock, binds exact original rows, exposes all eligible per-lifetime non-owning publication facts together, and snapshots earlier agent questions excluding every co-head. One native SDK cohort capture/application retains its original SDK candidate set; callbacks cannot reselect a newer head. Native SDK final-use and older-agent final-use data gates recheck original row/publication eligibility after provider/publisher callbacks. Known individual expiry or consumption may leave a surviving original co-head eligible, without selecting an incidental last live member; uncertain loss/changed rows are not that finite terminal proof. All co-heads carry the physical publication's original SDK scope, including after its first member completes. A surviving member cannot renew that origin from its own owner. Actual-I/O protection additionally seals only store-produced callback carriers, not caller inputs or generic outbound traffic: callback references, array topology and callback-data identities stay fixed, and serializers cannot substitute controls. Callback-bearing Rich markdown is a sealed scalar on the prepared copy; ordinary text/non-control rendering and button display labels remain mutable. The whole-body undefined serializer sentinel is enumerable only on this private batch carrier so it survives the native client's shallow copy without changing wire JSON. This supplements, not replaces, the original six-locator fence. Revisions/answers regenerate ordinary owned copies, never another head or deadline; existing capacity and actual-I/O work remain until drain. Local closure adds 57 property/temporal regressions and replaces three obsolete multi-group-held partitions. Native client/Bridge/Bus/Delivery/store cases include Classic/Threaded text/Rich, exact-N/wizard siblings, reentry, known terminal versus uncertain history, physical SDK origin loss, late body/serializer/control substitution and caller mutability. Real retained collector groups do not retain their drained shared publication/cache. Exact source/actual-dist, restored mutation and full-package evidence is under `/home/llb/pttmp/cohead-first-*`. No batch registry/timer/dialog, public API, source ACK, root/default activation or remote-receiver certificate is added; independent/platform/live/release gates remain open. ##### Native Co-Head Batch Coordination (Assessed, Held) A controlled real client/Bridge/Bus/Delivery/store probe publishes two independent Confirm groups in one native Message ACK. Original SDK scopes are native branded owners, not DTOs; one alternate runtime has identical profile/operator/target fields but fails native scope matching. Nine source and nine actual-dist cases are exactly equivalent: full/reversed footers, first/last group expiry during issuance, mixed runtimes, partial group, missing ACK ID, newer SDK admission in the original agent-authority guard, and explicitly held in-flight expiry. At that assessment checkpoint multi-group membership stayed held in every partition; the bounded first-send implementation above supersedes those held expectations. A logical group expiry while the native response is blocked does not release `waitForPublicationIdle`; actual drain remains required. Two exactly restored semantic shortcuts falsify naive widening (11 assertion-RED partitions, seven controls; two models, not 11). Removing the singleton gate overwrites the membership candidate: later SDK admission shortens only the last recorded group, and reversing rows reverses the omission. If that last candidate expires before ACK, its live co-head is missed; a partial group can instead leave a previously selected prefix, and one foreign runtime can demote its own SDK questions on behalf of the whole physical footer. Serially invoking the existing single-group settlement handles either individual known expiry, but makes an earlier co-head a tail immediately. It also takes a later SDK snapshot after the first guard callback admits a newer SDK head, wrongly demoting that newer head from the older ACK. Missing ACK ID stays a control in both shortcuts. This earns a bounded first-send coordination change, not a generic batch registry/receipt or edit/default activation. Capture/spend the complete original cohort before callbacks, prove common immutable native SDK/runtime origin before I/O, retain individual known terminal state, and fix one ACK/earlier-question snapshot excluding all co-heads. Expose eligible per-lifetime non-owning publication facts together before external guards and apply the original SDK snapshot only once, preserving the original physical publication scope and newer-head ordering. Never loop fresh snapshots, reselect a last live group, accept a partial/foreign prefix or release actual-I/O capacity on logical terminalization. This historical first-send assessment granted no multi-group edit authority; the separate bounded known-parent implementation below has its own original-parent/native-ACK gates. Evidence uses controlled HTTPS, native local owners and zero runtime files/model sends. It is not live Telegram, authenticated remote-receiver proof, a production defect claim for the held path, or independent/platform/live/release acceptance. Source is exactly restored and dist behavior unchanged; the previous full-package gate is reused only through pinned code/test/dist equivalence, not claimed rerun. Reports and exact restoration/mutation/audit manifests are under `/home/llb/pttmp/cohead-native-*`. ##### Native SDK Cohort Final-Use Gate (Private, Locally Bound) Existing lifetime-owner `captureTail()` now optionally accepts one local `{ scopes, assertCurrent }` cohort. This closes the SDK side of a concrete batch prerequisite: its last original provider callback can observe loss of a different captured peer or clear agent head rows after caller-side checks. A native peer-history barrier and synchronous data-only head guard therefore run inside the existing SDK owner immediately before irreversible shortening. This is not publication membership or a new cohort/receipt registry. The SDK clock and original question entries are captured before reading even cohort-option getters. Native scope readers snapshot only branded same-runtime/profile/operator/exact-target facts; copied/prototype/foreign scopes, empty/malformed vectors and missing guards refuse with the attempt already spent. Caller-array, wrapper and guard replacement cannot reselect scope history or newer SDK questions. The pinned guard runs at capture and application after native provider callbacks, returning only undefined or throwing synchronously; Promise/other returns refuse without awaiting; the existing inert Promise-rejection-observer pattern prevents a refused rejected return from becoming an unhandled process failure. Peer history is read before and after that guard. The last barrier reads native flags only, not dependency accessors: a port getter could otherwise clear the head after its final check. Options/guard own reentry, including caught invalid-token or apply-alias attempts, poisons the original owner; no callback failure renews capture/application. Omitted arguments retain the existing single-owner path. This private in-process option is not serialized or a callable IPC port, does not export a public SDK batch API, and is bound only by private first-send/known-parent button-store cohorts, not production/root. Group/publication membership, source ACK, business approval, receiver IPC, defaults and live/release readiness remain unchanged. The bindings publish co-head facts together and exclude their peers from one original earlier-agent snapshot; general/unproved multi-group edits remain held. Local closure includes 26 new SDK regressions: original compiled API gives 23 assertion-REDs on the initial fixture; the final-port-accessor witness and capture/application rejected-return witnesses separately fail their pre-fix source. Native/actual-dist, exact restoration, retention and full-package evidence are retained under `/home/llb/pttmp/cohort-gate-*`; independent/platform/live/release acceptance is not implied. ##### Native Co-Head Known-Parent Edits (Assessed, Held) A controlled native client/Bridge/Bus/Delivery/store probe first establishes two real co-head lifetimes on one positive first-send Message. A later native SDK admission proves both original parent facts by shortening their independent deadlines. Two fresh question groups then attempt a text or direct reply-markup edit on that physical parent. Thirteen source/actual-dist cases are equivalent after omitting only random callback nonce spellings from comparison: complete text/markup, omitted Thread, foreign runtime with identical profile/operator/target/generation, text not-modified, old-parent versus fresh-member in-flight expiry, partial fresh group, retained old rows, retained embedded Rich controls, newer SDK guard reentry, original publisher loss and observed original native SDK-scope loss. At that assessment checkpoint all thirteen multi-group edits remained held; the bounded known-parent implementation below now admits its positive region. Later SDK admission cannot manufacture missing positive membership. Both expiry partitions retain actual publication work until the native response drains. Two exactly restored unsafe coordination models produce 14 assertion-RED partitions and 12 passing controls, not 14 independent models. Reusing first-send cohort settlement for edits, even after matching the original Thread, wrongly spends another runtime's SDK authority on the old physical publication, treats text `unchanged` as a head ACK, ignores expired original parent preimages and retained embedded Rich controls, and accepts fresh same-runtime peers after the original physical SDK scope has observed sticky loss. The original SDK-scope witness uses the native owner's failed target observation followed by target restoration, not a replacement DTO/wrapper. Serial single-group settlement additionally makes one fresh question an immediate tail or selects/demotes a newer reentrant SDK admission; omitted-Thread/markup positives expose that a serial loop cannot supply missing physical-parent evidence. Some held partitions and individual fresh expiry are controls, not proof those shortcuts are safe. This narrows the next local implementation: reuse one unambiguous original physical publication and complete original parent group/row snapshot, not one incidental live parent/Map winner. Every fresh owner must prove the same original native SDK runtime and first-physical scope chain, including the ancestor scope after semantic parent retirement. Snapshot and spend all fresh descriptors before publisher/SDK callbacks; require the exact native positive edit outcome and original parent preimage at ACK, then spend old row associations and expose every eligible fresh weak fact together before notifications/providers. The existing SDK cohort gate must include the captured parent/physical ancestry as well as fresh peer histories. Once supersession spends old semantic rows, subsequent data-only checks must verify the original expected retirement/publication facts, not reacquire an old collector or insist retired rows remain executable. Preserve one fixed ACK/earlier-agent snapshot, original native SDK snapshot, single-application/newer-head fences and the actual-I/O callback-carrier/lane ownership. No new SDK port, batch registry, timer or generic receipt is established by this assessment. Old-parent expiry during issuance remains an explicitly unproved parent-preimage region, not a new product rule that all future edit modes must reject every known terminal parent. A fresh member's finite expiry is separate from old-parent authenticity. That assessment granted no multi-group edit authority. The bounded implementation below closes only its explicit positive region; mixed/retained old or ordinary footer shapes, general/untracked edits, root/default/receiver IPC and independent/platform/live/release acceptance remain held. Reports, original source restoration, native case equivalence and two-model evidence are under `/home/llb/pttmp/cohead-edit-*`; source/test/dist behavior is unchanged, so the preceding full-package gate is reused by exact pinned equivalence rather than claimed rerun. This is local controlled adapter evidence with no runtime files, model sends or live Telegram. ##### Bounded Co-Head Known-Parent Edits (Private) The existing button-store cohort path now also admits more than one fresh complete question group through a text/Rich or direct native reply-markup edit on one unambiguous retained positive physical publication. It snapshots the complete original active parent row/group roster, visible callback identities, publisher guard, exact Thread and every parent/first-physical SDK scope before any provider callback. Fresh descriptors are all spent before original publisher/native SDK scope checks and I/O. All fresh and ancestor scopes must belong to the same native SDK runtime/profile/operator/exact target; identical fields, another runtime, missing/ordinary/unproved parent peers, partial/duplicate/retained old controls, alternate/extra fields and spent lifetimes do not earn a prefix. Single-group edit and ordinary legacy rendering remain separate existing paths. At ACK only native `edited` qualifies; `unchanged`, boolean/void, method-bound rejection and unknown issued outcomes cannot mint a head. The original complete parent preimage and exact publication/publisher must still match before old semantic rows are spent. Complete supersession then removes old associations without notifications. Before SDK/producer callbacks, all eligible fresh weak facts become visible together, inherit the first physical SDK scope, and fix one earlier-agent snapshot excluding the entire fresh cohort. One native SDK capture/application includes fresh scopes and original parent/physical ancestry; its final data guard runs after provider callbacks. That guard verifies the captured original rows are absent with the expected `superseded` retirement and original publication, rather than reacquiring or executing a retired collector. The original publisher/ancestor SDK histories remain sticky and terminal-safe; replacement chains cannot renew the physical origin from an immediate fresh owner. Known expiry/consumption of a fresh member can leave a live new sibling eligible; an old-parent preimage change during issuance remains held by this bounded mode. Exact-N/wizard groups retain their one lifetime; answers/steps and later ordinary native revisions do not mint heads. ACK clock, SDK candidates and agent peers are captured once so reentrant newer SDK/agent heads see all fresh facts and cannot be selected back by older work. Logical completion/expiry does not release publication capacity or native busy lanes before actual drain. The same prepared callback-carrier/serializer seals used for first sends protect this edit path without freezing caller inputs or non-control rendering. Direct reply-markup edits retain embedded Rich controls and cannot prove complete supersession when those controls belong to the old parent; expected old-row retirement therefore refuses them without a redundant cohort-only Rich result predicate. Likewise a Rich edit that omits `reply_markup` preserves the old keyboard: a positive replacement using new inline controls must explicitly clear or replace that keyboard. Omitted Thread may derive only from the captured physical parent, never caller success metadata. General/untracked/ordinary-only/edit-born, mixed/retained/unproved parent histories and old-parent terminal exceptions remain outside this region. No new registry, timer, SDK port, receipt, public API, receiver IPC, root/default/live activation or source ACK is introduced. Local closure adds 58 regressions and updates one obsolete all-edits-held test into spent-ID republication protection. Classic/Threaded text/Rich/direct-markup matrices cover one/two original parents and scalar/real set/wizard fresh groups; temporal witnesses cover pre-I/O spending, fixed ACK clocks, complete parent versus fresh expiry, both SDK/agent reentry, last-provider row/ancestry loss, supersession, original-scope chains, unknown retries and actual prepared control carriers. Controlled native client/Bridge/Bus/Delivery/store evidence uses original native scopes and real parser/collector rows; retaining four original/replacement collector groups does not retain their drained shared physical publication/cache. Exact source/actual-dist/native/restored-mutation/full-package evidence is under `/home/llb/pttmp/cohead-edit-impl-*`; independent/platform/live/release acceptance remains separate. ###### Prepared Collector Publication Guard (Local) Real callback/handler interleaving on a positively edited co-head parent now covers Classic/Threaded text/Rich/direct-markup, wizard-first and set-first ordering. Wizard advancement/completion preserves an unfinished exact-N peer; each group emits exactly one ordinary semantic answer, no intermediate prompt, new SDK owner, head or deadline. Controlled native client/Bridge/Bus/Delivery/store cases include one group's known expiry while a neighboring update is issued, uncertain native failure and original publisher loss, all retaining actual publication work until drain. This is adapter/handler evidence, not live client acceptance or a source ACK. That closure exposed a shared prepared-selection authority gap, not a new membership rule: the fresh collector checked its own owner/deadline after awaited transport, but could commit and enqueue after the original physical publisher became unavailable. The existing `guardSelection` now captures its original stored publication and exact publisher callable before any prepare/owner callback. Published prepares verify that original reference, non-lost state and callable identity around the publisher callback, then retain that same fence in prepared guards and commit. A final publisher check follows own-owner/deadline/raw-collector callbacks, immediately before semantic commit. Failure invalidates the original publication and retires its active footer; it cannot reconstruct a publisher, accept restored equal fields, choose another message or release native busy/reference work early. No-publication legacy selectors retain their previous path; known semantic expiry still retires only its question. Twenty-four new regressions include twelve real handler interleavings and twelve partial/final loss partitions, including revocation inside the last commit-owner guard. Original compiled code passes the twelve interleavings but fails all twelve loss cases; the controlled native original-publisher case also fails before the fix. Three exactly restored assertion-RED models distinguish publisher invocation, post-I/O authority and the final post-owner-callback barrier; a surviving earlier-guard model is not credited. A real handler revision plus four retained original/replacement collector groups do not retain their drained shared physical publication. Source/actual-dist/native/GC/full-package evidence is under `/home/llb/pttmp/cohead-collector-*`. No registry, timer, SDK port, public authoring/API surface, root/default activation, live probe or receiver certificate is added; independent/platform/live/release gates remain separate. ###### Scalar Question Publication Guard (Local) Native Confirm callbacks on a positively replaced physical parent exposed the analogous scalar gap: `resolve` checked the exact callback location/lost flag and fresh action authority but could return an ordinary final question/answer after the original publisher was unavailable. That was not a new head or SDK business grant, but it violated the retained physical-publisher boundary. Text/direct-markup Classic/Threaded native witnesses prove the original parent/fresh SDK facts first, then reproduce publisher loss before resolution, in a fresh authority callback, or in completion/diagnostic callbacks. The existing store now shares one private `capturePublicationAuthority(stored)` closure between prepared collectors and non-selection scalar actions whose `promptKind` is `selection`. It snapshots the original publication and publisher callable before callbacks, validates reference/non-lost/callable identity around that exact callable, and invalidates that physical footer on failure. Scalar attempts still spend the pressed/completion-group controls first; the original publisher is checked before and after fresh action/binding authority, before producer completion. After completion and retirement diagnostics, one final original-publication barrier precedes the returned action/result. Loss in completion/diagnostics suppresses the outward result without pretending to undo the already spent semantic completion. Neither restored fields nor a later callback can revive controls or borrow a fresh publisher. Existing producer completion exceptions, ordinary/app dispatch, no-publication legacy selectors, lifetimes/capacities and actual-I/O lanes are not redefined. Thirty property regressions cover text/Rich/direct-markup and Classic/Threaded, healthy/before/own-guard/completion/diagnostic partitions on old real collector parents. Original compiled code passes six healthy controls but fails all 24 loss cases; native source/compiled pre-fix witnesses reproduce the forbidden scalar result. Four exactly restored assertion-RED models distinguish scalar opt-in, original publisher invocation, post-fresh guard and final result barriers. Twenty native cases use real client/Bridge/Bus/Delivery/store/handler and native SDK scopes; retaining four old/fresh scalar producer groups after a real completion does not retain their drained physical publication. Source/actual-dist/inherited-native/GC/full-package evidence is under `/home/llb/pttmp/scalar-publisher-*`. This adds no public API, generic dialog/registry/receipt/timer, root/default policy, receiver IPC, source ACK or live/release authority; independent/platform/live acceptance remains separate. ###### Question Lifetime Production Composition Inventory (Read-Only) The private native kernel/agent publication proofs above do not mean production composition is one root flag away. The original read-only source/type/native inventory under `/home/llb/pttmp/composition-inventory-*` identified then-missing edges without importing the live extension, activating defaults or changing runtime data. Its twelve source/actual-dist cases are historical baseline evidence, not the current positive production boundary. The current Root composition is: - **Question-bearing first sends:** existing bounded direct SDK/agent/app joins keep their original native owner/kernel contracts. Follower plain/native pure/mixed app joins additionally require the original acknowledged API registration and complete native bot/chat/Thread/Message carrier. Mixed app rows share one exact native result, not equal binding fields. See [follower birth](#follower-question-birth-and-plain-first-send-root-bounded) and [mixed-app first send](#follower-mixed-app-first-send-root-bounded). - **Ordinary-only first sends:** one certified native bound row can retain its original physical source without creating a question head, shortening an existing SDK question or renewing ordinary button TTL. See [original first-wire certification](#ordinary-only-first-wire-source-root-connected). - **Known question parents:** follower original headed-parent Text/Rich and keyboard-only edits retain native Message data separately from public outcomes; omitted request Thread must match the captured physical parent. Existing direct headed/legacy joins remain on their prior guarded kernel contracts, not automatically on this stronger carrier policy. Neither path grants unobserved edit-first ancestry or adoption of arbitrary old controls. See [follower known-parent edit](#follower-plain-known-parent-edit-root-bounded). - **Read-only callback children:** native mixed/pure, queued feedback and deferred editor subsets retain the consumed source's original invocation, worker drain, feedback and first-physical ancestry. One authenticated after-child-ACK SDK admission may supply its original conditional ceiling. Later method execution alone cannot renew membership. See [read-only child](#follower-read-only-app-callback-child-root-bounded) and [deferred child](#follower-deferred-native-feedback-child-root-bounded). - **Managed refresh children:** follower unchanged headed parents and direct/follower certified question-free parents have bounded Root joins for one complete mixed/pure read-only child from the original pre-worker snapshot, exact drained result and native edit ACK. Root managed carriers are actual Text in both rendering preferences; that setting alone is not native Rich evidence. Direct edits retain the original native response through the same guarded call; neither route fabricates a human callback. See [timed publication join](#timed-refresh-publication-join-root-bounded-original-source-one-attempt), [question-free child](#question-free-timed-refresh-child-root-bounded-original-first-wire) and [direct native carrier](#direct-native-edit-carrier-root-bounded-original-operation). - **Retained original group:** one explicit producer-backed native Rich proposal preserves its complete original group, birth, deadline, selection and first publisher alongside qualified fresh questions. This is not general discovery of old controls, native Text/keyboard retention or permission to infer producer intent from matching keys. See [retained native Rich Root region](#follower-one-retained-original-group-root-bounded-native-rich). - **Required refusals:** missing required original source/SDK/app authority, copied or foreign sources, carrier failure under the lane's contract, observed loss after equal restoration, spent/replayed attempts and newer-owner substitution never qualify a prefix. They remain refused even when the independent answer, app method or native UI edit is authorized. A consumed source qualifies only through its bounded native callback transition, not absence of its rows; later/repeated work cannot rebase first-physical ancestry. These are preservation obligations, not omitted policy flags or promised future positives. In particular, complete bot/chat/Thread/Message admission applies to follower publications and direct certified ordinary-source publications/descendants; a direct headed/legacy result is not silently enrolled merely because it is normalized. - **Unproved positive regions:** general edit-first/footer histories, state-writing/unknown/cold transitions, multiple feedback or intervening views, partial/multiple retained groups, [native Text/keyboard retention](#retained-textkeyboard-native-root-assessment-carrier-intent-held) and embedded old Rich rows in non-superseding markup edits are not certified by the subsets above. Some require additional original producer/physical transition evidence; others must stay refused when that evidence cannot exist. The canonical backlog owns investigation order, not this inventory. No blanket permission to widen them follows from a successful worker, normalized edit or current SDK scope. Current production evidence lives in `tests/integration.test.ts`: the direct `Production question root` and follower `Production follower SDK first-send` families exercise real Root/worker/native transport composition, while `Ordinary first-wire source`, `Native timed publication joins` and `Timed source native retention` isolate certification, one-attempt joins and genuine drain. Their source/actual-compiled witnesses and native GC composites are local evidence, not independent review, multi-process/platform or operator/live acceptance. The ownership inventory below retains historical seam detail; it is not a second list of open composition work. - **Delivery concrete kernel**: Constructor owns `questionHeadTail`, synchronous `onQuestionAdmission`, native scope and original owner capture. Preserve native/runtime/deadline/final-use contracts; these ports are private. - **Delivery Bridge adapter (historical inventory)**: At that checkpoint the interface and explicit runtime construction omitted policy/admission forwarding, so untyped extra fields were ignored. The [private Bridge/lifecycle checkpoint](#question-policy-bridge-and-lifecycle-private) below now declares/pins/forwards those ports plus the original provider; missing provider holds opt-in. Root now supplies conditional direct policy, native admission forwarding and the original direct publisher capture; unavailable coordinated provenance retains independent SDK UI. - **Delivery lifecycle**: Owns current runtime, shutdown/replacement and registry binding. Its facade still does not add a lifetime-owner method: the implemented private native `captureTelegramQuestionLifetimeOwner()` snapshots original binding once at group admission. Private options now pass through existing lifecycle construction; ACK must never read a successor. - **Button store**: Root captures original agent session/profile/operator/transport role/epoch or follower generation/target through `BusApi.createTelegramButtonSelectionAuthorityCapture`; root now supplies the existing native registry-bound SDK capture at group birth. Root also supplies the native app reader and independent selection mode: bounded direct app questions join common membership only with their original SDK/app scopes, while SDK absence or loss does not disable an otherwise-owned answer. Neither an ACK nor a later row upgrades a missing birth. Agent action/publisher authority and original SDK lifetime scope remain distinct. The existing native owner must be acquired once at group admission. - **Assistant planner**: Root now passes the private third opt-in, adopting the 24-hour omitted Confirm/Choice timeout. Explicit shorter deadlines and original wizard cutoffs remain unchanged. - **Bound-app output planner**: The inventory found `createTelegramOutboundReplyPlanner` missing the compiler policy port. The [private outbound factory](#outbound-question-policy-private-factory) now forwards a constructor-only literal opt-in. Root and Bindings now pass the 24-hour compiler policy and app-result label. Compiler policy alone grants neither membership nor effects. Root now separately captures the original app owner for bounded direct first-send questions; Root separately pins original bound-app callback bindings, composes app-only successor lineage and joins qualified native dispatch/invocation with bounded read-only mixed-footer HTML/Rich feedback/edited-child ownership. Pure-question/queued/deferred and one-event SDK-tail ownership are now Root-composed; one retained original group is now composed for an explicit app-owned native Rich proposal, while broader histories remain separate. Root now enables the existing callback-worker drain owner with its original update execution fence. - **Native API/publication lanes (historical legacy-peer baseline)**: Root wires `beginButtonPublication` and the editor through Bus-aware transport. The current positive regions are listed above; normalized success alone still supplies no original physical proof. Twelve original source/actual-compiled `Production follower question root` cases exercise a real follower Root, authenticated socket registration/calls and native broker/proxy/API. Eight hold common membership despite complete Message ACKs under HTML/Rich, with/without actual Artifact incarnation. Four replace the ACK after a real native send with a foreign-request pre-HTTP refusal: the original caller now retains `commit-unknown` for SDK HTML and agent Rich instead of trusting that rejection or retrying. Ordinary native store selections remain answerable and retain their original 24-hour deadline across SDK admissions; real equal-target re-registration ends the old selection while fresh controls still answer. These are negative membership/positive independent-UI witnesses, not positive remote coordination. The broker fixture is native composition, not a second production leader Root or a private Input receiver. Existing Artifact/Attachment capability/receipt semantics cannot be borrowed to certify questions. The concrete-kernel opt-in control captures native owners, emits two synchronous admissions and expires the earlier question at its tail cutoff. At the inventory checkpoint, default Bridge and an untyped Bridge carrying unsupported extra fields captured no owner, emitted no admissions and preserved released independent SDK lifetimes. That historical unsupported-field premise is superseded only by the new private typed opt-in below; omission/default behavior is unchanged. The inventory was not a released defect or activation authority. Native lifecycle replacement already ends the previous SDK runtime's questions; source inspection also confirms Bindings clears button actions at session start/shutdown and waits for publication drain on shutdown. Native transport/registration and leader-target notifications now reconcile the Delivery runtime against its captured original local authority, replacing it on genuine loss/rebind or availability gain rather than every repeated notification. Same-generation/equal-field native registration mutations still revoke the original scope; local legacy scopes need no Artifact incarnation and confer no remote publication certificate. Session shutdown fences late reconciliation, and managed publication rechecks original question authority after I/O before recording ownership. Do not replace those owners with a second session/head registry or infer that every future role/epoch transition is already certified. Receiver readiness is another boundary, not an omitted convenience getter. Root supplies configured bot identity/original ownership to the private reply classifier and captures local publication ownership for Delivery, but does not bind the Bridge's `getTextInputReceiverBotId` or Attachment counterpart. The config getter and reply marker are not proof that every local/remote participant can privately collect/dispose the original source. Queue transport stamps track profile/token generations; agent selection capture separately fences original session, role, epoch/follower generation and target. Those facts must not be conflated with a native original physical receiver/bot/session/binding certificate or SDK scope merely because addresses match. Foreign receiver IPC and v5 source disposition remain separate gates. The [native binding assessment](#native-question-runtime-versus-binding-scope-read-only) below closes the original admission-time binding inventory without implementing a new certificate. No wrapper/current lookup may recreate a lost native scope, acquire a successor at ACK or claim remote readiness. The store is constructed before API/Delivery lifecycle construction and captures its owner provider once, so casually closing over a later root variable is not a composition contract. Reuse existing owners/registry and named domain ports only under an earned, scoped original-binding/provider contract. Bounded direct/app Root wiring and the plain follower first-send join below are now connected; broader remote histories, reload, live probes and publication remain separate. The ordinary `follower.callApi` path now validates the original ACK kind/request before interpreting its generic success or structured error; foreign success/refusal/stale-target/uncertainty and request-kind frames are not evidence for the current operation. Non-idempotent unconfirmed outcomes stay `commit-unknown`; read-safe calls report an unconfirmed ACK, without replay. Matching legacy ACKs retain their prior semantics. Twenty-six native socket regressions have thirteen pre-fix controls and thirteen assertion-RED refusal cases, including multipart and read-safe calls. Guarded ordinary native API calls now pin original endpoint/auth/generation values and provider identities plus the existing native registration scope, wired through the Root's follower client. Ready registration captures precede the first await; a not-yet-ready call may complete bounded legacy recovery before wire admission. Original checks span connect/ACK and the final endpoint callback; equal-field registration replacement cannot revive the source. Twenty-one caller regressions include sixteen pre-fix identity-loss failures, healthy/recovery/omitted legacy controls, missing configured scope and a separately assertion-RED final-provider-barrier mutation. Twelve source/actual-compiled follower Root cases now also observe actual native owner wiring rather than a policy flag. Those baseline caller fences add no new registry or receipt family. The bounded ordinary broker now receives the native polling owner through Root (not an Artifact grant), and the existing registry exposes a general lifetime capture through the same scalar owner helper as its Artifact check. For the existing three-argument single-attempt non-idempotent `call` shape, it captures registry/transport/profile/operator/epoch/providers and a detached descriptor before heartbeat/authorizer callbacks. Native options carry the guard to actual HTTP issuance; source checks also bracket ownership recording and ACK. Twenty-five native polling/registry/Bridge/client broker cases include eighteen pre-fix authority-loss failures, three healthy controls, omitted legacy, real policy/HTTP rejection and substituted-wire refusal. Seven additional generic registry partitions retain heartbeat liveness while refusing replacement/remove/re-add/overlap/prune/clear. Source/actual-compiled leader Root witnesses now check that the actual native polling guard exists and is current after startup. Scoped numeric first-send ACK sanity now also refuses malformed message IDs and explicit contradictory chat/Thread/business echoes before ordinary ownership publication. Missing legacy target echoes retain independent compatibility, not certification. The ordinary ownership recorder excludes business request/result namespaces even when numeric IDs match, including omitted-scope legacy calls. Forty-four native polling/registry/Bridge/client cases span text/Rich, Classic/Threaded, complete/legacy/foreign/malformed/business results; pre-fix evidence includes twenty-eight refused-carrier partitions and eight business-to-bot ownership counterexamples. Four source/actual-compiled SDK witnesses construct both actual Roots in one isolated test process, provision distinct bindings through the real authenticated socket and prove one native send plus positive/withheld ownership. They exposed a default-profile regression: the supplied config provider's `undefined` means canonical `default`, while absent providers remain refused. Exactly restored Root mutations separately fail for disabled carrier validation and missing default normalization. This is not multi-process/operator live acceptance. Caller/broker wire and ACK sanity still are not an authenticated original question-publication certificate: original question-birth receiver/publisher capture and complete carrier joins must additionally qualify each remote history. The bounded plain first-send consumer below now does so; ordinary wire negotiation alone is not a question receiver certificate. A current/equal locator or Artifact incarnation is insufficient; do not introduce a parallel receipt family or restore private Input receiver IPC/v5 as a shortcut. Independent/platform/live acceptance is not supplied by this inventory. ### Negotiated Ordinary API Owner (Wire Only) Root advertises `guarded-api-authority-v1` for the existing bounded, non-Input, single-attempt non-idempotent `call` descriptor. With both compatible peers advertising it, the broker echoes its originally captured protocol in the existing ACK field for success, original policy refusal and native/uncertain outcomes; the caller rejects absent or different peer metadata before interpreting that outcome. Legacy peers, unmarked calls, multipart and private Input/Attachment contracts are not silently enrolled. No receipt or new wire field is introduced. The native caller's `captureAuthority()` (also the client runtime's `captureApiAuthority`) captures an already-ready caller-local registration, credentials, endpoint, original provider/function identities and original compatible peer metadata without RPC, waits or recovery. Loss is sticky for that capture; equal restoration cannot revive it. A later genuine capture is a new scope. Marked negotiated API attempts consume this guard in addition to their original wire-admission checks. It proves neither a live remote receiver at capture time nor the receiver registry lifetime at question birth; it cannot mint SDK/app membership, certify a physical send, borrow Artifact incarnation or activate Input privacy readiness. Root's bounded follower question capture below additionally joins local SDK/bot/provider birth and native complete first-send evidence; this wire-only scope is never interpreted as that certificate. Four source/actual-compiled two-Root SDK witnesses now capture the native negotiated wire owner before the question, preserve matching original pre-HTTP policy refusal without a physical send and prove shutdown ends the captured owner. The plain first-send join below adds the SDK membership evidence. Twelve legacy-peer Root witnesses retain independent selections and show Artifact incarnation cannot replace ordinary negotiation. Fourteen native birth partitions cover compatible/unavailable/old-peer and original-scope loss/restoration; six socket ACK partitions cover matching/missing/foreign success and refusal. Restored mutations separately falsify original-method capture, peer ACK matching and actual broker echo wiring. The stronger consumer below joins these owners without interpreting this wire capability alone as question readiness. ### Original API Registration Identity (Root Guarded) Root additionally negotiates `api-registration-authority-v1`. The existing native registry's incarnation is acknowledged in a separate `apiRegistrationIncarnation` bootstrap-result field, under its general registration lifetime capture before display/registered callbacks and again after them. Equal-field replacement or a changed capture provider cannot publish the old binding as current. This is a role-specific projection of the same registry scalar, not a second identity generator, registry or per-publication receipt. Artifact/Attachment acknowledgement and authority remain separate. The existing registration state retains that API identity only for the negotiated pair. Native `captureAuthority("registration")` / client `captureApiAuthority("registration")` pins it, native caller-local lifetime, endpoint/auth/protocol and original providers without RPC/recovery. A file incarnation or absent/malformed/unnegotiated API field cannot substitute; lost captures remain lost after equal restoration. Default `captureAuthority()` remains the weaker wire-only scope. Neither mode synchronously proves remote liveness. Marked ordinary single-attempt calls between registered-capable peers carry the captured `apiRegistrationIncarnation` in the existing `follower.callApi` envelope. Before heartbeat, authorizer or HTTP, the broker requires its exact current native registry row and retains that row through issuance/ownership/ACK via the existing guard. Missing/wrong origins, an unmarked/Input/Attachment shape, missing transport or unnegotiated origin cannot degrade into legacy execution or known policy refusal. A sender whose local bootstrap metadata still names an old row cannot graft onto an equal-generation/target replacement. Legacy peers/unmarked calls without an issued API origin keep their own independent behavior. These two identity projections are new fields, not physical-publication attestation or a receipt mechanism. Twenty-four native partitions cover capture provenance, original issuer callbacks and guarded broker matching. Ten source/actual-compiled two-Root cases retain prior healthy/carrier/bootstrap controls, add equal-row remote replacement before API handling (zero native sends), and prove ordinary API publication without Artifact capability or scope. Exactly restored mutations falsify receiver matching, the final issuer barrier and Artifact-only substitution. The bounded consumer below now composes original question-birth/SDK/publisher scope and complete plain first-send carrier evidence. The identity alone still grants no membership; broader remote histories remain held. Private Input receiver/v5, operator/platform/live acceptance and publication are not activated. ### Follower Question Birth And Plain First Send (Root Bounded) Root now supplies the original native API registration capture and bot reader to the Bus API's question provider. A follower capture joins those constructor-pinned publisher/registration/bot providers with the existing local session/profile/operator/target authority before Delivery constructs its native coordinated SDK namespace. The SDK registry binding and every group capture stay original; runtime/registry replacement cannot be repaired by a fresh owner at ACK. Missing legacy provenance retains independent SDK/agent UI. No Artifact authority, new protocol capability, receipt family, timer or question registry is introduced. For Text/Rich first sends, the API captures its publisher guard and bot before the native publication observer or any await, forces guarded single-attempt follower I/O and rechecks the original scope afterward. In addition to the native receiver/outer ACK guards, common membership requires data-property Message evidence: positive message ID, exact chat/Thread, original bot ID with `is_bot:true`, and no business namespace. Missing/foreign/accessor fields withhold membership without claiming the otherwise-successful send failed. No getter is invoked to manufacture proof. Lost original publisher authority refuses before I/O or retains post-I/O uncertainty, without adopting a successor sender. The existing publication observer's refusal-only `restrictQuestionMembership` can limit a batch to complete original-source first sends or deny it entirely. It never grants membership. Plain and the [bounded native app origins](#follower-bound-app-first-send-root-bounded) below qualify only through their existing original owners; ordinary/unproved mixed/retained transitions, general app-parent edits and unproved edit-first successors remain held; the [plain known-parent edit](#follower-plain-known-parent-edit-root-bounded) below has its own bounded join. Restriction preserves selection, native spent descriptors, body sealing and original physical publisher/drain facts; it does not erase a live first publisher to satisfy eligibility or GC. Existing retained members keep their original birth/deadline and are not promoted or renewed. Direct bounded app/parent paths are unchanged. Twenty-nine API partitions cover original local/receiver/provider/bot/role loss, asynchronous refusal, complete/legacy/foreign/accessor I/O evidence and non-question delivery preservation. Only native observed question/button publications receive the supplementary question publisher guard; ordinary traffic retains its preceding delivery contract, and managed SDK UI already carries its own born guard. Three hundred eighty-six source/actual-compiled dual-Root cases now prove the one-hour SDK demotion of complete original plain/native-app Text/Rich first sends, complete plain known-parent edits, independent original deadlines for incomplete/foreign ACKs and unproved edit-first successors, no ACK-time SDK rebind, native bootstrap/registry replacement refusal and operation without Artifact capability. Three restored mutations falsify bot identity, refusal-only membership and publisher capture before observers. Twelve legacy-peer Root witnesses still have no common SDK owner. Broader remote app/parent histories, private Input receiver/v5 and independent/platform/operator-live acceptance remain separate gates. ### Follower Bound-App First Send (Root Bounded) A native app's pure first-send question frame now uses the same original SDK/API/publisher and complete native carrier join as plain output. Removing the prior blanket app restriction grants no authority: the existing store still requires the original native app result binding, app FS/history guard, independent selection scope, original registry-bound SDK capture, complete roster and first physical publication. It does not reacquire an app or SDK owner at ACK. Question actions retain no method binding; original app authority, not SDK membership, governs selection. First-send proof alone grants no app callback/edit or retained-parent adoption. The source/actual-compiled Threaded two-Root app cases use durable native ingress, real follower Pi dispatch and an actual trusted app worker. Its two fresh Confirm groups join one common SDK cutoff only after the original first-send ACK. Native state remains unchanged by selection, and a later committed app revision retires the still-unspent peer. Complete ACKs also work without Artifact capability. Legacy/wrong-bot carriers retain their original independent clocks; the mixed native frames below have an additional original-result join. An app revision committed during pending HTTP retires the old scope without creating a partial or fresh cohort. SDK replacement during pending app HTTP cannot lend a namespace or renew a clock: the original logical Delivery publication reports display failure despite the one physical send, while still-owned native selections remain independent. The send is not replayed. A pre-fix native Root falsifier demonstrates the old blanket restriction withholding both valid app heads; carrier and refusal-policy mutation checks remain independently evidenced. These are disposable local single-process dual-Root witnesses, not live Telegram or multi-process/platform acceptance. ### Follower Mixed-App First Send (Root Bounded) One fresh native app frame may now mix complete question groups with bound ordinary controls under the existing first-send join. Every fresh question origin and every ordinary row must retain the identical original native app-result binding, not merely equal app/generation/revision or SDK fields. The refusal-only policy narrows the existing complete-roster cohort; original SDK/app captures, FS/history/currentness, immutable row identities, full native bot/chat/Thread/Message evidence and one first publisher remain required. Unknown or unbound visible rows cannot be ignored to qualify a prefix. No new owner, wire field, registry, timer or callback framework is introduced. The existing native SDK cohort includes all original question/ordinary scopes and runs the app-authority barrier with its final-use data guard. The API still holds the original local/registration/publisher through native I/O. Selection and bound methods remain separate: SDK admission and a question answer do not dispatch the frame's state-writing control. A later committed app revision revokes both the unspent peer question and bound control. SDK replacement during pending display cannot report through the successor logical Delivery binding; it creates no fresh membership or renewed deadline and does not replay the physical send. Thirty-two source/actual-compiled Threaded dual-Root mixed-frame cases include four prior held cases now positively joined and twenty-eight additional partitions. Real durable ingress and a trusted worker produce two Confirm groups plus a native state-writing bound control. Complete Text/Rich first sends give both questions one SDK cutoff; a native read-only inspection still sees the initial state before an explicit authorized increment. Missing/foreign-bot ACKs, pending SDK replacement or app revision, and absent ordinary binding remain independent or retired under original authority. Two labeled main-side substitutions use separate genuinely native result bindings from initialization and a read-only view: both are live with equal app/generation/revision, but replacing either the ordinary source or one question group refuses the entire cohort. They do not establish a public composition or retention API. A pre-fix native Root falsifier withholds the valid complete frame; three exactly restored mutations falsify ordinary-result identity, all-question-result identity and complete visible-roster requirements. Callback-child membership needs the additional original feedback/invocation/first-parent join below; broader callback and retained-parent histories remain held. This is not live, multi-process or platform acceptance. ### Follower Callback Feedback (Root Native, Parent Membership Held) A genuine authenticated callback on a proven mixed app frame exposed two feedback failures: a valid reply-markup Message could not acknowledge its original projection because the public/observer result stayed `void`, while normalized Text/Rich `edited` could certify foreign or incomplete native feedback. The store now separates positive native edit acknowledgement from question-head eligibility. It joins the original edit Message with the captured parent message/chat/Thread and the API's sticky refusal-only `none` observation. An app cohort may stay unqualified while its exact native feedback succeeds; a normalized follower outcome never substitutes. Direct native embedding outcomes and public follower edit/void contracts remain unchanged. No owner, wire field, SDK port, registry or timer is added. Existing projection checks still own original consumed-row/dispatch identity, complete parent roster, preimage/postimage, app/SDK histories and current publisher through actual feedback I/O. A valid native projection preserves the captured invocation/result path. Missing sender/target evidence, foreign bot or Thread and original SDK-scope loss cannot lend a current owner or replay an issued callback. Feedback acknowledgement alone is not child publication, worker drain, business purity or common SDK membership. Twenty additional source/actual-compiled Threaded dual-Root cases admit real input, publish positively SDK-owned parent groups and route an actual callback through leader polling, authenticated follower forwarding and the native worker. HTML uses the real app tool's Delivery carrier; a labeled producer-backed native Rich first publication uses the actual trusted app result and Root planner/API rather than treating a rendering setting as evidence. Both retain the same native callback invocation, one original execution capture and model bypass. Actual worker exit is observed separately from its retained termination-call ACK; neither feedback completion nor exit may start result planning before that ACK. Valid original feedback permits one read-only child edit and `Done`; feedback alone does not grant child SDK membership, which now requires the separate bounded read-only first-parent join below. Missing/foreign-bot/foreign-Thread feedback and pending SDK replacement refuse the result path under original authority without a second method invocation. Three pre-fix source failures expose the valid-markup loss and normalized Rich false positives. Three exactly restored Root mutations falsify ignoring API refusal, omitting the captured parent Thread and substituting normalized success. These disposable local witnesses are not live/client, multi-process, platform or release acceptance. ### Follower Read-Only App Callback Child (Root Bounded) A complete edited child from the first native read-only callback on an original mixed app publication now joins the common SDK cohort. The existing refusal-only `known-parent-edit` mode permits this region only with one consumed ordinary parent, fully acknowledged original feedback, the captured native invocation/successor association, complete live parent questions and original first-physical SDK scope/history. The immutable first-publication scopes must still be the parents' own original capture, not a later immediate owner. All fresh questions and ordinary