I read this as a full implementation and verification task - I’ll trace the Task26 authority, Telegram dispatch, QA, and golden-path contracts, then add deterministic lease tests first, implement the minimal shared-lock lease, and run the focused validation suite.


I’ve traced the race to the existing group -1000 handler: it checks a watcher-fed boolean, then returns before later PTB handlers mutate state. The fix boundary must wrap `Application.process_update` itself, with blocking `flock` work moved off-loop; I’m adding deterministic writer/handler ordering tests at that boundary before changing production code.


The deterministic lease tests now pass. I’m moving to the real socket proof: the authority watcher callback will be deliberately prevented from disconnecting ingress, the already-open `getUpdates` response will carry a real message only after the writer commit, and the transcript will separately record server delivery versus handler entry and mutation counts.


The real localhost PTB QA now demonstrates the non-tautological case (`server_delivered_post_revoke_updates=1`, `handler_entries=0`, `mutations=0`) while the watcher disconnect callback is deferred. I’m at final verification now: full focused authority/Telegram/socket and golden verifier suites, plus the repository’s Task26 Ty surface gate.


I read this as completed implementation and verification - the Task26 inbound revocation TOCTOU is closed with an application-level authority lease.

Implemented:
- One async shared authority lease per complete PTB `process_update`.
- Blocking `flock` acquisition/release runs off the event loop.
- Revocation-first updates are rejected before handlers.
- Update-first processing holds the lease until success, stop, error, or cancellation.
- Watcher remains eventual disconnect only.
- Real localhost socket QA returns a post-commit Telegram update with watcher disconnect deferred.
- Golden transcript requires:
  - `server_delivered_post_revoke_updates >= 1`
  - `handler_entries == 0`
  - `mutations == 0`
  - `watcher_failure_deferred == true`
- Verifier rejects empty-update evidence.

Verification:
- Authority/Telegram/socket tests: 35 passed.
- Golden verifier: 62 passed.
- Task26 Ty surface gate: 7 passed.
- Focused Ty checks: clean.
- Ruff on all scoped files: clean.
- Full `telegram.py` Ty still reports unrelated existing monolith diagnostics; none target the new lease code.
- No commit created.