fix(telegram): stop shared topic authority outages from crashing the daemon

[Heyaaz]

What

Stop the Telegram notifications daemon from dying when the shared topic authority is momentarily unavailable.

Root cause: the liveness heartbeat (5s interval, one per session) renewed a session's topic lease via void this.#renewTopicLease(logicalSessionId).then(renewed => {...}) — a single-argument .then() with no rejection handler. #renewTopicLease is an async function that adopts #persistTopicMutation's promise, so any authority failure (compareAndSet/read throwing shared topic authority unavailable) rejected that promise with nothing attached and escaped to the process-level fatal handler.

Production evidence (gjc 0.12.15, 2026-08-06/07): repeated Uncaught exception / Unhandled rejection: Error: shared topic authority unavailable entries with a bare throw-site stack + processTicksAndRejections, plus session scan failed, Telegram replay admission failed, shutdown persistence failed, shutdown was not durably quiesced while the authority was down.

Fixes (all in packages/coding-agent/src/sdk/bus/telegram-daemon.ts):

1. Heartbeat lease renewal now passes a rejection handler — the failure is warn-logged and retried on the next heartbeat instead of killing the daemon.
2. Startup registry load — run()'s await this.loadTopics() is wrapped; a failed load warns and the daemon continues with an empty registry (mirrors the runScan retry philosophy from fix(notifications): stop a failed reconciliation pass from exiting the Telegram daemon #3907). Connected sessions re-create topics via ensureTopic; persist passes read the winner back from the authority.
3. Cause preservation — the four catch { throw new Error("shared topic authority unavailable") } sites now throw with { cause: error } so the underlying failure isn't lost.
4. Bounded compensation fence — #superviseCompensationFence's for(;;) 250ms retry now gives up after 40 attempts (~10s) with a warn; previously it spun forever while the authority was down, churning the registry and blocking shutdown quiescence.
5. DAEMON_GENERATION 54→55 (protected run() lifecycle change); generation-guard manifest regenerated.

Why

A single topic-authority outage killed the daemon (5s heartbeat × sessions), leaving every session topic as an unarchived shell answering nothing — observed as eight hours of dead-owner state with no notifications delivered.

Testing

• Reproduction: new regression test (a topic lease renewal failure on the liveness heartbeat is reported instead of escaping as an unhandled rejection) drives connectSession + hello(client_ping_pong) + event_replay_result to register the heartbeat interval, arms a dead compareAndSet authority, fires the tick. Against the unpatched code it fails with exactly the production signature (shared topic authority unavailable + processTicksAndRejections unhandled rejection); with the patch it passes (no escape, warn logged).
• bun test packages/coding-agent/test/notifications-*.test.ts — 1430/1430 pass (54 files, includes the 556-test telegram-daemon suite)
• tsc -p tsconfig.json --noEmit (packages/coding-agent) — clean
• biome check on touched files — clean
• bun scripts/telegram-daemon-generation-guard.ts --validate-current-tree — clean (manifest regenerated for the run declaration digest)

GJC verdict

gajae.pr-review-verdict.v1 merge-approved sha256:3562971edf08fd92bddda2efc469fbed670b2c74b0c59f6931916c775afbd87e reviewer:critic evidence:bun test packages/coding-agent/test/notifications-*.test.ts (1430/1430) + tsc --noEmit + generation-guard --validate-current-tree + four independent critic passes on exact head df4f1f8cb205aea5da9d356bd885aec9e4fbcc05 (rebase onto upstream/dev 9079f1b9a; CHANGELOG conflict resolved keeping both entries; fix code tree-identical to critic-approved bf240f526)

---

• Target branch is dev
• bun check passes (biome + tsc on touched package)
• Tested locally
• CHANGELOG updated (if user-facing)
• Verdict above matches the exact PR head, not an earlier commit

[Yeachan-Heo]

Terminal red-team (exact head df4f1f8)

Verdict: MERGE_READY / APPROVE

• Contract: shared topic authority outages must not crash the Telegram daemon; generation bump to 55 with tests.
• Scope: telegram-daemon + contract + tests + generation manifest.
• Exact-head CI green; mergeable=clean. Generation pin advances 54→55 for this daemon contract change (supersedes #3972 pin intentionally).
• Independent of ACP #3950 and perf #3764.

Merge authorized.