successor rows retain one native result binding. Existing pre-I/O descriptor spending, native read-only completion check, provider/app FS guards, original publisher and complete native edit Message remain authoritative; neither flags nor equal app/revision data substitute. Complete native Text/Rich child rosters are admitted here; the pure-question form below uses its original branded question captures instead of a fresh ordinary control. Beyond the separately bounded queued-native-I/O, deferred single-admission and one retained original Rich group below, unproved deferred/multiple-admission histories, partial/multiple retained groups, state-writing/unknown ancestry, multiple ordinary parents, repeated feedback and arbitrary app edits remain held. Original parent supersession and SDK application still occur through the existing one-cohort final-use gate, with original first-publisher ancestry retained through actual drain. No Root adapter, SDK port, identity, wire field, registry or timer is added. Private policy naming now reflects known-parent edits, not only plain parents; the hint itself grants nothing. Thirty-six source/actual-compiled Threaded dual-Root cases cover four former held positives plus thirty-two new partitions. Authenticated callback forwarding, genuine native read-only invocation, actual worker exit/original termination ACK and native feedback precede child planning. Both complete child groups share one later SDK cutoff in actual HTML and native Rich carriers. Missing/foreign-bot/foreign-Thread child ACKs, SDK replacement, app revision or parent consumption during native child I/O leave both groups unqualified. A labeled live equal-field result from a separate read-only main-side view cannot replace the callback's native successor. A second real authenticated callback can execute, but its descendants do not acquire first-parent membership or renew the first physical ancestry. No callback enters model admission or repeats its original method. A pre-fix Root falsifies the former blanket hold; three exactly restored mutations falsify native successor verification, first-physical scope/history and child Thread matching. This is bounded local production-Root evidence, not broad remote readiness, live/client/platform acceptance or release authorization. ### Follower Pure-Question Callback Child (Root Bounded) The first read-only callback child join now accepts output containing only complete question groups. It reuses the existing question-origin candidate snapshot, captured before parent/body/provider callbacks: every fresh question already carries the original SDK owner, native app-result binding, app FS/history and independent selection authority. The same completed native invocation must prove that binding as its read-only successor. Removing the redundant fresh ordinary-row requirement does not reacquire a current owner or turn a plain question string into app provenance. All question groups retain one original result, with no dummy ordinary control, collector, timer, registry or SDK port. Fully acknowledged native feedback, the original complete first-parent roster, first-physical SDK scope/history, original publisher and a complete matching native edit Message remain required. Existing SDK final-use and actual-I/O drain guards still expose or withhold the whole child cohort together; earlier deadlines and source loss win. The separately joined queued-native-I/O, deferred single-admission and one retained original Rich group below retain these proofs; pure output alone does not admit unproved retained/deferred/multiple-admission or later-parent histories. Bare/unlabeled question markup cannot borrow the consumed app control's authority. Forty-four additional source/actual-compiled Threaded dual-Root cases run real authenticated callback forwarding and the native read-only worker in actual HTML and native Rich carriers. Two pure Confirm groups share one later SDK cutoff, while the registered child roster contains no ordinary control. Missing/foreign-bot/foreign-Thread edit evidence, SDK/app/parent loss during native child I/O, an unrelated live equal-field native result, unlabeled app provenance, a partially visible group and mixed native result origins leave both memberships unqualified. The real callback remains model-bypassing with one original execution capture and separate worker-exit/termination-ACK barriers. Native Root pre-fix cases falsify the former ordinary-row hold. Three exactly restored unsafe models falsify skipping the native successor check, relaxing both pure-question/cohort original-result identity checks, and ignoring the captured child Thread; the two-check identity relaxation is one conjunctive model, not two independent proofs. This is bounded local production-Root evidence, not general remote/Input readiness or live/platform/release acceptance. ### Follower Queued Native-Feedback Child (Root Bounded) The same first read-only callback child may be planned while its original feedback HTTP request remains pending. The existing store claims that exact native projection once, before body/provider callbacks, and pins its consumed row, invocation, ordinary roster, original before/after preimage and first-physical SDK ancestry. The existing publication tail delays child issuance until the preceding feedback I/O settles. This neither substitutes worker completion for the original termination-call ACK nor captures a current app/API/SDK owner after the wait. Pure-question successors use the same original branded question-row capture; mixed successors retain one exact native result across every question and ordinary row. The refusal-only known-parent policy permits that already-proved queued projection. The ordinary queued subset applies its captured cohort when the original editor has acknowledged by the child's native ACK; the deferred form below separately retains that ACK-time cohort until the same original editor completes. Neither native feedback, child I/O nor logical `Done` alone exposes a head. Existing original authority, native bot/chat/Thread/message, complete first-parent/child roster and single-cohort SDK final-use guards remain intact. An SDK admission before child native ACK continues to mark the queue source lost: it cannot be adopted by the later deferred matcher. No settlement-time clock or replacement SDK owner is admitted. Forty source/actual-compiled Threaded dual-Root cases use actual HTML/native Rich parents, authenticated callback IPC and the real native worker. Before releasing feedback HTTP, the original worker has exited and its exact termination ACK has settled, child planning has occurred once, and no child edit has issued. Complete mixed and pure outputs subsequently edit the same original message without a send fallback; both groups share the next SDK cutoff. Native feedback refusal, original SDK/app/parent loss during the wait, unrelated live equal-field native successor, foreign child bot and an SDK admission before child ACK keep both memberships unqualified. Negative paths may retain independent UI or existing rendering fallback, never a qualifying prefix or another invocation capture. The labeled original-editor hold finishes child I/O and `Done` without a pending head; the deferred join below now owns its later qualification. A native pre-fix positive falsifies the blanket queued-projection hold; restored native-successor and feedback-refusal models falsify those independent guards. The earlier refusal of every pending editor is superseded by the bounded deferred proof, not removal of actual completion authority. This is local production-Root evidence, not multi-process/platform/live/Input or release acceptance. ### Follower Deferred Native-Feedback Child (Root Bounded) A complete first read-only follower callback child may finish native I/O and `Done` while the original feedback editor is still pending. Both native edit carriers must already have matched the original bot/chat/Thread/message under the original API registration and publisher, and the same original projection must have a genuine feedback after-frame. The existing parent-current gate and deferred result owner retain the complete child/first-parent rosters, exact invocation/successor, original SDK scope/history, app/FS authority and captured postimage. Removing the blanket late-editor refusal does not apply the cohort yet: the existing deferred path captures it once at child native ACK, exposes no provisional published facts, and only the original editor's guarded completion can apply it. There is no Root adapter, current-owner reacquisition, new identity, registry, timer or SDK port. After that child ACK, at most one native matching SDK admission may supply its original authenticated numeric time through the birth-captured matcher. That time plus one hour bounds all fresh children at actual editor completion, subject to each earlier producer deadline. Cancelling the admitted SDK question does not erase the event or renew the clock. A second matching admission, original SDK replacement, app revision or terminal child during the wait refuses the whole cohort; a foreign child carrier never creates it. An admission before child ACK still loses the queued source rather than being retroactively adopted. Original SDK cohort capture excludes the later Input, and neither SDK admission nor editor settlement can turn the pending result into a head or recapture newer SDK entries. All existing final-use, original publisher/drain and first-physical ancestry checks remain authoritative. The separately bounded retained Rich group below preserves these same captures; unproved retention, later/multiple feedback and general app-parent histories stay separate. Forty additional source/actual-compiled Threaded dual-Root cases, plus four upgraded editor-hold cases, use authenticated IPC, real native read-only workers and actual HTML/native Rich carriers. Pure and mixed children wait for the original editor before joining. One actual SDK admission occurs after child ACK but before that editor ACK; deadlines remain unchanged while held, then both receive the exact authenticated ceiling after an explicit later settlement. The cancellation variant retains that same numeric event, a labeled original producer cutoff stays earlier for one group, and a subsequent SDK question cannot renew either bound. SDK/app loss, a second actual admission, a foreign child bot and consumed original child leave both memberships unqualified. No callback enters model admission, repeats method execution, recaptures execution authority or needs a dummy ordinary control. A corrected pre-fix Root falsifies the blanket late-editor hold; before-ACK and after-ACK admission phases are separately witnessed rather than conflated by fixture naming. Three exactly restored unsafe models falsify ignoring the native API bot, substituting editor-settlement time for the retained ceiling and accepting a second matching admission. A store-only omission remained blocked by the independent API refusal policy and is not counted as a falsifier. Future-ceiling/GC/provider partitions remain supported by the existing private conditional kernel, not newly claimed Root/platform/live coverage. This is bounded local production integration, not broad remote/Input or release acceptance. ### Follower One Retained Original Group (Root Bounded Native Rich) The original read-only follower child join now permits one complete retained original question group in a native Rich parent and child. Its policy only narrows the existing retained-parent proof: the group must already belong to the same captured native projection/consumed app result, and its original selection, attempt, birth, deadline object, SDK scope/history, app/FS guards and first-physical publisher remain exact. Every old member must occur once, every fresh question/ordinary row retains the original read-only successor binding, and the complete first-parent roster and native edit Message remain required. The retained group is excluded from fresh coheads; it is neither registered again nor reborn, promoted or renewed. Equal app/generation/revision fields, a later SDK owner, a boolean rendering setting or a normalized edit outcome cannot establish that proof. The follower Root admits this retained region only with both actual native Rich carriers and the already-proved read-only app edit. The existing before-I/O snapshot and `assertRetained` gate own complete member/owner/deadline identity, while original native API/bot/Thread and final-use checks still bracket one operation. A deferred editor and its one authenticated later SDK admission may bound only the fresh coheads; the retained group keeps its earlier original cutoff and publisher. Original SDK/app loss, consumed parent, incomplete/foreign carrier, partial or multiple retained groups refuse the whole fresh cohort without a qualifying prefix. First-publisher authority remains necessary after the retained question ends until actual publication drain. No new SDK/API/retention port, identity, timer, registry or Root adapter is added. Twenty-four additional source/actual-compiled Threaded dual-Root native Rich cases use authenticated IPC and the real trusted worker. The explicitly labeled main-side producer input supplies one previously published native callback row; the worker reads and re-emits it beside fresh declarations. Pure and mixed children qualify, the deferred case retains its authentic admission-time ceiling, and the original group keeps its earlier exact deadline through child I/O, SDK inputs and selection. Its original prompt and callback roster resolve without a method binding or another invocation, and fresh controls remain usable after that original question ends. The public resolution projection intentionally does not expose internal completion-group state; assertions use its existing original callback roster/prompt rather than adding inspection authority. Partial/two-group proposals, original SDK/app loss during queued work, parent consumption during native child I/O, an unrelated live equal-field successor, foreign bot/Thread ACKs and deferred SDK replacement keep both fresh groups unqualified. A native pre-fix positive falsifies the blanket retained-group hold. Three exactly restored unsafe models falsify native read-only successor verification, original bot matching and captured parent Thread matching. This is a bounded producer-backed Root fixture and source contract, not standalone-app retention/discovery permission, intent inferred from copied keys, arbitrary app-edit retention or a general retained-controls API. Native HTML/keyboard-only retention, later/multiple feedback, partial/multiple retained groups and cold/foreign/unknown histories remain outside this join. Existing private temporal/GC kernels support the retained lifetime contract; these Root cases do not claim new GC/platform/multi-process/live or release acceptance. ### Retained Text/Keyboard (Native Root Assessment, Carrier Intent Held) The native Text assessment keeps the original app/SDK/publisher and worker lineage intact; it does not manufacture a weaker retained parent. Explicit fixture input supplies a complete previously published callback row, the actual trusted worker reads and re-emits those same native Rich callback declarations beside fresh mixed/pure questions, and planning waits for original worker exit plus termination-call ACK. The worker result really contains both old callbacks. These are labeled producer-input witnesses, not a standalone discovery/retention API. Under HTML rendering, the actual native result edit has Text and a reply keyboard, not a native Rich message. That keyboard contains the fresh controls but neither original callback. The old group is therefore superseded and cannot answer; its recorded deadline is not renewed. The fresh question cohort still joins its ordinary proved parent transition and remains answerable after the original editor settles. No copied native callback row is inserted into the keyboard by the main-side fixture. The direct headed/legacy contract is not silently enrolled in the stronger follower carrier policy. This is a representation gap before a proposed Text retention join: the executable ABI returns string `output`, not a native retained-keyboard field. Fresh Confirm/Choice declarations allocate fresh groups; they cannot express keeping an original group by matching its question text. Raw Rich callback declarations in that output do not become Text/reply-markup controls merely because the rendering preference changes. Separately, the follower's `retainedEdit` admission remains explicitly Rich-only even if a future authentic Text proposal supplies a complete old roster. Removing that check alone cannot create the missing physical carrier or producer intent. Twelve new source/actual-compiled Root cases cover pure/mixed output, direct Classic/Threaded and authenticated follower transport. Together with the existing Rich/partial/source-loss controls, all 48 retained Root cases pass. They preserve one actual worker invocation, native method/result and editor ordering, original clocks and useful fresh answers. The whole direct family now contains 156 cases and the follower carrier family 474; those totals are inventories, not a fresh rerun of every case at this assessment checkpoint. No production source was changed. This adds no positive Text retention or GC/platform/live acceptance claim. An actual source-preserving Text/keyboard retention representation must be earned in the existing producer/planner/rendering owners before any wider policy. The current contract supplies no general old-control discovery or app output keyboard API, and this assessment does not add either. Keep the proved Rich subset and ordinary Text supersession unless a concrete producer contract authorizes and proves the original group-to-keyboard transition. Independent integrated review, supported-platform and operator/live acceptance remain separate. ### Follower Timed App Refresh (Native Root Assessment, Held) The remaining general app-parent work includes the existing managed Live Surface refresh path, not another missing policy flag. `GenerativeApps.createGenerativeAppLiveSurfaceRuntime().refreshNow()` verifies its original Delivery handle and app generation/revision, invokes the real `refresh` worker, then plans and edits the returned native app result. The [app-only source checkpoint](#timed-refresh-original-app-source-root-connected-sdk-parent-held) now supplies its original native app binding and worker drain, so the genuine result retains its app predecessor without claiming a human callback invocation. The original pre-worker SDK/physical capture now supports the [bounded native publication join](#timed-refresh-publication-join-root-bounded-original-source-one-attempt); copied/unknown sources and later/unproved histories remain held. The follower store's refusal-only app-parent rule requires the captured original read-only source and complete physical ancestry, so a complete edit Message cannot alone join these new groups to SDK head/tail. Current handle availability, no app-state envelope, equal fields, normalized success or a later SDK capture must not be substituted for that missing source. Sixteen source/actual-compiled Threaded dual-Root cases, now also checking the connected app-only predecessor, capture the existing Live Surface clock port and trigger its genuine scheduled callback once; they do not emulate refresh with a method result or a second executor. The trusted worker records one labeled producer-side execution counter outside its app-state journal; this is a test trace, not a business-purity claim. The existing SDK-managed view makes one native edit of the original message. Both configured assistant rendering preferences use the measured managed Text carrier here, not a fabricated native Rich parent. A store observer retains the actual complete bot/chat/Thread/message edit ACK separately from the public SDK edit result. The positively owned original first-send question groups already share an SDK cutoff before refresh; only actual first-wire cells are counted, not initial-digest-only planned registrations. Healthy and incomplete-ACK refreshes preserve useful independent questions; an authenticated real callback also executes the refreshed bound control with its exact native app binding and one execution capture, without borrowing a qualified invocation or entering model admission. Both refreshed groups retain their original 24-hour clocks through a later real SDK admission despite a healthy native edit ACK. Original SDK replacement and app revision during held native edit I/O preserve no-replay and withheld membership; app loss refuses its old selection. Omitted hints close the live surface, and neither failure nor callback execution repeats the refresh worker. A temporary, exactly restored model removing the follower app-parent source restriction wrongly shortens both groups and is assertion-RED. This is a held-region falsifier, not a released defect or a source/SDK capability grant. The original assessment's missing source is now supplied by the [one-attempt publication join](#timed-refresh-publication-join-root-bounded-original-source-one-attempt). Its first unchanged mixed parent may produce mixed or pure-question output; this does not activate wider or repeated histories. Reuse the existing Live Surface, app, store/publication and Delivery owners, without inventing a human callback. Missing or lost source stays held; old and fresh independent UI retain their prior answer/dispatch contract. The original assessment grants no membership policy, SDK/public API, readiness, receiver/v5 or live/platform/release authority; the bounded app-source runtime change below closes only its named component. ### Timed Refresh Original App Source (Root Connected; SDK Parent Held) Managed live surfaces now carry constructor-private `originalAppBinding` from their genuine native producer result. The existing live-record owner snapshots that exact binding/native app owner before clock or currentness callbacks; supplied accessors/copies/foreign objects fail closed without getter execution or legacy downgrade. Omission preserves existing embedding behavior. The record reserves in-flight work before external callbacks, checks that it still owns its key, and validates the original native app/generation/revision/binding and filesystem/history before worker dispatch, after planning and after actual edit I/O. Observed source-data loss is sticky even if an error-classification callback restores equal fields. A replacement, shutdown or callback reentry cannot run obsolete work or erase a successor. Refresh uses the existing native original-binding and actual-worker-drain options of `invokeGenerativeApp()`, without creating or claiming any callback invocation. The real no-app-state-write result records that same original app predecessor; this is app-only lineage, not business purity, SDK scope or physical-parent permission. Healthy edit retries retain one native result/frame and cannot reacquire a source or repeat its worker. Lost app authority cannot be retried merely because the current Delivery handle or error classifier remains positive. The existing record/map/timer owns all state; no new identity generator, registry, receipt, generic executor or public API is added. Cancellation now drops its exact record before clock callbacks and does not spread discarded surface data, avoiding execution of a refused source getter and accidental deletion of a reentrant replacement. Explicit callback resume may reopen only a genuine same-app/generation current native result; a legitimate committed state revision may replace the old app owner, but copied/foreign/tampered result metadata and loss during planning/edit cannot rebase it. Resume preserves replacements and shutdown. This is a new live-surface lifetime after the existing producer callback, not promotion of an old question or substitution for the first-physical publisher. Twenty-nine native app-source/resume properties cover absent legacy controls, immutable original capture, copied/accessor/peer/mutated metadata, SDK-currentness reentry and replacement, restoration after observed data loss, source/plan/edit loss, retained-result retry, genuine read-only/state-written resume, foreign/copied/getter results, replacement and shutdown. Four additional source/actual-compiled Threaded Root cases hold the original real `Worker.terminate()` ACK after actual worker exit: neither planning nor native UI edit begins until that ACK settles. The preceding sixteen Root refresh witnesses now also prove the genuine original app predecessor while still refusing SDK membership on complete native Message ACKs. Independent answers and ordinary bound callbacks retain their previous path without borrowed invocation authority. Old compiled Root code is assertion-RED on missing original predecessor; four exactly restored unsafe models separately falsify refused-origin downgrade, the post-planning source check, original worker drain and forgetting observed source loss after equal-field restoration. The [original publication capture](#timed-refresh-original-publication-capture-root-connected-publication-handoff-held) now connects pre-worker SDK/physical snapshot transport to the exact native result. Neither the surface field, app-only successor nor opaque result property alone is a question-head certificate; the [native one-attempt issuer/parent/ACK join](#timed-refresh-publication-join-root-bounded-original-source-one-attempt) is required. The [private publication-source kernel](#original-publication-source-snapshot-private-kernel-refresh-handoff-held) owns the snapshot; only the bounded native issuer/attempt transition below may consume it. Private Input, receiver/v5, standalone retention intent, broader histories and independent/platform/live/release acceptance remain separate. ### Original Publication Source Snapshot (Private Kernel; Refresh Handoff Held) The existing Button Store now provides private read-only `capturePublicationSource(handle, binding)`. The handle is only a locator: an exact original native app binding, one complete ordinary row, positively published question cohorts, original SDK scopes/history and the complete native visible callback roster must already exist in that store. Capture snapshots the original publication, publisher callable, message/Thread, keyboard/Rich frame identities, row/member identities and first-physical SDK ancestry before authority callbacks. It uses the owners captured at birth and never calls the current SDK-owner factory. Accessor locators are refused without invoking getters; copied bindings, ambiguous/multi-message targets and unpublished planning cannot supply provenance. The frozen store-branded snapshot has a sticky, reentry-fenced currentness check and a private one-use attempt latch. Original SDK/native scope and publisher guards precede native app authority and the final store-data barrier. SDK/app/publisher loss, spent parents, changed physical frames and unknown/busy/dirty/closing publications refuse; equal-field frame restoration cannot revive an issued snapshot. Capture does not spend a callback or question attempt, change a birth/deadline, create a head or invoke a method; only the later native store descriptor may claim this source once. This is not an independent receipt/registry, new public API or generic certificate. Later/consumed/deferred/retained histories remain outside this first-physical mixed-parent kernel. Twenty native HTML/Rich properties prove original-owner reuse without factory recapture, unchanged clocks, useful unspent controls, SDK/app/publisher loss, parent consumption, accessor/copy/namespace refusal, changed-and-restored frames and caught reentry. The twenty original source/actual-compiled Root refresh cases first exercised this kernel test-side; the [current production capture](#timed-refresh-original-publication-capture-root-connected-publication-handoff-held) now uses the genuine managed path before callbacks and worker execution. They preserve the real scheduled callback, actual worker/drain and original edit path. Two exactly restored kernel models separately falsify forgotten sticky loss and accepting an equal-roster changed physical frame; the full native join below, not capture/result transport alone, activates the bounded membership. Production refresh now captures the original SDK/physical snapshot before refresh callbacks/worker work and retains its exact result association. The [native join below](#timed-refresh-publication-join-root-bounded-original-source-one-attempt) now authenticates that original store-issued source and binds it to one exact publication attempt, complete parent/child rosters, native I/O and final use. A pre-edit snapshot deliberately cannot certify its own edited successor or busy publication. Do not turn SDK-parent eligibility into a global app-execution guard: unavailable shared ancestry keeps membership held while independently authorized refresh/questions/controls retain their contract. No current-owner lookup, source reacquisition on retry, fake callback or policy-only activation may bridge that gap. Only that original-source case qualifies; broader histories, private Input, independent review and platform/live/release acceptance remain separate. ### Timed Refresh Original Publication Capture (Root Connected; Publication Handoff Held) Bindings now wires the existing Button Store `capturePublicationSource` into the managed app tool. The existing Live Surface record pins that provider at construction and reserves in-flight ownership before calling it with the original handle and genuine app binding, before refresh clock/currentness callbacks, filesystem work or worker execution. Capture happens once per logical refresh; even an absent/refused result remains captured across edit retries. Reentry, replacement and shutdown cannot dispatch an obsolete worker. A successful later hinted refresh is a new operation, not permission to recapture during a pending attempt. The exact drained, output-only native `refresh` result carries the original snapshot in a frozen, non-enumerable `originalPublicationSource` owner property. It remains main-side in the existing native result/binding ownership; it never enters worker data, generated Markdown, wire bodies or a public SDK membrane. Native source/result association, not equal app/generation/revision or copied fields, decides which result holds it. An unrelated or later genuine successor cannot inherit the property implicitly. Explicit invocation captures the source and operation before asynchronous work; option replacement cannot redirect it. Supplied source getters, missing native binding/drain, another method or a human callback invocation are refused before filesystem/worker work, without spending that callback invocation. This is **opaque transport, not source authentication or a membership certificate**. Shape validation only accepts frozen data-property captures, drains malformed genuine rejected Promises without awaiting them, and does not run foreign assertion/then getters. Missing, malformed or thrown capture retains independent app execution under its existing native app/Delivery guards. An issued but later lost SDK/physical snapshot is retained exactly, not cleared, replaced or interpreted as permission to reacquire a current owner. SDK-parent eligibility is never installed as a global worker/edit guard. The [native store join below](#timed-refresh-publication-join-root-bounded-original-source-one-attempt) authenticates the original issuer, physical ancestry and one publication attempt before head/tail use; no flag-only source policy is enabled. Twenty-three additional native properties cover constructor-pinned capture, pre-clock/currentness/owner-observation ordering, legacy omission, missing/throwing/async/getter/then-getter/unfrozen capture, SDK eligibility loss, pending retry without recapture, caught reentry/replacement/shutdown, a later hinted operation, exact result association, original option capture and no implicit successor inheritance. The Generative App suite has 160 local cases. Twenty-eight source/actual-compiled Root refresh cases now execute the production handoff instead of a test-side call; eight added cases spend an original question before capture or after capture but before the worker. Genuine app work, refreshed independent answers and authenticated bound controls remain useful in both cases; issued lost provenance stays attached to the exact result while missing provenance stays absent. Original real worker exit/termination ACK, complete/incomplete edit carriers, SDK/app loss during I/O, one worker, one capture and unchanged later-SDK clocks remain enforced. The enclosing dual-Root carrier matrix now has 394 cases. Old compiled Root code is assertion-RED before its first await on missing production capture. Three exactly restored unsafe models falsify retry recapture, using SDK eligibility as a global execution guard and implicit source inheritance by a later native successor. The [native publication join below](#timed-refresh-publication-join-root-bounded-original-source-one-attempt) supplies source authentication and the original publication-attempt/native-ACK/final-use transition, never recapture at plan/ACK or treating this owner property as a certificate. A pre-edit snapshot cannot validate its own changed successor or arbitrary busy publication. Only its privately bound descriptor may bridge that exact native transition; general/later/retained histories, private Input/receiver work, independent review and platform/live/release acceptance remain separately gated. ### Timed Refresh Publication Join (Root Bounded; Original Source, One Attempt) The Button Store now brands each captured original source with store-local native private fields and a constructor key, not public shape, copied assertion callbacks or a new registry/identity family. Its native reader claims that source once with the existing first publication descriptor, before SDK/provider callbacks. A refused descriptor, including a confirmed native method rejection, never releases that claim for another result or retry. The read-only public snapshot guard cannot stand in for this private descriptor or certify a busy/changed frame. `getGenerativeAppRefreshPublicationSource()` reads only the exact native binding's original opaque source and predecessor; copied bindings and foreign/getter shapes cannot produce that association. The store independently requires its own native source brand, exact original publication/publisher/frame, complete parent question/member roster, one original ordinary parent, and the same original native app owner as predecessor. Every fresh question and any fresh ordinary row must carry that one actual result binding, not equal fields. Pure-question children need no dummy control. Consumed/projected/deferred/retained or unrelated parent histories cannot enter this path. Before issuance and again at successful native ACK, the privately claimed source revalidates its original SDK scopes/history, publisher, app filesystem authority and unchanged complete parent under the exact one in-flight publication. Source/namespace/parent loss withholds the whole cohort without replacing the source or preventing independently authorized UI. The existing API still requires original bot/chat/Thread/message evidence; the raw edit Message, not `edited`, `void` or legacy success, supplies the carrier. Only that original descriptor may retire the old rows and expose the complete fresh cohort. The captured postimage, original first-physical scope/history, original publication/SDK/app guards and existing final-use tail registration bracket commit; no pending head, newer owner lookup or renewed old clock is introduced. Thirty-two Classic/Threaded × native HTML/Rich kernel properties prove mixed and pure positives, copied/foreign-store source refusal, constructor-key refusal, no reuse after a rejected descriptor, a genuine equal-field but wrong app predecessor and atomic partial-child refusal. The production matrix adds twenty source/actual-compiled cases to the preceding twenty-eight timed-refresh witnesses: forged source, foreign bot/Thread ACK, parent consumption during real native I/O, mixed native question-result origins and pure output. All fifty-two timed Root cases use real managed capture, worker/termination drain and the actual measured Text carrier in either configured rendering preference; the enclosing dual-Root carrier matrix has 418 cases. Healthy complete ACKs qualify both groups together on a subsequent SDK admission, while every negative keeps both original independent clocks. Independent answers remain useful, and a later actual bound-control press may create its own genuine invocation; the timer creates none and later results cannot inherit its snapshot. The qualified callback witness required a genuine native feedback Message from the fixture instead of its old boolean keyboard-edit ACK. The guard was preserved, not relaxed. Three exactly restored unsafe models falsify source reuse after rejection, accepting another equal-field native predecessor and omitting the original API bot match. The earlier held-region positive now falsifies the blanket refusal; old actual-dist code failed the new positive before rebuild. This closes the named first-parent timed publication slice, not all app histories or release acceptance. Later/repeated/multiple/retained/unknown-parent histories and receiver/private Input remain held until their own original-source proofs exist. No callback invention, weaker prepared-wire SDK retry, additional public opener, registry/timer/receipt family, independent review, supported-platform/live acceptance, reload or publication follows from these local cases. ### Timed Source Retention and Drain (Native Source/Compiled) Twelve `--expose-gc` subprocess composites cover source/actual-compiled modules × mixed/pure output × normal selection, expiry during pending I/O and an explicit producer-held native result. They use a genuine installed app and refresh worker, the constructor-pinned Live Surface capture, the store's native branded source and publication attempt, a bound native SDK registry and the existing Bus API/publication-editor ports with controlled direct edit I/O. These are native ownership/collection witnesses, not full-extension follower/socket, client, multi-process or platform GC acceptance; the functional dual-Root matrix remains separate. While the real edit promise is pending, the source, original app binding, native result/binding and original publisher remain live even when all controls expire. Native completion drains that operation without another worker/capture. After successful replacement, old callback keys really refuse; the original publisher remains usable and retained while fresh controls still need it. A later SDK head still shortens both fresh question groups to their original shared ceiling after GC, and their original answers remain usable. Mixed output retains the old publisher after both questions end while its ordinary control remains; pure output needs no extra control or artificial hold. A settled unheld result collects while its native binding/source remain legitimately controlled by the UI, proving that the native result WeakMap does not root its key through the new reference cycle. Conversely, retaining that exact native result intentionally retains the entire source/publisher chain after controls and work end; releasing it permits collection. Final assertions collect source, original/new app bindings, result, original publisher and old/fresh question groups while Store, live-surface runtime and SDK namespace remain alive. Store clearing and SDK shutdown occur only in final fixture cleanup after those assertions; no source-field replacement, authority revocation or rebasing is used to make collection pass. A temporary exactly restored `WeakMap`→`Map` model in the native result owner table fails the early unheld-result collection assertion. No production behavior or guard changed for this checkpoint. The preceding full-package/418-case functional result remains applicable to unchanged runtime code; this slice adds focused native source/compiled retention evidence only. Broader retained/late/unknown histories, independent integrated review and supported-platform/operator-live/release gates remain open. ### Ordinary-Only App First Frame (Native Root Assessment) A concrete general ordinary-footer path is witnessed: `telegram_bind` first publishes one real bound control and no questions, then its real timed `refresh` emits questions. The initial assessment separated healthy born native app/SDK owners from missing ordinary-only first-physical provenance; a complete native ACK, known IDs and current SDK namespace alone did not establish it. That source gap is now closed by the bounded first-wire certification below. The [bounded question-free child join](#question-free-timed-refresh-child-root-bounded-original-first-wire) now uses that original certificate; a zero-question parent must not be repaired with a dummy group, fresh SDK owner or copied fields. ### Ordinary-Only First-Wire Source (Root Connected) The existing Publication owns private `ordinarySource` rows/frame metadata, separate from `ordinary` question-cohort and callback-projection parent metadata. It certifies exactly one original bound ordinary row and no questions through an original bounded direct/follower API first-send descriptor. Born action/lifetime identities are snapshotted before body/parent callbacks; that existing descriptor is spent before SDK/provider/FS callbacks, including refused or uncertain sends. Complete visible native callback roster, exact native app binding, original SDK scope/history/target and publisher must remain current around issuance and ACK. The API's original registration/bot/native Message checks must retain its `first-send` policy; legacy, foreign bot/Thread/business or incomplete carriers cannot certify the source. Direct/legacy embeddings without that original API policy retain their preceding behavior; the bounded original direct first-wire supplement is described below. No question head, agent/SDK tail, invocation, method execution or new button deadline is created. The certificate is not callback execution authority. SDK callbacks precede native app FS; final data/history checks follow it. Missing/lost ancestry refuses certification only, not an independently authorized UI send or method. Rejected/unknown first descriptors cannot be retried into fresh certification. Multiple rows, duplicate/foreign rosters and callback-introduced births remain outside this bounded source. The constructor-pinned pre-worker `capturePublicationSource` can now issue a store-branded snapshot for that unchanged certified frame with an empty question-parent vector and its original ordinary SDK owner. Native app/SDK/publisher loss, row consumption, altered/intervening frame, target mismatch and equal-field restoration refuse; capture never looks up a current owner. The existing exact-result read-only refresh transport and one-attempt source claim retain it without a fabricated human invocation. The bounded child join below now accepts that certified question-free vector, not the absence of question rows. It preserves the original SDK/physical source and does not mint a head at first send. Sixty-eight native Classic/Threaded and HTML/Rich-request properties cover pending/complete/legacy/foreign carriers, SDK/app/publisher loss during I/O, expiry/consumption, body-getter births, repeated refused/unknown attempts, duplicate/multiple controls, sticky loss and intervening frames. The first ACK's exact frame is pinned before SDK/provider callbacks; a reentrant embedded edit cannot become first-wire ancestry, nor may an unsettled/dirty/closing publication certify it. Actual ordinary controls are measured at their emitted footer, not inferred from the rendering preference. A pre-existing native SDK question remains on its original clock beyond one hour, and the ordinary control still works then under its 24-hour TTL. Three exactly restored unsafe models falsify carrier refusal (conjunctive original-policy checks), born-row snapshot and first-descriptor spending. The original 16 source/actual-compiled Threaded Root cases positively observe the certified source before the real refresh worker, except for the legacy first ACK. Their healthy complete case now joins through the child boundary below; SDK-field proxies remain unbranded and pending-I/O namespace replacement cannot revive the original birth. Capture-provider fallback remains compatible, but fixture assertions are checked outside that fallible boundary. Local source/compiled evidence is not independent, platform/live or release acceptance. ### Question-Free Timed Refresh Child (Root Bounded Original First Wire) One unchanged certified ordinary-only first wire now qualifies a complete mixed or pure-question read-only refresh child. Before original SDK/provider/app FS callbacks, the existing descriptor authenticates and spends the original store-branded snapshot carried by the exact native drained result. The question-free exception requires its exact Publication/publisher/frame, certified one-row vector, native app binding and identical original predecessor. Empty question rows alone never make an edit parent. Copied/foreign-store/spent sources, compatible-but-distinct native predecessors, a stale or intervening frame and any unproved parent cannot qualify a prefix or fall back to a prepared-wire retry. The original ordinary SDK owner supplies the first-physical scope/history in place of nonexistent parent questions. Every fresh question and optional ordinary row must retain the same native successor result; all native scopes/targets and original SDK/app/publisher histories are checked before issuance and through the complete original bot/chat/Thread/message edit ACK. The source remains current under the one busy original publication attempt until its ACK; final postimage/retired-parent/data-only checks bracket SDK/agent cohort application. This reuses the existing transition and head/tail owners, without another registry, timer, receipt, invocation or public API. The first ordinary wire still creates no head and preserves its button deadline. Only the actual qualified question child captures the original ACK-time SDK/agent cohort; snapshot application never reselects newer heads. Fresh heads keep the ordinary first wire's original SDK scope/history, not their own newly born question-owner identity. A later real read-only callback may execute and edit that physical message independently, but cannot rebase its ancestry and renew common membership. State-written/unknown/multiple/retained/intervening histories, direct/legacy first-wire admission without original native API proof, and general later/repeated adoption remain outside this boundary. Missing or lost SDK-parent eligibility is not global app/answer execution authority. Thirty-two additional native Classic/Threaded × rendering-request properties cover mixed/pure output, native constructor/brand and foreign-store refusal, refused-source replay, distinct native predecessors and partial children. A real pre-existing SDK question expires at the child's original one-hour ACK cutoff only for qualified cases; refused ancestry leaves it waiting, proving both SDK and agent effects rather than flag-only membership. Thirty-six added and four upgraded Threaded source/actual-compiled Root cases bring the timed family to 104 and the full carrier family to 470. Actual managed carriers remain Text in both rendering preferences. Complete pure/mixed/drained-worker joins, incomplete first/child ACKs, foreign bot/Thread, SDK/app/consumed-source loss, proxy provenance and pre-worker source absence preserve whole-cohort clocks and independent execution. The later witness runs a genuine native callback worker, native feedback and complete child edit, then proves its fresh questions stay independent under a later SDK head. Three exactly restored unsafe models falsify omitting original native predecessor checks (conjunctive structural/transition checks), omitting captured Thread matching, and rebasing first-physical scope/history to the refresh child's birth. The initial simpler callback witness survived that last model because it proved execution only; it was not counted. The later-question witness supplies the actual falsifier. Old actual compiled code fails the newly qualified question-free Root path. Twelve additional native source/compiled `--expose-gc` composites bring the timed retention family to 24. Question-free parents contain zero actual question groups. Original source/app binding/new binding/result/publisher survive pending I/O and intentional live UI/result roots, while unheld results collect; the exact chain and both group generations collect after genuine control/result drain, before Store clearing or SDK shutdown. Expiry during I/O cannot replay work, and the native worker counter remains one. These native composites are not full-extension follower/socket or supported-platform GC acceptance; independent/platform/live/release gates remain separate. ### Direct Ordinary First Wire (Native Root Assessment) The initial 32 source/actual-compiled Classic/Threaded Root witnesses established that available native SDK/method guards and a complete first Message did not by themselves certify a direct ordinary-only frame. Original publisher/bot capture was absent, and the standard direct edit adapter discarded its complete native response before the publication observer. A flag-only policy model wrongly certified a legacy first ACK. Both handoffs are now connected below through the original operations, not repaired by normalized success or current SDK scope. ### Direct Ordinary First-Wire Authority (Root Connected) `lib/bus-api.ts` now captures the direct first-send publisher, original method set, authority/role providers and constructor-pinned bot provider/value before publication observation. Method references are pinned before the capture's role/bot/provider callbacks. Sticky original-owner and reentry checks span body preparation, native issuance and response. The no-argument SDK method-scope factory also retains bot-provider identity without making a numeric bot mandatory for legacy embeddings. No public opener, package entrypoint, lifetime registry or new routing owner is added. The existing Store observer exposes one readonly own-data `ordinarySource` kind for a born first-wire candidate or an edit of its certified ordinary-source publication, including descendants. It is an eligibility locator, not authority: the API never invokes a foreign hint getter, and only an original direct scope plus a complete exact bot/chat/Thread/message carrier can certify the first send. The Store's existing native row/app/SDK/source/descriptor guards remain authoritative. Missing/async scope, absent/undefined bot, malformed/legacy/business/foreign ACK or original provider/method loss cannot mint provenance. Independent sends/answers and existing headed/legacy contracts remain intact when stronger evidence is absent. For an eligible first send, the original caller UI guard is captured and composed with the original publisher, not replaced. Text uses the native local-authority adapter and Rich carries an explicit one-attempt non-idempotent scope; both fence the actual native HTTP boundary. Before-HTTP loss is an unissued authority refusal; after-response loss retains `requestIssued:true`, and native server uncertainty retains its commit-unknown classification. Server/rate pressure and known refusal cannot replay or switch routes. A declined issued source cannot fall back to another native method or owner. A complete direct ordinary first wire supplies a genuine store-branded pre-worker source, including its native read-only predecessor/exact-result transport, without a head or new deadline. The bounded native edit handoff below now joins its complete fresh question cohort. Missing native edit data remains refusal-only; original direct headed/legacy editing is not indiscriminately enrolled or retired. Forty-six new API partitions cover complete/refused carriers, getters, missing/malformed scope, bot/provider/method/role changes, I/O loss, native-boundary and original-caller guards, and unenrolled headed UI. Ten actual native HTTP properties prove one attempt and the existing issued/unissued/server-error meanings. Sixty-eight additional native Classic/Threaded/rendering cases bring first-wire properties to 136, including SDK-question clock preservation beyond one hour, original button TTL, pre-ACK absence, refused retry, source loss and reentrant frames. The first-wire checkpoint added 16 Root cases, positively capturing the native source while absent bot/legacy/foreign first evidence stayed unqualified. The direct family is now 148 cases after the carrier cohort below. Actual managed carriers remain Text in both rendering preferences; original answers and bound controls stay independently usable. The first-wire checkpoint's restored models falsified bot-value continuity, original method identity, native bot matching and premature normalized-edit enrollment while the raw handoff was absent. The latter is not permission to enroll without native data. Old actual compiled code failed its positive first-source witness. Independent/platform/live/release acceptance remains separate. ### Direct Native Edit Carrier (Root Bounded Original Operation) The native direct text and positional markup adapters retain their actual result before public normalization through private `onNativeEditResult` data observation. The observer and original UI guard are captured before recovery/provider callbacks and I/O; own accessors/non-functions refuse without invocation. The native result is not synthesized from `edited`, a handle, configured bot or current SDK owner. Observation is outside remote error recovery and bracketed by the same captured issued-authority guard, so callback/scope failure cannot start another request or claim unchanged ownership. The observer never enters the body, native client options or follower IPC. For edits of a certified ordinary-source publication, Bus API captures the original direct publisher/bot/provider/method scope before the Store observer. It composes the original caller guard, invokes the existing guarded native edit once, and accepts one native result only while that operation is live. Missing/duplicate/late callbacks, unavailable original scope, unchanged/boolean/legacy/foreign carriers and lost authority withhold common membership. Native bot/chat/message identity is checked in API; an omitted edit Thread remains joined only by the Store's captured physical parent. Data may be retained even when an opaque worker source is unbranded: native response data is not Store-source authentication or execution authority. The existing Store transition still requires the exact store-branded pre-worker source, native drained read-only predecessor/result, complete fresh mixed/pure roster, original first-physical SDK/app/publisher histories and final native ACK/postimage barriers. That bounded question-free direct child now joins SDK/agent head/tail like the follower counterpart. The first ordinary send remains headless and keeps its original button deadline; pure children need no dummy control, and the timer creates no human invocation. Public text outcomes stay `edited`/`unchanged`, Bus API positional markup stays void, and original native error recovery/issued uncertainty stay intact. Known refusal, 429/server pressure and scope loss cannot replay through another/raw call. The readonly own-data `ordinarySource` hint also follows later edits of this certified