Completes TODO #5. Forwarding a post now asks whether to save it whole
or extract its media; sending media directly is unchanged.
Built on forwarding rather than copying file_ids. The bot already has
the post in its private chat with the owner, so it stores message ids
and forwards them back. forwardMessages takes a list and keeps an album
intact, which is what made the caption-plus-album case tractable; ids
must be strictly ascending, so they are sorted on the way out.
- Vault rows live in their own table and every query is scoped to an
owner_id, so a guessed id cannot reach someone else's saved post.
Nothing in the vault is searchable inline, moderated or federated,
and the separate table makes that structural rather than a flag.
- Albums arrive as separate messages with no completion signal, so they
are buffered by media_group_id behind a 1s debounce and prompt once.
- The add path now takes a list of items, so extracting an album stores
every piece under one set of keywords instead of asking repeatedly.
- /vault searches keywords and the original caption, since the point of
a vault is finding something you never got round to tagging.
- Retrieval failures are reported: a message id is a pointer into the
chat, not a self-contained file_id, so clearing history breaks it.
Three near-identical keyword collectors are now one helper.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Design-only document covering the moderation queue, public mode,
save-vs-extract vault, and federation. Records the four decisions
taken on the roadmap and the API claims verified against aiogram
3.15.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
goyban