publication. They cannot silently fall back to the broader direct legacy normalized-edit contract. A later real callback may execute independently and edit with complete native feedback, but its fresh questions cannot rebase or renew common first-physical ancestry. Original headed/legacy publications without this new provenance retain their prior contracts. Unknown/state-written/intervening/repeated/retained histories still need their own proof. Twenty native adapter properties cover exact Message capture, boolean and not-modified compatibility, pre/post-observation authority, malformed/changed observer and original guard identity, callback failure and no second recovery. Thirty Bus API properties cover public/native separation, missing/duplicate/late data, foreign/bad carriers, guarded publication, missing scope and original caller loss. Ten actual HTTP properties establish one native request, unchanged text versus markup rejection, and existing issued/unissued/server uncertainty. Forty-eight added and eight upgraded Classic/Threaded source/actual-compiled Root cases bring the direct family to 148: mixed/pure positives, incomplete/foreign child ACKs, consumed parent, SDK replacement and a genuine later callback all run real workers and original edit methods. A legacy SDK-only scope proxy remains unbranded despite available native response data. Twelve additional direct ordinary-source source/compiled `--expose-gc` composites bring the native retention family to 36. Source/original/new bindings/publisher/result survive pending I/O and live UI or exact retained-result roots; unheld results collect, and the remaining chain collects after actual control/result drain before Store clearing or SDK shutdown. Fake-clock expiry during I/O cannot replay the one counted native worker. These composites are not full-extension transport/platform GC acceptance. Four exactly restored models falsify substituting normalized text for the actual result, omitting native bot matching, omitting captured parent Thread and dropping strict descendant policy. The last one renewed a later direct child's common membership through legacy normalized edits, and the real-callback witness caught it. Old actual compiled code fails the positive raw-carrier witness. No public Delivery membrane, question receipt family, polling owner, authority-clearing GC workaround or live/reload/release acceptance is added. ### Follower Plain Known-Parent Edit (Root Bounded) The follower API now retains the actual `editMessageText` Message alongside the existing private observer's normalized outcome, without changing public `edited`/`unchanged` results or independent app feedback. The added optional fourth observer argument carries native response data, not authority, a serialized receipt or another SDK port. The original API registration/publisher/bot checks still bracket one unretried operation. Before the original observer settles, API-side evidence requires an exact positive message ID, matching chat, original bot with `is_bot:true` and no business namespace. The store independently matches the Message's Thread to its captured original parent; omission from the request is not omission from proof. The Bot API's non-inline edit returns a Message, while boolean success cannot certify this numeric parent join. The refusal-only `known-parent-edit` policy admits complete fresh plain question cohorts on an unambiguous already-proven plain physical parent through Text/Rich edits. Existing original publisher/preimage/complete parent-row and SDK ancestry checks, spent descriptors, atomic supersession and one native final-use cohort capture remain authoritative. Neither equal IDs nor the normalized `edited` string can create a head. Original SDK replacement or parent consumption while HTTP waits keeps the fresh cohort unqualified without borrowing a new namespace. The separate read-only app-child join above does not open general app-parent/ordinary/mixed/retained histories; keyboard-only reply-markup separately preserves legacy UI behavior and original independent clocks. Forty additional source/actual-compiled Threaded dual-Root cases establish two positively SDK-owned first-send parents, prove both original memberships through a real SDK admission, then attempt two fresh question groups on that same Message. Complete Text/Rich edits share one subsequent SDK cutoff. Missing/boolean/foreign-ID/foreign-Thread/foreign-bot/unchanged ACKs, pending SDK replacement and consumed-parent preimages withhold both fresh memberships. Actual native app-parent frames remain held despite complete native edit evidence. Twelve Classic/Threaded API partitions retain the raw carrier separately from the unchanged legacy outcome, reject DTO getters without invocation and keep one issued call. Three exactly restored Root mutations falsify dropping the native carrier, ignoring the captured parent Thread and promoting app ancestry. Existing known-parent kernel gates remain unchanged. These are local disposable Root witnesses, not live client, multi-process or platform acceptance; broader app/parent/retention histories and private Input/release gates remain open. ### Follower Plain Reply-Markup Edit (Root Bounded) The existing follower `editMessageReplyMarkup` path now retains its actual native Message through the same private observer argument used for Text/Rich edits. Public `Promise` and the observer's preceding `undefined` result remain unchanged; void or normalized success is never the edit certificate. The API still requires the original local/acknowledged registration/publisher/bot scope, one guarded call and complete native Message evidence. The store independently joins the exact captured parent message/chat/Thread. The same refusal-only `known-parent-edit` mode and existing complete-parent, fresh roster, spent descriptor and final native SDK cohort guards apply; no new identity, registry, timer, receipt or wire capability is introduced. A complete keyboard-only plain parent can be superseded through this method in either HTML or Rich rendering. Ordinary Confirm/Choice controls are footer keyboards in both modes: a rendering setting alone is not physical-carrier evidence. The method preserves in-body Rich controls. When original parent rows remain there, the existing final-use requirement for expected old-row retirement refuses fresh SDK membership; it cannot promote a replacement prefix or pretend the original controls disappeared. A fresh main-side native projection fixture proves this held region without claiming copied old controls or standalone-app retention intent. App-parent, mixed/retained, unknown-parent and other non-superseding histories remain held. Forty-four additional source/actual-compiled Threaded dual-Root cases prove original first-send memberships for both parent groups before markup edits, common SDK demotion of both fresh groups on complete keyboard replacement, and independent deadlines for missing/boolean/foreign-ID/foreign-Thread/foreign-bot native evidence. SDK replacement and parent consumption during HTTP cannot borrow new authority. Method-bound not-modified errors retain their preceding rejection behavior; no unpublished selection is claimed. Actual native app-parent and embedded Rich frames remain held in both rendering settings. Twelve additional Classic/Threaded API regressions retain the native carrier separately from unchanged public/observer void outcomes, preserve one issued call and never invoke DTO getters. A native pre-fix Root fails the positive case; three exactly restored mutations separately falsify dropping the markup carrier, ignoring original Rich-row retirement and promoting app ancestry. This is local disposable production-Root evidence, not client, multi-process, platform or operator-live acceptance. ### Original Bootstrap Acknowledgement (Admission) Before interpreting protocol, success, refusal or restore-only skip, `registerWithLeader()` now requires `bus.ack` with the original registration request ID. A foreign/control-plane response is unconfirmed, not a success, compatibility result or known policy rejection. The existing failure owner clears active credentials/registered state, stops the receiver and never publishes the ready generation or calls `onRegistered`. Matching success, protocol errors and identity-less rejections retain their meanings; matching restore-only Workspace refusal still returns its non-admitted result. There is no new receipt, protocol capability or wire field. Eleven native socket partitions cover those outcomes, matching/foreign IDs, restore-only refusal and a matching wrong-kind frame. Five original pre-fix partitions failed assertions. Two source/actual-compiled dual-Root falsifiers corrupted only the native backend's bootstrap ACK ID after real registration and demonstrated the old code publishing ready authority. The corrected bootstrap subset retains its four successful/foreign-carrier witnesses while two bootstrap cases prove no ready generation, API birth or SDK publication; the expanded identity family above adds four independent registration-origin witnesses. Attachment's existing wrong-ACK cases now refuse the whole registration, rather than treating uncorrelated bootstrap authority as a weaker legacy success. This closes a necessary admission hole, not by itself the original remote receiver registry lifetime or SDK/publisher/physical-carrier join; the bounded first-send consumer above supplies those additional proofs. ###### Native Question Runtime Versus Binding Scope (Read-Only) A native scope captured directly from `createTelegramDeliveryRuntime()` proves that concrete runtime and its constructor-pinned authority/target providers. It is not automatically a certificate for the existing global Delivery registry binding or every transport/session fact outside those providers. Sixteen source and sixteen actual-dist Classic/Threaded cases under `/home/llb/pttmp/binding-scope-*` separate those identities, with exact case equivalence. Every registry mutation occurs only inside a disposable Node child; no live extension, registry, Workspace or Telegram state is touched. - **Direct native scope**: A deliberately unregistered kernel can capture/apply its own native owner. Same-runtime registration rebind and later unbind also leave that direct runtime owner usable while its providers remain valid. The public registry route independently becomes unavailable after unbind; successful direct tail application is not evidence that a registry binding still exists. A stale old unbinder cannot erase the newer same-object registration. These are controls of the current pure-kernel contract, not newly discovered released-runtime defects. - **Replacement and shutdown**: Binding a different native runtime, explicit shutdown and lifecycle replacement make the original native owner/captured application refuse. The replacement may have identical visible generation/profile/operator/target values but is a different native scope. Original refusal cannot demote its question. Lifecycle replacement already owns shutdown; it does not require a second registry or timer. - **Original transport provider**: A native original Bus agent guard notices an epoch change and stays lost after exact address/epoch restoration. A kernel provider supplying only unchanged profile/operator/target does not magically acquire that history: its direct owner remains usable. A separate control that actually includes the original Bus guard in its fixed authority provider refuses and stays lost. That control is not production wiring, a remote receiver certificate or permission to repurpose Artifact authority. - **Refusal versus completion**: Native owner refusal alone does not assert immediate terminalization of every underlying SDK question. In the provider-loss case, the failed tail is not applied and the question remains pending at the one-hour observation; the existing question owner still owns later observation/termination. Runtime shutdown, by contrast, actually ends its questions. Neither fact is source non-use, source completion or actual-I/O drain proof. One unsafe late-owner model replaces the spent original capture with a new capture from the then-current runtime. Four genuine assertion-RED Classic/Threaded registry/lifecycle replacement partitions show the successor question actually expiring from that forbidden shortening. This is one disposable coordination model, not four source mutations; no repository source was mutated or mutation credit claimed. A value-equal/current-runtime proxy therefore cannot solve the missing original binding boundary. This read-only preparation established the requirement for the authorized [native original registry-binding checkpoint](#native-original-question-registry-binding-private) below; original session/transport provider composition remains separate. Further integration must preserve same-object rebind/unbind and sticky-loss semantics, native peer histories/final-use, true replacement/shutdown, direct unregistered-kernel embedding and actual drain. A second registry, ACK-time successor lookup or wrapper-only assertion that the native final-use reader never observes cannot supply that authority. Root/default/receiver IPC, Text/v5/source disposition, independent/platform/live acceptance and publication remain gated. ###### Native Original Question Registry Binding (Private) The operator authorized autonomous local pre-release preparation and the necessary narrow private original-binding/provider checkpoint. The first implementation closed registry provenance inside existing Delivery ownership. Subsequent original-provider and private Bridge/lifecycle checkpoints below complete those local prerequisites, without wiring root/defaults or certifying a remote receiver. The existing global Delivery registry now creates a native-branded record, and its existing `binding` slot carries an internally keyed native token rather than a new registry. Bind/rebind, exact unbind and clear revoke the previous token before relevant callbacks. A stale old unbinder cannot revoke its successor. Legacy/foreign registry records retain their existing ordinary behavior but confer no native question-binding certificate; there is no silent upgrade/adoption or availability-based successor fallback. The private captured reader requires the secret key, so constructor/static-reader discovery cannot expose or reset its mutable revocation cell. `captureTelegramQuestionLifetimeOwner()` observes only an already-present native registry. At group admission it snapshots the exact registry, runtime, binding token and original capture callable once; absent/legacy/foreign/unavailable evidence refuses without creating a registry or invoking foreign captures. The kernel's existing private owner port accepts only that native binding token (not a DTO/copy/proxy). The returned native scope retains the original cell, and its availability participates in native scope matching and cohort final use. Pure unregistered-kernel captures stay unchanged, but cannot match/borrow a bound scope. Same-runtime rebind is therefore distinct from the original bound scope even when every visible field matches; restored objects/callables cannot revive an observed or natively revoked cell. Binding currentness uses only own data descriptors on the original native registry/runtime and the global binding carrier, plus private sticky flags. It never invokes dependency getters after the SDK cohort's successful data-only head barrier. Registry replacement, an accessor substituted for the global carrier or original capture method, rebind/unbind and loss inside the final head guard therefore refuse before irreversible shortening. Original SDK question admissions also snapshot the native binding before reservation/observers; a bound owner cannot authenticate another same-runtime registration's admission. Admission failure cannot replay/roll back an already admitted SDK head, and native owner refusal is still not SDK-question completion, source disposition or actual-I/O drain. Fifty-four Classic/Threaded regressions cover before/provider/final-data loss, same-runtime rebind/unbind, replacement/clear/shutdown, copied registry/callable accessors without getter invocation, positive bound peer/admission matching, pure embedding, fake tokens/secret-reader substitution, original-capture reentry, legacy refusal and old-unbinder safety. Four exactly restored assertion-RED models distinguish peer binding identity, native final-use history, descriptor-only currentness and admission binding. Native client/Bridge/Bus/store evidence uses the new bound helper for four genuine old/fresh scalar question groups and positive co-head replacements, and retention checks keep those groups while collecting their drained physical publication. Evidence is under `/home/llb/pttmp/binding-contract-*`; local validation and self-review are not independent/platform/live acceptance. No public `/delivery` export, new timer/registry/storage family, function IPC, model waiter, source ACK, receiver readiness or root/default activation is added. Registry provenance alone does not authenticate session/transport/bot/physical receiver; preserve the original-provider/Bridge prerequisites below, existing lifecycle owners, native final use, pure-kernel embedding and actual drain. Autonomous local preparation does not imply live/release consent. ###### Original Question Provider Guard (Private Kernel) The production root now constructs `BusApi.createTelegramQuestionAuthorityCapture` before the Button Store and passes its pinned factory to Delivery construction. It joins the existing session/profile-token/operator/role/target guard with the original bot reader and a native acknowledged follower-registration lifetime; same-generation/equal-field registration replacement, provider substitution, bot loss and caught reentry cannot renew an old scope. The native registration owner shares its existing lifetime with Artifact capture without granting file or publication rights. The Bus-aware API now captures its original direct runtime/methods and this provider before coordination; role/provider substitution and observed loss are sticky. Delivery's constructor-only `coordinateQuestionsWhenAuthorized` pins that generation's original guard and enables the existing head/tail policy only with positive original direct authority. Unavailable provenance keeps independent SDK UI; genuine availability gain or original-provider loss reconciles to a new runtime, never renews old questions. Root supplies native registry-bound SDK capture to Button Store and forwards original SDK admissions. Independent runtime renewal remains on the existing registration, leader-target mutation, Locks availability and explicit transport-change ports. Leader target moves notify after committing the new identity; unchanged display metadata does not reset views. This preserves managed `/new` and `/compact` confirmations after routing rebind without weakening their original-source or recipient guards. Remote physical-publication provenance, general app parent composition and private Input readiness remain separate. Registry identity is now joined by an optional private kernel `captureQuestionAuthority` factory. Only literal `questionHeadTail: true` reads/validates that port. The factory value is pinned at construction; the original guard is captured once at the first eligible SDK question/owner authority attempt, before later authority/target/disposal callbacks. All native scopes and Confirm/Choice/Text questions in that runtime share this one nonrenewing provider history. Failed/unavailable capture, guard failure, own guard reentry or non-undefined/async results hold the provider permanently until a genuinely new runtime; changing the configured factory or restoring equal fields cannot choose a replacement guard. Refused Promise values receive only the existing inert rejection observer, never an await or an effect grant. Omission preserves pure-kernel/default behavior without reading an unwired factory getter. The runtime owns only capture/checking/lost flags and the original callable, not another head/session registry or timer. Its guard runs around the existing SDK metadata checks. Native scope/peer availability and cohort final use read shared lost history after the synchronous head-data barrier, without calling providers again. Every otherwise-matching peer therefore sees an original provider loss observed by a different scope in the same runtime; independent per-peer guard callbacks cannot recursively reconstruct authority. Native active/binding/observed-loss flags are rechecked after the last guard callback itself, before outward authority can escape. This remains observation-based authority, not a poller or a claim to detect raw unobserved changes in arbitrary external state. SDK Confirm/Choice/Text capture/check the same provider before admission/publication and during existing question observation. Acceptance rechecks it after external answer-authority callbacks; terminal `assertCurrent` retains the original provider rather than reacquiring current session/transport permission. Text source `assertOriginalBinding` remains terminal-safe but also refuses observed original-provider loss. Cleanup of a logically completed question fences the provider on its existing target lane before edit issuance, including cleanup queued behind actual work. A terminal result/refused shortening is not source disposition or actual-I/O completion: issued target work remains pending through logical loss/shutdown until drain. Task View, Artifact and Attachment keep their own owners and are excluded, including after a question-provider refusal. Native Bus selection/session/transport captures supply the concrete local provider witnesses: original session, profile/token stamp, operator, direct/follower role, leader epoch/follower generation/registration and exact Classic/Thread target. They are used as trusted in-process constructor ports, not DTO authority or function IPC. Eighty-five property regressions cover direct/follower native history before/inside metadata/at the final observed-loss barrier, one-shot/uncertain capture, native peer history, acceptance and terminal/source authority, getter/default compatibility, last-guard shutdown/rebind, queued cleanup, excluded owners and issued drain. The original compiled implementation fails all 85 selected assertions; a native original-provider epoch-loss case also fails with a genuine missing-refusal assertion. Seven exactly restored assertion-RED models distinguish original invocation, nonrenewal, post-metadata checks, final shared history, post-answer callback checks, last native flags and cleanup authority. Twenty-four source/actual-dist real client/Bridge/Bus/store cases use the provider plus native registry-bound owners across first-send/known-parent co-head replacement and scalar answers, including observed original-provider loss. Source/actual-dist cases are exact; four real retained producer groups still do not retain their drained physical publication/cache. Evidence is under `/home/llb/pttmp/provider-contract-*`. These controlled native guards do not certify a remote original receiver/bot or independent/live/platform acceptance. The [private Bridge/lifecycle checkpoint](#question-policy-bridge-and-lifecycle-private) below now forwards these ports through their existing owners. Remaining app/remote composition, receiver IPC, Text/v5 source disposition, source ACK and publication remain separate gates; neither local checkpoint creates another registry/timer/receipt or implies live authority. ###### Question Policy Bridge and Lifecycle (Private) `TelegramBridgeDeliveryRuntimeDeps` now accepts the kernel's private literal `questionHeadTail`, synchronous `onQuestionAdmission` and original `captureQuestionAuthority` ports. One Delivery-local helper validates/pins their values at constructor entry, before other dependency callbacks, and forwards observer/factory return values with the exact original option receiver. It does not await or suppress returned Promise values: the existing kernel owns inert observation and synchronous admission closure. Omitted policy does not inspect observer/provider getters; ordinary Bridge behavior, SDK lifetimes and pure-kernel embedding stay unchanged. A concrete Bridge opts in only with a genuinely available original provider. Missing factory installs a private refusing capture rather than falling back to the pure kernel's optional-provider behavior. Unavailable/async capture or guard, observed session/token/role/epoch/follower loss and native peer/final-use refusal remain one-shot and sticky inside the original runtime. Dynamic profile/operator/target output permission cannot replace that provider. There is no new owner facade: callers use the existing native binding helper at group admission and retain that scope, never a lifecycle/current-runtime proxy at ACK. The lifecycle constructor pins the same private options once. At each existing runtime generation it copies enumerable own values in original spread order, skipping those three private keys, then overlays pinned policy. Each ordinary descriptor and value is read sequentially from the original option receiver, so an earlier getter can still change a later ordinary dependency. This avoids re-reading private getters while preserving ordinary generation-specific reads, getter receiver/order and symbol/data-key spread behavior; cloning all descriptors first would change that contract. Existing stop/bind/shutdown/generation owners are reused; successor runtime can capture its own original guard, but spent old scope/application cannot shorten it. This adds no runtime/head/history registry, timer, executor, receipt or storage family. It does not claim the lifecycle facade becomes an aggregate drain across replaced runtimes; original issued runtime work retains its own existing lane/references until actual completion. Private opted-in Bridge publication also rechecks the supplied question authority after native send resolution and before recording local ownership. Before this local fence, core question observation could refuse the returned handle while Bridge had already recorded the physical message under a changed context. A late native ACK now remains unavailable without an ownership claim. Input's existing dedicated post-publication guard remains unchanged; omitted/default Bridge output is not widened. Logical failure still does not undo an issued Telegram message or certify source non-use. Sixty-two property regressions cover Bridge/lifecycle × Classic/Threaded native admissions and SDK head/tail expiry, equal output policy with original-provider loss, missing/unavailable/async providers, exact factory/observer receiver and getter pinning, synchronous admission closure/rejected observer values, generation replacement, old-scope/successor separation, Text readiness versus lifetime authority and in-flight ownership/drain. The initial sixty assertions fail against the previous compiled Bridge (the private opt-in was absent, not sixty released defects). Self-review found that descriptor cloning changed ordinary getter receivers/order; two added regressions fail against that intermediate compiled candidate while the prior sixty pass. Seven exactly restored assertion-RED models distinguish kernel forwarding, missing-provider refusal, admission forwarding, private getter pinning, ordinary spread semantics, post-native ownership and original factory receiver. The original-receiver model selects its eight positive admissions; its initial broad run waited for an intentionally unreachable I/O entry and timed out, which is not mutation credit. Twenty-eight source/actual-dist native cases now instantiate the SDK through the real Bridge adapter, alongside client/Bus/store/known-parent co-head edits/scalar handlers. They cover four late-ACK provider-loss cases plus original/fresh scope loss/ordinary scalar controls, with a distinct physical SDK message and exactly one provider capture per runtime. Four retained real old/fresh producer groups still do not retain the drained publication/cache. Evidence is under `/home/llb/pttmp/bridge-policy-*`; mocked native Telegram visibility and in-process providers are not authenticated remote receiver or independent/live/platform acceptance. Root now connects conditional direct SDK policy/admission/provider and native store owner capture, and assistant/bound-app planners adopt 24-hour defaults. Source/actual-compiled Classic/Threaded production-root cases exercise actual tool planning, native HTTP ACKs, SDK-to-agent shortening and a genuine Delivery replacement during pending publication: the ACK and later SDK admission cannot borrow the successor binding. Original app capture now joins direct first-send questions; the same root family admits real durable Telegram input, starts its native Pi dispatch and displays actual `telegram_bind` initialization. Both new app groups receive a common SDK tail; SDK-only replacement preserves a still-owned answer, and a native state revision without a replacement view retires the other unspent group. Independent source regressions cover absent/ended SDK membership, original app FS/events, forged bindings and regenerated collector rows. Root now opts callback workers into actual exit plus original termination-call settlement. The same source/compiled root family delivers a real callback with SDK membership unavailable, captures its actual update fence once and holds result planning/publication after native exit until the retained termination ACK settles. New-send target capture preserves the original callback chat/Thread across later provider reads instead of falling into All; source binding regressions cover both legacy and drained paths. Root now also pins the original callback binding before provider callbacks and enables app-only successor lineage for bound actions. The same real source/compiled callback probes authenticate that original native read-only predecessor before result planning, including without SDK membership. Native tests preserve legitimate state-changing and legacy unbound execution and refuse an equal-field peer substituted by a provider. Root now joins qualified exact store dispatch/invocation and bounded read-only mixed-footer HTML/Rich feedback/edited-child facts. Fifty-two native Root cases cover independent, exact read-only HTML/Rich, pure-question, queued native I/O, deferred original editor, conditional SDK-tail and state-writing callbacks across source/compiled Classic/Threaded. The producer receives the actual one-use invocation; the edited child's original group then joins SDK shortening. Missing original qualification keeps legacy execution, while spent/refused native origins never fall back. Mutable DTO flags cannot classify state writes or grant read-only parent authority. The pure-question/queued/deferred and one-event SDK-tail policies now compose original owners without delaying result/`Done` on arbitrary editor work. Membership waits for actual editor settlement; authentic admission time supplies the unchanged tail ceiling. Root witnesses keep namespace loss and second admissions held. One retained original group is now composed for an explicit native Rich proposal authored by the actual trusted app worker from producer-owned input. The Root witness retains the original group/deadline, answers through its original selection and holds partial-group/SDK-loss histories. Bound-app edits now use the existing configured single-Markdown renderer instead of the generic HTML editor; harness menus remain HTML. No general retention/discovery API or arbitrary copied-control permission follows. Authenticated remote plain/native-app first sends and plain known-parent Text/Rich/keyboard-only markup edits now have the bounded original birth/publisher/carrier composition above. General/untracked/retained footer provenance, broader remote app-parent/edit/receiver guarantees, source disposition and independent/platform/live gates remain open. Do not substitute configured bot ID, visible controls, equal fields, a normalized follower result or the new forwarding for those proofs. ###### Outbound Question Policy (Private Factory) `createTelegramOutboundReplyPlanner()` now takes the same optional third literal `questionHeadTail: true` argument as the assistant button factory. It validates at constructor entry before rendering/registration dependencies and passes that captured primitive to the existing compiler. There is no per-call, declaration/body or public package option. Omission retains released Confirm/Choice one-hour normalization; opted-in omitted Confirm/Choice starts at 24 hours, while explicit 1..3,600,000ms limits and earlier owner/store cutoffs remain unchanged. Input/Attachment declaration defaults are not changed. This is a compiler prerequisite, not publication, membership, receiver readiness or root/default adoption. The combined planner continues extracting voice from original input and stripping delivery comments. Scalar, exact-N and wizard remain existing collectors with one original deadline; selection values such as `counter::increment` or `/stop` remain ordinary question/answer data. The existing compiler deliberately does not attach a Generative App method binding to structured selections. Only ordinary method controls retain the original app binding; this forwarding must not turn selections into method dispatch or invent an app-correlated SDK dialog. App owner/semantic validation remains with its producer. Thirty mirrored outbound properties cover HTML/Rich, released/private defaults, scalar/set/wizard completion without renewal, explicit bounds, invalid constructor values before dependency reads, captured policy across rendering callbacks, ignored untyped per-call activation, closed declaration fields, original method binding and voice preservation. Two actual Generative App tool regressions install/init a disposable managed app through `registerTelegramBindTool`, exercise its real planner with the native app binding and verify state remains unchanged when a method-looking value is merely displayed. Native source/actual-dist client/Bridge/Bus/store witnesses use the combined factory, start fresh co-heads at 24 hours, then demote them only through native SDK admission; original/fresh scope, publisher and late SDK ACK-loss fences remain intact. Retaining four completed real groups does not retain the drained publication/cache. The previous compiled factory yields 14 assertion failures and 18 preserved controls across 32 selected tests; a native compiled counterexample shows 1-hour rather than 24-hour fresh heads before SDK admission. Five exactly restored assertion-RED models distinguish forwarding, omission, constructor validation, ordinary method binding and refusal of per-call activation. The last model selects only the omitted-constructor/true-per-call case; its broad run also hit a native TypeError for invalid false policy, which is not credited. Evidence is under `/home/llb/pttmp/app-policy-*`. Source/compiled/controlled app execution does not constitute live UI or remote receiver acceptance. Root and Bindings constructors retain their existing two-argument calls, the public `/outbound` membrane is unchanged and no registry/timer/executor/entrypoint is added. The [native composition assessment](#composed-question-graph-local-assessment) below now joins actual app output, both planners, original SDK owner capture and Bridge lifecycle under session/transport authority. Pure co-head reciprocity is proved locally; known ordinary method siblings expose a separate held whole-roster boundary. General/untracked/retained footer provenance and original remote receiver remain separately held; do not infer them from a configured bot, field equality, normalized follower success, known locator or this flag. ###### Composed Question Graph (Local Assessment) A disposable native witness now joins the same existing owners used by root, without importing or editing the live extension: `registerTelegramBindTool` installs/initializes an actual managed app, its real callback binding enters the combined planner, the assistant planner uses the same store, and the store captures the existing native SDK binding helper at group admission. Session authority uses the real Lifecycle context store/generation and public Pi session-ID projection; transport authority uses the existing Queue stamp owner and original Bus selection capture. Private Bridge lifecycle forwards policy/provider/admission to its original runtime, and real client/Bus publication carries the final native Message ACK. The controlled HTTPS fixture is not a remote original-receiver certificate. Eighteen source and eighteen actual-dist Classic/Threaded cases are exactly equivalent. Four healthy pure-question app footers expose both original co-head facts together: their positive ACK demotes an earlier SDK question, and a later SDK admission or assistant ACK demotes both app questions from 24h to 1h without selecting a row winner. Actual app inspection confirms method-looking answer data did not execute a method. Six in-flight session-generation/token/lifecycle loss cases hold the native ACK and publication idle promise: original loss refuses the old scopes but cannot release issued work; after actual response/drain, callbacks refuse even if token fields are restored. Two post-ACK epoch cases separately observe original SDK scope and producer/publisher loss before restoration; both remain sticky. A displayed SDK View under unchanged output policy is not positive question membership: the session-generation-only case may return `displayed: true` while its controls remain unavailable. Those observations keep different owners distinct. `hasPendingTarget` includes logical questions as well as actual target work; owner refusal alone does not terminalize an earlier SDK question. The witness separately retains the publication idle promise through the blocked native response, then observes the earlier question through its exact refusing callback before asserting all old target work is clear. SDK lifetime-provider history and original agent publisher history are also distinct: observing one scope's loss cannot be relabeled as observation by an independent producer guard. The post-ACK witness actually exercises the original producer guard while epoch is lost; it does not infer semantic cancellation merely from SDK scope refusal. Six normal mixed app footers—two structured questions plus one ordinary bound-method control—remain held for shared membership. Their known native message/rows are visible, but current bounded multi-group admission explicitly requires every original record to belong to a question group. Therefore the footer does not shorten the earlier SDK question and neither later SDK nor assistant head can demote those unproved app facts. Two of those cases change the actual app revision while the native ACK is blocked: the ordinary binding is lost, SDK/question scopes remain valid, no method-looking selection is implicitly executed, and the mixed footer still cannot borrow the pure co-head proof. These are deliberate current holds, not released/default regressions or missing physical message IDs. One temporary one-line source shortcut removes the ordinary-record exclusion. In two Classic/Threaded native assertion-RED partitions it then wrongly expires the earlier SDK question after the actual ordinary app owner was lost before ACK. The exact source is hash-restored; no implementation is retained. Removing that filter is therefore not a safe completion strategy. Future known-ordinary support must capture the complete original physical callback roster, original app binding/callable/producer authority, relevant retirement facts and actual carrier before callbacks/I/O, and carry those facts through native SDK final use without a dependency getter after its data-only barrier. Never select a question-only prefix, ignore changed ordinary rows, renew origin/deadlines or acquire current app/SDK owners at ACK. Unknown/general/retained/foreign rows and remote receiver provenance remain separate. Evidence is under `/home/llb/pttmp/composed-question-*`, including 30 golden-pinned app worker loads over the real init/inspection and explicit test-owned revision-change calls. No model send, live runtime/Telegram change, new registry/timer/receipt/entrypoint, receiver IPC or root/default activation occurs. Root still omits bound-app private parent/dispatch composition. The [private native app-owner history](#original-app-callback-owner-history-private) below closes one necessary local prerequisite. The next authorized slice remains bounded known-ordinary whole-roster/native final-use composition, not simply removing the mixed exclusion. Keep general history and remote readiness held, and do not ask another routine local permission. Independent/platform/live/release and public Text/v5 source ACK gates remain open. ###### Original App Callback Owner History (Private) Known ordinary method siblings have an additional original authority: the Generative App journal/generation owner. Its existing callback guard performed synchronous file checks and retained sticky loss only inside its closure, so store row equality or an observer notification could not expose that history to a later native data-only barrier. `captureGenerativeAppCallbackOwner(binding)` now captures only the original native callback binding, not a current app/result lookup or a caller-shaped binding. This private prerequisite now supports the [bounded live native ordinary store path](#live-native-ordinary-question-roster-private), which supplies the [SDK authority phase](#original-roster-authority-before-native-data-barrier-private). Ordinary parent/terminal continuity, root/defaults and remote receiver readiness remain held. The existing `callbackOwnerProofs` WeakMap still owns result-to-binding association. Its values now use a frozen native binding class with the same `app`, `generation`, `revision`, `assertCurrent` surface. A secret constructor key and captured private-brand reader refuse DTO/copy/proxy/prototype/constructor/static-reader substitution without invoking foreign getters/guards. No second registry, timer, watcher, persistence family or executor is added. The private frozen owner capsule carries the exact original filesystem guard plus `assertObservedCurrent()`, a callback-free, filesystem-free read of that same native cell's observed loss/reentry flags. Equal-field peers cannot lend a fresh cell to a lost original; repeated successful capture returns the same capsule, while observed loss never reacquires/revives it. `assertCurrent()` retains the original journal file/device/inode/size and generation checks; it now poisons caught own reentry. `assertObservedCurrent()` deliberately does not certify fresh filesystem state, bytes/digest, cross-process writer exclusion, callback eligibility or positive publication. Raw unobserved file changes can leave history available until the original filesystem guard observes them; once observed, exact file/field restoration cannot revive that cell. The private SDK final-use phase below now supports that original native filesystem authority after potentially invalidating provider callbacks, before the successful data-only head barrier. Its future store caller must capture the original native scopes/owners first and supply original observed history/rows without another dependency getter or file check after the barrier. A wrapper precheck or row notification alone is insufficient. Native provider history is not source-use/disposition, drain or original remote receiver authority. Sixteen mirrored properties cover journal append/same-byte inode replacement/missing journal, generation change/missing generation, exact restoration from both public-binding and captured-owner guards, data-only zero-I/O history, failed capture without renewal, real revision/output-only behavior, equal-field independent native cells, copy/proxy/prototype/getter/secret-key/reader substitution and caught guard/history reentry. The previous compiled native public binding guard accepts a caught recursive filesystem observation; an actual app witness fails the expected-refusal assertion there and passes after the fix. The new private export is absent in that build, so missing import/type errors are not baseline evidence. Seven exactly restored assertion-RED models distinguish history, no filesystem inside history, nonrenewal, captured reader, constructor key, guard reentry and reader key. A native owner/GC probe retains the captured capsule while the invocation result and callback binding collect, verifies the original guard before loss, and retains unavailable observed history after exact restoration. The existing 18-case real app/planner/Bridge graph still preserves pure reciprocity and mixed holds. Source/actual-dist native/worker/retention evidence is under `/home/llb/pttmp/ordinary-roster-owner-*`; all app data are disposable fixtures. No new public package API, Root/SDK cohort/store adoption, live probe, receiver IPC, source ACK or deployment is implied. ###### Original Roster Authority Before Native Data Barrier (Private) The SDK's existing `captureTail(cohort)` now optionally pins `assertAuthority` alongside the original scopes and data-only `assertCurrent`. This narrow private phase is for original native owner checks, such as the app capsule's filesystem guard; it is not a general executor, publication receipt, root option or public SDK API. Its caller must not introduce SDK/provider callbacks or effects there. Kernel omission preserves the existing path. No module, registry, timer, watcher, waiter, peer index, app dependency or root/default connection is added. Question candidates and clock are still captured before any cohort getter. The original authority function is read/validated once, not renewed at application. After the original runtime/provider checks, the native cohort checks peer history, runs original authority synchronously under the existing own-reentry guard, rechecks peer/native history before admitting the data guard, then executes the original data-only guard. After that successful barrier, only native peer/lost/provider/active flags precede irreversible SDK shortening. A thrown/non-undefined/async authority refuses without a data prefix, await or retry; rejected returns are only inertly observed. Capture/application are each spent before callbacks. Snapshot entries never include SDK questions created by an options/authority callback. The phase does not authenticate arbitrary host callbacks: only an original native owner may supply it, and its data guard remains a trusted private producer contract. The native app-plus-SDK witness mutates journal size, generation or same-byte inode from the last SDK provider callback, without a store notification. The original app wrapper guard and data-only history both passed beforehand. Without this phase, the compiled SDK accepts application despite that loss; with it, original native filesystem authority observes sticky loss before the data barrier, retaining the old SDK question. Exact restoration cannot revive app history. Native caught filesystem-guard reentry also refuses. Classic/Threaded healthy cases shorten at the original capture clock and perform no filesystem calls after the data barrier. These are actual native app/kernel checks, not yet store roster membership. The associated whole-roster assessment found a separate safety hole: co-head batches already refused ordinary/unknown rows, but the sole-question path could expose a question-only prefix from such a footer. A real managed-app/native Bridge graph with one Confirm plus an ordinary method and app revision loss before ACK wrongly expired the previous SDK question. The store now computes one complete unique known-question callback-roster predicate for both sole membership and co-head batches. Ordinary callbacks, unknown callbacks and duplicate carriers stay held, even when all question members/SDK scopes are known. First descriptors remain spent; a failed mixed attempt exposes no weak positive fact and no later SDK/agent tail membership. Pure sole-question/co-head controls remain unchanged. This descriptor-roster refusal is not native ordinary adoption or completed actual I/O. The subsequent [bounded sole/co-head closure](#sole-question-native-carrier-and-final-use-private) below replaces the old singleton shortcut with the same complete native body/carrier/data-guard path. Fifty mirrored properties cover 34 SDK phase boundaries and 16 sole-roster cases (Classic/Threaded × HTML/Rich × pure/ordinary/unknown/duplicate). The prior compiled phase runs 34 assertion-RED cases because it lacks the private feature; that is not 34 released defects. Sole-roster pre-fix controls are 4 passing pure cases plus 12 assertion failures. Native phase source/dist witnesses are 18 each, and actual one-question managed-app/Bridge cases add 4 each. Ten exactly restored assertion-RED models distinguish phase omission/order/renewal/non-void return, pre-data peer checks, own reentry, data veto, fixed snapshots and complete sole/unknown callback rosters. Mutable cohort/scope arrays collect while original phase/data guards remain retained until the pending application is released; original owners retain neither after drain. Evidence is under `/home/llb/pttmp/ordinary-final-authority-*`. The subsequently implemented [live native ordinary subset](#live-native-ordinary-question-roster-private) captures complete original rows, original native app capsules and SDK scopes at birth and retains original selection/publisher observed-loss history. The bounded sole/co-head closure now exposes that history through the existing guard itself, not a new registry; an app capsule or row equality cannot substitute for it. Supply original native app authority before the SDK data barrier and original history/row checks at final use and later SDK-to-agent tails. The later private live-native first-send subset is separately proved below; ordinary parent/edit/terminal/foreign/untracked history remains held. Root/default/readiness, independent/live/platform acceptance and remote receiver/source disposition remain separate gates. ###### Sole Question Native Carrier And Final Use (Private) The separate singleton membership/edit path has been removed. One otherwise eligible question now uses the same original descriptor/group/SDK-scope capture, closed body/locator allowlist, complete unique callback roster, native pre-I/O scope checks, actual prepared callback-carrier/serializer seals and `captureTail(cohort)` data barrier as multiple co-heads. Supported native body fields/rendering remain bounded; first sends with alternate locators, unknown fields or simultaneous text/Rich carriers stay held. Known-parent edits require the existing complete parent rows/scopes/preimage, edited ACK and expected superseded facts; implicit retained Rich controls, terminal/untracked/foreign/ordinary parents remain held. Earlier deadlines, question-local known expiry, no retry/reselection and actual I/O retention are unchanged. No root/default or ordinary adoption is activated. The existing `authorities` WeakMap still owns original selection/session/transport guards. Its same callable guard now has a frozen own-data `assertObservedCurrent()` function reading the same sticky `lost` flag. Capture, unavailable/lost history and callable/group identity are not renewed, and no second registry, watcher, timer or exported authority facade is created. The data reader calls no captured provider, filesystem, transport or app function. It proves observed history, not fresh unobserved external state; original currentness checks and the original native SDK provider remain separate. Existing valid nested producer callbacks are preserved rather than introducing another guard-wide reentry policy. At SDK final use the original publication guard's history and every original head producer's history run after row/deadline/retirement checks, inside the trusted data-only guard, before native SDK shortening. Thus a healthy publisher cannot lend history to an independently lost sibling, nor can a fresh producer lend history to a lost first physical publisher after a semantic replacement. The SDK-to-agent tail predicate also checks that candidate's original publication and producer histories after local row/clock reads. Already authorized earlier cuts are not rolled back by a later loss observation. Original physical SDK ancestry remains pinned across edits. When a first publication's physical token is exactly its candidate owner's native scope, the newer head's existing native peer check has already proved that token: the tail consumer skips a redundant call back into the candidate's own active SDK guard. Different first-physical ancestor tokens are still checked through the original native owner. This preserves valid callback-created newer heads without weakening SDK own-reentry poisoning or adopting equal-field/copy scopes. The ACK clock/candidate snapshot remains before ACK-time callbacks; pre-I/O callbacks are not mislabelled as post-ACK observations. Twenty-six mirrored properties cover actual carrier reference/code/array/serializer/inherited/caller/Rich behavior, final native clear/consume/expiry, independent producer loss with unchanged rows, SDK-to-agent last-callback history, edited first-publisher loss and unsupported bodies. Prior compiled code produces 19 assertion failures and 7 controls. Eight exactly restored assertion-RED models distinguish singleton routing, carrier sealing, native cohort data use, original publisher versus semantic history, final candidate history, closed body eligibility and redundant self-guard recursion. Four prior fixture families are corrected to actual single text-or-Rich bodies and ACK-time (not newly observed pre-I/O) triggers; the independent native-admission snapshot witness is retained unchanged. An intermediate redundant self-scope call incorrectly poisoned valid active candidates; the exact-token redundancy removal fixes it. Thirty-two source/actual-dist native Classic/Threaded cases compose real Lifecycle session generation, Pi identity projection, Queue stamps, Bus selection capture, original native registry binding, private Bridge provider/admission and native client/Bus ACK. They verify carrier seals at the recovery/native JSON boundary, original one-question positive cuts, last-provider clear/consume and independently observed publisher/sibling loss, unknown bodies and an expiry-held actual native ACK. No provider or producer callback occurs after a successful native data barrier and before SDK shortening. Three prior compiled native partitions genuinely RED on codec substitution and last-provider publisher/semantic-sibling loss. A native bound GC probe retains one original group plus two replacement groups, observes real scalar completion and reciprocal SDK demotion, and collects all weak publication/cache facts after actual drain. Artifacts are under `/home/llb/pttmp/sole-final-use-*`; these controlled local probes do not authenticate a remote receiver or replace independent/live/platform acceptance. ###### Live Native Ordinary Question Roster (Private) The existing store now has one optional constructor-only `captureOrdinaryBindingOwner(binding)` port, using the owning Generative App capsule contract through a type-only import. It is read/pinned only when SDK lifetime capture is composed; SDK omission does not inspect an unrelated app getter. Non-function configuration refuses. Factories retain their original function/receiver through `Reflect.apply`, not a mutable function `.call` member. There is no per-declaration/per-call option, public entrypoint, Root connection, registry, watcher, timer, executor, receipt or model waiter. Before clock/cleanup/binding/retirement callbacks in ordinary row admission, the store captures that row's original native SDK scope and original producer guard, then the original native app capsule/functions. Native SDK capture precedes app/producer callbacks; later owner/registry lookup is never an ACK repair. Missing/throwing/foreign/async capture cannot gain membership later. Refused async app results are only inertly observed. Ordinary rendering/method binding remains independent of coordinated membership. Known native bindings are frozen own-data objects whose original current function matches the captured capsule; the owning native reader rejects DTO/copy/proxy bindings. Structured selections never acquire an app binding or method dispatch. Caller-shaped private `ordinary` fields are overwritten, not imported as store facts. Each eligible ordinary row retains its original binding, SDK owner, native app current/history and SDK data-history functions in existing Stored metadata. A successful supported first footer fixes complete unique callback rows plus those originals in its existing publication. Only otherwise-live native ordinary siblings can extend the complete question roster; ordinary-only, repeated/retained, missing/foreign/copy and untracked/duplicate histories remain held. The later [live known-parent path](#live-native-ordinary-known-parent-edits-private) extends edits only with original complete parent proof; ordinary semantic retirement remains held. All original ordinary SDK scopes must natively match question heads' exact runtime/profile/operator/target/binding. A positive native ACK exposes coequal question facts and one original earlier-question snapshot; ordinary methods do not become question heads. Attempts remain spent before callbacks, with no prefix, winner, replay or recapture. At SDK final use, the existing pinned `assertAuthority` phase checks original native app filesystem authority after SDK provider callbacks and before the data-only guard. The guard then checks original rows, binding/callable identity, liveness, producer/app/SDK histories and every question SDK/publisher history, with no dependency getter or filesystem call after success before shortening. For SDK-to-agent and agent-to-agent tails, the same original publication ordinary scopes/producer guards are checked before native app authority and final local histories. A new mixed head must revalidate its own app authority after SDK shortening and later peer callbacks, before an earlier agent cut; an earlier successful cut is not permission for the next one. Known question expiry remains local, ordinary retirement is not silently adopted, uncertain original history refuses the whole remaining footer, and actual issued I/O retains capacity/references until drain. The native SDK owner adds optional private `assertObservedCurrent()`, reusing its existing native peer-history check: active/runtime, sticky scope/provider/observation loss and original native binding/callable history, with no provider getter or fresh target read. Loss is sticky for that original scope. This supplies the previously missing callback-free SDK check after native app I/O before an agent deadline cut. Older/foreign owners without the port do not gain ordinary membership; pure question embedding/omitted defaults remain unchanged. Native binding currentness already owns callable descriptor checking: a surviving duplicate-check model led to removing the redundant new descriptor read rather than claiming mutation credit. Forty-three mirrored properties cover Classic/Threaded × HTML/Rich × sole/co-head healthy reciprocity, no method-looking answer dispatch, original constructor functions/receiver/property and call-slot mutation, private field injection, native SDK data-only loss, app revision/generation/restoration, SDK loss during native app I/O, final-provider raw app/row loss, changed-head app authority before an earlier-agent cut and absent/foreign/copied/proxy/failed/async capture. Prior compiled code has 34 assertion-RED cases and 9 controls because the private feature is absent, not 34 released defects. Eleven final assertion-RED models were exactly restored; one redundant SDK callable-check model survived and is uncredited. Actual managed-app/tool/planner/Lifecycle/Queue/Bus/registry/Bridge/native-client composition is now 20 source/dist cases, including 4 healthy mixed sole/co-head successor directions, original issued-loss/drain, before-ACK app revision loss and raw app loss from the last SDK provider. The four-case sole mixed graph also supports healthy native membership but retains actual revision-loss holds. SDK original-provider capture remains one-shot; there is no method dispatch/model send. A store-isolating native bound GC probe retains two native question groups while publication, invocation result and binding collect after reciprocal SDK demotion/actual drain. A separate diagnostic with retained compiler-produced groups kept the binding through their existing compiler closure; this is qualified, not counted as a new-store leak or falsely claimed collected. No unrelated compiler lifetime rewrite is included. The first full gate exposed a new test-isolation defect, not an assumed production regression: syncing named Node built-ins while timer mocking was active left named `setTimeout` bound to the disposed mock. A real default-runtime dispatch and an added named/global timer identity assertion reproduced it; explicitly resetting mocked timers before re-sync fixes both, with no timeout relaxation/production edit. Artifacts live under `/home/llb/pttmp/ordinary-live-*`. This is private local first-send support, not production readiness. Ordinary consumption/expiry/supersession, native known-parent/replacement or app-revision continuity needs separate original retirement/physical-ancestry proof. Missing rows, observed revision fields or visible controls do not supply that proof. General/foreign/retained history, remote receiver/source disposition, Root/default/public Text/v5 activation, independent review and live/platform acceptance remain gated. ###### Native Ordinary Retirement And Parent Transition (Assessed, Held) A 16-case source/actual-dist assessment now runs the real callback handler and Bindings method invoker, not a direct mutation standing in for a click. It composes managed app/tool/planner/store, Lifecycle/Pi session identity, Queue stamps, Bus selection capture, native Delivery registry/Bridge scopes and native API/Bus ACKs in Classic and Threaded modes. Cases are read-only/state-changing methods with edit/new output, an actual pending worker aborted through its original execution signal, method failure, pre-effect execution refusal and an unconsumed read-only known-parent edit. HTTP/HTTPS and model fallback are refused; apps and signals are test-owned. This is local evidence, not receiver authentication, independent review or live acceptance. The ownership order is concrete. `store.resolve()` spends a callback before the handler delegates to Bindings; consumption can precede a refused effect, failed method or unsettled worker. `removeAction()` marks feedback and schedules publication cleanup; its `consumed` string is not a native method-disposition result. The existing publication work set retains actual cleanup/edit I/O, while Generative Apps' per-app invocation queue and worker/abort owner retain actual method work. In the pending-worker case, native keyboard cleanup ACKs and `waitForPublicationIdle()` resolves while the real bound-method promise is still pending. Thus publication idle is not method drain, and neither idle nor consumed alone proves completed use/non-use. This does not prove all finite retirement must block unrelated question cuts forever; it proves a completion claim cannot be inferred from those observations. A state write appends `states.jsonl`, reports the next revision and publishes `state.json` before the invocation records its new native result binding. Original app currentness then fails; a read-only result can instead have matching app/generation/revision and both current native guards, but distinct binding objects/capsules and independent histories. At that assessment, `callbackOwnerProofs` authenticated result-to-binding ownership, not an original-row-to-effect-to-successor transition; the later private app lineage below still does not supply a store-row disposition. Bindings carries the original callback guard/expected generation/revision into invocation, then plans from the new native binding; ordinary observer fields and the result are not an authenticated retirement of the old store row. No replacement lookup or field comparison can supply that missing relation. At the assessment checkpoint, behavior was deliberately bounded. All six initial native question/ordinary scopes are original and the first-send cohort positively cuts an earlier SDK head. A state-changing or read-only callback's fresh **new-message** footer can positively cut the SDK challenge after its actual native ACK; its new questions later tail normally. The old consumed/uncertain footer is not promoted by that success. An **edit** still has no positive mixed-parent membership: its new question rows may display and supersede old rows, but neither a current new app binding nor a native edit ACK alone makes them SDK heads. The unconsumed read-only edit confirms this is also held when the old app guard remains current, so the next live-parent slice is separable from business retirement. Two counterfactual private models were exactly restored and genuinely assertion-RED in both Classic and Threaded partitions. Forgetting retired ordinary app/history checks lets a SDK admission shorten both original questions while the state-changing method's replacement ACK is held and the original app owner is unavailable. Merely accepting live ordinary parent rows/fresh edit rows, without adding original ordinary parent SDK scopes to final-use proof, permits an original scope to become sticky-unavailable from a native SDK metadata callback during cohort capture, yet demotes the SDK challenge. Original question-parent scopes, fresh native scopes and both app guards remain current in that second witness. These are failures of proposed shortcuts, not defects in the retained refusing implementation. The latter witness concerns complete original parent authority at the transition's final SDK use; it does not require every superseded semantic scope to remain current forever. The subsequently implemented boundary below is live, **unconsumed** native ordinary known-parent replacement only. Reuse captured old/new rows, app capsules, SDK scopes/data-history functions, the existing publication/preimage/ACK owner and SDK authority-before-data phase. Pin the whole old ordinary SDK roster alongside question/first-physical scopes before callbacks, validate original and fresh app authority in the native phase, retain expected native supersession rather than row absence, and close the corresponding data-only checks after app I/O before SDK and agent cuts. Persist the original physical publisher/SDK ancestry and its available native data history without adopting a later peer. Do not add a registry, generic receipt/executor, new package API or Root wiring. Consumed/expired/failed/changed-generation/state-changing retirement needs a separate positive original producer/disposition boundary; the assessment does not authorize it. Artifacts are under `/home/llb/pttmp/ordinary-parent-assessment-*`. No production source/test/default changes are retained by this assessment, and the preceding 10,989-test full gate applies by exact code/test/dist/bundle hash, not by claiming a new full run. Root/default/live/v5/public Text/receiver/source-ACK gates remain unchanged. ###### Live Native Ordinary Known-Parent Edits (Private) The existing bounded known-parent owner now accepts a complete live native ordinary parent roster as well as complete questions. This extends the private constructor-composed path, not the public API or defaults. An edit pins the original publication, full parent keyboard/preimage, original ordinary records/capsules/SDK scopes and original question/physical scopes before callbacks; every new descriptor is still spent before I/O. Consumed, expired, owner-lost, foreign/untracked/incomplete parents and unsupported body/carrier histories remain held. Actual matching native `"edited"` ACK, unchanged original parent/preimage, complete fresh rows and expected native `superseded` retirement are required; a boolean/legacy result or row absence cannot authorize the transition. Original and fresh ordinary SDK scopes join the same native `captureTail` vector. Original and fresh app guards run in its authority-before-data phase; current rows, exact expected parent supersession, original producer/app/SDK data histories and question/physical SDK histories follow without provider/filesystem callbacks after the successful data barrier. The same original app and data facts are rechecked after SDK shortening before an older agent cut. A different current native app binding, or an equal-field read-only result binding, cannot lend its guard to the original parent. Native first-send, pure-to-mixed, mixed-to-pure and repeated live-parent edits use the common carrier/ACK path, not a parallel executor. Each original physical SDK scope now carries its birth-captured data-history function in the existing question lifetime. All co-heads share the history of that exact first physical scope; replacements copy it, never a fresh peer's history. This closes SDK-to-agent physical-scope loss observed during later native app I/O after the last SDK callback. An absent original history cannot be repaired by a later native owner; pure omitted embedding keeps its previous behavior. A synchronous `ordinaryParent` snapshot in the existing publication retains original rows/question histories only while the native mixed-parent cohort is being qualified. Reentrant newer agent publications must see those original data histories and native app checks as well as fresh rows. It is removed in `finally`, not retained as an edit chain or a new registry. If mixed-parent qualification fails after the ACK, fresh weak membership facts are withdrawn without rollback, retry, semantic result reversal or undoing an earlier authorized cut. Otherwise a later SDK admission could see only fresh healthy rows and forget an unavailable parent. Successfully superseded semantic scopes need not accumulate forever; first-physical publisher/SDK ancestry remains pinned. Thirty-two mirrored properties cover Classic/Threaded × HTML/Rich × sole/co-head healthy reciprocity; complete old/new topology, duplicate/partial/foreign rows, consumed/deadline/revision/unknown ACK holds, original question/ordinary SDK loss in final metadata or native app I/O, old versus fresh app authority, SDK-to-agent physical history, repeated edits, reentrant agent cuts, post-SDK agent history, pure/mixed transitions and actual pending edit drain. Nine exactly restored assertion-RED models distinguish eligibility, complete parent, original app authority, post-I/O parent SDK history, physical history/pinning, failed weak facts, native ACK and reentrant data qualification. Prior compiled code has 17 assertion-RED cases and 15 controls because the private feature is absent, not 17 released bugs. Two actual compiled Classic/Threaded healthy native partitions also fail before this implementation. Twenty source/dist native cases extend the preceding real Bindings/callback/worker/Lifecycle/Queue/Bus/registry/Bridge/client graph. Healthy unconsumed read-only edits positively cut the SDK challenge and later become tails; original SDK metadata loss and later original physical scope loss hold. Real consumed/state-changing/failure/aborted callback cases retain the previous holds, while their independent fresh-message footer remains eligible. A native bound GC probe retains six real question groups across two replacements, then collects publication, native invocation and binding after actual drain and reciprocal SDK demotion. Deterministic native/worker/GC and self-review evidence is not independent or live acceptance. Artifacts are under `/home/llb/pttmp/ordinary-parent-live-*`. Remaining ordinary semantic retirement beyond the unused-deadline subset below needs its own positive original producer/disposition proof. No method-success receipt, state-changing continuity, cold/foreign history, remote receiver/source disposition, Root/default/public Text/v5 activation, live reload or release follows. ###### Native Ordinary Unused Deadline Retirement (Private) The store now preserves already positively published question heads when a complete original ordinary row reaches its own native **unused** deadline. This is SDK-to-agent and agent-to-agent tail continuity, not a new head, an expired-parent edit or a method-result successor relation. Only native `cleanup()` can record the exact original callback key, ordinary lifetime and publication while that row is still indexed and belongs to the original complete published ordinary roster, before removal and retirement callbacks. A row handed to a handler was already spent and cannot acquire this fact, even if its worker later aborts, fails or never starts. Caller-shaped private metadata is discarded at registration. Clock observation, a `deadline`/`consumed` string, row absence and an ACK cannot create or renew this record. Once issued, clock restoration cannot resurrect the row. Original app filesystem authority and original producer/app/SDK data histories still run at final use, together with first-physical publisher/SDK ancestry. Known unused expiry does not forgive observed loss, app-state/generation change, incomplete/foreign history or uncertain cleanup. Unpublished/early expiry cannot create first-send membership. Live known-parent edits continue requiring unretired ordinary parents and exact supersession; the unused fact is never a substitute for that transition. Native disposal of one row proves only that this store did not hand that row to an effect handler, not global app inactivity, remote source disposition or completion of another invocation. Issued cleanup and edits keep their existing publication work/lanes/references until actual drain; a logical tail cut can occur while that work is pending, without an ACK wait inside admission. Twenty-three properties cover Classic/Threaded, HTML/Rich and sole/co-head continuity, agent-to-agent tails, clock-only refusal versus positive native expiry, sticky non-use, consumed/clear/app/SDK/physical loss, first-send and expired-parent refusal, late SDK history loss during app I/O, pending cleanup and unknown cleanup failure. Five exactly restored assertion-RED models distinguish the native issuer, clock/retirement shortcuts and post-expiry app/SDK authority. Sixteen source/actual-dist native callback/Bindings/worker/Lifecycle/Queue/Bus/registry/Bridge cases extend the assessment with initial ordinary deadlines: unused native rows preserve old heads while a replacement edit is actually pending; consumed/failed/aborted/state-changing paths stay held. Separate fresh-message heads remain independently eligible. Native GC retains six real question groups over two edits and collects the publication/result/binding after unused expiry, reciprocal SDK demotion and actual drain. Artifacts: `/home/llb/pttmp/ordinary-deadline-nonuse-*`. These are deterministic local proofs, not independent, remote-receiver, platform or operator-live acceptance. Root/default/public Text/v5/source ACK/reload/release remain gated. ###### Native Returned-Worker Drain (Assessed, Held) The consumed read-only callback boundary needs actual-work ownership before any positive completion/successor certificate; the private implementation below now supplies that prerequisite. Released/default `executeGenerativeAppWorker()` still handles normal success and worker-reported failure by settling its result promise, then discarding `worker.terminate()`'s promise. The per-app `invocationQueues` entry follows the enclosing invocation result, not that termination. Abort/timeout instead already use `terminateAndFinish()` and await termination. This is a newly separated producer-work boundary, not another inventory of original app capsules or SDK phases, and no runtime/default change is retained by this assessment. Eight source/actual-dist managed-app cases hold only the original native `Worker.terminate()` call. They observe the actual worker thread still live before release, then call the captured native method and verify its real exit afterward. Read-only edit/new and state-changing results, as well as native method failure, settle before that drain; abort/timeout stay pending. A second same-app read-only worker can run before the first worker exits, demonstrating that the existing invocation lane has already advanced. Read-only native bindings can have equal generation/revision and both original/current app filesystem guards while remaining distinct objects. The original execution source may also become unavailable after a result is returned with both app guards still current. Neither equal fields nor app currentness supplies source completion or termination ownership. Four additional Classic/Threaded × edit/new cases exercise the real callback → Bindings → managed worker → planner → Lifecycle/Pi/Queue/Bus/registry/Bridge/native client graph. After the method result and final Telegram ACK, the callback answers `Done` and publication idle resolves while that worker is still live. Original consumed-footer membership stays held; an independent fresh-message footer remains eligible under its own existing proof. The same four native partitions are assertion-RED under the counterfactual interpretation “completed native callback/result plus publication idle means worker drain.” These are explicit evidence assertions, **not runtime mutations**, and receive no mutation credit. All held workers are released and their native exit is verified; no production worker/process or runtime data is touched. The private owner below now retains actual callback-worker termination work, including success/failure, original abort/deadline/authority loss and uncertain termination, while preserving released/default behavior. Do not add a worker registry, timer family or generic receipt/executor. That assessment did not activate Root policy; the authorized composition below now connects the existing owner. A semantic result can be distinct from actual drain, but cannot silently release its actual-work lane/references. Only after that owner exists should a bounded original producer/store disposition and exact successor relation admit a consumed read-only transition. Method return, `Done`, a native result binding, publication idle and matched fields remain insufficient on their own. Artifacts: `/home/llb/pttmp/ordinary-worker-drain-*`. This docs-only checkpoint reuses the previous full 11,044-test gate by unchanged runtime/test/dist/bundle evidence; it does not claim a new full run or independent/live/platform acceptance. Root/default/v5/receiver/source ACK/public Text/reload/release stay held. ###### Private Callback-Worker Drain Owner (Root Callbacks) Private `invokeGenerativeApp({ callbackWorkerDrain: true })` and the same constructor-only Bindings invoker option join actual worker exit with settlement of the original native termination call. Both are necessary, in either order: a promise ACK without exit, exit with an outstanding call, or a rejected/thrown termination without known exit cannot release the existing per-app invocation/transition-lock owner. Success and failure retain their original pending result/error until both observations; unknown termination remains held until real exit and then rejects, including falsy rejection causes. The same worker record owns the pending state, original termination callable/receiver, method timer, abort listener and settlement; no new registry, queue, timer family, receipt or executor is added. Exactly one termination call is issued on this private path. The private invoke entry captures the option once, its original execution fence receiver/function/signal and original app callback guard before argument getters or awaits. The original execution fence is checked again before worker creation and after actual drain; abort/deadline while draining refuses the result without releasing work early. Bindings captures the constructor option and original execution-factory callable once, invokes it once with the original receiver via `Reflect.apply`, and forwards the private policy. Mutable factory properties or function `.call` slots cannot substitute later owners. Private invalid policies and missing execution factories refuse; omitted invocation and Bindings options preserve released ordering and result-before-drain behavior. Root's bound-button invoker now opts in through the existing original update-execution-fence port, independently of SDK cohort eligibility. Install/bind-tool and public API defaults remain unchanged; no successor/dispatch/consumed-parent policy follows from worker exit. Thirty-three properties cover success/failure/state publication, abort/timeout and late source/callback loss, queued successors, rejection/throw/falsy termination, early ACK, exit-before-ACK, original termination/fence/callback/factory capture, omitted controls and invalid policies. Twelve exactly restored assertion-RED models exercise independent exit/promise requirements, rejection versus exit, final source checks, original captures, falsy rejection and single issuance. Earlier empty-name filters, a result-bypass model that never issued termination, type/harness errors and timing failures are uncredited. A nested mock restoration leak in the initial fixture was corrected by single-owner prototype restoration and a native callable identity assertion; it is not a production workaround. Four source/actual-dist Classic/Threaded × edit/new native graph cases prove no method-result planning/publication before the worker drain, while independent feedback cleanup/publication idle may complete. Original consumed-footer holds and independent fresh-message eligibility remain unchanged. Native GC retains the original execution fence through pending worker work, then collects it after actual exit and drain; inherited original question/publication GC remains separate. Artifacts: `/home/llb/pttmp/callback-worker-owner-*`. This is only actual-work ownership, **not** an original row disposition, method-success/non-use receipt, successor relation, business-effect completion or question membership authority. Consumed read-only adoption still needs its own exact producer/store proof. Root callback-worker and app-only bound successor composition are now connected; exact dispatch/parent composition, live/v5/receiver/source ACK/public Text/reload/release remain separate. Deterministic native/GC/self-review is not independent or operator-live acceptance. ###### Native Read-Only Callback Successor (Root Bound Callbacks) The private producer can now relate one exact original native app binding to its completed read-only successor. `invokeGenerativeApp({ callbackWorkerDrain: true, callbackBinding })` reads that original native binding once before argument getters/awaits; omission of the drain policy does not read this data-only input or create lineage. The captured secret-key class reader refuses copies, proxies, prototype peers, promises and foreign DTOs without probing their getters. Original app directory/name/generation/revision and existing guard/history are pinned; conflicting explicit expectations refuse instead of overriding the original. The original app guard runs after provider callbacks, at the last pre-worker boundary, after actual worker drain before state publication, and after native successor-recording I/O. Observed original loss is sticky and never recaptured. Only normalized native worker output with no app-state write records a predecessor. Mutable public invocation-result fields cannot add/remove that fact. The existing `callbackOwnerProofs` remains the sole result-to-binding owner; its native binding value stores a weak one-hop predecessor owner, not a second registry or retained transition chain. The original frozen capsule's private `captureReadOnlySuccessor(binding)` checks that exact predecessor, original and child native filesystem guards, then their data histories. It returns the same child capsule or refuses; it neither adopts equal-field/current peers nor traverses lineage transitively. Native class/WeakRef constructor/readers are captured, so mutable static/prototype/function slots cannot substitute another predecessor. A retained child does not retain an obsolete original result, binding or capsule after their actual work drains. Filesystem/history checks retain their existing limits: no proof of every unobserved file change, exact bytes, writer exclusion or remote receiver disposition. Bindings retains strict constructor-only `callbackSuccessor: true`, requiring `callbackWorkerDrain: true`. Root now uses the separately pinned `"bound"` mode with that drain owner: the original action binding is captured once before execution/live-surface providers and cannot be replaced by an equal-field peer. Bound actions pass that exact native origin; missing, mismatched or nonnative bound origins refuse. Initially unbound legacy method routing remains independent and never gains lineage. Mutating methods still run but cannot record a no-state-write predecessor. Worker-drain-only and omitted invokers preserve their previous behavior; install/tool/public API/receiver policies are unchanged, and no function crosses worker or IPC boundaries. Thirty-seven properties cover native one-hop identity, equal-field peers, omitted policy, complete original native brand, directory/expectation refusal, sticky loss before arguments/observation/worker and after drain/recording I/O, pre-state-write authority, mutable result data, child/original data histories and captured readers. Fourteen exactly restored assertion-RED models distinguish those owners and boundaries, including the last execution/provider callback before a state write and original fence/guard capture before the origin getter. Four source/actual-dist Classic/Threaded × edit/new native callback/Bindings/worker/Lifecycle/Queue/Bus/registry/Bridge/client cases prove original app lineage **before** result planning/publication ACK, while consumed-store membership remains held and independent fresh-message heads retain their own eligibility. Native GC keeps the successor/result alive while the obsolete original result/binding/capsule collect, demonstrating weak non-accumulating ancestry. Artifacts: `/home/llb/pttmp/readonly-successor-*`. This closes only the app producer half. A binding pair does not prove which store row was dispatched, exact invocation arguments, row retirement, source use/non-use, business-effect completion or a valid physical footer transition. The later private store origin below supplies native row/dispatch identity separately, not an exact invocation/result join. Store adoption still needs a positive exact original row/dispatch/invocation join, original execution/SDK/publisher/app authority, complete old/new roster and final data barrier, expected supersession and native ACK. Do not erase consumed rows from history, treat a current child as replacement authority, or release actual work from logical retirement. General/foreign/cold history, Root/default/v5/receiver/source ACK/public Text/reload/release and independent/platform/operator-live acceptance remain gated. ###### Native Ordinary Store Dispatch Origin (Root Qualified) Constructor-only `createTelegramButtonActionStore({ ordinaryCallbackDispatch: true })` can retain one native consumed-row origin on the existing `Stored`. It snapshots the exact still-indexed, unretired ordinary row, original complete published ordinary roster, app/SDK/producer owners, first-physical SDK scope/history and original callback query before removal/retirement callbacks. The query must have matching own-data callback ID/key, chat/message/Thread and original object identities. Unpublished, disabled, omitted-query, wrong-locator, expired, untracked or unavailable original facts cannot issue this origin. Registration erases caller-shaped private marker fields. Only the resulting frozen native resolved action can service the private `captureTelegramOrdinaryCallbackDispatch(action, query)` reader. Its secret constructor/brand and captured reader reject DTOs, copies, proxies, prototypes and caller construction without probing foreign action getters. Capture spends once on the original query object before provider callbacks; wrong-query and caught own reentry refuse without retry. A later duplicate capture refuses without revoking an already issued scope. Its enumerable scope fields are original `binding`, `prompt`, `assertCurrent` and data-only `assertObservedCurrent`, not a method-result, success/non-use or edit permission. The later exact join adds non-enumerable native invocation issuance/successor checks. Currentness runs original producer/runtime and SDK/first-physical checks, then original native app filesystem authority, then the pinned row/query/store and original data-history barrier. No provider/filesystem callback follows that barrier. Query/clock, source owner, app/SDK/physical history, clear or unknown publication loss stays sticky after observation; equal fields or restoration cannot renew it. Native clear removes stored origin markers before retirement callbacks. Source expiry, absence, a consumed string, publication idle or a missing action alone does not issue a fact. Original query/provenance and remote sender/receiver admission remain distinct; these local facts do not authenticate an arbitrary host or remote source. The marker stays on `Stored`; there is no second dispatch/interaction registry, queue, timer family, generic executor/receipt framework or root policy. The scope uses captured native weak constructor/readers for the original row, lifetime and publication; it intentionally keeps its explicit original binding. A retained resolved action/scope can coexist with collected original publication and invocation result after clear/drain. Native GC holds two question groups and the explicit original binding while that publication/result collect, then verifies the retained scope refuses. Initial callback predicates accidentally retained the shared lexical publication slot; direct loops remove that capture, and a restored assertion-RED retention model distinguishes it. Forty-four properties cover Classic/Threaded × HTML/Rich × sole/co-head origins, native brand, one-shot and query identity, six sticky query changes, original producer/app/SDK/clear/deadline loss, indexed/physical admission, capture/history reentry, original factories/policy and captured reader. Fifteen exactly restored assertion-RED models cover issuer/query/spend, provider/native/data phases, physical history, clear and actual GC retention. Four source and four actual-dist full native callback/Bindings/worker/Lifecycle/Queue/Bus/registry/Bridge/client cases capture the origin before method work, preserve private actual-worker drain and show **consumed-store transition remains held even with both this origin and app A→B lineage**. Root now opts into `ordinaryCallbackDispatch: "qualified"`: absent original SDK/physical provenance, including already-ended native SDK history before issuance, leaves ordinary execution independent. After issuance, `hasTelegramOrdinaryCallbackOrigin` recognizes even spent/refused native actions without granting dispatch; they cannot be reclassified as legacy. Strict private `true` and omitted defaults retain their contracts. Artifacts: `/home/llb/pttmp/store-dispatch-*`. At that checkpoint, the remaining native join still had to bind this exact original row/dispatch to one exact original invocation/arguments/result and successor, not any read-only invocation under the same app binding; the private exact join below now closes that identity seam. Do not pass a caller memo token as authentication, infer the join from matching fields, or turn these scopes into an effect executor. Before any future consumed-parent exception, preserve complete old/new roster, native preimage/edited ACK, original execution/app/SDK/producer/first-physical authority, data-only final use and actual work ownership. This scope starts no work and releases no method/publication lane. General/foreign/cold/failed/state-changing parent history, broader defaults/v5/receiver/source ACK/public Text/reload/release and independent/platform/live acceptance remain gated; qualified bounded Root dispatch is connected. ###### Exact Native Store/App Invocation Join (Root Qualified) The private original store scope can now issue exactly one producer-owned `NativeCallbackInvocation` through its captured original app capsule's `createCallbackInvocation`. This is a sealed one-use app input, not a caller memo/receipt or effect executor: the native cell fixes original app owner/path/generation/revision, decoded method/normalized JSON argument, the store's hidden original row marker and original source authority functions. Its private class fields are not enumerable/serializable; copies/proxies/prototypes/foreign objects and caller construction cannot supply the native brand. The original class/claim/origin and weak readers are captured. No second registry, timer, queue, package entrypoint or function IPC exists. The existing `Stored.ordinaryInvocation` weak field pins the issued cell; native clear and registration erase the field with the original dispatch marker. `takeInvocation()` spends before callbacks and runs original producer/SDK/physical guards, native app issuance and the final original row/query/history barrier. Only native flags/weak association follow that barrier. The source scope's non-enumerable `captureReadOnlySuccessor(binding, invocation)` checks its one issued cell, the original marker and exact native result's private cell relation through the captured app reader, then original store data history. It cannot accept another read-only call under the same app binding, a caller-origin cell, equal fields or a newer result. These remain validation methods, not a generic method executor or physical footer grant. Private `invokeGenerativeApp({ callbackWorkerDrain: true, callbackBinding, callbackInvocation })` claims a native cell once before argument callbacks/awaits, pins exact app/method/path for that call, and refuses conflicting normalized input/owner instead of substituting peers. Original execution/callback owner functions are captured before the invocation getter; the native cell also pins original source authority receiver/functions. Original source currentness runs at the last pre-worker boundary and after the last state-write execution callback, followed by native app FS and source data history. Native result recording rechecks the original source after its own I/O. Cell/source authority stays main-side and is never included in worker data. Logical source loss cannot release the existing worker/invocation owner before actual exit plus original termination settlement. Successful native output retains a weak exact claimed-cell link on its existing native result binding in `callbackOwnerProofs`. Only no-app-state-write output also records the read-only predecessor; no method/effect execution permission is derived from either association. Native classification matches that exact live cell, which retains its original source owner, so missing read-only ancestry is not inferred from GC or a mutable `stateChanged` DTO. `captureReadOnlySuccessor` without invocation arguments preserves its earlier app-only lineage semantics. Explicit original source loss, method failure, state write, unknown work or an unavailable link cannot be repaired with an unrelated result. A state-changing method may already have made its authorized effect; refusal of a read-only join is not rollback, replay permission or non-use proof. Bindings adds private constructor-only `callbackDispatch: true`, requiring successor and worker-drain policies. It pins the original execution receiver/callable/signal before store/provider callbacks, requires that original execution fence, captures the native resolved action/query once, takes the cell, and forwards it into the existing invocation. After the original final execution callback, it checks the exact store/result join before result planning. Non-method ordinary/selection values stay data; missing/foreign bound origins, missing execution or failed joins have no ordinary/model fallback. Root now uses `callbackDispatch: "qualified"` with the bound successor and worker-drain owners. It requires the exact native join for an issued origin; missing provenance alone leaves legacy routing independent. A native state-writing result can display under its current native app owner but never supplies read-only parent authority. Failed read-only joins stay refused. Install/tool and omitted defaults remain unchanged. Forty-nine properties cover exact native row/cell/result and normalized input, one-shot ownership, unrelated same-field results, caller memo origins, native brand/readers, original source/provider/physical data at final use, state-write and recording boundaries, binding policy and late-loss refusal. Eighteen exactly restored assertion-RED models distinguish those boundaries. Four source and four actual-dist full native graph cases prove the join before planning/publication, preserving the consumed-footer hold; four additional per-mode native source-loss cases clear the original store while real worker termination is gated and prove no result/plan until actual drain, then refusal. Native GC retains the successor/result and two question groups while original publication/result/binding/action/scope/cell collect after clear/drain, demonstrating no accumulating invocation ancestry. Artifacts: `/home/llb/pttmp/invocation-join-*`. The exact join is locally closed and now serves the [bounded consumed-parent path](#bounded-native-read-only-consumed-parent-root-qualified). It alone is not membership/edit authority: the physical path separately qualifies complete original/fresh rosters, unchanged preimage/native edited ACK, original final-use history and expected retirement before any head cut. Do not infer general physical authority, permit a prefix, reselect B, renew the publisher or release actual publication work. Owned bounded HTML/Rich feedback is now Root-composed; general/foreign/cold/failed/state-changing parent histories, broader defaults/v5/receiver/source ACK/public Text/live/reload/release and independent/platform/operator acceptance remain gated. ###### Consumed Read-Only Parent Preimage (Native Assessment, Held) The exact invocation join is complete, but native result planning and physical-parent membership are different boundaries. Ten source and ten actual-dist full native graph cases distinguish Classic/Threaded crossed with untouched old callbacks, positively projected feedback, queued feedback, query loss at result ACK, and an independent fresh send. The probes use the actual callback handler, private Bindings/native worker drain, app journal/result binding, Store, Queue/Lifecycle/Pi/Bus and native API ACK normalization. Their physical-view map is a test-owned HTTP fixture observation, not authenticated remote receiver/currentness evidence. In the untouched case, the complete original callback preimage still contains the consumed ordinary row when the read-only result edit begins and issues. The native exact row/cell/result relation and original source guard remain available; the positive edited ACK replaces the whole footer with disjoint fresh callbacks. At that assessment checkpoint, and still when the new private parent policy is omitted, both new question groups remain outside coordinated membership and do not shorten a later SDK head. This was the then-unimplemented consumed-parent exception, not a released effect failure. The independent new-send control does qualify and shorten its SDK predecessor and later agent tails. Feedback splits the prospective exception. A completed native feedback edit removes the consumed callback before result planning. More subtly, a result publication can begin with the untouched old preimage while waiting behind an already issued feedback edit; after that earlier native ACK, the result issues against the projected preimage instead. Both actual I/O owners drain correctly, but the later positive edited ACK does not certify the result's earlier begin snapshot. Publication idle waits across queued work and cannot be used as an intermediate feedback receipt. An old-key absence or a normalized success cannot replace positive original physical history. The query-loss case observes the exact original source data guard failing inside the result HTTP-ACK boundary, then restores the query fields. The original guard remains unavailable; the already completed native app row/cell/result relation remains authentic. Consequently completion identity must not bypass source-loss history or renew the query. Conversely a still-successful source guard after a healthy edit does not grant physical membership. Three counterfactual models, each Classic/Threaded and source/actual-dist, produce twelve assertion-RED witnesses: completion plus edited ACK as membership, edited ACK as an unchanged begin preimage, and completion as continuing query currentness. These are evidence assertions, **zero runtime-mutation credit**, not independent review or twelve released defects. Artifacts: `/home/llb/pttmp/consumed-preimage-*`. The assessed first implementation candidate, now closed by the bounded path below, stays constructor-private/unwired and admits at most one positively completed original ordinary row while the complete physical callback preimage is unchanged and still contains that row. Snapshot every original/fresh question/ordinary peer before callbacks; authenticate the exact issued cell and original native read-only successor, not merely equal bindings. Keep every other old peer live until its expected native supersession. Pin the original preimage through actual queued issuance and ACK; projected feedback, changed/uncertain preimages, another consumed row, expired parents, failed/state-changing work and missing original facts remain held. Preserve first-physical SDK/publisher ancestry and source observed-loss history through final original native authority and the data-only barrier, including the expected consumed-row/live-peer retirement transition. Any transient proof belongs to existing Store/publication/worker owners and ends with its actual work; do not add a head/receipt registry, timer family or generic executor. No runtime, policy/default, public API, Root, source ACK, receiver, v5 or live activation changed in this assessment. All 84 compiled runtime files and the ten previously loaded in-repository fixture pins match the invocation-join checkpoint before and after rebuilding. The previous fresh full-package gate is reused for unchanged implementation, not a newly executed full suite or a claim that every historical unused fixture pin is current. General consumed-parent adoption, feedback-history exceptions and independent/platform/operator acceptance remain gated. ###### Bounded Native Read-Only Consumed Parent (Root Qualified) Constructor-only `ordinaryReadOnlyParent: true` on the existing button store requires native `ordinaryCallbackDispatch`; omission preserves prior holds. Root now composes this bounded policy with qualified dispatch and owned HTML/Rich feedback, witnessed by an actual edited child joining SDK shortening. The opt-in admits only one exact native consumed ordinary row while its full original physical callback preimage still contains that row. Every other original ordinary/question peer must be live and present; every fresh question group must be complete/unique, and all fresh ordinary records must be original births bound to one exact native read-only successor. At least one fresh ordinary record is required as the native successor carrier; a pure-question successor is outside this first exception. The store snapshots original rows and physical keyboard/Rich references before publication callbacks. Before I/O, its captured original native app reader authenticates the original row marker/issued cell and that exact successor, matching the already captured native successor guard/history. This immutable native relation is not reselected or looked up at ACK. Final use separately checks original native app FS for every old/new producer, original SDK/producer/publisher/first-physical histories, exact cell/marker identity and source data history after callbacks. The source's original observed-current function stays weakly associated with the existing `Stored` row; it is owned by the issued work/cell, not a new completion registry. An earlier feedback edit can remove the old callback while this result waits. The original physical preimage is observed at lane readiness, native body sealing and ACK; observed change is sticky even if later fields match. A qualifying ACK must be native `"edited"`, the same original publication/ordinary roster and complete old rows, and the pinned unchanged preimage. Before head cuts, the native postimage is pinned too. Projected feedback, missing/changed/unknown preimages, partial/duplicate controls, mismatched successor producers, extra consumed rows, expired parents, failed/state-changing methods and original loss remain held. At commit, existing native retirement must show the one certified row still consumed, every live old peer superseded, old question groups retired and no old indexed row. Only during that synchronous transition does existing `Publication.ordinaryParent` carry the captured completed row with old peers/questions; the original source data guard recognizes that exact expected roster transition, not general absence or renewed authority. Native clear removes original row/cell/history associations from both current and transitional rosters before callbacks. The transient proof is deleted in `finally`; failed qualification withdraws fresh weak facts. First-physical ancestry remains nonrenewing across later replacements, and actual publication work retains its existing lane/references until drain. Thirty-four properties cover Classic/Threaded, HTML/Rich, sole/co-heads, live ordinary siblings, single-retirement bounds, exact versus unrelated/same-field successors, full/duplicate rosters, late source/SDK/native-FS loss, private policy pinning and queued feedback. Nine exactly restored assertion-RED models cover exact native completion, source history, original preimage, all fresh producers, transitional clear, policy, weak cell retention, expected retirement and unique callbacks. The expected-transition model is a positive-behavior regression, not a released-defect count. Ten source and ten actual-dist native graph cases qualify only the untouched case; feedback-cut, queued feedback and query loss remain held, with independent fresh sends as positive controls. Native GC retains the physical publication and successor result while cell/action/scope collect; after real replacement the obsolete original binding/result collect with both old and fresh question groups retained. Artifacts: `/home/llb/pttmp/readonly-parent-*`. This is a local private exception, not general consumption/business purity or remote receiver/source disposition. No new registry, timer, execution framework, public API or function IPC is added. The separate [owned HTML feedback extension](#native-html-feedback-parent-root-qualified) and opt-in [whole Rich/keyboard extension](#native-richkeyboard-feedback-parent-root-qualified) close one already-drained projection; all unowned/queued feedback, pure-question successor provenance, general/foreign/cold/failed/state-changing transitions, broader defaults/receiver/source ACK/v5/public Text/live/reload/release and independent/platform/operator acceptance remain gated. ###### Native HTML Feedback Parent (Root Qualified) Constructor-only `ordinaryFeedbackParent: true` requires the closed original-dispatch/read-only-parent policies. Omission preserves prior holds and released behavior. Root now opts in with qualified exact dispatch/read-only parent ownership; source/compiled Classic/Threaded cases exercise actual native feedback ACKs before the edited child's SDK tail. The first subset supports only a completely settled HTML feedback edit before result publication begins. It does not infer membership from a removed key, editor `void`, normalized success, a DTO/carrier clone, native worker drain or matching app fields. The existing pump owns one transient `Publication.ordinaryProjection`: exact consumed row/marker, complete original ordinary/question/live callback roster, preimage, publisher and store-produced projected markup. It is captured before editor/provider callbacks. Its first same-publication native observer attempt is spent before callbacks and must be that exact original markup, native markup-edit method, closed routing/body and full live callback projection. A mismatched first attempt fails closed. The actual prepared carrier gets the common callback/serializer seals, including the own undefined serializer sentinel through native client copying. Original producer/SDK/first-physical authority precedes native original app FS, then the data-only snapshot/history barrier. Only the original observer's positive native `"edited"` ACK may pin the exact projected cache frame after unchanged-preimage checks. That ACK is not the editor's completion: the existing publication work/closing owner retains the original editor invocation until its promise and final original guard settle. Only then may the existing row hold one local `ordinaryFeedback` fact for its original marker/roster/projected frame. The inner native request and enclosing editor work retain their respective existing ownership; no generic executor, extra timer, registry, polling or universal result delay is introduced. Missing/legacy ACK, Rich without its separate opt-in, uncertain callback roster, observed original loss and unknown editor completion invalidate the scoped footer rather than fabricate a proof. Ordinary question-local termination and native unused-deadline cleanup remain on their existing paths. A subsequent result begin can capture that already-issued fact only while its exact projected frame and ordinary roster still match. The closed native cell/result successor proof, complete old/fresh roster, original source/SDK/app/first-physical history, expected retirement and final native authority/data phases remain mandatory. There is no successor lookup at ACK or replacement of the fact with a current view. Result begin before feedback ACK/drain, intervening native edits, extra consumed peers, pure-question successors and unknown history remain held. A native ACK with an enclosing editor still pending cannot authorize this first subset, even though a future explicitly owned result/drain split could be designed separately. Twenty-four properties cover Classic/Threaded, live ordinary peers, omitted/invalid policy, real versus legacy ACK, exact/cloned/partial carriers, void editor, Rich refusal, source clear/query/app loss, observed intervening frames, prepared seals, editor ownership and queued preimage changes. Eight exactly restored assertion-RED models distinguish native ACK, original carrier, full editor settlement, unknown completion, no frame rebasing, seals, policy and original native FS. The editor-settlement model falsifies this bounded admission policy, not a universal semantic-result delay rule. Ten source and ten actual-dist native graph cases add the already-drained feedback case to the untouched and independent-send positives; queued feedback and query loss remain held. GC retains the actual publication, successor result and original/fresh question groups while original cell/action/scope and, after replacement, obsolete app binding/result collect. Artifacts: `/home/llb/pttmp/feedback-parent-*`. This fact stays on the existing row; registration and clear erase caller/retired associations, active projection loss is sticky, and the pump removes its transient owner in `finally`. It is native local physical history, not business purity, generic completion/non-use, remote receiver/source disposition or every unobserved file/provider change. The separate [whole Rich/keyboard extension](#native-richkeyboard-feedback-parent-root-qualified) does not widen this constructor's omitted behavior. Queued feedback, general transitions, broader defaults/v5/receiver/source ACK/public Text/live/reload/release and independent/platform/operator acceptance remain gated. ###### Native Rich/Keyboard Feedback Parent (Root Qualified) Constructor-only `ordinaryRichFeedbackParent: true` requires the original dispatch, read-only-parent and feedback policies. Omission preserves the HTML-only gate and released behavior. Root now opts in with qualified dispatch/read-only ownership; actual source/compiled Classic/Threaded Rich callbacks prove the edited child's native SDK tail. This extends the existing `OrdinaryProjection`, pump, prepared-carrier observer and row fact, not a second certificate registry or drain family. The native pump supplies one complete original text edit with its projected Rich message and entire keyboard, including unchanged Rich content when only keyboard callbacks retire. Before editor callbacks, both internally produced carriers are frozen. Capture reads canonical executable rows across both original carriers using the existing literal-aware parser; code examples never become callbacks. Exactly one consumed row and the complete live question/ordinary roster remain mandatory. The first observer attempt must use the exact original Rich and keyboard references, `editMessageText`, closed routing/body and every live callback exactly once across their union. A markup-only prefix, omitted keyboard, clone, altered text or extra callback cannot substitute. The common actual prepared body seals both carriers and their serializer slots. Rich Markdown is sealed even when retiring the only in-body callback leaves zero executable Rich rows. Only the original native `"edited"` ACK and unchanged preimage can pin the complete projected frame; the original editor promise and final guard must then settle before the existing row fact is minted. Subsequent result begin captures that fixed fact, never a later view or ACK-time successor lookup. Original producer/SDK/app/source/first-physical authority, the native FS-before-data barrier and exact invocation/successor/whole-roster retirement checks are unchanged. Thirty-three properties cover Classic/Threaded, sole/co-heads, mixed/Rich-only/keyboard-source carriers, retained unchanged Rich, inert code, private policy, carrier identity/content, incomplete/duplicate projections, legacy/void ACK, query/clear/intervening loss and empty-inline seals. Nine exactly restored nonempty assertion-RED models falsify original Rich/keyboard/content, whole original/prepared rosters, retained Rich, empty-inline sealing and policy; positive-behavior models are not released-defect counts. Thirty source and thirty actual-dist native graph cases exercise three carrier layouts through real callback/Bindings/app worker/SDK/Queue/Lifecycle/Pi/Bus/client paths: unchanged and fully drained feedback parents qualify; queued preimage change and ACK-boundary query loss remain held; independent sends qualify separately. Queued cases report actual original-source currentness without requiring the HTML case's historical value, and observed loss remains sticky. GC retains the physical publication/successor while obsolete invocation/action/scope and replaced binding/result collect. Artifacts: `/home/llb/pttmp/rich-feedback-*`. This is local original physical history, not remote receiver/source disposition, business purity or detection of every unobserved authority change. Queued/multiple-step feedback, view rebasing, pure-question successors, general/foreign/cold/failed/state-changing history, broader defaults/v5/public Text/live/reload/release and independent/platform/operator acceptance remain gated. ###### Queued Original Projection/Editor Ownership (Native Assessment, Held) The next queued-parent gate is ownership and ordering, not missing worker, dispatch, read-only lineage or Rich carriers. Twenty source and twenty actual-dist native cases now pin the actual original callback, worker exit and original termination settlement, native invocation/result relation, full HTML or Rich/keyboard roster, SDK, Queue/Lifecycle/Pi and Bus/API path in Classic and Threaded modes. Only disposable fixture apps, native workers and mocked remote effects are used. The normal observer retains the original native `ready` promise identity; it observes settlement without replacing it or introducing an extra await. Counterfactual waits are explicitly separate fixture models, not runtime changes. The five controlled histories distinguish the actual owners: - `drained`: original native ACK and the complete editor/publication work finish before result begin. The existing positive parent qualifies and cuts the SDK predecessor. - `native-pending`: result begin sees the original callback; the original feedback ACK later changes that preimage and releases the native lane. The editor can fulfill before the held result HTTP ACK, yet the earlier begin snapshot remains unqualified. A later successful editor does not rebase that admission. - `editor-pending`: the original feedback RPC has ACKed and its native lane has released, but the enclosing editor promise is held. The actual successor text edit ACKs and the callback reports `Done` while global publication idle remains false. Releasing that original editor fulfills its promise, but its final publication-owner guard fails against the intervening native result frame. - `editor-reject`: the same already-issued native result/callback can precede a late original-editor rejection. That failure invalidates the uncertain footer; it neither undoes nor replays the completed read-only method or remote edit. - `editor-depends-result`: a legitimate enclosing editor awaits the exact successor view promise. The current nonwaiting native path completes that view, allowing the editor promise to fulfill; its final owner guard still refuses the changed frame. Making the successor's readiness universally await that editor instead creates a direct cycle. Both real owners are observed waiting before a test-only escape drains them; no timeout counts as proof. All queued histories stay held for question membership, even with an exact native read-only result, complete disjoint fresh roster and positive result `"edited"` ACK. Later SDK admission cannot renew that failed first-physical ancestry. In the HTML native-pending witness, original source history may still report current while membership is held; the Rich witness observes sticky source loss. Neither historical currentness nor observed loss alone is physical completion permission. Native RPC settlement, outer editor fulfillment, the publication owner's final guard/fact, semantic result and actual drain remain distinct. Four counterfactual models across both formats, Thread variants and source/dist yield thirty-two nonempty assertion-RED outcomes: native ACK as editor drain, later editor as earlier membership, fulfilled editor as final owner commit, and a universal editor waiter as cycle-free progress. These are hypothesis falsifiers, not production mutations or released-defect counts. Actual state remains unchanged, dispatch is one-shot and model sends remain zero. Artifacts: `/home/llb/pttmp/queued-projection-*`. No runtime policy, default, Root, public API, registry, timer, waiter or receipt family changes. A future local join must capture one original projection and one original successor before callbacks, recognize only its exact native frame transitions, retain actual owners, and independently close final source/SDK/app/first-physical guards. SDK/head ordering across native result ACK and later editor settlement is still unresolved: do not silently choose settlement time as a new head birth or claim ACK-time ordering from this assessment. Prepare that bounded ordering witness before selecting a nonblocking membership settlement or a narrower native-editor contract. General/multiple/foreign histories, receiver/source disposition, production/live/platform/independent acceptance and release remain separately gated. ###### Queued SDK Head Ordering (Native Assessment, Held) The [editor-ownership assessment](#queued-original-projectioneditor-ownership-native-assessment-held) left one ordering question: an earlier result cannot become a new 24-hour head merely because its original editor settles later. Sixteen source and sixteen actual-dist native cases now vary HTML/Rich, Classic/Threaded, already-drained versus pending original editor, and an optional later SDK admission. They retain the actual callback/worker/invocation/read-only successor and native API path; no runtime policy changes. The controlled clock separates original question birth (1,000), an SDK question before result ACK (5,000), native result ACK (10,000), an optional later SDK question (20,000), and original editor settlement (30,000). With already-drained feedback, the real result qualifies: the older SDK question gets the ACK-time cutoff 3,610,000. A later SDK admission leaves its own head alive and cuts the result's original question groups to 3,620,000. Earlier producer lifetimes are not renewed. With the original editor pending, result membership stays held. A later SDK admission can independently shorten the older SDK question to 3,620,000; that is the SDK's own ordering, not proof that the result qualified. The earlier SDK question still accepts at 3,615,000, while the later head accepts after 3,630,000. The held result groups retain their original 86,401,000 deadline rather than receiving a fabricated pending-head cutoff. Editor fulfillment/final-owner refusal does not promote them or rebase their birth. Thirty-two additional source/dist mechanism controls invoke the existing original SDK owner's one-use `captureTail` in explicitly isolated fixture branches, not as physical-parent authorization. Capturing in the ACK-time turn, at the same fixed clock after callback settlement with no intervening admission, then applying at editor settlement preserves the original entry set and 3,610,000 cutoff; the later SDK head is excluded. Capturing only at settlement moves the cutoff to 3,630,000 and includes that later head: the earlier question accepts between the two cutoffs and the later head expires after the new cutoff. This is native capability behavior, not permission to apply it for an unqualified parent. The same original owner identity is retained; no current-runtime lookup or equal peer supplies it. The existing original owner's `assertAdmission` also reads the authentic SDK admission time synchronously before the store subscriber, including 5,000/20,000 while the result is held. A copied admission refuses. This supplies a possible native ordering observation through existing ports; the current published-roster subscriber deliberately does not turn it into pending physical membership or a retained tail fact. A future broader join must retain that original event/time rather than reread current heads at settlement. Three counterfactual hypotheses across formats/Threads/source/dist yield thirty-two nonempty assertion-RED outcomes: settlement-time capture preserves ACK time, settlement-time capture excludes later heads, and the existing published-roster subscriber already records the pending result's native SDK cutoff. These are hypothesis/feature-absence falsifiers, not runtime mutations or released defects. Golden workers are fixture-only, state remains unchanged, and model/unmocked network sends are zero. Artifacts: `/home/llb/pttmp/queued-head-*`. This closes the ordering assessment, not queued adoption. The separate [queued-by-result-ACK subset](#queued-original-projection-by-result-ack-root-bounded) now closes one original projection/exact successor only when its original editor/final guard has drained by the native result ACK, without blocking native or semantic publication. Genuinely later editor completion still needs a separate membership-settlement proof. Retain one original ACK-time SDK snapshot and original question births. Initially refuse an intervening same-scope native head after reservation instead of inventing delayed promotion; both SDK admission and a separate eligible agent-head ACK must fence that subset. Broader interleaving requires original native cutoff observations, including no cut of a later head and no extension of the earlier question. Preserve original source/app/SDK/first-physical histories, exact expected native retirement, the final editor/publication-owner guard and actual drain. General histories, Root/default/receiver/source ACK/v5/public Text/live/reload/release and independent/platform acceptance remain gated. ###### Queued Original Projection By Result ACK (Root Bounded) Constructor-only `ordinaryQueuedFeedbackParent: true` requires the existing original dispatch/read-only/feedback policies; Rich still requires its separate Rich opt-in. Root now composes this existing policy; omitted embedded defaults remain unchanged. The native pending-feedback Root witness captures result begin before the original HTTP ACK and releases that actual native owner independently. This deliberately closes less than a general deferred-membership protocol: one original feedback projection can still be pending when result publication begins, but its exact editor promise and final original guard must already have settled successfully by the positive native result ACK. A later editor stays held; there is no target waiter or universal semantic/native-I/O delay. The first same-publication queued attempt is spent before body/provider callbacks. It captures the already-claimed original projection, consumed row/marker, original ordinary/question roster, invocation/result successor and original preimage. Only that projection's sealed native `before → after` transition may advance the queued snapshot, never an arbitrary current frame. The existing complete fresh batch, original native read-only relation and all scope/history checks remain mandatory before I/O. Unsupported first attempts invalidate rather than retry/reselect. The original pump now assigns the issued feedback fact to its own transient projection as well as the existing row, only after native `"edited"`, unchanged-frame checks and actual editor/final-guard completion. Existing publication work retains that same projection while the queued native result owns it, even if the editor has already drained. At result ACK, the ordinary parent can qualify only with that exact projection-issued fact still matching the original row and native projected frame. The normal ACK-time SDK capture then applies; there is no successor or current-owner lookup at ACK. The queued native attempt releases its transient retention in its existing drain `finally`; editor work keeps its own lifetime independently. Before irreversible tail changes, original producer/SDK/publisher authority, native original app FS, source invocation/query history, full old/fresh rosters, first-physical ancestry and exact expected supersession remain required. Genuine same-scope native SDK admission and a separate agent head fence this first subset during reservation. The originating result cannot fence itself. Later SDK/head history is held, not promoted from editor settlement; another original scope cannot lend an intervening head. Unknown/legacy ACK, extra retirement, partial/duplicate controls, source clear/loss or missing editor completion cannot qualify. Forty-seven properties cover Classic/Threaded, sole/co-heads, HTML/Rich, result begin during native feedback or enclosing editor work, policy pinning/dependencies, late editor, legacy acknowledgements, sticky query/clear, both SDK interleaving phases, independent agent head, incomplete/duplicate rosters, a second retired peer and native scope callbacks that publish a newer head. SDK/agent tail snapshots and the queued-fence candidate snapshot precede those callbacks; a prior event cannot recapture the head they create. Eleven exactly restored nonempty assertion-RED models falsify policy, native transition, editor receipt, SDK/agent fences, both snapshot orders, projection retention, positive result ACK and original source history. Positive feature-absence models are not released-defect counts. Twenty-four source and twenty-four actual-dist native graph cases exercise real callback/Bindings/worker/SDK/Queue/Lifecycle/Pi/Bus/client ownership; only the already-drained control and queued native-feedback path drained by result ACK qualify. Two GC cases per mode retain current publication, successor result and old/fresh question groups while the original projection carrier, invocation/action/scope and obsolete result/binding collect. Artifacts: `/home/llb/pttmp/queued-join-*`. No additional interaction/head/worker/completion registry, timer, waiter, executor, receipt family, public port or Root policy is added. The original [editor dependency assessment](#queued-original-projectioneditor-ownership-native-assessment-held) still rules out an arbitrary outer-editor wait. The [post-ACK owner-retention assessment](#post-result-ack-original-owner-retention-native-assessment-held) narrows the next private implementation without changing this by-result-ACK subset. Genuinely later editor completion, broader SDK/agent interleaving, general/foreign/cold/failed/state-changing parents, receiver/source disposition, broader defaults/v5/public Text/live/reload/release and independent/platform acceptance remain gated. ###### Post-Result-ACK Original Owner Retention (Native Assessment, Held) Twenty-eight source and twenty-eight byte-pinned actual-dist cases observe the existing queued policy after native result ACK, not another worker/invocation/Rich prerequisite. They retain the actual callback, both original worker-drain signals, native invocation/read-only successor, SDK, Queue/Lifecycle/Pi and Bus/client graph in HTML/Rich and Classic/Threaded modes. Passive native WeakRef observation reads the same internal publication/projection identities used by the prior GC fixture; it changes no production object and supplies no authority. Original native `ready` is neither replaced nor delayed. The enclosing editor awaits the exact successor view and then a fixture gate: the native result and `Done` complete while that original editor remains owned. At result ACK (10,000), the original projection is still retained by the closing editor, but the queued native pending marker and actual-I/O lane have drained. The original ordinary roster/source cell remains available; non-consumed ordinary peers and old question rows have the expected `superseded` retirement. The cache now contains the exact native result frame, not the projection's feedback frame. No editor fact is issued, no SDK tail is captured for the held result, and only the two original physical weak facts exist. These observations are not completion or non-use permission. At editor settlement (30,000), the unchanged final owner guard refuses the changed frame, invalidates the publication and removes the projection; original source history then refuses too. The completed native binding identity remains distinct from that source permission. Seven histories distinguish the remaining barriers. An SDK admission or separate eligible agent ACK at 20,000 marks the existing queued-interference loss, without shortening the held result's question groups. A separate positive same-message edit changes the result frame again, so it cannot be folded into the one expected transition. Observed query loss remains sticky after exact field restoration. An original publisher-epoch change remains invisible to data-only observed history until the normal final publisher check sees it; restoring the epoch afterward cannot undo observed loss. Clear removes authority but does not drain the editor. The healthy no-interference case shows that post-ACK source history can remain valid until the final owner check: treating native drain itself as source death is also wrong. Sixteen isolated source/dist mechanism controls use the same original result SDK owner. Unlike the earlier same-clock post-callback experiment, ACK controls call its one-use `captureTail()` inside the original positive result observer at 10,000; settlement controls capture at 30,000. With an SDK head admitted at 20,000, ACK capture preserves the original cutoff 3,610,000 and excludes the later head. Settlement capture leaves the older question answerable at 3,615,000 and incorrectly includes the later head, which expires by 3,635,000. All result groups retain their original birth/deadline and physical membership remains held. These bare-kernel, no-cohort controls are capability experiments, not a physical-parent or final-use certificate: a future join must retain the original native cohort scopes, app-FS authority and trusted data barrier as well. Forty-eight nonempty assertion-RED counterfactual outcomes falsify the queued-native pending marker surviving ACK, positive result already retaining an SDK snapshot, completed lineage renewing a lost query, observed history being fresh publisher authority, SDK admission already recording a pending-result cutoff, and arbitrary positive edits being one transition. They receive zero runtime-mutation/released-defect credit. Fixture state remains unchanged, one callback is dispatched, and model/unmocked network sends are zero. Artifacts: `/home/llb/pttmp/late-join-*`. At that assessment checkpoint, runtime/package tests remained byte-equivalent and its 11,345-test gate was reused, not rerun; the subsequent private implementation below is a distinct runtime checkpoint. The [private deferred original-editor join](#deferred-original-feedback-membership-root-bounded) now implements that bounded expected-transition and ACK-snapshot boundary in the original projection/pump. The validated by-result-ACK omission remains unchanged. Broader histories and Root/default/public/receiver/source-ACK/v5/live/reload/release activation remain gated. ###### Deferred Original Feedback Membership (Root Bounded) Constructor-only `ordinaryDeferredFeedbackParent: true` requires the original queued/read-only/feedback/dispatch policies; Rich still requires its separate whole-carrier opt-in. Omission preserves the validated by-result-ACK subset and released/default behavior. Root now supplies this existing flag without a new port. Source/compiled Classic/Threaded callbacks return native result/`Done` while their original editor remains pending, expose no pending head, then qualify only after that actual owner and final guard settle. This closes one original consumed-row/read-only successor whose native result ACK precedes actual completion of its original feedback editor, not general late-owner adoption. The first queued attempt still spends its original projection before body/provider callbacks. At one positive native result `"edited"` ACK, the complete old/fresh rosters, fixed feedback transition, native row/invocation/successor and original source/SDK/app/first-physical history must qualify except for the still-running editor. The existing projection then retains one frozen `queuedResult` with its exact result postimage, original batch/retirement facts and one-use completion closure. The original ordinary roster remains installed while that source relation is needed. No current-owner/successor lookup or new head birth occurs at settlement. The original SDK owner captures its one-use tail at that ACK with the native original cohort scopes, app-FS authority and a trusted data guard. Earlier-agent candidates and demotion time, plus any queued-head fence candidates, are also captured before provider/scope callbacks. These are owned pending facts, not published membership: fresh weak facts and SDK/agent cuts wait for the original editor promise and final original owner guard. The same cohort guard checks the retained pending state during capture and the exact committing state during final application; it is not the assessment's bare-kernel control. Only the captured native result frame and whole expected retirement may satisfy the final editor data guard in place of the original feedback frame. Original publisher/producer/SDK callbacks still precede original native app FS and source/query/first-physical data history. All fresh heads must remain live in this first subset. The pump mints its original editor fact only after actual editor fulfillment and that final guard. Completion spends its one attempt, temporarily installs the exact existing ordinary-parent transition while publishing the full certified coequal batch, then applies the retained SDK and agent cuts. Native cohort application again performs provider checks, original app FS and the final data-only barrier before irreversible shortening. Earlier producer deadlines win; settlement never renews the original birth. SDK admission or a separate eligible agent head after reservation refuses this subset. Deferred head-fence candidates are captured at ACK but applied only after the original editor qualifies; an unqualified pending result cannot act as a completed head. Any second same-message publication attempt also poisons the original join before callbacks, even while that second RPC is unacknowledged and the cached result frame is unchanged. Native I/O may still progress, but its separate actual-work owner must drain. Retained controls, a restored view/query, legacy feedback/result success, fresh consumption/expiry, clear, producer/SDK/app loss or editor rejection cannot substitute for the original join. Failed qualification neither undoes nor replays the completed method or remote edit. The original pump/publication work owns deferred settlement. The native result and `Done` do not await an arbitrary editor; an editor may itself await the exact result view. Native drain removes only its own pending marker, while the still-closing pump retains the projection and native cell until its actual owner settles. Pump `finally` removes the queued result and transient projection on both success and failure. There is no second registry, executor, receipt family, timer, waiter, result-delay wrapper or public SDK surface. Sixty-nine properties cover Classic/Threaded, HTML/Rich, sole/co-heads, native/editor-pending result begin, original ACK-time SDK and earlier-agent cuts, shorter producer deadlines, policy pinning/omission/dependencies, all-fresh-live refusal, exact whole carriers, legacy ACKs, final native-FS-before-source history, sticky loss, callback-admitted newer heads, and pending/retained/changed second views with actual drain. Fourteen exactly restored nonempty assertion-RED models falsify these boundaries and projection cleanup; the joint second-view model disables both its sticky-attempt fence and fixed-frame guard rather than claiming either redundant layer independently. Feature-absence RED is not a released-defect count. Thirty-six source and thirty-six actual-dist native graph cases retain real callback/Bindings/worker/SDK/Queue/Lifecycle/Pi/Bus/client ownership: the four healthy original late-editor cases qualify; thirty-two source/head/view/clear histories remain held. Two GC cases per mode retain the current publication, native successor and four question groups while obsolete projection/carrier, invocation/action/scope and binding/result collect. Artifacts: `/home/llb/pttmp/deferred-join-*`. This is local physical history, not business purity, every unobserved provider/file change or authenticated remote receiver/source disposition. The separately Root-composed pure-question and one-event SDK-tail policies close only their bounded histories. Multiple feedbacks, fresh-terminal/general/foreign/cold/failed/state-changing parents, broader defaults/v5/public Text/live/reload/release or independent/platform acceptance remain gated. ###### Pure-Question Read-Only Successor Provenance (Native Assessment, Held) This is the pre-origin checkpoint: the private origin implementation below closes birth/currentness capture, not consumed-parent adoption. This assessment changed no runtime policy. Sixty source and sixty actual-dist native cases compose the original callback, Bindings, worker exit plus original termination settlement, invocation/read-only successor, SDK, Queue, Lifecycle, Pi, Bus and client. Classic/Threaded × HTML/Rich × independent Confirm heads, exact-N Choice and sequential wizard × five native publication histories all produce identical source/dist case outcomes. The private original/deferred feedback policies remain enabled only in the isolated kernel. No Root/default activation occurs. The authentic native result binding exists in `Bindings.planOutput(result.output, { binding: successor })` before compiler registration. The original store source history is still current at planning; the native app one-hop lineage and exact store invocation join are already proved. Frozen field copies and proxies of that binding refuse native owner/lineage capture, without probing proxy getters. The missing fact is not worker completion, source dispatch, a new result lookup or a visible callback value: structured registration deliberately omits the method-routing `action.binding`, and the store currently captures the native app reader only for ordinary rows. A pure result therefore gives its new question groups original SDK/producer lifetimes but no retained native app-result origin. `beginPublication` cannot construct its consumed-parent completion from a nonexistent fresh ordinary successor row. - **Native mixed result:** a deliberately emitted fresh ordinary successor carrier allows the existing exact consumed-parent join at a positive edited ACK, with one ACK-time SDK cohort capture. This is a different native producer output, not a dummy-carrier workaround for a pure result. - **Pure edit, untouched consumed preimage:** positive edited ACK and `Done`, but no app reader capture for the new groups, result SDK cut or fresh membership facts. Original source history can remain current; that is not permission. - **Pure edit after drained feedback:** positive edited ACK and `Done` still do not qualify. The authentic original editor/final-owner fact does not supply the missing successor origin. - **Pure edit with pending original editor:** the first result edit refuses before native I/O. Bindings' existing independent send fallback cannot revive that already-spent membership attempt. Result/`Done` can finish while the original editor remains owned and must drain. - **Explicit pure new view:** an independent positive send, without an earlier failed edit attempt, qualifies the existing private pure-question first-send head cuts. It neither adopts nor moves the original consumed parent, and does not certify native app ancestry for that old message. The original app footer is born at 1000; the probed SDK question and result groups are registered at 5000, followed by result ACK 10000 and later SDK admission 20000. The mixed-edit and independent-new controls cut that probed SDK question at the original ACK cutoff 3610000 and expose result groups that the later SDK admission can shorten to 3620000. The three held edit histories retain result group deadlines 86405000; the earlier SDK question remains confirmable at 3615000. There are 24 qualified controls and 36 held histories per mode. The result binding is never selected again at ACK. Sticky source loss and native completed-result identity remain separate; no absent row, live source, `Done`, positive edit or SDK cutoff substitutes for an expected parent transition. Healthy mixed/new controls also answer the original Confirm, exact-N set and full regenerated wizard through native callback/collector updates. `counter::increment` and `/quit` remain structured answer data: one minimal answer prompt is admitted only at completion, the bound-method dispatcher is never called by those selections, the original read-only method is invoked once and app state stays `0`. Regenerated wizard rows retain `binding === undefined`; future provenance must live with their original group/lifetime instead of being recaptured as a new birth. The fixture intercepts prompt admission and makes no model or command call. Passive WeakRef observation delegates the native constructor/deref and supplies no authority; it is not GC evidence. Forty-eight nonempty counterfactual assertion-RED runs falsify six shortcuts across both targets/carriers and source/dist: native completion as pure-parent membership, feedback fact as successor origin, planner binding as already-retained question origin, pending editor as permission for a carrierless edit, independent first-send as old-parent adoption, and method-looking selection data as app dispatch. These are capability/ordering falsifiers, not runtime mutations or released-defect credit. The immutable final compiled audit contains 25 processes, 57 compiled modules, one pinned fixture and 252 hash-pinned generated app workers, with inherited preload, terminal process summaries, forbidden network/source fallback zero. Artifacts: `/home/llb/pttmp/question-successor-*`. The next bounded implementation is a constructor/factory-private non-dispatch native question-result origin, captured before relevant callbacks at the original group birth and retained by existing `groupFacts`/question lifetime/publication owners. Carry only the exact original native result binding on the existing main-side planner/registration path; authenticate it with the existing native app reader and exact source invocation/read-only successor, never a DTO, hidden field, prompt, matching app/revision or ACK-time lookup. Require one common original successor across the entire fresh question roster and the same complete original/fresh parent contract, app-FS-before-trusted-data final barrier, original SDK scopes/birth/cutoff and actual-work ownership. Preserve ordinary omission, structured `binding === undefined`, answer-data routing and collector regeneration. Do not add an ordinary button, registry, timer, result waiter, generic receipt/executor, function/native-cell IPC or public package entrypoint to manufacture the missing proof. This was the provenance-diagnosis checkpoint. The native origin kernel below is now composed for bounded direct first-send Root app questions; general consumed-parent composition, unsupported physical histories, authenticated remote receiver/source disposition, public Text/v5, live/reload/release and independent/platform acceptance remain separate. Runtime, package tests and dist are byte-identical to the deferred original-editor checkpoint; its fresh full 11414 total / 11409 pass / 0 fail / 5 skip, types/strict consumers/DAG evidence is reused, not rerun for this documentation/evidence-only assessment. ###### Native Question App Origin `questionAppOrigin: true` retains the strict private action-store policy requiring original question, producer and native app capture ports. Production Root uses the constructor-only `"independent"` variant with those same native captures: selection authority is separate from the stronger SDK/app cohort authority. Missing/ended SDK membership may leave an original producer/app-owned answer usable, never acquire a new SDK birth. App/producer loss still refuses selection. The private outbound reply factory has a separately pinned fourth `true` opt-in requiring its original question policy; Root/Bindings now supply it. Omission preserves the prior embedding behavior. The factory carries its one original native result binding on the existing main-side `register(action, questionResultBinding?)` call, including later collector rows. It never sets `action.binding` for a selection or serializes an origin, function or invocation cell into a prompt, SDK result or worker request. Existing `groupFacts` owns one original origin alongside its question lifetime. The group birth and first capture attempt are recorded before callbacks. SDK capture precedes native app capture and FS checks; independent mode first seals the original producer so a capture callback cannot replace its birth. The existing native app reader authenticates the original frozen binding and its exact guard/history functions. Unknown/missing capture is sticky, as is a later attempt to supply a different native binding with equal app/generation/revision fields. An initially unbound group stays unbound. Captured SDK/app/provider functions and receivers are never looked up again, and collector regeneration retains the original group, origin, scope and deadline rather than minting another birth. A callback that advances time cannot move producer TTL to the collector footer's later birth: the original question-group birth bounds the deadline, including refusal when it expires during compilation. The question lifetime's cohort authority still fences original SDK, producer and app currentness/history. Independent selection uses its separately captured original producer and app authority, not that SDK membership grant. SDK-only loss cannot make the cohort current again or invalidate an otherwise-owned answer. App owner reset/generation/revision events poison both authorities before retirement callbacks, including when SDK membership was absent; a restored event/file or peer native result cannot renew them. Per-group collector prepare/update/commit uses that stored authority even when a plain question owns the message's physical publisher. Selections remain answer data, never Generative App method dispatch. At qualified first-send/common co-head application, the original app FS guards participate in the native SDK cohort's `assertAuthority` callback, after provider/scope callbacks and before the final trusted data barrier. The same ordering applies when a later SDK/agent admission shortens an already-published question tail. Data history alone cannot detect an unobserved file mutation; the final fresh native app check is required. A failed or uncertain origin cannot leave a usable head/cut through a later lookup or exact field restoration. If an origin-bearing cohort fails after provisional whole-batch publication, both completion/error boundaries withdraw every fresh membership fact, including plain peers: a later SDK admission cannot consume a healthy-looking prefix of the failed footer. This changes neither prior authorized cuts nor native/business effects. No second origin/head registry, timer, executor, generic receipt or waiter is introduced. This is an origin/currentness prerequisite, not an implicit consumed-parent completion. It supports original app question outputs, including standalone native initialization/new views, without claiming that they are read-only successors of some old row. With this origin flag alone, the native graph still holds pure consumed edits, drained-feedback pure edits and the already-spent pending-editor fallback. The separate bounded parent policy below must join the retained binding to the exact original source row, native invocation/read-only successor and complete old/fresh retirement; no ordinary result button is fabricated. Local properties cover both targets/renderers, scalar and collector declarations, original capture order/receiver/policy pinning, unavailable/copy/proxy/peer origins, sticky loss, owner events, caught SDK reentry, original TTL before callbacks, final native FS and a collector whose physical publisher is plain. Source and actual-dist native cases retain actual callback/Bindings/worker/SDK/Queue/Lifecycle/Pi/Bus/client ownership and prove regenerated rows use the same original origin without method routing. GC distinguishes the current question and actual issued cleanup from disposal of the owner store: native binding/group references survive current/issued ownership and collect after native drain and owner-store release; it does not call a cached publication unowned merely because no question row remains. Artifacts: `/home/llb/pttmp/question-origin-*`. Bounded direct first-send Root/default app origin is now connected, including source/compiled Classic/Threaded real ingress, Pi dispatch, native app worker initialization and actual HTTP ACKs. General consumed-parent composition, unsupported histories, authenticated remote receiver/source disposition, public Text/v5, live/reload/release and independent/platform acceptance remain separate. Native local app history is not business purity or every unobserved provider/file change. No production runtime data or live binding is changed. ###### Native Pure-Question Consumed Parent (Root Bounded) `ordinaryQuestionParent: true` is a separately pinned constructor-only opt-in requiring `ordinaryReadOnlyParent: true` and native `questionAppOrigin`, including their original dispatch/SDK/app/producer prerequisites. Omission retains the ordinary-carrier requirement. Root now composes this policy with its independent selection/native app captures. Actual source/compiled Classic/Threaded Root pure-question edits keep selection `binding === undefined` while joining native SDK tails after original parent qualification; no public entrypoint or agent tool is introduced. Before body or parent getters, the existing publication observer snapshots already-born unpublished question identities, group lifetimes, native origin bindings and their pinned SDK/app functions. It does not capture another owner or look up a successor at ACK. For a pure carrier, every callback record must match that original snapshot, every included group must be complete, and all those question origins must share one exact original native result binding. A copied/proxied/self/unrelated native binding, an unbound included group, mixed origins or getter-introduced group refuses the join, never a weaker singleton. This is the complete physical callback roster and each included group, not a new result-wide transaction over unrelated questions or frames. The first pinned question origin supplies only the existing completion's app/SDK authority fields, not an ordinary record or method binding. The consumed original row still supplies the original dispatch, one-use native invocation, exact query/input and source history. Its original native reader must authenticate that exact result binding as the read-only successor of that same invocation/origin and return the exact captured app guard/history functions. A genuine read-only peer with equal app/revision fields cannot substitute. Native result authenticity or source liveness alone still grants no parent permission. All existing old/fresh roster, unchanged-preimage, native edited ACK, expected retirement, original publisher/producer/SDK/app and first-physical checks remain mandatory. Fresh questions retain their original scopes/births/earliest deadlines. Selections keep `binding === undefined`; method/slash-looking values are answer data. Collector regeneration retains the original group/origin and does not capture another SDK birth. Native app FS stays after SDK/provider callbacks and before the final trusted data barrier; an observed file/query/SDK/publisher loss remains sticky after exact restoration. Failed qualification cannot leave provisional co-head facts. With the existing feedback/queued/deferred opt-ins, the same exact pure successor also joins one original whole HTML/Rich feedback frame. Native/semantic results still do not await the original editor. A pending original editor retains only the already-certified result ACK/postimage, original source/rosters and ACK-time SDK/agent snapshots; its actual fulfillment and final owner guard are still required for membership. ACK at10000 and editor fulfillment at30000 retain the original3610000 SDK cutoff, not a settlement-time recapture. A later SDK admission at40000 can then shorten the resulting groups to3640000. No fresh ordinary carrier, projection, registry, timer, waiter, executor or result-birth renewal is introduced. Source/actual-dist properties cover sole/co-head Confirm, exact-N and wizard plans, both targets/carriers, exact source lineage, mixed/unbound/peer/copy/proxy origins, incomplete/duplicate physical rosters, policy dependencies/pinning/omission, original query/SDK/publisher/app loss, final SDK-provider app-FS mutation and shorter producer deadlines. Native callback/Bindings/worker/SDK/Queue/Lifecycle/Pi/Bus/client cases prove pure untouched, drained-feedback and pending-original-editor adoption alongside native mixed/independent controls. Real collector clicks regenerate rows without bound-method dispatch or intermediate model work. Native peer origins and observed/restored source loss remain held; independent new sends remain separate controls, never old-parent adoption. GC retains current publication/successor/groups while obsolete source action/invocation/result/binding and original projection carriers collect after actual owner drain; SDK-only first publishers are intentional GC fixture premises. Artifacts: `/home/llb/pttmp/pure-parent-*`. Without the separate [one-event conditional SDK policy](#one-event-conditional-sdk-tail-root-bounded), successfully validated same-target current SDK interference continues to poison this bounded join. That policy does not relax any second same-message attempt, even still-pending native I/O; actual I/O retains its lane until drain. General interleaving still needs separately proved original history, not a live lookup, scope recapture, erased sticky-loss flag or a new head ledger. General/retained/multiple-feedback/foreign/cold/state-changing/known-terminal histories, authenticated remote receiver/source disposition and broader defaults/public Text/v5/live/reload/release/independent/platform acceptance remain gated. Local native app no-state-write is not business purity or proof of every unobserved provider/file change. ###### Pending SDK Admission Cutoff (Native Assessment, Held) The original retained result/editor owners now make one narrower interleaving question actionable: can a native SDK admission during that window leave a conditional result-tail ceiling, without prematurely exposing a head or moving its original birth/cutoff? That assessment was native evidence/design only: runtime, package tests/dist/metadata, Root and public APIs were byte-identical to the pure-question checkpoint. The finite-event SDK prerequisite below and the [separate one-event store opt-in](#one-event-conditional-sdk-tail-root-bounded) are now implemented. This section records the unchanged-policy assessment baseline; omitted/default behavior still marks successfully matched current interference `queuedLost`. The native graph keeps the original callback/Bindings/worker drain, exact source/invocation/read-only binding, complete physical rosters, Bridge SDK/Queue/Lifecycle/Pi/Bus/client, native result ACK and still-running original feedback editor. Both mixed native result rosters and pure question rosters run in Classic/Threaded and HTML/Rich. At result ACK10000 the existing frozen `queuedResult` has only `assertCurrent` and `complete`, keeps its original ACK-time SDK/agent snapshot and owns no conditional admission clock. SDK C is admitted at20000 while the editor remains pending; its final owner is released at30000. No observer changes that record, a deadline, a sticky fence, `ready` or the original editor's native flow. The assessment distinguishes these native facts: - **Original finite clock:** Both the original projection SDK owner and the pinned result SDK owner match the live native admission and return20000. A real SDK provider callback moving the clock to27000 does not move that return value; the candidate ceiling is3620000, not3627000. Copy/proxy admissions refuse without probing proxy getters. - **Closed synchronous scope:** Replaying that exact admission after the observer returns refuses, even while its SDK question remains alive or its actual publication RPC is still pending. The original result SDK owner remains current. A retained token/callable is not an ongoing lease or a settlement-time matching mechanism. - **Source independence:** Observed/restored original query loss can leave both native SDK matches successful while the original pending result's data guard already refuses. SDK scope/clock matching is not original source/invocation/parent authority. - **Fresh app authority:** After a native app-file mutation, SDK matches still return20000 and the pending data-only guard initially succeeds. The already-pinned native app FS guard then rejects and the data guard becomes sticky-refused. Restored bytes cannot renew it. Data history and a successful SDK match do not replace the fresh app phase. - **Admission versus publication:** Canceling C after the actual store admission observer, but before publication, yields no SDK API request. The original SDK predecessor nevertheless expires at its20000 admission cut: the late3625000 query is expired. Cancellation does not undo an already-authorized SDK demotion, and it is not result-parent permission. - **Independent actual work:** With C's native SDK RPC held, the original editor/final owner settles at30000 while C's open remains unsettled. Its own RPC is then released and drained separately. Neither admission-scope closure nor editor settlement releases that actual SDK work. - **Native runtime identity:** A genuine SDK admission from a separate unregistered pure-kernel runtime has matching public target/time and configured profile/operator, but neither original owner accepts it. It does not poison this pending projection; the original result can qualify normally. This is a mechanism control, not authenticated foreign receiver/source adoption. - **Finite-event gap:** C is already reserved and its SDK demotion is issued before the observer. If C is canceled inside that same synchronous observer before either original owner matches it, the existing current-entry matcher refuses, as it does for the foreign control, although the event is genuinely from this runtime and has not left its native scope. Original SDK owners and the pending source/app record remain current; the existing fence does not mark `queuedLost`. The legacy result then qualifies at30000 and only a later admission at40000 shortens its groups to3640000, not the missing original3620000 ceiling. Refusal of the current-entry matcher cannot classify this finite event as foreign or never admitted; public `target`/`at` fields cannot repair that provenance gap. The result cohort is captured exactly once at ACK10000. Its returned native apply is never attempted in the successfully matched same-runtime held cases; the foreign-runtime and cancel-before-match legacy controls apply that original capture at editor qualification30000. The cancellation-after-valid-match expiry is therefore not a hidden result-ACK cut. The successfully matched same-runtime cases retain original result deadlines86405000 after the editor drains; no conditional ceiling is applied and no weak-fact prefix is promoted. Both legacy controls preserve the original3610000 SDK cutoff and a later same-runtime admission at40000 demotes their qualified result groups to3640000; that is not an implemented SDK conditional-tail history. These outcomes separate SDK demotion, pending source authority, native ACK, actual editor/final-owner qualification and independent RPC drain. The probes invoke the original matcher/app guard explicitly as labeled mechanism checks; passive WeakRef observation is not GC evidence or authority. The native finite-event prerequisite is now closed by the [private owner method below](#finite-sdk-admission-event-private-unwired); the following assessment constraints govern the separately implemented bounded conditional owner, not a general interleaving grant. Authenticate the original native runtime/profile/operator/target/binding, original SDK provider/history and still-live synchronous event scope even when its already-admitted question has since terminated; do not renew that question or silently change the existing current-entry matcher default. Copies/proxies/equal fields, lost original SDK/binding authority and post-scope calls still refuse. That evidence then supports one separately opted-in synchronous capture on the existing `queuedResult`/projection closure. It must spend/guard the original attempt against reentry, validate the original producer/publisher/SDK/source scopes, match the genuine finite event before its scope closes, then run pinned native app FS before the trusted data barrier. Retain only the authenticated original numeric ceiling on that owner, not the admission token/function or a new SDK/head owner. Reuse the original ACK-time SDK/agent captures; after the original editor and final guards qualify the whole roster, apply only an earlier producer/conditional ceiling without another owner lookup or capturing a newer SDK head. An already-elapsed ceiling, unknown/second matching admission, source/app/SDK loss, agent interference and second native attempt stay outside the initial positive subset. Cancellation after a valid finite admission must not be recast as cut rollback. No implementation or activation is granted by an isolated matcher success or a copied numeric field. The assessment closes scope/time/retention diagnosis and identifies the finite-event versus current-entry matcher gap, not runtime SDK-interference adoption. A universal waiter, delayed admission scope, deadline change while the result is held, scope recapture at editor settlement, removed sticky-loss fence, callback after the trusted barrier or new ledger/registry/timer is not an acceptable shortcut. General/retained/multiple-event/known-terminal/cold/foreign/remote-receiver histories and Root/default/v5/public Text/live/reload/release/independent/platform acceptance remain separate gates. Native local app no-write is not business purity or proof of every unobserved provider/file change. Source/actual-dist native cases and counterfactual assertion witnesses live under `/home/llb/pttmp/pending-sdk-*`; counterfactuals are not runtime mutations or released-defect credit. The fresh full11514 baseline is reused by byte equivalence, not claimed rerun for this documentation-only assessment. ###### Finite SDK Admission Event (Private, Unwired) The native SDK owner now has optional private `assertAdmissionEvent(admission)`. It authenticates the existing branded admission, original runtime/profile/operator/target/binding and pinned SDK provider/receiver history, returning only its original SDK demotion clock. It accepts an already-admitted event after that entry is canceled or expired, but only while the original synchronous native observer scope is still live. The existing `assertAdmission` remains a current-question matcher: a terminal entry still refuses, and neither method grants an answer, source disposition, business completion, publication or pending parent membership. The optional owner port preserves embedded structural owners; it is not a public Delivery entrypoint or new constructor policy. The original NativeQuestionAdmission facts own the additional guard; there is no new registry, receipt owner or timer. Entry phase/signal/deadline and finite admission history are deliberately distinct. The finite path skips only entry deadline/terminal liveness, never original SDK provider, generation, authorization, receiver or native binding checks. It rejects non-finite original clocks and copy/proxy/foreign/equal-field substitutes without probing proxy getters, retaining the original module-pinned native reader. Observed authority loss poisons the same native event in both directions between current-entry and finite-event guards, including across original SDK owners; caught shared-guard reentry is sticky too. Ordinary cancellation/expiry alone does not poison finite event history. The original owner also keeps its own nonrenewing scope/reentry loss. After the last original SDK callbacks, one data-only native event/binding check closes late shared-history loss without another provider callback. Thirty-nine properties cover Confirm/Choice/Text and Classic/Threaded, live/canceled/expired entries, original clocks, structural omission compatibility, native identity/static-reader substitutions, foreign/wrong-target/birth tuples, original scope loss, shared reentry/legacy history, final native data and actual publication drain. Source/actual-dist native result graphs retain the original SDK publisher/worker/source/editor owners and still show unchanged store behavior: valid finite events return20000 even after cancellation-before-matching, while the legacy matcher refuses that terminal entry. Both original projection/result SDK owners agree; foreign runtime events still refuse. Source/app loss remains independent and requires its own guards. Replaying either token after the observer returns refuses even while native publication is held. Native GC witnesses collect the obsolete event token while its original SDK owner stays current, including while actual publication I/O remains pending; shutdown cannot release that lane until its own operation drains. Existing complete-parent/current-publication GC witnesses remain separate. Twelve exactly restored assertion-RED models distinguish terminal versus finite matching, runtime/target/reader identity, scope closure, sticky event/legacy history, caught reentry, original owner guards, finite clocks and final data. Evidence is under `/home/llb/pttmp/finite-admission-*`; deterministic/native workers and self-review do not constitute independent/live/platform acceptance. The optional private `matchAdmissionEvent(admission, finalUse?)` now distinguishes intrinsic non-match from matching uncertainty. A copied/proxied/non-native value, another runtime/binding or a different target returns `undefined` without probing SDK providers or final-use guard getters. A matching original event whose scope/authority is lost throws; it must never be treated as absent or foreign. Changed matching birth profile/operator still poisons the original owner. The existing asserting method delegates to this same native matcher but continues to throw for non-match, preserving its prior API contract; current-entry matching is unchanged. Neither return shape proves that the original owner is current in every other respect. For a genuine match, the caller may supply exactly the existing narrow native purposes: `assertAuthority` for original native app FS and required `assertCurrent` for the trusted data-only row/source/roster barrier. Snapshot these functions before SDK callbacks. The SDK finishes its original provider/event callbacks, then runs native app authority, native flag checks, trusted data and final native flags without another provider callback. Every supplied callback must be synchronous and return `undefined`; Promise/non-void results, malformed guards and caught SDK reentry refuse without extending the observer scope. No generic executor, business callback/permission, new owner, registry, timer, receipt or IPC function is introduced. This is a trusted private native-cohort contract, not authentication of arbitrary hosts. Twenty-three additional properties distinguish typed non-match with zero guard/provider/getter calls, genuine matching-event loss, function snapshots, app-before-data order, both synchronous-void boundaries, SDK reentry and native binding/shared-history loss before or after data. Native result graphs use the actual pinned app FS guard and retained `queuedResult.assertCurrent` as these guard purposes: valid matching events return20000, foreign events return `undefined` without guards, and observed source/app loss throws rather than masquerading as non-match. These callbacks do not shorten held deadlines or install membership. Actual publication/editor/drain and the store's existing fence remain separate; no conditional record is installed by this SDK consumer prerequisite. These SDK changes close only native event/consumer prerequisites. Omitted store policies retain their current-entry sticky-refusal/legacy boundary. The separate conditional store implementation below consumes these ports; it does not change SDK defaults, authenticate arbitrary hosts or grant general/remote membership. ###### One-Event Conditional SDK Tail (Root Bounded) Constructor-private `ordinaryDeferredSdkTail:true` requires the existing deferred feedback policy. Only the original consumed read-only projection, one native result ACK and its still-owned original feedback editor may use it. It neither replaces the existing interference fence nor creates a head, registry, ledger, timer, waiter, executor or public API. Missing original matching support refuses qualification; omission preserves released/private-prior behavior. Root now composes this policy with its original deferred editor and native SDK admission forwarding; omitted embedded SDK/store defaults remain unchanged. Root witnesses authenticate the original admission time synchronously, retain no event token and wait for original editor settlement before applying its unchanged ceiling; namespace loss and second admissions stay held. Question birth pins the original optional `matchAdmissionEvent` function before app/producer callbacks. The result ACK snapshots original owner/matcher, deadline objects/shorteners, complete candidate groups, physical transition, source authority and the existing SDK/agent captures. The same frozen `queuedResult` gets one private synchronous `admit` operation; no token or callable from an admission is retained. Its reentry/spend guard belongs to that existing closure. Intrinsic native non-match returns without consuming the one matching-event allowance; it does not certify freshness. A matching authority error, a second matching event, absent original matcher, observed reentry or source/SDK/producer/publisher/app loss makes the existing projection sticky-held. Within the original native observer, matching first authenticates the finite event even if its SDK question was canceled before matching. Original producer/publisher/SDK/scope callbacks run before a final native matcher call with pinned app-FS authority and trusted row/source/roster data. The native SDK finishes its callbacks, then runs app FS, data and final native flags. Only equal, finite original admission clocks and a still-future ceiling may be recorded; no provider/getter/filesystem callback follows that successful barrier. The closure retains only `admittedAt + 3600000`, not the visible current clock, event token, new scope or cohort. SDK cancellation/expiry does not roll back a valid admission cut or resurrect the terminal question. The original pump still owns membership, cleanup and actual editor drain. Only its original editor fulfillment, final owner, exact prepared carrier/after-frame and complete original source/parent/successor roster may invoke the one-use retained result completion. Original ACK-time SDK and agent captures apply unchanged; neither the intervening SDK head nor a later SDK cohort is reselected. Before conditional deadline shortening, original callbacks, native app FS and trusted data qualify the entire retained roster again, including future ceiling and original deadline/method identities. Shortening is monotone; earlier producer cutoffs win. Failure withdraws provisional weak facts through the existing whole-transition path, without undoing native methods, state, authorized prior cuts or actual work. The existing completion/projection data guard already blocks a second SDK event from borrowing staged weak facts; a duplicate proposed guard was removed after its mutation survived. Native timing witnesses use ACK10000, admission20000, provider clock27000 and editor30000: qualified groups end at3620000, original SDK predecessors retain the ACK-time3610000 cut, and the intervening SDK head is not cut by settlement recapture. Independent actual SDK RPC may remain pending while the editor qualifies; its own owner drains it later. Cancellation before/after matching and Confirm/exact-N/wizard collectors preserve the same birth/deadline and non-dispatch answer data. Intrinsic foreign native runtimes remain separate controls, never authenticated foreign receiver adoption. Source/actual-dist property, native graph and GC evidence lives under `/home/llb/pttmp/conditional-tail-*`. Native probes separately expose source/app loss during final SDK callbacks: matching uncertainty cannot be disguised as foreignness, nor can earlier data history replace fresh app FS. GC must collect an admission while `queuedResult` and even its SDK RPC remain pending, and collect obsolete projection/action/invocation/binding/result after actual drain while the current successor/publication stays live. Exactly restored assertion-RED models are distinguished from survivors and fixture/filter diagnostics. Pre-ACK SDK interference, unknown/second matching events, agent interference, second native attempts, elapsed ceilings and lost original facts remain held. General/retained/multiple-feedback/known-terminal/state-changing/cold histories, authenticated remote receiver/source disposition, independent/platform/live acceptance and broader defaults/public Text/v5/reload/release remain gated. This bounded local app no-state-write proof is not business purity, digest/writer exclusion or proof of every unobserved provider/file change. ###### Retained Original Question Group (Native Assessment, Held) This assessment changes no runtime, package tests, SDK, default policy or production wiring. It asks whether one already-published question group can remain in the proposed physical carrier beside a complete fresh result roster after the original native read-only callback. The existing native graph retains callback dispatch, exact invocation, actual worker exit plus original termination settlement, app binding/read-only lineage, original source, native Bus/client, physical preimage and the original pending feedback editor. The golden app still emits only its normal fresh declaration. A labeled main-side fixture augments that proposal with the exact old native keyboard cells; it does not prove standalone-app retention intent or introduce a retained-question authoring API. Thirty-two source and thirty-two actual-dist cases have exactly equal complete outcomes: Classic/Threaded × HTML/Rich+keyboard × mixed/pure result rosters, for four carrier proposals. Full fresh replacement and omission of one whole independent fresh group qualify. Inclusion of one whole original group or only half of that same group stays held. The original old group has already been demoted by SDK admission5000 to3605000; none of these proposals renews that deadline or its birth. The held cases fail the first result edit on the original message before result-native I/O; the original feedback editor has already completed its own native edit and remains pending. The existing projection becomes lost, native Bindings falls back to a different-message send, and the read-only method still completes with `Done`. No original `queuedResult` or result SDK cohort is captured at that fallback ACK. The exact native app lineage remains available, but original source history—live at planning—is already lost after that refused attempt; later editor fulfillment or copied controls cannot revive it. In the qualified controls that source history remains live at ACK and closes only after the original transition is consumed/cleaned up. Neither terminal source history nor read-only lineage is a reusable authorization for another edit. Native preparation strips old callback identities from the fallback wire while retaining their visible labels without callbacks. A labeled stale-key replay against the new message returns `Button action expired`; it is not a tap on a still-visible old callback. A genuinely visible fresh selection in that same fallback still returns one ordinary question/answer JSON value, including method-looking answer data, without invoking an app method or intermediate model. Thus answer usability and semantic completion are not question-head membership. A genuine finite same-runtime SDK event at20000 still authenticates, but both fresh groups retain86405000 through original-editor settlement30000 and a later SDK admission40000. A prepared fresh-only wire image cannot erase the unsupported retained proposal, restore source authority or supply a weaker qualifying prefix. Full fresh controls retain the original SDK capture at ACK10000, apply it once at editor30000, keep the original SDK predecessor's3610000 cutoff and shorten included fresh groups to3620000. Omitting a whole independent planned fresh group before the descriptor captures its proposal leaves the included group qualified at3620000 and the unused group at86405000. The complete proposed physical callback roster and each included group—not every independent group planned with a result—are the qualification unit. Dropping one cell from an included retained group is a different history and remains refused. At this assessed checkpoint the gap was narrow and owned: fresh `questionCandidates` excluded already-published rows and the co-head path refused a spent original attempt; whole-parent supersession retired every old parent group. The separately opted-in extension below now closes one original retained-group subset, while omission preserves these assessment outcomes. Do not reset that old attempt, acquire a fresh origin at ACK, retire and recreate the retained group, erase projection loss or turn a fallback ACK into the original receiver. The assessed boundary, implemented below under its separate opt-in, requires capture of one complete retained group's existing members, lifetime, app origin, birth/deadline and first-physical SDK/publisher ancestry before callbacks, its original source/invocation and exact native read-only successor, and preservation as the original retained tail rather than a reborn/co-head group. Fresh groups must still qualify as one complete original proposal, including the conditional SDK ceiling when enabled; dropped old groups may retire only under their original native transition. Reuse the existing projection/publication/lifetime owners, not a retention ledger, waiter, receipt registry or new public markup. Sixteen nonempty counterfactual assertion witnesses separate complete retained data from original-parent permission, `Done` from membership, finite SDK matching from physical source proof, and included-group completeness from a whole-result transaction. They receive zero runtime-mutation or released-defect credit. Fixture diagnostics included an initial syntax error and an incorrectly treated `store.resolve` inspection: resolution is consuming, so that probe was removed, replaced with passive native-wire facts and deliberate post-drain presses, then every accepted source/dist history was rerun. Only the final `retained-question-complete-compiled-` audit is accepted. Artifacts live under `/home/llb/pttmp/retained-question-*`; the fresh full11678 baseline is reused by runtime/tests/dist/metadata byte equivalence, not claimed rerun. Partial/multiple retained groups, changed-generation/state-changing/known-terminal/foreign/cold histories, multiple feedback, remote receiver/source disposition and independent/platform/live acceptance remain outside this assessment. Root/default/public Text/v5/reload/release stay off. Exact copied controls, a native result, app no-state-write and local deterministic execution do not establish arbitrary-host authority, business purity or unobserved provider/file currentness. ###### One Retained Original Question Group (Root Bounded Rich) Constructor-private `ordinaryRetainedQuestionParent:true` requires both `ordinaryQuestionParent:true` and `ordinaryDeferredFeedbackParent:true`. Omission keeps the assessed refusal/fallback behavior. The existing original projection/publication and `groupFacts` lifetime own this bounded extension; no extra retention map, timer, waiter, receipt, executor, public entrypoint or markup is introduced. Root now composes this existing policy for explicit producer-owned native Rich proposals. Omitted embeddings retain their prior boundary. Source/compiled Classic/Threaded Root witnesses run the actual trusted worker, which intentionally re-emits the original native rows from its explicit fixture input alongside fresh declarations, rather than augmenting a fabricated result or inventing an authoring API. Before body/parent/provider callbacks, the result descriptor snapshots the original projection's retained candidates: exact member/action/group/lifetime, native app binding/owner and original guard functions, spent attempt, original birth, deadline/shortener, publication weak fact and first-physical SDK/publisher ancestry. Exactly one complete included original group may remain; fresh candidates continue to exclude published actions. A genuine same-path/generation/revision peer binding is still not the source's original binding. Partial/multiple groups, missing or substituted origins, foreign/unowned/terminal history and replay after a refused attempt remain outside the positive subset. A whole independent fresh group omitted before capture is not a partial included group. The same original consumed row/query/input/invocation and exact native read-only successor must qualify the complete proposed carrier, fresh rosters and retained original members at the original result ACK/editor/final-owner boundary. The retained lifetime is never reset, retired/recreated, promoted to a fresh/co-head descriptor or rebound at ACK. Native transition cleanup retires only genuinely dropped original groups. Retained controls keep their original native message and ordinary selection semantics; method/slash-looking values stay answer data with `binding === undefined`. The original ACK-time agent-tail capture includes the retained group even though it belongs to the proposed carrier; only fresh groups enter the new head cohort. Original SDK and agent captures apply after the same editor/final-owner qualification, without recapturing later heads. A retained original tail is shortened monotonically from the original ACK clock, never from editor settlement. Earlier producer/SDK deadlines win. The optional one-event SDK ceiling still applies only to qualified fresh heads; it cannot extend or rebirth the retained group, renew a canceled SDK entry or shorten the intervening SDK head. Elapsed retained deadlines, source/app/publisher/SDK loss, second matching admissions and any second native attempt remain sticky whole-transition refusals. Original callbacks precede native app FS and trusted data; no provider/getter/FS callback follows the successful data barrier. Native timing keeps old groups already cut at5000 to3605000 unchanged. Fresh groups qualify at editor30000 under the genuine event20000 ceiling3620000, while original SDK captures remain at ACK10000/3610000. Separate unit controls without a prior agent cut prove that an otherwise-live original retained group becomes3610000, not a new24h head or a settlement-time3630000 tail. Their SDK predecessor is opened after source consumption and cannot be misreported as an earlier authorized agent cut. Original retained attempt/origin/owner/birth/deadline/publication/scope/history identities are unchanged, including Confirm/exact-N/wizard fresh rosters and native retained answer presses. Evidence under `/home/llb/pttmp/retained-parent-*` includes77 new package properties, complete source/actual-dist native outcome equality, finite-event token GC and exactly restored assertion-RED models. At the private checkpoint, the golden app remained a normal fresh-output app: its retained cells were an explicitly labeled main-side fixture proposal, not standalone-app authoring permission. The later Root witness separately exercises an actual worker-authored native Rich proposal using explicit producer-owned published controls; it grants no general discovery/retention API. Disabled/partial/native-peer controls preserve fallback/source refusal and cannot acquire a weaker fresh-only head. GC distinguishes owners instead of declaring a live first-physical guard leaked. Consumed source/action/invocation/result/projection collect while the retained question and current successor remain live. After the retained question ends, its group collects, but its original app-bound first-physical publisher still owns the original app binding while fresh controls use that same physical publication. Only actual publication clear/drain permits that publisher/binding to collect; current successor result and fresh group identities remain separate. An initial expectation of binding collection immediately after question completion was a false fixture premise, corrected without a runtime change. The preceding native assessment remains the omitted-policy falsifier, not an attempt eligible for retry. Local proofs do not certify standalone-app retention intent, business purity, arbitrary-host or remote receiver/source authority, writer exclusion or every unobserved provider/file change. General/multiple-retained/multiple-feedback/state-changing/known-terminal/foreign/cold adoption, independent/platform/live acceptance and broader defaults/public Text/v5/reload/release remain gated. #### Declarative Interaction Pre-Release Composition Boundary **Local integration authorization:** production Root/default question-policy wiring is now explicitly authorized as pre-release preparation, subject to the original-provider/receiver, registry, scope and actual-I/O proofs below. This does not authorize private Input/Attachment re-landing, receiver IPC/v5 activation, runtime-data changes, reload, operator acceptance or publication. The inventory distinguishes the connected bounded direct/follower subsets from the still-held general app/remote histories; the [question-free timed child](#question-free-timed-refresh-child-root-bounded-original-first-wire) is connected; [original direct edit retention](#direct-native-edit-carrier-root-bounded-original-operation) is connected; remaining first-physical histories need new proof, not another Root flag. The working tree is not ready for the complete declared feature release merely because its private question-lifetime kernels pass. This is a source-composition reconciliation, not live acceptance, a change to release scope or another open-work surface. [BACKLOG](../BACKLOG.md#declarative-interaction-acceptance) alone owns remaining tasks. - **Public membranes in the working tree:** `api/delivery.ts` exposes exactly eight value functions: `deleteTelegramView`, `editTelegramView`, `openTelegramTaskView`, `openTelegramChoice`, `openTelegramConfirm`, `sendTelegramArtifact`, `sendTelegramChatAction` and `sendTelegramView`. Confirm/Choice/Task/Artifact remain separate producer-owned primitives. Text/Attachment openers and all lifetime/provider/cohort/store-dispatch/invocation/worker policies are not added to that public membrane. - **Agent selection is implemented, not the whole planned language:** Root connects the existing button store, normal assistant and app planners, callback handling, native publication observer/editor and Queue path. Confirm/Choice/exact-N/wizard answers remain ordinary answer JSON without method dispatch. This working-tree implementation does not establish release, loaded-runtime or client-visible acceptance; Text/Attachment markup and private SDK input are separate. - **Bounded direct SDK/agent composition is connected:** `lib/extension.ts` supplies original selection and native registry-bound SDK captures, conditional direct publication authority and synchronous native admission forwarding. Root/Bindings planners adopt 24-hour defaults and label app questions so they cannot masquerade as unbound agent questions. SDK/provider availability gain and loss reconcile through existing lifecycle ownership; a pending ACK never reads a successor. Source/compiled Classic/Threaded production-root regressions exercise actual planners, native HTTP ACKs and replacement. Original app first-send capture is now connected with separate independent selection authority. Root callback-worker drain is now connected with original execution and explicit callback-target preservation, including an unavailable-SDK control. App-only bound successor lineage is also composed and verified before planning, independently of SDK availability. Qualified exact dispatch/invocation and bounded mixed-footer HTML/Rich feedback/edited-child ownership are now composed with actual Root witnesses. Pure-question/queued/deferred and one-event conditional tail policies are now composed with native pending-I/O/editor witnesses and sticky namespace/second-admission refusal. One retained original group is now composed with an actual worker-authored native Rich carrier; original lifetime/selection survive without a new birth, and partial/owner-loss proposals stay held. The app-specific edit port uses the existing configured single-Markdown renderer and captured execution guard without changing harness-menu HTML. Authenticated remote plain/native-app first sends, plain known-parent Text/Rich/keyboard-only markup edits, the first read-only callback child, pure/queued/deferred single-admission children and one producer-backed retained native Rich group now have the bounded original-owner/carrier joins above. Timed managed app refresh now has a bounded first-parent native issuer/one-attempt/ACK/final-use join for mixed or pure-question output, without a fake callback or renewed original clock; wider general app-parent/unproved mixed/partial-or-multiple-retained/edit-first/non-superseding markup histories remain held, not candidates for flag-only activation. Private Input receiver gates are not silently enabled. Root remains composition-only. - **Defaults and eligibility remain distinct:** SDK and production agent Confirm/Choice omitted timeout is 24h; ordinary/app prompt callbacks are also 24h. Only positively owned bounded direct and negotiated-follower SDK/agent/app publications coordinate tails. Missing SDK/remote membership retains independent UI only while original producer/app authority remains valid, never grants common membership. `/name` remains a separate five-minute dialog; no Name/Input migration, private collector activation or live acceptance follows. - **Next-text/source remains locally incomplete:** Public Text is unexported, production receiver/readiness ports are unbound, and known exact-reply handling is not modal next-text capture. The pre-ACK association boundary remains an authorized local implementation task. Bounded first-observation ingress already protects original opening A before ACK, with optional native snapshot provenance; it is not accepting next-text collection. Warm non-use/CAS and the instance-local sweep hold do not supply ongoing/cold association, positive SDK/source use, sibling/writer exclusion or production adoption. Name migration depends on the accepting common Input path. - **Other acceptance boundaries remain independent:** Attachment durable pins/history, foreign donor/receiver IPC and unknown/cold source disposition cannot borrow question-lifetime proofs. One original retained group is supported only under its private policy and exact original transition; the main-side augmentation fixture is not standalone-app retention intent. Original app no-state-write is not business purity or arbitrary-host/remote authority. - **Operator/environment gates are not local fixtures:** Independent review, supported-platform and operator-live acceptance still need their named evidence owners and a separately authorized loaded candidate. No subagent, reload, actual quit, runtime-data/tab/binding mutation, version bump, commit, push, tag or publication is performed or authorized by this reconciliation. Do not silently exclude unfinished parts of the declared feature to call the whole release ready. The earlier direct/native question-lifetime checkpoint is `/home/llb/pttmp/retained-parent-validation.json`: fresh full11755/11750pass/0fail/5skip, plus source/actual-dist/native/GC and exactly restored assertion-RED evidence. That evidence applies to its pinned implementation and fixture bytes; context-only reconciliation reuses it rather than claiming a fresh runtime test. Native mocks, worker exit/termination, semantic completion, original editor drain and final publication qualification remain distinct from operator/platform acceptance. #### Staged Source Acquisition Fence (Journal, Implemented) A real local child-process witness exposed a narrower current-writer race beneath the v5 activation gate. A valid legacy-v1 source writer using a different native source-serializer path could acquire a strict absent-family observation, then pause before obtaining the common per-family transaction. The private v5 initializer could publish while holding that transaction; after release, the legacy writer used its cached absence and overwrote v5 with v1. Existing-snapshot refusal and observing both known mutexes did not close this pre-acquisition window. A same-byte v1 snapshot replacement is the same stale-observation class without a schema change. `createJournalStoreCore()` now preserves the strict non-destructive source preflight **before** the transaction helper may create anything, but rechecks that exact native physical/namespace observation **inside** the acquired family transaction before any operation can use it. It does not silently refresh/rebase the source under a waiting operation. The existing bounded, sticky Journal observation guard is reused for current source-aware v1/v2/v3/v4 stores; no schema, lock owner, serializer namespace, Source DTO authority or public API changes. A changed snapshot, inode or observed family namespace refuses before source mutation, even when its logical bytes are equal. Source-free legacy operations continue to read inside their family transaction. Mirrored native/actual-dist tests launch an actual local writer with a different serializer and gate only its filesystem lock-attempt timing. They prove refusal after absent-to-v5 birth and same-byte v1 replacement; the original v5/v1 bytes remain exact. Child processes inherit the compiled-verification preload, so their implementation is redirected/audited too. The original implementation and removal of the in-transaction guard both assertion-fail this interleaving. Existing early guard rejection remains before transaction creation. This repairs participating **current-code** stores, not already-loaded older binaries, unenumerated resetters or nonparticipating writers. Quiescence/exclusion of those actual participants, v5 source admission/selection, cold unknown-source handling and activation/readiness/live gates remain separately open. Source metadata alone cannot prove that all incompatible processes are absent. #### Native Companion Command Enrollment (Private, Unwired) `Commands.captureTelegramExtensionCommandExclusion(canonicalName)` captures only a genuine current enrollment created by `registerTelegramCommand()` in its original registry object/map, with the original name and ordinary handler callable. The existing command entry carries private native birth facts; no second registry, identity map, timer or public membrane is introduced. Its ordinary plain-record prototype, own-key order/descriptors and handler receiver remain unchanged. Legacy structural registries/selected preparation remain supported by the ordinary path, but equal/copied/prototype/proxy records, peer maps/registries and alias keys cannot become native enrollment proof. Canonical parsed names are required; this helper neither parses a raw source nor authenticates a bot mention/address. The passive frozen result has `name` and synchronous void `assertCurrent()`. Capture/guard never call a handler, selected preparation, classifier, registry accessor or substituted Map getter/method. Own-data checks and pinned native Map access decline unsupported/foreign roots before probes; absent lookup does not create or repair a registry. Matching observed membership/name/handler/root/method loss throws and sticks to that original native entry after restoration. Native dispose/clear issuance revokes it even if the old record is reinserted before another observation; a fresh public registration is a distinct enrollment, and a stale disposer cannot delete that replacement. Foreign intrinsic non-match alone does not revoke the genuine owner's enrollment. This is observed history plus native retirement, not exhaustive detection of unobserved foreign mutation or arbitrary-host authentication. This guard concerns the original ordinary handler enrollment, not selected-prepare lifetime, business purity, handler invocation/admission/result/drain, receiver/source freshness, SDK use, source disposition or a command execution claim. Original functions stay in-process, never serialized/function-IPC. A discarded capture collects while its entry remains live; after retirement and caller release, the obsolete entry/capture collect while a replacement remains native-owned. Existing Commands ownership retains these facts; no routing wrapper or Root closure invents them later. **Private-consumer boundary:** the separate `companionCommandFrame` opt-in above consumes this helper only through the existing selector/source barrier. `coreCommandFrame` without it remains core-only and continues holding genuine companion/template/unknown frames before Input observation. Public/default/Root/common-provider composition does not consume the new policy. Passive enrollment plus that bounded storage partition grants no handler execution, source completion, accepting SDK collection or production activation. Remaining work lives only in `BACKLOG.md`. #### Prompt Template Provider Boundary (Assessed, Not Source Authority) Prompt templates have a different owner chain from native companion enrollment. `Pi.createExtensionApiRuntimePorts().getCommands` delegates to the current `api.getCommands()` with its ordinary receiver/getter semantics; Root's menu getter and Routing's paired-runtime wrapper both reuse `PromptTemplates` normalization. Discovery calls the provider, accepts `source: "prompt"` path metadata, applies reserved-name suppression and first-wins canonical collision handling, then returns plain records. Ordinary expansion reads the current named file (or its supplied reader), strips frontmatter and substitutes arguments. It is not a passive native catalog enrollment, original provider/resource epoch, file-incarnation seal or physical-source receipt. The inspected Pi SDK loader checks extension activity before delegating to `runtime.getCommands`; the runner binds that current action, and AgentSession maps current ResourceLoader prompt templates into fresh metadata. A stable outer API/port/getter function and equal command/path values therefore do not by themselves certify the original inner producer, catalog incarnation or file bytes. This observation is not a claim that ordinary dynamic discovery is broken, nor a mandate to pin all template bytes for an exclude-only partition. A catalog enrollment/lifetime proof and an authorized body read/effect are separate requirements. Commands' existing held-template plan already pins its semantic owner/get/expand functions and rechecks the uniquely matching command/path, extension collision and expanded text. Those checks intentionally call `getCommands`/`expand`; they must not be borrowed as a callback-free pre-ACK source classifier or physical-source completion proof. Native assessment witnesses across opening/waiting and Classic/Threaded show that querying either the ordinary getter or held eligibility before original Input capture can cause a supplied callback to replace A with B. The plain-only original-capture-before-metadata control retains A, while actual core/native-companion selectors continue holding a genuine template-containing frame without any provider, expansion or Input probe. Equal-value provider replacement, trusted getter receivers, file replacement, canonical collisions and advertised-name suppression are also distinct observed boundaries. These are controlled counterfactual/compatibility witnesses, not released defects, runtime mutants, actual Pi session rebinding or arbitrary-host authentication. **Still held:** no template exclusion flag, native template enrollment or Source/Root adoption is implemented. A future boundary must obtain original producer/callable/lifetime evidence in the existing owning Pi/lifecycle/PromptTemplates path before invoking resolver callbacks, then bind it to the original frame barrier; wrapping a current getter or branding returned metadata late cannot supply missing authority. The birth-pinned API callable boundary is implemented separately below; its sufficiency for catalog/resource lifetime remains unproved. Preserve ordinary/selected callback behavior and the Commands-native frame partition; do not add a shadow registry, force template expansion to recognize a name or infer source use from absence. Remaining work lives only in `BACKLOG.md`. #### Original Pi Command Provider Callable (Private, Unwired) `Pi.createExtensionApiRuntimePorts(api, true)` privately captures the original own-data `api.getCommands` function before any provider callback. Omission retains the existing nine dynamic ports, original getter counts/receiver semantics and no capture property; the ordinary `ports.getCommands` stays dynamic even when private capture is enabled. Invalid non-true options, accessor/inherited API slots and proxy API objects/callables refuse before invoking them. Root still calls the factory with one argument. Only the opt-in adds `captureCommandProvider()`, returning the same frozen `PiCommandProviderCapture` owned by those existing ports. It exposes synchronous `assertCallable()` and an explicitly guarded `getCommands()`; no registry, timer, lifecycle/session selector, metadata cache or generic executor is added. The module-pinned `readPiCommandProviderCapture(value, ports)` authenticates the capsule's private brand and exact original ports object. Copied/prototype/proxy/getter DTOs or foreign ports are intrinsic non-matches without probes or revocation of the genuine owner; constructor/static-reader substitution cannot mint or replace a capsule. The callable guard checks original own-data API method, ordinary getter port and capture port identities using pinned native own-data descriptor extraction, including the descriptor's own value slot rather than an inherited `value` getter. Matching loss is sticky through restoration. Private `getCommands()` uses pinned `Reflect.apply` with the original function and API this-argument, never the function's substitutable `.call` property. It checks before invocation and after the synchronous callback, with pinned native array recognition and no getter/provider callbacks in that final barrier. Caught native capture/read/guard/invocation reentry poisons the outer observation. Original SDK exceptions preserve their cause/identity and retire this capture; non-array outcomes, including ordinary Promise/non-array thenables, are refused without probing a `then` getter. Arrays and their elements are not authenticated, cloned or inspected for accessors/thenability. This is a synchronous SDK-query contract, not an async-work/drain wrapper. **Deliberate limit:** `assertCallable()` proves visible callable/port identity only, not the SDK's hidden extension activity, current Core action, original inner producer, ResourceLoader/catalog enrollment, source freshness or physical-file incarnation. Hidden SDK inactivity can leave the passive callable guard valid until the original SDK method itself refuses; that observed failure then stays lost. The same API function can validly return a different inner producer's equal metadata while this callable proof remains valid. Returned arrays remain ordinary data, not native catalog/source receipts. Trusted host API construction is a premise; this does not authenticate arbitrary hosts or make ordinary discovery/selected-template callbacks pure. Discarded capsule/port cycles collect while an independent ordinary API port remains owned; a retained capsule keeps its exact original ports alive until release. These lifetimes do not grant template classification, Source submission/disposition or accepting Input. Template-containing frames remain held without these callbacks. Native companion enrollment remains a separate Commands issuer. No consumer, Root/default policy, public export, production readiness or live SDK session is adopted here; the actual SDK producer/lifecycle/catalog proof remains in `BACKLOG.md`. #### Installed SDK Producer Lifetime (Assessed, No Passive Catalog Port) The installed SDK **1.0.0** owner chain is now exercised, not only inferred from bridge-controlled API objects. Isolated fixtures obtain the actual API from `loadExtensionFromFactory`, bind it through real `AgentSession`/`ExtensionRunner` constructors, and use native `DefaultResourceLoader.extendResources()`/`getPrompts()` over owned prompt files. A resource-loader subclass only supplies the owned native extension result through `getExtensions()`; it does not replace API methods, Core command mapping or prompt loading. In-memory settings/sessions, an unread model-service sentinel and a non-running Agent avoid user configuration/extensions, credentials, model requests and live runtime state. These internal SDK imports are fixture-only, not new production dependencies. SDK API `getCommands()` checks failed-load state and `runtime.assertActive()` before invoking the current `runtime.getCommands`. Before Core binding, the original callable exists but querying it throws not-initialized; a bridge capture that observes that failure remains lost after native binding, while ordinary discovery can work. Failed-factory discard also retires an escaped actual SDK API and removes its event subscription. Runner invalidation/session disposal fences the original SDK method; rebinding Core afterward cannot reactivate that retired API. Passive bridge `assertCallable()` cannot observe these hidden issuer states without a semantic query. This distinguishes real SDK retirement from a callable-slot check rather than inventing another lifecycle owner. Native resource extension can replace the prompt roster and member objects at the same path with equal metadata while both visible SDK API and Core callable identities remain unchanged. Adding an owned prompt likewise changes query results without changing those callables. The real Core mapping returns fresh ordinary command DTOs, not an original catalog enrollment or producer-retirement capability. SDK extension-command and prompt metadata share that query; neither is the separate native Telegram companion enrollment. `resources_discover` supplies startup/reload path declarations, not a physical-source or catalog-epoch receipt. A deliberately shared-runtime fixture additionally binds a second real SDK session producer while retaining the first API method. Its current command catalog changes under a still-valid callable capture. This is a controlled native-composition counterexample, **not** a claim that normal Pi replacement omits invalidation: the inspected `AgentSessionRuntime.teardownCurrent()` aborts, emits shutdown and disposes the old session before replacement. Native disposal/refusal is positively tested separately. Equal metadata, fresh DTOs, method identity and that counterexample prove neither a production rebinding bug nor arbitrary-host authority. **Template widening is SDK/host-producer gated for this inspected boundary.** The extension API exposes current `getCommands()` metadata but no passive original catalog/resource enrollment and retirement port; host-side `ResourceLoader.getPrompts()` is also plain data. The missing unblocker is positively owned producer evidence on the original receiver before resolver callbacks, or an explicitly approved different exclusion contract—not another bridge wrapper, late metadata brand, semantic resolver call masquerading as passive inspection, shadow registry or blanket file-byte pinning. Keep template-containing frames held. No template policy, accepting collector, Source disposition, Root/default/readiness, installed-SDK mutation or operator/live acceptance follows from this assessment; remaining work is canonical in `BACKLOG.md`. #### Private Session Sweep Hold (Implemented, Unwired) `createTelegramSessionFolderSweeper()` accepts the package-private `preserveJournalFamilies?: true` construction option. Only literal `true` or omission/undefined is accepted; other runtime values refuse construction rather than silently selecting destructive cleanup. The value is captured once. A held `sweep()` returns an empty removal list before clock, session/profile/keep-set callbacks or filesystem observation. It suppresses the entire sweep, including empty-folder removal, rather than parsing a readable v5 marker and treating everything else as disposable. Protected, malformed, torn, unmarked, snapshot-less segment/retention history and empty namespaces remain untouched. This deliberately holds ordinary-looking families too: it does not yet prove any source safe to release. There is no deadline, automatic demotion, mutation-based release or source classification. Omitting the option preserves the released orphan/default cleanup policy. Root does not pass it, legacy `recovery`-folder removal is unchanged, and no production behavior or readiness is activated. Changing the dependency object later cannot release a held sweeper or retrofit an already-created default one. Constructing another default sweeper can still remove the same v5 fixture: this mode is a local negative effect boundary, not a durable source pin, global protocol/participant closure, source completion/ACK or reconstruction authority. Its empty result does not attest that a source exists, is unused, or has completed; a later call neither repairs nor recreates a removed family. Mirrored native/actual-dist tests cover seven retained tree shapes with exact bytes/names/inodes, keep-set loss and elapsed time, one-read construction capture, zero observation callbacks, invalid runtime options and the separate-default counterexample. A controlled actual-dist composition also holds the native registry reference, Workspace lease, paired Config admission and both Journal mutexes: opt-in preservation retains every tested family while unchanged default controls reproduce the original deletion boundary. Four assertion-failing mutations establish hold, capture, literal-option validation and pre-observation ordering, with hash-verified restores. Synthetic source/association data and ledger liveness remain explicit fixture premises, not native Input selection, authenticated multiprocess exclusion or live acceptance. **Remaining adoption gate:** install the correct mode before the first protected write only through a separately authorized startup/root composition, with actual incompatible-participant exclusion and durable/unknown-history continuity. No runtime Journal or Telegram writes, Locks/reset behavior, public API/default/readiness, collector/SDK execution, Bus/Turns/Attachment, reload/live/commit/publication or new registry/storage family is granted by this local implementation. #### Receiver-Owned Input Scope (Private, Implemented) Text Input publication now requires the exact current instance receiver target, not merely a target authorized for ordinary output. In Threaded Mode a direct leader may send views to another live Thread, but cannot silently become that Thread's modal collector: explicit-target and active-turn Input requests resolving outside its instance target fail `target-unauthorized` before rendering/publication. Missing, throwing or renewed instance-target providers fail closed. Explicit own-target requests remain supported; generic View, Confirm/Choice, Artifact and Task View target policy is unchanged. A future cross-owner Input must first prove recipient-owned delegation; this checkpoint introduces no such protocol. The kernel captures the instance-target callable at construction. A final pre-admission observation after rendering/drain capture rechecks receiver authority, abort and deadline before any predecessor can be spent; callbacks ending the successor cannot replace an otherwise valid waiting Input. Each Text Input receiving/publication/effect observation checks that original callable and target; observed address loss, unavailable observations and caught observation reentry permanently fence the original question. Restoring equal fields cannot revive it. Scope observations remain non-settling SDK guards, not source disposition or submission receipts. At later valid target admission, questions marked lost are terminalized as invalidated (or expired if already elapsed) before predecessor callbacks can borrow the successor. Their opening work still retains existing capacity until actual I/O drains. The motivating offline direct/follower model used genuine Bridge/Ownership/native broker code with controlled registration and readiness ports plus mocked HTTP, not real Telegram or authenticated processes. Before confinement, direct permission to output into a follower's live target allowed two independent kernels to retain live guards there. The retained implementation instead refuses that cross-owner publication before I/O while independent original receivers continue to work. Cancellation still leaves original publication history, confirming that a latest publication record cannot stand in for a current Input owner. Source and actual-dist probes do not submit SDK text or write source journals; ordinary bare text is still not collected. Six semantic falsifiers cover admission, sticky loss, caught reentry, cross-admission scope history and final preflight/end observations, with hash-restored source. Public Text/readiness, next-text association, foreign custody and `/name` migration remain gated/staged as recorded in BACKLOG. #### Private Input Replacement (Local Kernel, Unreleased) Within the existing Delivery kernel, a valid admitted Text Input replaces active Text Inputs with the same exact profile/operator/bot/chat/Thread context, regardless of producer `owner`. Static request/target/render/readiness preflight failures do not spend the predecessor. Admission reserves the successor in the existing question map before predecessor disposal or drain observers run; reentrant newer admissions may replace that opening successor, but the outer call cannot reinsert it or attach an abort listener afterwards. Waiting predecessors resolve exactly once with frozen `{ status: "replaced" }`; opening predecessors return explicit `reason: "replaced"` without waiting for queued/issued publication. Existing explicit expiry still wins when the predecessor is already expired. Other targets and Confirm/Choice/Attachment remain independent. Replacement is terminal before transport effects, not contingent on a successful successor ACK. Failed/unknown successor publication never restores the predecessor, and old exact reply nonces, cancel controls and captured receiver guards cannot borrow the successor. Cleanup labels the original question as replaced under its original edit fences. A successor that reports an identity in the existing retired-publication cache is refused without editing that borrowed message. This is bounded local negative evidence only, not cold/history completeness or a grant to infer freshness from cache absence. Closed Text openings stay in the existing question map with `publicationPending` until the actual serialized publication promise settles; only then are their pool slot and drain observation released. Waiting-slot replacement can reuse capacity immediately, while queued/issued predecessors still count against the shared 256-question/task bound. Thus repeated supersession behind blocked I/O cannot accumulate an unbounded chain of retained publication closures; rejected excess admission does not replace the current opening Input. Terminal input whose actual I/O has settled is not retained forever merely because its outcome was unknown. No new registry, persistent/wire field, poller or executor is introduced. Native regressions cover Classic/Threaded and same/different producer replacement, target/family isolation, failed preflight, full capacity, queued/issued drain, bounded supersession, observer reentry, uncertain publication and reused publication identity. Scope, actual-drain retention, late-listener and publication-borrowing semantic falsifiers produce assertion failures and are restored by hash. This checkpoint is question lifetime only: it grants no private-source receipt/disposition/ACK, v4 adoption, cross-process modal selector or public Text readiness. Next-text capture and `/name` still use their separate gates; the retained exact-reply collector below remains the implemented addressing path. #### Text Input Foundation (Private, Unreleased) > **Release scope:** the private Text Input kernel, Input custody v4, journal v5 source protection and Text-source ingress code described in this section is not part of the current tree. The unreleased implementation, tests and the design records cut from here are preserved on local branch `wip/private-input-foundations`; remaining text records boundaries that still apply to the shipped code. See the re-landing item in [BACKLOG.md](../BACKLOG.md). Delivery now has a private Text Input request/reply kernel sharing the existing question pool, target queue, publication guards, finite timeout/abort, one-shot settlement and cleanup. It matches an exact reply-to message plus operator/chat/Thread and current profile/transport owner; duplicate publication identities fail closed. Answer validation preserves original text, applies snapshotted length/multiline limits, and refuses edits, captions/media, blank/control/malformed text. Command-looking text remains data. Cancellation uses an exact opaque `tginput:` control, never a native-command mapping. Terminal text-question identities remain cached inside one generation for one hour, capped at 512 records without answer bodies; expiry or eviction makes that cache lookup unmatched. Text-question cleanup now retains the opaque `tginput:` control as a truthful request-status button. A stateless reader inspects at most 65 rows × eight buttons and recognizes that control only on an original message from the configured bot, returning private routing evidence rather than a receiver or execution grant. Markers outside that scan yield no evidence; absence is not proof that an input is ordinary. Malformed/ambiguous controls and namespace conflicts yield unavailable evidence. Message-resident evidence survives the tested cache expiry/eviction and fresh-kernel cases without a new persistent root, but does not restore nonces or authorize a result. Reserved cancel/status callbacks are consumed before generic callback fallback, including absent/older bindings. Ownership additionally supports an explicit `retainOriginal` opt-in on the first known publication. The existing cache row then retains a frozen owner/target and follower-registration snapshot alongside its ordinary mutable projection; default records retain no extra receiver snapshot. Ordinary lookups may still rebind, but the original-owner lookup never does. A foreign original-forward candidate requires nonblank binding, registration, session, process-birth, cwd and endpoint identifiers, an explicit nonnegative integer session generation, positive integer PID and valid connection time, plus the captured protocol and exact current identity. Equal missing fields are not completeness. An omitted registration target is allowed only for a Classic publication; an explicit Classic target or any Threaded target must match the original publication. Incomplete origins, later opt-in and cache refresh cannot manufacture that provenance. Forget/prune/clear remove it with the existing row; it is not durable custody. The original lookup remains a read-only candidate, not an RPC grant. An explicit `captureOriginalForwardOwnership()` additionally captures the exact origin row, profile, immutable ownership projection and recipient snapshot. Its local `assertCurrent()` rechecks row continuity and the existing full semantic foreign-registration/target/protocol policy on every call; a failed or unavailable observation permanently invalidates that captured fence. Forget/recreate cannot renew an old fence even with equal metadata, while ordinary projection refresh and non-authoritative connection-time observations do not change the retained origin. Compose this guard with source and Delivery receiver authority at RPC issue/ACK; it is neither of those authorities. Generic generation/protocol validation alone can miss same-generation session changes. Native IPC fixtures pass the guard through the existing foreign-forwarder local assertion port to a controlled test server, including pre-write and post-write changes; they do not activate private reply forwarding or prove its authenticated recipient/journal disposition. The source composition now binds captured first-publication writers to Delivery and the follower API parent. Capture validates profile, target and complete live registration before I/O; a known positive receipt is pinned under that captured scope before the SDK handle or parent ACK succeeds. First-only writes reject an existing row rather than upgrading a later observation. A changed profile refuses the write; replacement after issuance may retain only the original diagnostic provenance and refuses success. SDK envelopes are copied before asynchronous proxy work; ordinary API recording keeps its existing path. Missing capture support refuses SDK issuance; missing/invalid receipts, failed post-send pinning and post-issued authority loss preserve `commit-unknown`, without replay. Pre-issuance refusal stays distinct, ordinary API classification is unchanged, and already settled abort/expiry decisions are not revised. These are source-level publication and local provenance-fence primitives, not durable custody or an integrated private-reply issuance/ACK authorization path. No private-input peer capability is advertised yet. Bridge and follower API publication now require an explicit synchronous `getTextInputReceiverBotId` readiness query. Its provider must return the configured positive safe-integer bot ID only when the local collector, source disposition and required peers are ready for the exact target; the query is not execution authority. The callable identity is captured, queried targets are immutable, and missing/older queries, invalid IDs or throwing observations refuse before API issuance. The question snapshots the ID and rechecks readiness at publication, answer and cleanup boundaries; the parent rechecks before pinning/ACK. Readiness/identity loss after issuance preserves uncertainty without replay, while a settled decision stays terminal. Confirm, Choice and ordinary views do not consult this gate. The source composition deliberately leaves the query unbound until real collector/compatibility readiness exists, so even private Bridge opens currently refuse without explicit test wiring. Pure transportless kernel fixtures are separate from this production admission contract. Injected positive queries and mocked HTTP do not establish compatible-peer handling or inbound privacy. Updates exposes an optional private Delivery-reply interception port after sender admission and before ordinary message/target ownership, foreign forwarding, unbound-Thread handling, edits and command/media/model lanes. Its caller rechecks the exact execution fence around the await; failure or an invalid disposition cannot fall through. Synthetic internal agent messages bypass this human-input port while preserving their existing target routing. The source composition now binds a local known-reply collector through Routing with configured bot identity and original-ownership ports. A recognized own-bot marker or retained original provenance prevents ordinary fallback. Only matching marker target, request nonce and a current local original fence can reach the exact-ID Delivery collector; absent or older unversioned collectors consume unavailable rather than ignoring the nonce. Known SDK edits/media remain outside command/media/model handling. A live foreign original refuses before any private IPC attempt and retains the source by failure; it never uses ordinary replacement forwarding. Missing/stale provenance or malformed known SDK evidence is consumed as unavailable, not revived. No private foreign attempt is issued by this implementation. Each positive classifier guard permanently refuses after an observed source, bot, instance or original-ownership assertion failure, including caught assertion reentry during the final observation. Restoring equal values cannot renew that captured guard. Callables remain captured; a fresh classification is separate evidence, not renewal of an earlier acquisition or pin attempt. Local completion remains journal-owned: a stopped source cannot deliver, and failed removal retains its original entry/namespace for normal worker retry. Tests use real temporary journal/admission workers to show command-looking text reaches only the typed result, exact completion reports follow removal, and removal failure/retry does not deliver the result twice or enter the agent queue. The typed result can precede source removal; it is not an exactly-once business-execution receipt. These are local known-source integration witnesses, not full production privacy acceptance. Unclassified replies still follow existing routing; missing both marker and original metadata, historical/held inputs and foreign custody remain open. Both publication-readiness providers deliberately stay unbound. No public Text Input entrypoint/lifecycle opening port or private peer capability is exposed. Before exposure, bind exact current receivers and source disposition through the existing routing/journal owners; refuse stale/unknown SDK evidence without reviving a callback or retargeting input through replacement ownership. Require configured bot identity and compatible private-input handling across leader/follower peers before publication, including Classic Mode; test mixed/older peers and historical/held-input paths rather than assuming Thread routing supplies that protection. Verify the original-message/control representation through decoder/IPC and separately authorized live clients. Missing/unavailable evidence must never become an implicit SDK-to-agent fallback. Public exports remain unchanged; these tests do not activate agent markup or deliver model input. #### Private Foreign Reply Custody (Journal Preparation Only) **Current-tree boundary:** native private storage/decoder and queued-completion primitives remain preparation only. The removed complete source-owner, selector/admission, first-observation ingress and warm Text/Attachment disposition assemblies are archived on `wip/private-input-foundations`; source-assembly checkpoint descriptions below record that deferred contract, not a current public/production capability or permission to restore it. Re-landing remains separately tracked in BACKLOG. The selected next direction is one authoritative source, reusing input custody rather than enabling ordinary executable-copy forwarding for SDK replies. Ordinary stable delivery IDs and issue/ACK guards remain useful transport mechanics, but the recipient-copy path has bounded process-local post-completion deduplication; it does not establish exclusive private custody across reconstruction. Persisted evidence is not a live Delivery receiver, forwarding/execution grant, submission receipt or restored nonce. The private journal preparation stores an immutable destination latch on the existing source entry, independently of acquisition lifetime. Claim-owned purpose was considered and rejected under current recovery: ready release deletes `inputClaim`, and exact dead-owner recovery uses that release. An `executionUpdate` projection can represent the bytes, so a projection-only adapter remains technically feasible, but it would need new enforcement preventing every projection-losing release and ordinary-execution path. The source-entry choice avoids silently making disposable claim data permanent authority. The frozen journal preparation contract selects storage explicitly: only `createTelegramInputJournalStore({ storageVersion: 4, ... })` selects storage v4; omission or `3` retains v3. V4 reuses v3 custody/exclusion semantics and adds optional source-entry `privateTextReply`; v3 refuses that field. No existing file migrates or silently upgrades. V1/v2 constructors and v1 receipt/binding identity codecs stay unchanged. Mode-specific factory/read facades keep normal stores and typed default input options statically at versions ≤3; only a physically supplied `storageVersion: 4` selects the journal-only v4 facade. The internal all-version view is not a worker projection: every source read refuses a mismatched selected version before body decoding. Worker DTOs and admission stay unchanged. An unchanged-source tempfile probe passed 18 assertions across v1/v2/default-v3 readers and strict family inspection: raw v4 snapshots and segments (including unknown/malformed bodies) refuse `unsupported-version`, preserving bytes and names. Older readers' raw-version guard precedes body decoding; optional-field compatibility is expressly not assumed. The strict journal-owned persisted projection is `{ source, expectedSource, destination }`: `source` is the exact existing `{ journalBindingKey, tokenSha256, updateId }` reference; `expectedSource` is the first whole-entry `{ updateId, sourceSha256 }` digest before pin. `destination` contains `profile`, configured `botIdentity` (required positive `botId` and token SHA-256), positive `operatorUserId`, `sourceTarget`, positive `sourceMessageId`, `publicationTarget`, positive `publicationMessageId`, `requestNonce`, and `receiver`. The original FOREIGN receiver contains `instanceId`, `profileKey`, `bindingKey`, `registrationGeneration`, `sessionId`, nonnegative `sessionGeneration`, positive `pid`, `processBirthId`, `cwd`, `endpoint`, optional `slot` and optional `target`, plus `protocol: { protocolVersion, runtimeBuild, capabilities }`. Registration target omission is allowed only for Classic publication; otherwise it equals publication target. No timestamp substitutes for original registration identity. This is evidence, not a duplicated bus runtime model. All target chat IDs, message/operator/bot/PID/protocol IDs are positive safe integers; Thread IDs are optional positive safe integers; update IDs and generations are nonnegative safe integers. Strings are nonblank, at most 256 UTF-16 code units and 1024 UTF-8 bytes, except CWD/endpoint at most 4096 units/bytes; hashes are exactly 64 lowercase hex characters; slot is one `A`–`Z`. Capabilities are ordered distinct nonblank strings, at most 64 members, each at most 128 units/512 bytes. The complete projection is at most 16 KiB UTF-8 JSON. Unknown keys, nulls, incomplete shapes, accessors/non-data properties and non-plain records refuse. Capability arrays must be dense plain arrays of enumerable data elements, without extra properties; sparse arrays cannot survive validation only to serialize as rejected nulls. Arguments and returned metadata are cloned. No answer-body copies, credentials or authentication secrets belong in this DTO. `TelegramInputJournalStore.pinPrivateTextReplyDestination({ receipt, expectedSource, destination, assertAuthority })` is synchronous and v4-only. It snapshots arguments and captures the REQUIRED synchronous caller assertion before observations. The caller owns semantic sender/marker/source/original verification; the latch never proves them. First pin requires the exact current owned READY, unoffered, nonexcluded pending receipt, current context/binding, exact source reference and pre-pin whole-entry digest. The captured caller guard composes with existing context checks before publication and at issue/pre-rename/post-publication boundaries, never replaces them. Exact duplicate live pins compare the stored first digest and destination (not the changed post-pin row digest), require the SAME current ready authority, and return `pinned: false` without revision/write. Recomputing the row digest with only the latch removed also verifies the original pre-pin row/claim; a replacement acquisition cannot reuse the old digest as renewed pin authority. Any different digest/destination conflicts. Existing cloned `read()` is the only post-cache-loss observational API; it grants no renewed pin authority. Bounds/capacity fail before writes and existing progress reserves remain. Pre-publication failure leaves no change; after issuance, failure may have committed and is not rollback or permission to blindly reissue. Reconstruction may inspect evidence and retry only under still-valid live pin authority. The implementation preserves evidence through strict decoding/encoding, explicit entry constructors (including field-by-field `queueInputs()` reconstruction), deep cloning, claim release/recovery, queue transitions, segments and compaction, under existing capacity/progress reserves. Publication checks private continuity only for v4 and reuses its existing old-entry ID index; ordinary ≤3 publications do not pay repeated private-entry searches. A structural entry-visit regression covers all four storage modes without a timing threshold. Stable receipt/binding identities remain separate from storage version. No new persistent root, parallel journal, interaction registry or execution framework is added. The latch preserves evidence only. Existing `acquireInput()`/`startInput()` have no private-purpose consumer; retention alone cannot prove no-agent admission. Custodied execution currently starts before the Routing handler, while handoff requires ready authority, so private transfer must be selected at a pre-start admission boundary rather than inserted into the running local handler. Existing handoff retains its recipient binding; arbitrary foreign stable-binding transfer and production offer/wake relay are not established by the current primitives. Required future reconciliation distinguishes accepted-ready custody, running/outcome-unknown, exact terminal disposition and unresolved evidence. The current ready-only reference resolver cannot decide every case. After unknown ACK, donor/cache loss or receiver-session replacement, use retained source/destination evidence: never send another executable copy, inherit a replacement receiver, silently discard source authority, or treat entry absence/cursor coverage as answer submission. `completeInput()` currently removes input without a destination-scoped private submission receipt. The existing source-completion owner is a candidate for later terminal proof, not an implemented private contract. The local implementation is deliberately disconnected journal preparation after the schema/publication audit: no production caller, receiver invocation, RPC, capability advertisement, readiness binding or public export. Journal regressions cover strict/bounded DTO partitions, immutable original identities, revision-stable retries, argument/read clones, stale/excluded/offered/running authority, composed publication guards, commit-unknown reconstruction, release/dead-ready recovery, handoff, queue construction, quarantine/requeue, snapshot/segment continuity, compaction, selected-version refusal and physical capacity preservation. Custody retains its existing forced snapshot compaction/progress reserves; a constructed valid two-segment chain independently witnesses that a latch first introduced after the base snapshot cannot disappear or change in a later segment. These are tempfile preparation tests, not source disposition, no-agent-admission, migration, mixed-peer or end-to-end foreign validation. Both production readiness providers stay unbound. ##### Disconnected First-Preparation (Private, Unwired) Production still constructs ordinary v1 stores through the binding resolver. Raw v3/v4 custody facades do not preserve the production `routingInputs`, strict scoped queued-completion, retention and native completion surface; neither an input-store constructor substitution nor relabelling snapshot v4 as executable v3 is an adoption plan. The existing custody session acquires and starts before its handler, while configured-sender admission and private interception occur inside that later handler. Generic handoff preserves its acquired binding: an A-bound claim cannot become B-bound by naming B as its RPC receiver. Production source selection/adoption remains separate from the unwired owner-backed B-scoped capability below. The package-private first-time READY preparer in Updates uses Journal's purpose-confined owner-backed source and a non-executing Routing classifier through an injected port. Routing depends on Updates, with no reverse import. `createTelegramPrivateTextReplyPreparation({ config, classify })(source, updateId)` prepares one persisted update ID through an explicit v4 source capability, returning only `not-private`, closed `unavailable`, or `ready` with exact source reference, ready receipt and pinned destination. No caller-supplied replacement message is classification evidence. `unavailable` is neither ordinary fallback nor permission to dispose source authority. The source capability is stronger than a detached journal/binding string. Journal-owned `withScope(updateId, operation)` holds the actual reference and outer Workspace admission and supplies a purpose-restricted, pre-admitted v4 handle; its inner operations do not reacquire Workspace/transport authority under configured-user admission. The [owner-backed selection contract](#owner-backed-first-ready-selection-private-unwired) binds the identical handle, source/digest, local incarnation and exact original B. Production selection of this capability is still unimplemented. Preserve Workspace admission → configured-user transaction → source serialization/journal ordering; a stable recovery key never establishes lifetime or admission. Inside that scope, read and digest the retained v4 entry before callbacks, then admit its actual configured sender using the existing synchronous `withPairedUserAdmission` semantics; never pair a new owner here or treat `preApprovalExcluded: false` as sender authorization. Classify that entry's bytes without manufacturing an execution fence, collecting an answer or forwarding, and refuse classifier-induced mutation of the snapshot. Known-private missing/stale evidence remains unavailable. First preparation accepts only a pending, nonexcluded, unclaimed, unlatched entry without execution provenance; existing claims/projections and already-latched input belong to later reconciliation, not a new first pin. Positive preparation is for an exact foreign original. Local collection keeps its existing execution path and cannot become ordinary fallback through the preparer. After explicit one-shot receiver selection and context verification, acquire without an execution projection; a private native constraint checks the selected pending digest and eligibility against the actual serialized row before constructing READY. Re-read and verify the exact acquired ready row, original bytes, receipt, binding and scope before computing its first whole-entry digest and guarded pin. Recheck composed source/original/configured-bot/current-context authority before mutations and success; retain the journal's own context/publication checks. Acquire and pin are two durable publications, not one transaction: loss after acquisition can leave unresolved ready authority without a latch; loss after pin can leave retained evidence without a successful return. Mutation exceptions propagate unchanged, with no automatic release, reacquire, repin, ordinary fallback, completion or rollback claim. Native regressions cover persisted/caller-byte and projection mismatch; wrong sender despite nonexclusion; context/source/handle mismatches before acquisition; source/profile/bot/session/original loss; ordered publication and serialized-row substitution; already-claimed/latched refusal; faults after each publication with retained evidence; and existing local/private-unavailable classifier behavior. Real owner/resolver/config/classifier integration leaves donor-owned B-bound READY and a latch without start, completion, ordinary handling, queue admission, offer/wake, RPC or Delivery collection. Compile-time checks retain explicit-v4 versus default-v3/old-worker boundaries. The classifier remains read-only; local handling separately supplies its execution fence and exact collector. This is bounded native evidence, not pre-extraction byte equivalence, exhaustive callback-reentry proof or live acceptance. Production source selection, transfer/consumption, terminal reconciliation, historical/cold privacy and both readiness bindings remain unimplemented. ##### Non-Settling Receiver Capture (Private, Unwired) For later foreign acceptance, Delivery provides the package-private, synchronous `TelegramDeliveryRuntime.captureTextInputReceiver(identity)` and bound `captureTelegramTextInputReceiver(identity)` preparation contract. Identity is `{ requestId, messageId, operatorId, botId, profile, target }`, with a concrete `{ chatId, threadId? }`; the result is a frozen local `{ assertCurrent(): void }` guard or `undefined` (unavailable). Capture snapshots identity/target and observation callables before observation, binds the exact waiting Text Input row and original known publication, and captures runtime/question generation internally. Positive configured-bot proof must already belong to that question; transportless legacy collectors do not establish readiness. The bound helper additionally captures the exact runtime, method and binding lifetime, refusing older kernels without fallback. Every bind, including the same object/generation, ends earlier binding authority; stale unbinders cannot remove a replacement. Capture and assertion only observe: they never accept/copy an answer, read a result, settle, clean UI, drain/admit/queue, retire/prune, install timers/listeners or perform transport/journal work. Deadline expiry is unavailable even before the timer runs, without causing settlement. Timeout, abort, submit/cancel, row loss, shutdown/replacement, changed observation callables or lost operator/profile/target/bot readiness invalidate the core guard; the bound helper additionally fences registry/binding removal or replacement; an observed failure is permanent. Multiple guards may coexist without reserving an answer. Actual collection still rechecks scope and settles one-shot; post-acceptance feedback authority remains separate. Owner-provided authority, target and receiver-readiness callbacks must honor their read-only observation contracts. Selected native scope-changing fixtures do not prove a globally atomic external snapshot against arbitrarily effectful callbacks. This process-local preparation is not a result, reservation, submission/execution grant, peer capability or full foreign/private-terminal proof; functions never cross IPC. Production readiness providers, receiver IPC, source adoption and private foreign acceptance remain unbound and separately gated. ##### Private Text B Offered Fixture (Unwired) The local Journal suite now has one coherent Classic/Threaded offered-source fixture for the receiving-side B seam. Its existing native Config/Workspace/serialization fixture exposes its real Config store; a real Bridge Delivery kernel B publishes through a controlled test API and native original-ownership writer, obtains a genuine Text Input nonce and waiting handle, and binds the actual Delivery runtime. A strict-v4 Journal records a full human reply using that publication's emitted markup. Native acquire/pin/offer creates donor-owned READY designated for the same B, with matching binding, process/session fields, publication ID, target, operator/profile/bot and request nonce. The fixture is local to the mirrored suite; it does not import another test suite or add a generic fixture framework. Positive native tests join the actual stored latch and reply provenance to the bound receiver guard, leave the SDK promise pending and retain donor custody. Native abort and same-runtime rebind invalidate the old guard while the offered Journal entry remains unchanged; a fresh binding may provide a new observation, never revive the old guard. No accept, SDK submission, source completion, ordinary worker wake, private RPC or production readiness occurs. These are coherent setup/lifetime witnesses, not private guarded-accept or end-to-end handoff implementation. The test API's positive publication ID and bot/readiness facts are controlled fixture inputs; the native original writer and receiver state are not mocked. The source fixture's liveness and B registration descriptor remain fixture facts, not authenticated peers or multi-process proof. B's receiving owner additionally uses its actual self-process birth identity in the guarded-accept witnesses below. Native acquire/pin/offer is trusted setup, not the missing production donor capability. The separately confined receiving-side runtime below composes verified source/latch, original B and actual Delivery guard with serialized accept checks; existing generic accept plus `signalWorker()` is not that composition. Keep the current first-READY synchronous scope, source defaults, peer advertisement and both readiness bindings unchanged. Donor/Bus/RPC, phase-specific custody ACK/reconciliation, private consumption and production adoption remain separate gates. ##### Private Text B Guarded Acceptance (Private, Unwired) Journal's `createTelegramPrivateTextV4AcceptanceOwner()` exposes only the retained observational `sourceOwner` plus a separate synchronous first-acceptance source. It owns explicit-v4 physical J, native local B/session/birth, existing references and Workspace, persisted configured-user admission, source serialization and native CAS. It never extends the first-READY scope, adopts a production source, wakes a worker or grants SDK submission/completion. Each source attempt is consumed before observations in a bounded non-evicting set (the existing Journal entry limit); caught reentry poisons the current attempt. The same source cannot retry after a closed/unavailable/unknown attempt or equal-key renewal. A replacement owner observing accepted READY receives no new first-acceptance authority. Eligibility requires the actual original offered READY, immutable private latch, exact source/operator/target and B process/session/binding. Removing the latch and the added offer must reproduce its original pre-pin READY digest; another body/acquisition is not the prepared source. Updates' `createTelegramPrivateTextReplyAcceptance()` captures its selection/source callables and delegates to that owner. Routing's `createTelegramPrivateTextReplyReceiverSelector()` joins the actual reply's marker/question publication/target/nonce to the latch, existing original-ownership classifier, exact current B registration projection and real bound Delivery receiver guard. A copied marker from another B publication cannot borrow the live SDK question. Registration projections are trusted current runtime ports, not independent evidence from a DTO or proof of authenticated transport. The selected source/message snapshot and callable identities stay checked. Native core's existing private admission seam now has a confined `accept` purpose: the actual serialized offered row must match the observed digest. Native context/publication checks run the retained receiver/source guard at write/rename boundaries and after publication. Success replaces A's acquisition with B's READY acquisition and the same handoffId; the source update and latch stay unchanged. This is an expected custody transition, not loss requiring A restoration. Any error after possible commit leaves the result unknown and first attempt spent: no rollback, repeated accept, source removal or ordinary fallback is inferred. Returned receipt data is a custody fact, not SDK result, execution authority or durable exactly-once proof. No accept reconciliation or cold continuation is implemented. Native Classic/Threaded witnesses use the actual source, Config/Workspace/serialization, original publisher, SDK kernel/binding and Routing/Updates/Journal composition. They cover positive acceptance with a still-pending SDK question, source/publication mismatch, before/inside-serialization body substitution, original B/receiver/binding/provider loss, persisted sender refusal before private lookup, source renewal, caught reentry, candidate mutation and before-write/after-rename native interruption. Postcommit loss preserves B custody without positive success; restoration and renewal cannot reopen a spent attempt. These remain local component proofs with test transport/readiness/registration inputs. Authenticated donor offer/Bus receiver integration, exact peer capabilities, actual RPC lifetime/ACK fencing and reconciliation, private consumer/SDK settlement, terminal disposition and production source selection/readiness remain gated. The generic handoff Bus branch still lacks this private binding and post-await private authority composition; no Bus/root/public API or schema changes follow from this local implementation. ##### Retained Source Observation Owner (Private, Unwired) Physical source identity, recipient designation and local custody ownership are separate namespaces. Journal derives `journalBindingKey` from the retained path/profile/bot identity; `acquireInput()` separately compares the requested `recipientBindingKey` with its actual context and checks the context's local process/birth identity. A physical source J owned by donor A can therefore hold donor-owned READY designated for B. This neither moves J to B's journal path nor impersonates B's process. It does not establish how an owner obtains authority to select B. Observation alone does not select B. The separate [owner-backed first-READY source](#owner-backed-first-ready-selection-private-unwired) explicitly selects after admitted classification, retaining the original assertion and actual guarded context getter. Updates owns semantic provenance; Journal confines its use. Neither metadata nor possession of an observation scope grants preparation authority. The package-private `createTelegramPrivateV4SourceOwner({ storageVersion: 4, ... })` constructs and retains its own strict Journal read handle from captured profile/token/bot/path getters, semantic local process/birth/session identity, the existing reference registry, Workspace admission and source serialization. `withSourceScope()` exposes only frozen physical `sourceIdentity`, cloned actual-v4 `read()` snapshots and `assertCurrent()`. The owner also exposes explicit `renew()` and `invalidate()`. It is neither the preparation-source interface nor an old-worker port; no input context or mutation capability escapes. Ordinary v1 routing, exact completion, retention and native consumers remain unchanged; input defaults remain v3. Selected-v4 reads refuse older families without changing their bytes or names. No operational selection, migration or production opt-in follows. Each observation retains a `private-source-observation` reference for J before outer profile Workspace admission. Methods fence the exact retained incarnation and current profile/token/bot/path/local-session authority, including actual self-process birth liveness and the captured ledger/acquire/release identities, before and after reads. No inner Workspace/transport admission is acquired. The callback is synchronous: scoped methods expire on return or throw before thenable inspection, admission release and finally reference release. Returned promises/thenables cannot extend authority. Sole failures retain identity; multiple original/later read or cleanup failures retain ordered private provenance. Both fast and serialized fallback reads preserve journal data and names, including unsupported/malformed refusal; expected admission leases and transient transaction guards are separate effects. No acquire/pin/start/complete/forward/Delivery port is exposed. Same-owner renewal recaptures from the original construction ports, invalidating the predecessor before successor construction even with identical stable metadata. Failed construction leaves the owner unavailable rather than restoring old handles. Observed authority loss permanently poisons that incarnation; restoration requires an explicit successful renewal. Separate equal-key owner construction does not invalidate another owner. The registry protects participating references, not object incarnation. This is explicit owner renewal plus existing physical-source checks, not detection of unobserved external change-and-restoration or a globally atomic snapshot against effectful callbacks. Native regressions exercise real identical-key renewal while the predecessor reference remains held, failed renewal, return/throw/promise/thenable escapes, expiry-before-release ordering, authority-loss latching, cleanup error provenance, clone safety, no mutation surface, old-worker type rejection and both strict read paths. An additional actual-Workspace-resolver case reads v4 under a real reference/lease, preserves data, refuses observed loss/restoration and recovers only by explicit renewal. Its initial construction failure exposed unstable provider wrapper identity; the Workspace-owned complete-authority capability guarantee corrects that without removing Journal's ledger/method fences. These are local fixture checks, not production adoption, B-scoped preparation, transfer or terminal proof. ##### Owner-Backed First-READY Selection (Private, Unwired) The former preparation-source `captureRecipientContext` seam is replaced by explicit one-shot `selectPrivateTextReplyContext`. This private authority amendment preserves the split: Updates admits the persisted sender and derives exact original B plus its retained assertion through the injected classifier; Journal enforces structural confinement and the supplied guard. A binding string, DTO or callback alone is not independent semantic provenance. Earlier preclassification with a second authoritative pass was not selected because it duplicates sequencing. `createTelegramPrivateV4FirstReadyPreparationOwner` returns frozen `{ sourceOwner, preparationSource }` from one private retained-owner core. The existing observational factory and frozen external surface remain unchanged. The sibling preparation source shares the current incarnation, physical options/J, donor-local A, reference and Workspace authority through private closures. It is not reconstructed from detached read metadata, an injected store/context getter, a new registry or B's journal path. Source-owner renewal/invalidation also fences preparation attempts. Only restricted v4 read/acquire/pin methods escape, never append/start/complete/release/handoff or execution authority. Journal owns the structural types; Updates consumes/re-exports the preparation-source contract without a reverse dependency. `preparationSource.withScope(updateId, operation)` binds one exact nonnegative source ID. The first facade read captures its pending digest; Updates independently computes the digest before admission/classification callbacks and refuses mutation of its classification snapshot. After configured-user admission and positive foreign classification, it supplies the identical facade, purpose `private-text-reply-first-ready`, exact source reference, `expectedPendingSource`, complete destination and captured `assertOriginal` callable to selection. Journal checks source/update/digest/destination consistency and creates immutable donor-local A plus recipient B. Its actual context getter enforces scope/incarnation/source/local-owner/original continuity on every invocation, including native publication checks; no shared ambient context is retargeted. A private first-preparation-only constraint checks the selected pending digest and unclaimed/unlatched/unprojected eligibility against acquisition's actual serialized row before claim construction. This is not a facade preread or post-claim comparison, public/general admission hook, schema change or acquisition/handoff redesign. Native context guards and facade pre/post checks retain publication authority. After successful acquisition the facade verifies the actual READY row against the selected pending source and privately records its receipt and READY digest; pin requires their complete values and the selected destination, retaining native digest and composed assertion checks. Selection, acquisition issuance and pin issuance are separately one-shot, consumed before supplied-value inspection, assertions or native calls. Recursive/repeated use poisons the whole attempt even if the callback catches the inner refusal; assertion reentry also refuses permanently. Legitimate receipt clones are accepted by complete value equality, not object identity. Uncertain acquisition supplies no pin authority, and uncertain pin supplies no retry. Original-B loss poisons this attempt rather than every source incarnation; observed source/provider/session loss remains incarnation-sticky. Synchronous scope expiry, sole-error identity and ordered native/read/cleanup provenance remain preserved. The order remains reference → outer Workspace → configured-user admission → source serialization/journal, without inner Workspace/config/transport acquisition. Acquire and pin remain separate publications: failure may retain READY alone or READY plus latch. No compensation, release, replay, fallback, rollback assurance or absence-as-submission proof follows. Trusted orchestration and synchronous read-only callbacks remain material assumptions; guards do not establish global atomicity or detect unobserved ABA. Native integration uses the actual Journal owner, Workspace runtime resolver, config admission and Routing classifier to produce physical J ≠ B, local A, READY recipient B and the exact original destination with unchanged command-looking input. Negative cases cover pre-claim serialized text/eligibility substitution; original loss at issue, write, rename and returned-serialization boundaries for both mutations; caught recursive/repeated use; receipt/destination/handle/source substitution; scope/renewal/failure restoration; layered poisoning; and retained state after uncertain returns. Selected witnesses establish no start/complete/Delivery/IPC/ordinary-admission effect, not end-to-end privacy or foreign acceptance. Production source selection/adoption, default/version migration, B receiver acceptance, answer delivery, source completion, business authority and both readiness bindings remain separate gates. ##### Production Source Adoption: Ordinary-V4 Consumer Gate The production producer durably appends a complete `getUpdates` response to one selected source before advancing its cursor. Selecting v4 therefore also selects ordinary prompts, commands, callbacks and routing/queue settlement—not a private-only inbox. The transport-named journal takes precedence over new session paths and survives release/succession; a new session or apparently empty/missing snapshot does not authorize a fresh generation or format switch. Ordinary-v4 consumer support is required before that shared polling source can be selected for private preparation. This preservation decision grants no operational adoption, migration, public configuration or writer-mode authority. The current chain is polling/forwarded admission → selected binding → referenced leader/follower lifecycle → worker acquisition/start → Routing handler → scoped settlement/native completion callbacks. Cursor/bootstrap queries, follower session succession, historical/held sources, Workspace protection, Restore/temporary cleanup and transfer reconciliation also consume those source contracts. The v1 branch stays unchanged. A future selected-v4 branch needs genuine typed snapshots, purpose-aware classification before acquisition/start, positive ordinary-admission evidence and all required ordinary consumer semantics. `not-private` based on absent marker/original metadata is not an ordinary execution grant. A v4 header proves physical format, not adoption permission; the installed `custody-v3` writer mode is not v4 authorization. The native source-selection assessment exercised `createTelegramUpdateJournalBindingRuntime()` through leader, follower, exact-recipient and explicit-path resolvers against the same real v4 fixture. Every ordinary `read()` and `appendBatch()` refused `unsupported-version`, while `readForProtection()` retained the pending entry and source bytes/names stayed unchanged. The default v1 source still read normally. This separates protective observation from executable source selection; it does not test production adoption or a live peer. The port gap is concrete: the production journal facade owns `routingInputs`, `removeCompletedExact`, `completeQueuedExact`, `inspectSourceCompletion` and `inspectQueuedReceipt`, but no private acquire/pin. A raw explicitly selected v4 input facade owns acquire/pin and native completion, but lacks `routingInputs`, `removeCompletedExact` and `inspectQueuedReceipt`. The restricted v4 Queue owner supplies positive-history completion for its own witness, not a replacement production facade. Matching source keys, a v4 header or method names cannot supply the missing lifetime, purpose and publication authority. **Operator-approved local consumer boundary; not adoption permission.** General ordinary-v4 consumer preparation may proceed beyond the restricted `/continue` witness under these limits: - Keep work in existing Journal/Updates/Routing owners and retain the old-worker membrane, original first-READY capability and v1/input-v3 defaults. Queue/Commands/root/public API edits still require a demonstrated owner gap and explicit scope amendment. - Require persisted paired-sender admission and positive purpose/local-route selection before claim/start. Missing private markers or original metadata remain unresolved, never implicit ordinary permission; held/private sources cannot reach registry, command, media/STT or model dispatch. - Preserve the real routing/retention and scoped Queue/source-completion consumers with genuine native-v4 snapshots, acknowledged source history, prepared scopes and actual-I/O drain. Do not cast v4 as v3, seed receipt maps or install a detached settlement owner merely to complete an interface. - Prove the local branch before production selection: native routing/Queue/completion integration, unknown publication/ACK and reconstruction, original source/receiver loss and unchanged legacy-source refusal. Independent integrated acceptance of the restricted vertical remains open; no source activation, writer-mode change, migration, private peer advertisement, receiver RPC or readiness binding follows from accepting this local scope. Full ordinary-v4 admission/liveness, routing/retention, historical continuity, mixed-peer exclusion and operational source selection remain gated. Native completion support below closes one consumer prerequisite, not those gates. Neither ordinary ACKs nor absent source/marker/cursor coverage prove private submission. Scoped completion depends on actual admission/lifecycle ownership, not merely completion methods. `publishCommittedQueueReceipt` and whole-snapshot reconstruction own committed receipts, prepared scopes and immutable pre-disposal attempts. The public legacy worker journal-port type and factory still exclude v4; an internal core now accepts genuine native-v4 snapshots only through the private constructor below and its retained positive-history policy. The settlement mux and accepted-handoff publisher select existing owners rather than minting another admission owner. Native `queueInputs` alone still does not publish an Updates/Pi receipt; seeded maps, detached state callbacks or a fixture-only terminal controller are not substitutes. The restricted same-live-owner vertical below is implemented locally. Its native witness composes actual v4 append, positive Routing selection, READY/start, normal continuation preparation/Queue report, required scope publication and scoped lost-ACK reconciliation. This does not establish a general ordinary-v4 consumer, independent integrated acceptance, production writer/peer authority or source selection. Unresolved/private input cannot become ordinary through absent evidence. Default v1/input-v3, legacy v4 refusal and restricted private preparation stay unchanged; there is no v4-as-v3 projection or fake v1 bootstrap. ##### Ordinary Text Preclaim (Private, Unwired) `selectOrdinaryTextPrompt()` supplies the first positive ordinary-input region beyond `/continue`: one fresh standalone private-chat human text message, without replies/quotes, edits, media, business/guest envelopes, entities or a leading slash command (including whitespace-prefixed commands). Envelope shape is allowlisted, not classified ordinary merely because a private marker is absent. Selection additionally binds the exact native candidate/source, configured bot/operator, local target ownership, mode, session and captured Routing providers; active Thread-name input stays held. Native Journal/Config admission still precedes the selector. Source snapshot mutation, cross-source borrowing, caught reentry and observed owner/provider loss refuse before acquisition; restoration cannot revive a spent guard. The frozen `TelegramOrdinaryInputSelection` exposes only `updateId`, `assertCurrent` and one-shot `consume`. It has no `execute` method and is not a continuation plan. Native fixture callers can compose its guard with real READY/start, but this does not create an Updates executor, queue admission/report, result, receiver or private custody grant. Unsupported/ambiguous input stays unresolved; selector refusal never grants ordinary fallback. Both purposes share the existing bounded, non-evicting source-attempt owner. The exact `/continue` parser and genuine execution association remain separate and retain native regressions. Default workers, production source selection and readiness remain unchanged. The separately confined [ordinary text execution witness](#ordinary-text-execution-private-unwired) now composes real Queue/scope completion. The preclaim surface itself remains non-executable; history folding, other input forms and routing/retention acceptance remain open. ##### Ordinary Text Execution (Private, Unwired) `prepareOrdinaryTextPrompt()` is a separate frozen `purpose: "text-prompt"` plan over the positive preclaim policy. It does not add `execute` to `TelegramOrdinaryInputSelection`. `createTelegramOrdinaryTextV4AdmissionRuntime()` owns its genuine READY/start, original native admission carrier, normal inbound/preparation and Queue report, acknowledged queue transition, required scope publication and exact completion. It shares the existing private lifetime/completion shell with the exact `/continue` factory, not a public dispatcher or arbitrary workflow executor. The old factory refuses a text plan, the text factory refuses a continuation plan, and separate readers check the genuine execution object's private purpose plus candidate/binding/fence identity. A failed read permanently invalidates that object; copying visible data cannot create its private association. Purpose-specific completion hashes preserve the existing `/continue` namespace. The text execution object captures a private visible-carrier snapshot; reads before and after source assertions refuse changed body/source metadata. Routing rechecks that native association before preparation, after awaited work, before the actual Queue append/report and on return. Original preparer, Queue get/set, lifecycle/fold, status, label and dispatch-provider identities stay captured. Provider, target/session/sender loss, caught reentry or an uncertain Queue append cannot borrow restored authority or repeat the handler. Normal inbound handlers retain their existing text-transformation contract; a carrier snapshot is not a sandbox against hostile JavaScript or a global atomic observation. This first execution region requires history folding to remain **false** and uses the existing ordinary Queue controller with `preserveQueued: true`; it does not merge or dispose unrelated accepted sources. Independent native text sources keep their own real receipts and can complete together through the existing settlement owner. A dispatch request before positive receipt/scope publication remains unready. Unknown append/persistence/publication outcomes stay held. Post-disposal lost ACK uses the original live issuer's frozen scopes and exact native markers, never handler/disposal replay or successor inheritance. Stop fences new work and drains actual preparation before releasing its retained source reference. Native Classic/Threaded witnesses cover these boundaries, body/purpose/provider mutations and refusal after completed scope preparation loses its owner; they are not live or independent acceptance. No default worker, production resolver, storage/writer mode, schema, peer capability, receiver RPC, readiness provider or public opener is changed. History-folding semantics, other ordinary purposes, the complete routing/retention facade, mixed/cold source continuity and receiver-scoped selection remain open. Private reply collection is still a separate SDK plane, not this ordinary-text execution witness. ##### Ordinary Text Folding: Assessed Owner Gap (Unimplemented) The normal Queue/Turns path does not require a new Queue API merely to retain receipt identities: Queue freezes candidate history orders, preserves the Pi-owned pending head and later arrivals, and Turns' receipt collector carries original history receipts alongside the current source receipt. `reportTelegramQueueAdmission()` reports only the receipt matching the genuine current admission binding; it does not republish old sources. None of those metadata mechanics proves that all history payload remains in the next prompt. A content-only probe through the actual `createTelegramPromptEnqueueController()` and `createTelegramPromptTurnRuntimePreparer()` exposed a Turns-owned ancestry gap. After folding A into B, the built prompt contains A and B, but `buildPreparedTelegramPromptTurn()` stores only B's current payload in `historyText`. A second fold into C therefore renders B and C without A. The case is possible when a combined turn has not dispatched before another fold request. Source and actual-dist probes agree; they use no admission receipts, source completion, model send or Telegram transport and are not native custody or live-incident evidence. The receipt collector's continued union of inherited identities makes payload preservation an acceptance condition before native folding can be enabled, not permission to acknowledge missing context. The required local scope amendment is narrow: allow the Turns owner and its mirrored tests to preserve original human payload ancestry across repeated folds, using existing runtime fields and without importing a second formatter into Routing. Preserve source-context, attachments/voice boundaries and current-prompt copy; do not copy an entire rendered model envelope or synthesize receipts. Queue/Commands/root/public API and persistent/wire schemas remain outside this amendment. Until approved and validated, the existing no-fold text witness remains enforced. This assessment changes no execution or formatting behavior. After that owner gap closes, native fold preparation must still compose original live grouped receipt/scope proof, Queue membership and pending-head protections, actual-I/O retention and unknown-outcome/no-replay rules. Capture/read old native scopes only after the current input's genuine RUNNING boundary, outside configured-sender preclaim admission: existing worker readiness/owner queries enter native source observation and would otherwise reacquire Workspace under the config transaction. Missing/foreign/frozen/cold proof remains held; a fold flag or copied receipt is not source/disclosure authority. No native folding implementation or permission follows from this assessment. ##### Ordinary-V4 Live-Owner Contract (Private, Unwired) **Implemented locally for the frozen restricted witness; independent integrated acceptance and production readiness remain open.** Use runtime-only positive admission history in one live Updates owner, initially for exact standalone `/continue`. Cold, historical, replacement-owner and unproven groups remain held. Durable ordinary-purpose evidence is deferred unless classification recovery after live-owner state loss becomes an accepted requirement; such evidence would still not recreate execution or issued-attempt authority. Defaults, old-worker refusal, restricted private capabilities and both closed Text readiness providers remain unchanged. **Implemented append-only prerequisite.** `createTelegramOrdinaryV4AppendOwner()` constructs the genuine retained native-v4 append path and returns `sourceOwner` plus `appendOwner` with `appendBatch()` and synchronous `withAcknowledgedPending()`. Its private invocation tickets and native-decoder digests retain only fully acknowledged actual additions; duplicate replay, observed mutation, uncertain return and equal-key renewal cannot reconstruct missing evidence. Local native regressions and independent source/native review cover this narrow boundary and preservation of the restricted private owners. This exposes no acquisition/start/execution capability: acknowledged pending observation is neither Routing purpose nor future Updates admission/queue/publication history. The separate input/Updates owners below supply the restricted coupled witness; append observation itself does not. **Implemented preclaim/custody composition.** `createTelegramOrdinaryV4InputOwner()` adds a one-use `inputSource.withScope()` alongside append. It consumes pending eligibility before callbacks, reads the actual acknowledged row, and uses Config's persisted `withPairedUserAdmission` for its exact sender before classification; paired-state exclusion or a stale cached owner cannot substitute. Its selector receives the Journal-owned candidate containing profile/bot identity, source reference, digest and a checked classification snapshot. Routing's guard binds that exact candidate identity; a copied view or another acknowledged source cannot borrow it. Snapshot mutation refuses before claim. Native acquire/start compare actual serialized pending/READY digests; only exact new READY and RUNNING succeed. Receipt mutation, caught reentry, expired methods, unknown ACK and final selection loss cannot permit another issuance. Synchronous authority expires before return-accessor inspection. `selectOrdinaryContinue()` on the actual Routing runtime implements the positive envelope/local-route policy with one-use consumption and sticky currentness. It requires an explicit session-ID provider, captures the real continuation preparation/Queue provider identities, checks the same-scope name dialog with permitted housekeeping, and holds missing/changed authority. Its bounded 1024-slot attempt map does not evict tombstones into fresh authority. Native Classic/Threaded regressions compose this policy with actual Config/Workspace/Journal acquire/start, including persisted-owner/cache disagreement and cross-source borrowing. Its one-use `execute()` now invokes the captured normal continuation only with the genuine started Updates association. An object carrying visible IDs or copied framework symbols cannot substitute. This is an in-process association under trusted native ports, not hostile-JavaScript authentication. Source-level tests are not production or live acceptance. **Implemented cohesive private Updates owner.** `createTelegramOrdinaryV4AdmissionRuntime()` constructs its own literal-v4 Journal owner, seals its own fully acknowledged native appends and passes exact candidates to the actual Routing selector. Native READY/start precede the real admission binding-only path; no registry handler, broad dispatcher or held continuation executes. The original admission owner receives the real Queue report. A currentness fence joins that carrier to the selected source, serialized RUNNING digest, persisted configured sender, session and captured providers before and after asynchronous preparation. This private path freezes its owned admission binding and composed fence: source IDs/keys and reporting/currentness callables cannot drift during asynchronous delegation; legacy bindings are unchanged. It preserves normal fold reset, the fence-carrying `continue` clone, control lane/prompt receipt and ordinary dispatch request. That request remains unready until complete prepared scopes and the committed receipt are published by the existing worker core. Journal retains only its own acknowledged RUNNING and whole native queue transitions. Unknown queue persistence cannot regain an ACK from rereading queued bytes. Whole-group inspection joins every source to that positive history and rejects private latches, unknown siblings, changed digests/owners or handoffs; observed interference cannot be repaired by restoring equal metadata. Publication additionally retains the consumed Routing guard until positive receipt publication. The required scope preparer is internal and cannot inherit legacy missing/undefined/partial preparation. The public legacy constructor retains its versions 1–3 membrane. Stop fences new work immediately and drains actual preparation before releasing its lifecycle reference; a predecessor still draining cannot renew. Equal-metadata successor runtimes cannot inherit queued history. Native Classic/Threaded witnesses use real Config/Workspace/Journal, the normal Turns/Queue owners and the existing settlement adapter: one preparation/append, complete scope/receipt publication, real Queue discard, postcommit lost ACK, public signal/drain refresh, then exact-marker local acknowledgement from a fresh same-session context without redisposal or republication. Additional native partitions cover lost READY/RUNNING ACKs, actual consume/execute reentry, late binding/fence/callable/source association changes, real append/report loss, postcommit throwing/thenable append wrappers without erasing prior acknowledged input, persistence uncertainty, cancellation, captured-provider/source loss, native Workspace/config method and receiver renewal, invalid execution association, persisted-owner/cache disagreement and structurally valid unknown/private queued siblings. Lifetime loss after actual scope derivation but before committed publication refuses readiness; ending the owner in its committed observer fences the still-retained map immediately, and an equal-metadata restart cannot inherit it. A separate compiled witness runs the same assertions against genuine `dist` implementations: the loader redirects implementation URLs, refuses source implementation loads and unmocked HTTP, and leaves fixture assertions unchanged. This proves the restricted compiled path, not the complete production-root lifecycle. These tests do not establish all ordinary input shapes, complete private-input privacy, live peers or activation. **Owners and scope.** A private Journal owner constructs and retains a genuine literal-v4 input store from strict source access, native queue identity, source serialization, real config pairing admission and input context, without competing paired-only mode. Existing config admission supplies literal false exclusion for an already-paired profile; this is not sender authorization. Capture actual native methods and receivers under source/process/session/callable lifetime, never accept a detached store/identity projection as a grant, and leave observation/private-first-READY surfaces restricted. Updates owns the cohesive admission/acquisition/start/queue history, real receipt publication/prepared scopes and immutable completion attempts; Routing owns selection and the narrow normal executor. Preserve the legacy factory/type/runtime snapshot membrane at versions 1–3. The initial coupled scope is `journal`, `updates`, `routing` and mirrored tests; Queue, Commands, root wiring and public API remain unchanged unless a concrete missing-owner duty requires an explicit amendment. No schema, version, storage family, registry, mailbox, poller or universal execution engine is added. **Acknowledged append eligibility.** Capture inside the explicit-v4 Updates owner's own native append invocation, not a polling signal or caller-provided freshness flag. Journal already distinguishes actual `addedUpdateIds` from duplicates under its transaction; polling awaits append but ignores that result before signaling. Mint a private append ticket before supplied wrappers or argument inspection. Only Journal's internal transaction may associate actual added membership and normalized post-publication digests with that ticket; no public hook, replaceable capture callback, ambient last-result slot or caller-created capture object. Complete synchronous return through every config/serialization/Workspace/writer wrapper seals the ticket; the still-current Updates owner activates it once. Caught reentry, missing/conflicting capture, thrown wrappers, thenable return or lifetime loss permanently prevents activation of that invocation. Return-value/thenable inspection must not reopen expired synchronous authority. Mutated returned ID arrays cannot add eligibility, and failure of one call cannot erase unrelated earlier acknowledged history. Bind eligible membership to the actual worker/source incarnation, canonical binding/token identity, native handle/method lifetime, update ID and exact acknowledged source digest. Duplicates, `nonExcludedUpdateIds`, timestamps, cursor coverage, first observation and absence from a startup snapshot do not mint eligibility. An uncertain append may leave committed rows but supplies no eligibility; reread or duplicate append cannot repair it. A later poller/cursor failure does not revoke an already acknowledged owner-local append or permit another grant. The selected pending row must still match; observed mismatch poisons its record rather than allowing restoration. **Digest and native confinement.** Define one Journal-private ordinary digest operation over the complete row normalized through the native v4 entry decoder representation. Use it for invocation-local capture, selection continuity and the serialized acquisition comparison. Verify returned READY/RUNNING records through the corresponding normalized transition representation, allowing only the expected custody change. Arbitrary mutation-object insertion order must not masquerade as source mutation; this does not require arbitrary deep JSON rewriting or changing the existing persisted completion-digest dialect. Before constructing a claim, native acquisition must compare the actual serialized row against the selected ID/digest and require literal v4, pending state, `preApprovalExcluded === false`, and no claim, projection, provenance, private latch or queue/handoff fields. This is structural confinement of trusted semantic authority, not Journal authentication of Routing meaning. **First accepted envelope.** Require plain JSON/data properties and exactly `update_id` plus `message`; the source ID is a nonnegative safe integer. Message requires positive safe `message_id`, `chat`, human `from`, and exact ASCII `text: "/continue"`. Its only optional fields are nonnegative safe `date`, positive safe `message_thread_id`, boolean `is_topic_message`, and `entities`. Entities are absent or one exact `{ type: "bot_command", offset: 0, length: 9 }`. Chat requires positive safe `id`, `type: "private"`, with optional string `first_name`, `last_name` and `username`. Sender requires positive safe `id`, `is_bot: false`, optional string `first_name`, `last_name`, `username`, `language_code` and boolean `is_premium`. Match chat and sender IDs to the already-configured operator. Classic requires positively local Classic routing, no Thread ID and absent/false topic flag; Threaded requires the exact positively bound local Thread, never All. Benign names/date/topic metadata do not grant authority or freshness. Unknown keys, arguments/whitespace/case/mentions, replies/external replies/quotes, edits/forwards, sender-chat/business/guest/channel namespaces, captions/media/albums/service events, callbacks/reactions, synthetic/held/rerouted carriers and preexisting framework authority remain held. This region represents a bounded witness, not all Telegram shapes or a general privacy classifier. **Routing selection and interpretation.** Routing positively checks its existing parser/reserved-action result, configured operator/bot/profile/token, exact current local target/session/route and captured normal continuation/provider lifetime. `not-private`, a typed DTO, command availability and an already-prepared held-command plan are not preclaim authority. Exclude same-scope Thread-name input before selection and re-establish absence before executor entry. Existing dialog inspection may call clock/currentness observations and retire expired/invalid state: permit only that owner's housekeeping, not command/custody/Queue/transport/model effects. Any same-scope candidate or uncertain/reentrant observation conservatively holds; do not claim a pure peek or exact equivalence to successful dialog consumption. Captured selection is owner-backed and one-use; copied diagnostics cannot mint it. Consume selection before assertions/native acquisition; repeated or recursive select/consume/acquire/start/execute, including caught assertion reentry, poisons the attempt. Require genuinely `acquired: true`, its exact retained receipt, then `started: true` for that receipt under the same owner; idempotent existing claims and uncertain returns cannot start the witness. After start, associate the actual native carrier with the genuine Updates execution fence and admission-reporting scope. Visible IDs or purported hidden symbols are insufficient. Execute the captured narrow normal continuation directly, never the broad dispatcher or held executor. Preserve normal fold reset, fence-carrying text conversion, real asynchronous turn preparation, Queue append, carrier admission report and dispatch request. Cover source/scope/journal/provider identity after awaits. Control lane does not change the prompt-based continuation's `queueKind: "prompt"` receipt into a control receipt. **Publication, reconstruction and lifetime.** Native `queueInputs`, a Queue object or receipt DTO is not Updates publication. The explicit-v4 core requires complete real scope preparation and committed receipt publication before dispatch; no optional/no-preparer, undefined-preparer or partial-scope relaxation. The normal dispatch request may remain, but readiness must refuse until publication and its committed callback may resume dispatch. Same-owner reconstruction joins complete native queued membership to retained admission/acquisition/queue-transition history; every sibling must qualify, with no omission of private/unknown sources. Queue append/persistence followed by failure remains effectful uncertainty: freeze the transition and resume only positively proven publication, never the handler. Retain the actual lifecycle source reference through asynchronous preparation and outstanding settlement; synchronous mutation boundaries keep reference → outer Workspace → configured user → source serialization/Journal ordering, without extending private synchronous scopes across a promise. Cancellation fences new effects; teardown drains actual work before reference release, and renewal invalidates its predecessor before successor construction. Equal metadata cannot inherit history. Trusted native ports/readonly observations remain assumptions; no hostile-JavaScript authentication or global unobserved-ABA guarantee follows. **Decisive implementation gate.** In one compiling unwired cohort, append through the actual current owner → positive Routing selection → constrained READY/start → real normal continuation Queue append/report → native persistence → mandatory Updates scope/receipt publication → scoped disposal with postcommit lost ACK → actual public refresh → exact-marker same-owner local acknowledgement. Reuse the accepted legacy refresh retention without redisposal, republication, handler/result re-entry or execution readiness. Require one executor/Queue append/disposal. Negative partitions cover historical/duplicate input, postcommit wrapper throw and thenable/caught reentry, returned-ID mutation, normalized mutation-return versus reread, substantive source substitution before claim, private-looking replies, dialog change/reentry, missing carrier/report association, cancellation during preparation/publication, source renewal/new-owner borrowing and whole-group unknown/private siblings. No production source adoption, migration, readiness opening or private submission/business grant follows from this witness. ##### Native Ordinary-V4 Queued Completion (Private, Unwired) Literal-v4 input-store construction now exposes native `completeQueuedExact()` and `inspectSourceCompletion()` through the existing Journal mutation, read, admission and publication owners. Conditional types and version-only runtime installation preserve default input-v3 and the old-worker membrane; production ordinary-v1 construction and restricted preparation/observation projections stay unchanged. The existing completion-evidence DTO is accepted narrowly in v4 snapshot/segment persistence and inspection, without broadening legacy-family identity, changing defaults, adding fields/families or migrating files. Exact completion checks complete receipt membership, disjoint sources, queue kinds, full persisted owner equality/local process identity, absence of offered handoff and supplied source digests before publication. Mutation rejects a durable `privateTextReply` anywhere in the removal set, including unmarked siblings and evidence retained after release/recovery/queue conversion. Segment continuity independently rejects newly marked removal containing that private evidence and requires newly marked v4 sources to belong to completely removed queued receipts. Unrelated private rows survive. Receipt indexing and cached replay-group validation avoid repeated whole-file scans per receipt/marker. Claims and provenance have no purpose discriminator; the latch is positive private evidence, not a universal classification oracle. Its absence—including interruption between acquisition and pin—does not prove ordinary purpose or restore lost history. Journal owns atomic removal and durable exact-marker consistency; trusted Updates supplies semantic completion scope and issued-attempt continuity. `completionSha256` is caller scope identity, not authenticated authorization. Terminal snapshots lack removed destinations, so markers cannot independently prove ordinary history, private submission or business effects; the bounded structural guarantee depends on trusted native mutation and replay continuity. Subset markers give no individual completion proof for unmarked removed siblings. Exact inspection returns cloned evidence, conflicts on changed scope and returns unavailable evidence rather than inferring an outcome from absence. Native checks exercise real append → acquire → start → queue completion, atomic malformed/owner/member/digest/scope rejection, whole-set private refusal across claimed/released/dead-recovered/projected/provenance variants, forged private-removal segment refusal, cold reconstruction and forced snapshot compaction. Failure injected after actual segment rename preserves its original `io` cause and committed marker for exact later inspection without compensation or replay. This is not a power-loss durability or handler/result non-reentry proof. Pre-edit actual explicit-v4 snapshot/segment readers refused the proposed completion collection as `invalid` with unchanged bytes/names; this is not the older ≤3 reader's separate `unsupported-version` classification or a post-edit decoder impersonating old code. Actual scoped Updates caller/issued-attempt integration, positive ordinary admission, production source adoption, SDK receiver acceptance, destination-scoped terminal disposition and both readiness bindings remain separate gates. Native Journal completion does not publish or collect private answers, grant execution, or make the release ready. #### Contract Checkpoint And Release Evidence The wire contract and lifecycle protocol are frozen in the canonical public/architecture docs. Golden decoder fixtures cover all four kinds, exact resource edges, single/batch versus row shape, authority-field refusal and semantic matrix round trips, including JSON-looking compact labels. This closes design ambiguity, not runtime acceptance. Preserve the implemented flat Choice SDK ABI; internal normalized rows/batches require a compatible adapter, never a silent signature change. Validate single question, batch, adjacent independent blocks and matrix-in-question as distinct equivalence classes, across SDK/agent and Classic/Threaded direct/follower composition. Include equal questions without authored IDs, malformed/disabled/forged controls, deadline/abort/publication races, source/registration loss, failed final admission, file limits/lifetime, replay and unknown outcomes. Use an import/preference scenario to compare model token/authoring/error-repair cost with manual prompt composition; the abstraction must earn its complexity. Release follows the canonical staged plan: contract freeze, shared SDK/native correctness, normalized Choice and batching, agent publication/prompt preparation, remaining surface adapters, then independent integrated review and fresh package validation. Local injected/native evidence does not establish live client or real-exit acceptance. Actual quit, reload, live/deletion probes, commits/push and publication retain their separate operator gates. ### Compaction And Typing Status Manual `/compact` requires inline confirmation because accidental taps are disruptive. Confirmed manual compaction and auto-compaction both set the bridge compaction flag, block queued prompt dispatch, retain that flag in explicit diagnostics, and clear it on native compact completion or failure, timeout fallback, or session shutdown. Pi owns its terminal compaction lifecycle; pi-telegram keeps `Active` scoped to Telegram-owned work and otherwise preserves the stable connected/leader/follower role. Mid-run threshold compaction reports notices in place between tool output and the next assistant response; compaction observed after terminal assistant output waits for final Telegram delivery so transport chronology matches the terminal. The five-minute observer timeout releases the local compaction flag and observer-owned typing and requests deferred queue dispatch; it is not Pi completion, cancellation or failure. Pending automatic terminal-notice and Activity correlation survive that timeout so a later native success/failure/cancellation still reports once. A new compaction supersedes the prior correlation; session shutdown discards it. Existing session and transport fences still govern publication. Native typing during compaction follows connected-instance activity rather than terminal status: - Confirmed manual `/compact` starts a native `typing` keepalive in the command target and stops it on completion/failure. - Automatic/session compaction with an active Telegram turn reuses that turn's target. - Automatic/session compaction without an active Telegram turn uses the connected instance's assigned target; an unconnected instance sends nothing. - Thread-targeted typing is sent only to the concrete thread. Aggregate `All` mirroring is intentionally omitted because duplicating every keepalive multiplies shared-chat flood pressure. Compaction completion, failure, or timeout stops only a loop actually started by the compaction observer; a pre-existing agent-owned loop remains active. Ownership is sticky across a repeated compaction start, whose shared-loop start reports `false` for the observer's own running loop. Authority loss and shutdown still stop the keyed loop. - Pi `ui_prompt_start` pauses typing while an extension-owned local prompt waits for the operator; `ui_prompt_end` emits the matching Activity boundary and resumes typing whenever agent or compaction work remains unsettled. At every connected instance `agent_start`, the lifecycle binding starts Telegram's native `…typing` indicator in that instance's assigned target, whether the run came from Telegram, the local TUI, or an autonomous continuation such as Grow Loop. Terminal `Active` remains Telegram-turn-specific; the native indicator answers the separate question of whether the instance is doing agent work. Streaming keepalives reuse a valid typing owner with the same session generation, transport and target rather than revoking its pending HTTP/IPC action. Fresh context wrappers may reuse that owner within a proven generation; without generation evidence, context identity must match. Explicit queue dispatch and Telegram prompt handoff still replace the owner. Queue dispatch carries the queued turn's exact target into typing before `agent_start`, rather than reducing it to a chat ID. In Threaded Mode, missing or invalid Thread targets are refused before starting a loop or invoking the API; mode changes also invalidate a captured Classic chat-only loop. A rejected start never replaces an existing valid Thread loop. The starter also requires the captured Pi context and session generation to remain current at start, queued send, tick and late failure boundaries, even if the transport epoch is unchanged; replacing a context object in place cannot revive old activity. Message activity hooks capture generation across awaited preview work, and agent-start bindings recheck it before post-await activity/typing, so an obsolete finally or continuation cannot acquire replacement ownership. The typing sender carries its captured loop/context/generation/transport assertion as process-local call authority: direct API issuance rechecks it after queued work, and the follower caller rechecks it after registration waits and immediately before socket issuance without putting callbacks in IPC data. Automatic typing uses one HTTP attempt with no transport-family fallback or delayed replay, including forwarded calls; a future keepalive is a fresh owner-checked attempt. An already issued HTTP/RPC cannot be retroactively unsent. An ended loop supplies a process-local cancellation observation: only a typed API authority refusal with no underlying failure and paired with that proof is omitted from API failure logs, while the call still rejects without success or retry. If authority expires while handling a real HTTP/network failure, the authority error retains that failure as its cause and the API recorder logs the original failure. Active-owner refusals and HTTP/network failures keep their diagnostics; the cancellation observation never crosses IPC. Each loop refreshes its exact target every three seconds and keeps one action in flight. The leader API runtime coalesces identical chat/thread/action calls for two seconds, admits different Threads independently, and shares a real Telegram 429 `retry_after` fence across every Thread key in that chat. A pending-request count retains that shared state until every concurrent action settles, so completion of a faster peer cannot orphan a late 429; expired gates prune opportunistically and each gate family retains at most 256 active keys. Suppression never schedules a delayed retry. A failed typing action remains a structured diagnostic but cannot project `error` onto an otherwise healthy connected/leader/follower status. Assistant message start/update hooks still re-arm typing during Telegram-owned turns so transient provider/model errors do not leave a continuing run without activity feedback, and agent/session completion stops it. ### Rendering And Delivery Rich Markdown is the default model-answer membrane. Complete assistant replies send final Markdown directly as `InputRichMessage.markdown` through `sendRichMessage` when `assistant.rendering` is `rich`, and through the legacy Markdown-to-HTML renderer when `assistant.rendering` is `html`; guest replies use native Rich Markdown through `InputRichMessageContent` in `answerGuestQuery` results. Reasoning/thinking blocks, menus, status rows, queue controls, settings, diagnostics, and other harness-owned surfaces stay on explicit Telegram HTML/plain rendering, while completed tool activity uses native Rich block objects for visually distinct structured disclosure. Streaming previews may use `sendRichMessageDraft` only when `assistant.draftPreviews` is enabled and draft delivery succeeds. The bridge still strips top-level assistant action comments before delivery and may split output only for Telegram transport limits. Assistant delivery guarantees: - Model-authored Markdown is the source of truth; the bridge does not pre-render assistant Markdown to HTML unless the operator selects `assistant.rendering: "html"` for compatibility. - Before native Rich Markdown delivery, the bridge normalizes known Bot-API-fragile source forms without changing visible meaning, including space-after-marker blockquotes and dollar-prefixed ticker atoms that Telegram may otherwise treat as unterminated math. - Prompt context blocks use compact metadata (`[tag|key:value]`) as the stable inbound contract. `[telegram...]` names the current surface only: owner/current turns use `[telegram]` or `[telegram|thread:]`; guest-mode turns use `[telegram|guest:]`. In a private Guest Mode turn the paired owner's `from` identity is never the guest: the remote private-chat identity wins, then non-owner caller metadata, with a non-bot replied peer available only as a final identity fallback when stronger conversation evidence is absent; username falls back to the remote display name and numeric id. Reply attribution still belongs independently in `[reply|from:...]`, and a replied bot can never define or replace the current `[telegram|guest:...]` location identity. Source authors for quoted/forwarded material and their files are carried by `[reply|from:]`, `[forward|from:]`, and `[attachments|from:]`, while plain `[attachments]` remains current-turn attachments and is ordered before reply/forward/source context. Media embedded in inbound Telegram `rich_message` blocks is downloaded like ordinary message media and stays attached to its forward-source block instead of being mislabeled as current-user material. Guest-mode turns append a `[guest]` block to their turn text stating the one-reply/limited-window constraint and instructing a fast, concise, self-contained answer; the note travels with the turn text rather than the system prompt. - Quoted rich replies use Telegram `rich_message` blocks as the prompt-context source when available, so `[reply]` context receives rendered plain text instead of raw `InputRichMessage.markdown` fallback text. Replied media runs through the same inbound handlers and voice transcription providers as current-message media, with provenance-scoped `[outputs|from:…]` appended inside the reply block. - Long native Markdown replies are split only at Telegram Rich Message transport limits; oversized fenced code, display-math, and fully wrapped inline-formatting blocks are rewrapped per chunk so persisted Rich Markdown chunks remain structurally valid. - When Draft previews are enabled, streaming previews pass structurally closed assistant Markdown prefixes through to `sendRichMessageDraft` with ownership checks, voice and guest-turn suppression, and serialized flushes. Telegram Guest Mode uses one guest answer, normally an early inline placeholder edited at completion, so guest turns never start ordinary preview state even while `assistant.draftPreviews` is enabled. Queued attachments replace the acknowledged placeholder through cached-media edits rather than a second guest answer; supported types, error handling and staging authority follow the [Guest Mode media boundary](./outbound.md#guest-mode-media-boundary). Unclosed inline spans, links, fenced code, comments, and display-math blocks are held back until a safe boundary exists. Draft failures are recorded and the failing frame is skipped instead of degrading to raw plain-message previews, because partial Markdown can be invalid while the final message remains valid. - Preview flushes are single-flight within their generation. Publication and final delivery capture only preceding draft/publication dependencies, never later drafts blocked by that publication, and final delivery performs no post-final draft-clear call. Reset/invalidation detaches old-generation dependencies; previously issued transport requests may still settle, but stale draft, timer and publication results cannot clear or mutate replacement work. Successful final text delivery clears local preview state only while its captured segment, session and transport remain active. UI/compat rendering guarantees: - Bridge-owned UI surfaces such as tool rows, reasoning/thinking blocks, commands, menus, status messages, queue controls, diagnostics, settings, and interactive sections use Telegram HTML/plain rendering helpers by default. These texts are authored for operational UI rather than model output, so explicit HTML/plain markup remains clearer, safer, and easier to maintain. - In those UI/compat surfaces, real code blocks stay literal and escaped, supported absolute links stay clickable, unsupported links degrade safely, tables use compact monospace rendering with grapheme/display-width accounting, and list/quote/heading spacing stays Telegram-safe. Final delivery attaches reply metadata only where requested. Reply parameters apply only to the first chunk of split messages; continuation chunks are adjacent normal messages. Media-group turns reply to the representative message id. ### Outbound Artifacts And Assistant Actions Outbound files staged during an active Telegram turn are delivered after that turn completes but before any separate final text. Final delivery clears an existing preview first so an edited older message cannot appear above a later upload. Files use `telegram_attach`, are checked atomically per tool call, and use configurable size limits before photo/document upload. When no Telegram turn is active, `telegram_attach` sends files immediately to the paired/default chat, an assigned follower thread, or an explicit `chat_id` plus optional `thread_id`; `telegram_message` provides direct local/TUI Markdown text delivery for explicit user requests and runs the same `telegram_button` markup planner so buttons attach to that text message. Direct local/TUI delivery is singleton-controlled: classic mode requires this Pi instance to own `/telegram-connect`, while Threaded Mode followers must be registered and route through the leader-owned transport. Already accepted active-turn reply/attachment delivery remains session-local. The channel-post journal records only this agent path's own publication intent. `prepare` is exact and idempotent; `beginPublication` durably changes one prepared operation to outcome-unknown before any future non-idempotent send; only `confirmPublished` records the returned numeric channel/message identity. A retry never regains issuance from outcome-unknown or published state. The store validates profile and token fingerprint, refuses malformed/duplicate/over-capacity state, and lists newest retained records without claiming Telegram history. The public-`@username` direct-leader sender now uses the tool-call ID to prepare and begin this journal transition before `sendRichMessage`, then records the returned numeric channel/message identity plus bounded username/title observed by `getChat`. Retained outcome-unknown state refuses automatic replay. Bounded agent-facing listing is available locally. Exact edit/delete journal transitions fence each tool-call mutation as outcome-unknown before direct-leader `editMessageText` or `deleteMessage`, and require the same mutation ID to confirm edited or deleted state. Numeric-channel publication requires explicit `channel: true`; direct-leader `getChat` must prove the exact negative ID and channel type before issuance, and the send response must preserve that identity. Cross-process regressions prove one winner for concurrent publication/edit/delete issuance and no restart regrant. Reads fail closed before parsing links, foreign/loose files, unsupported no-follow platforms, identity races, or oversized input. No legacy post schema is migrated: absent state starts empty and unknown versions/fields fail closed. The 0.44 downgrade checker leaves this inert journal untouched because old code cannot issue its effects. Only an explicit successful list returns retained authored Markdown. Channel publication/list/mutation failures and runtime events use fixed messages without retained content, token, path, or arbitrary transport detail. Production-helper regressions model a lost successful caller ACK and an ambiguous send response: the same operation returns retained success or refuses outcome-unknown without a second transport call. The retry uses a freshly opened replacement store, proving durable behavior across helper replacement/restart. A native entrypoint regression disconnects/reconnects direct ownership and proves both retained success and ambiguous outcome avoid a second `sendRichMessage`. Sender-rights and live rollout evidence remain separate 0.45.0 work. Channel media posts upload one local `.jpg`/`.jpeg`/`.png`/`.webp` photo or `.mp4` video through the multipart transport with `text` as the HTML caption; kind, byte size (photo ≤ 10 MiB, video ≤ 50 MiB), and 1024 visible caption characters are validated before issuance, and unsupported types or albums are rejected rather than downgraded to links. The journal binds the inspected kind/file name/byte size/SHA-256 media identity and caption, so duplicate requests and lost acknowledgements never re-upload. A media-post edit replaces the caption through `editMessageCaption` with the same Markdown-to-HTML rendering, where `||spoiler||` now renders as ``. Assistant-authored final-message actions use hidden HTML comments, with an additional fenced wrapper for in-body buttons: - `telegram_voice` accepts one positional compact action cell or JSON object and creates one voice artifact through configured outbound handlers, programmatic voice handlers, or registered synthesis providers. - `telegram_button` accepts a JSON object, adaptive JSON/CML matrix, or positional Compact Matrix Literal. Named JSON objects and positional cells may coexist, with commas optional only between completed matrix or row elements. Each top-level cell creates one full-width row, while a nested row groups buttons horizontally without an artificial parser-width cap; every callback enqueues its configured prompt text as a normal Telegram prompt turn. The JSON-first grammar, positional trim/escape rules, atomic rejection, and renderer-owned width policy are specified in [Adaptive Button Literal](./compact-matrix-literal.md). Standalone `telegram_button` fenced blocks reuse the same cell/matrix grammar and callback store, including adjacent complete cells and matrices whose normalized rows concatenate in source order, and compile to native Rich Markdown button rows between paragraphs. Rendering validates each complete block before registering any callbacks, escapes label text, preserves disabled cells, and leaves enclosing fenced examples literal. Opening and closing lines allow spaces/tabs; openings accept three or more backticks or tildes, optional whitespace before the exact `telegram_button` name, and trailing whitespace. Closures must use the same marker and at least the opening length, with no other text. Previews hide complete and unfinished action fences. HTML mode projects those controls into the footer. In-body callbacks acknowledge without rewriting the Rich message; selected-style highlighting remains footer-only. Complete HTML action comments activate solely by their delimiters and accepted payload, independent of whitespace, adjacent text, lists, quotes or code fences. Same-line comments are independent. Escape the opening delimiter as `<!--` to show a literal example; backticks and backslashes do not disable an action comment. Exact-name button fences retain their separate top-level recognition rules. The Telegram surface independently strips every complete assistant-authored HTML comment from previews and final delivery regardless of Markdown position or comment owner; an unclosed comment is withheld through the remaining tail, and a comment-only result sends no text message. Pi's terminal transcript and model context remain unchanged. Unknown callback data outside owned prefixes is forwarded as `[callback] ` only after built-in and extension handlers decline it. ### Generative Apps The `generative-apps` Skill owns the general Generative Apps concept, application shapes, and hybrid method/prompt model. This section records only how the `pi-telegram` runtime composes that concept into the bridge. The bridge owns canonical `/genapps//.mjs` identity, installation/replacement, bounded runtime ports, state revision/timeline integrity, `app::method` routing before Pi queue admission, ordinary prompt routing through Pi, and Telegram delivery of returned Markdown/buttons. External capability ownership remains outside the bridge. `telegram_bind` is the agent-facing lifecycle surface. Installation and explicit replacement invoke mandatory `init`; replacement stages and initializes a complete candidate before publishing it under the same app name. During an active Telegram turn, successful Tool output is planned and delivered directly to that exact target by default, and the Tool result suppresses model duplication; `display: false` retains agent-only diagnosis. Outside an active turn no implicit target is chosen. Buttons emitted as `app::method` or `app::method()` take the inference-bypass route. For buttons carrying an app binding (emitted by that app's output), missing apps, malformed actions, stale revisions, invalid output, or method failure fail closed without becoming ordinary prompts. A button without a binding is ordinary model-authored text: a prompt that is malformed as a bound action, or names an app that is not installed, stays an ordinary prompt (`std::map`, `a::b(c)`) and never raises a Generative App error. The concrete runtime and wire reference remains in [Generative Apps Runtime For Telegram](./generative-apps.md). The bundled `generative-apps` Skill owns the concept and agent workflow; `generated-control-surface` owns its separate ephemeral interface protocol; `telegram-bridge` owns transport, target authority, delivery, and general turn operation. ## Extension Surfaces `pi-telegram` intentionally owns one `getUpdates` loop per bot. `polling` owns that internal loop; `updates` owns classification/default-routing plans plus the public handler registry layered extensions use to observe or consume updates without opening a competing polling connection. Layered extensions should integrate through extension surfaces instead of polling the same bot independently. - Raw update observation/consumption: [Updates](./updates.md). - Telegram-native slash commands: `registerTelegramCommand()` from [Public API](./public-api.md#commands). - Target-aware operational views and chat actions: [Telegram Delivery API](./delivery.md). - Normalized non-blocking Pi lifecycle events: [Telegram Activity API](./activity.md); the separate [`pi-telegram-extension-demo`](https://github.com/llblab/pi-telegram-extension-demo) project remains the companion-extension reference. - Structured inline UI sections: [Sections](./sections.md). - Callback namespace discipline: [Callback Namespaces](./callback-namespaces.md). - Voice/STT/TTS providers: [Voice Integration](./voice.md). - Inbound/outbound command-template handlers: [Command Templates](./command-templates.md). Extension callbacks must avoid `pi-telegram` owned prefixes such as `compact:`, `new:`, `tgbtn:`, `menu:`, `model:`, `thinking:`, `status:`, `queue:`, `settings:`, and `section:`. Workflow-specific Telegram slash commands should use the public command registry instead of becoming new core built-ins unless they are bridge lifecycle, transport ownership, queue safety, or essential operator controls. The bridge does not mirror arbitrary `ctx.ui.confirm/input/select/custom` prompts from other extensions into Telegram. Companion extensions that need Telegram operation should expose a Telegram-native command, section, settings row, callback, status line, inbound/update handler, or assistant action-markup path instead of relying on hidden TUI-only prompts. ## Diagnostics And Operational Behavior Deferred diagnostics snapshots are session-owned. Each 100 ms coalesced request captures the exact context/session generation before its timer or queued microtask; a successor requires a fresh request. Shutdown synchronously suspends requests, cancels the timer and drops predecessor reruns, then drains any started publication before cleanup can proceed. Fencing occurs before status projection, not only before publishing the runtime section: its cursor getter uses a journal reader that can create transaction guards or recover a missing snapshot. Already-dequeued callbacks cannot clear a successor timer or recreate retired journal families. Explicit status rendering stays immediate, while its best-effort snapshot request shares the same owned scheduler. The session scope is structural; Status stays independent of Lifecycle and Locks, and neither diagnostics nor its drain grants transport, storage recovery or routing authority. Deterministic removed-directory and snapshot-with-segments regressions guard fixture isolation without sleeps, deletion retries or cursor relaxation; native fixtures are not live or cross-platform acceptance. Status rendering distinguishes connected, active, dispatching, queued, tool-running, model-switching, and compacting states; the Telegram status menu gives compaction precedence over generic active or pending work. Its compact Tokens row shows only input and output totals, while the adjacent Cache row groups `R` cache-read tokens, `W` cache-write tokens, and `CH` for the latest assistant request's cache-read share of prompt tokens rather than a misleading cumulative-session ratio; the labels remain distinct from companion-provided usage limits. Observed automatic compaction sends the same start and completion notices as the manual command without duplicating notices for command-owned compaction. If no terminal hook arrives, the current observation times out after five minutes: it releases only observer-owned status/typing, records a diagnostic, and requests a guarded queue-dispatch recheck. Timeout is not proof that Pi compaction completed or was cancelled and emits no invented terminal notice. Superseded timeout callbacks and stale-context terminal hooks cannot abandon or cancel a newer observation. If a queue mutation removes the last waiting item while Telegram-owned work still has running tools, status remains active instead of degrading to connected. Queue reaction behavior, lane-tail transitions, Keep/Skip independence, multi-reaction precedence, and the Bot API reaction-removal limitation are defined in [Priority, Reactions, Keep, and Skip](#priority-reactions-keep-and-skip). Reaction changes first flush a matching delayed text or media group so the governed turn exists before mutation, and dropping marked heads cannot leave status permanently queued. `/telegram-status` records grouped diagnostics for transport/API, polling/update, prompt dispatch, controls, typing, compaction, setup, session lifecycle, attachment queue/delivery, and recent redacted runtime events. Polling diagnostics expose the exact phase, phase start, current update, last successful `getUpdates` response, and stop reason; outbound success never substitutes for inbound progress. Expected preview noise such as unchanged edit responses is filtered out. The compact TUI status renders only `error`; detailed failure text remains in diagnostics and profile-scoped logs instead of expanding the status line. Complete intermediate assistant text blocks from Telegram-originated activity are sent once to the immutable originating target before active-turn final delivery; final and terminal-partial segments stay with settlement. If settlement nevertheless resolves to text exactly equal to an intermediate already admitted for that Telegram turn, it preserves lifecycle settlement but suppresses the second persistent reply. This same-owner equality fence covers ordinary finals and recovered fallback answers; it does not deduplicate different text or infer Telegram acknowledgement from chat history. While this instance has exact direct or follower transport authority, completed public blocks from local/autonomous work are always sent once and in source order to the instance's authorized target. Connected companion projection is not configurable; disconnect or authority loss is its boundary. Both paths use the configured Rich or HTML renderer and exclude reasoning, tool traffic, token deltas, local prompt text, unknown sources, and stale generations. Each admitted block remains fenced to its exact target, profile/token stamp, leader epoch or follower registration generation, and session generation; non-idempotent acknowledgement ambiguity never authorizes replay. `assistant.activity` is an independent bridge-owned projection over normalized Activity events. Each process reloads the shared file-backed setting at `agent-start` before activity admission, so multi-instance mode cannot continue projecting a stale broader process-local selection. Omitted values resolve to `verbose`, while invalid values fail closed to `quiet`; `thinking` and `tools` select one technical class, while `verbose` enables both. Provider-exposed thinking uses persistent ordinary HTML containing only a standard expandable blockquote with a bounded redacted latest-text window and inline Markdown rendered as Telegram HTML. Like answer drafts, it accumulates for two seconds before the first frame, publishes at most one update every two seconds, and flushes remaining buffered reasoning on terminal completion. Completed executed tools use native Rich Messages: each closed `: ` root details node renders snake-case names as title words while preserving an uppercase two- or three-letter repeated prefix per word, then the native disclosure chevron reveals an open-by-default `arguments` child plus closed retained `update N` and `result`/`error` child details with lowercase monospaced, marker-free summaries and JSON pre blocks; known-safe Rich rejections fall back to the previous HTML disclosure. The projection captures the exact target and transport stamp at activity admission, serializes updates, preserves tool-start order, closes coalescing across assistant/thinking boundaries, bounds retained text/update memory plus edit frames and message/tool size, disables previews and HTTP(S) auto-link recognition inside technical evidence, and never replays a possibly committed send. Session generations own independent queues, so replacement drops queued old work without waiting on an old call. Bridge-owned assistant output and activity projection share one activity-publication sequence admitted synchronously from the activity bus, so later tool disclosures cannot overtake earlier assistant blocks. Activity targets and transport authority are captured before queued work starts. Active Telegram-turn final replies/artifacts and automatic compaction notices use that same publication owner before the existing direct/follower transport split, without mutually waiting on separate output tails. Final settlement captures the exact active turn and assistant result and reserves its publication position before config loading. Empty outcomes without a publication candidate reserve no position. Replacement, preparation failure, or an unused reservation releases the position without resetting or replying for a replacement turn. Final errors also publish through this owner. Reservations accept one task; cancellation cannot undo a published task, and session reset releases unresolved reservations while fencing old queued tasks. Terminal assistant messages with a publication candidate reserve the final position synchronously; settlement consumes that reservation only for the exact originating turn. Compaction notices enter the same queue immediately, behind the reserved final rather than through a separate notice buffer. Settlement, a new agent run, or session replacement cancels an unconsumed reservation. Notice target and authority are captured when the event is observed. Pi lifecycle completion does not wait for network publication. This order is process-local and does not serialize unrelated instances or independent registered activity handlers. Settlement, replacement, disconnect, failure, or stale authority clears only local ownership; already-sent activity messages remain in chat. Telegram prompt guidance is context- and authority-aware. The package and source-checkout extension contribute `telegram-bridge`, optional `generated-control-surface`, and `generative-apps` Skills through Pi resource discovery. Generated Control Surface treats `interface = f(state, capabilities, intent)` as a renderer-neutral primitive, compiling transient evidence-backed controls over domain-owned workflows, systems, navigation, supervision, and decisions without creating parallel application state. It composes an ordered ragged sequence of independently sized semantic rows rather than filling a rectangular grid: compact rows contain genuine peers, singleton rows isolate structurally independent actions, and rectangular layouts remain reserved for genuinely spatial state. Text-bearing controls use at most two columns and flow into additional rows, while denser rows are reserved for short position-bearing glyphs or codes and never exceed the eight-column phone-width UX maximum. Vertical extent is independent: a true spatial surface may retain substantially more rows, while non-spatial button walls route to grouping, disclosure, or pagination. Symmetry is treated as an evidence claim about equal relationships or real spatial topology; an abstract layout catalog supplies adaptable singleton, peer, staged, navigational, repeated-pair, and rectangular shapes without forcing tasks into preset grids. Repeated controls carry the smallest sufficient action delta when visible conversation is unambiguous; larger or error-prone state moves to a deterministic task-owned Markdown artifact, correctness-sensitive transitions move to a small domain-owned transition implementation, and repeated clicks are adjudicated against current state rather than stale button appearance. Its filesystem adapter reserves the first full-width row for parent traversal outside root, places available Previous/Next controls together in one compact row immediately afterward, orders visible directories, hidden directories, visible files, and hidden files alphabetically within each category before fixed ten-entry pagination, renders path/range metadata as stacked status-style key-value rows instead of middle-dot prose, emits the complete Telegram control set through one JSON-matrix action, suppresses duplicate plain/monospaced listings and default Refresh unless user preference overrides presentation, and retains an ordinary numbered fallback when buttons are unavailable. Only an exact direct owner or live registered follower exposes the two pi-telegram delivery tools, their active-tool metadata, and the compact routing suffix. Disconnect or authority loss removes those tool surfaces for subsequent requests without touching foreign tools; reconnect/recovery restores only the pi-telegram subset that was active before suspension, including across same-process reload. Repeated stable interactions may graduate from that model-mediated surface into a reviewed Generative App whose deterministic bound methods bypass Pi queue admission; the `generative-apps` Skill owns this compilation and operating workflow while the underlying capability retains domain authority. Telegram-originated turns route to the stable Skill contracts and retain dynamic blocks such as `[voice] delivery: automatic voice`; the Skills and public documentation own syntax, target routing, Threaded Mode behavior, Generative App operation, and diagnostics. ## In-Flight Model Switching When `/model` is used during an interruptible active agent run in the current Pi session, the bridge emulates Pi's interactive stop/switch/continue workflow: 1. Apply the selected model immediately. 2. Queue or stage a synthetic Telegram continuation turn before aborting. 3. Abort immediately, or wait for every active tool execution to finish before aborting. 4. Dispatch the continuation in the same session context under the selected model. A Telegram-originated run retains its active prompt target and reply anchor. For local/TUI or autonomous work without an active Telegram turn, the exact authorized model-menu chat, Thread, and message become the continuation target and reply anchor. Merely busy non-agent lifecycle work remains ineligible because no active agent abort handler exists. Pending selection and fallback-target state clear together on cancellation, new agent start, settlement, or session replacement. Continuation queueing may synchronously re-enter the controller; each dispatch retains its originating context and abort handler until its own effects finish. ## Shutdown And Timer Lifecycle `session_shutdown` is the hard boundary for session-bound runtime work. It suspends Telegram polling through the locked polling runtime, aborts the poll controller, stops native typing, unbinds deferred queue dispatch, suspends pending media/text-group debounce work for rebinding to the replacement session, clears preview state, clears active turns, and drops the active abort handler. Non-critical timers are `unref()`ed so print/headless processes are not kept alive only by Telegram housekeeping. This includes typing keepalive intervals, bounded typing-idle waits, deferred queue dispatch, media/text-group debounce windows, preview flush timers, and polling retry sleeps. Polling retry sleep is abort-aware, so shutdown does not wait for the normal retry delay after a polling error. Non-interactive `pi -p` runs must remain passive unless Pi provides a live Telegram session lifecycle. Loading the extension with `telegram.json` or existing lock state must not by itself keep the print-mode process alive or let a non-owner send companion Telegram output. ## Related - [README.md](../README.md) - [Project Context](../AGENTS.md) - [Project Backlog](../BACKLOG.md) - [Changelog](../CHANGELOG.md)