@open-everywhere/provider-slack 0.1.0

package/dist/agent/channels/slack-front.js

@@ -0,0 +1,1958 @@
+// Component 2 wake path — MOUNTED).
+//
+// Slack delivers EVERY subscribed event to ONE Request URL. Eve's `slackChannel` owns that
+// URL and only acts on `app_mention` + `message.im` (DM); a plain `message.channels` reply is
+// silently dropped, and Eve exposes no `onMessage` hook. So to get "reply without re-tagging"
+// we FRONT the public URL with our own route and forward the events slackChannel handles to
+// its own handler — no dispatch fork (option (b)), no upstream dependency (option (a)).
+//
+// The design (why it's clean):
+//   • The wrapped `slackChannel` is pointed at an INTERNAL route (`/eve/v1/slack/mention`).
+//   • OUR route sits at the PUBLIC `/eve/v1/slack` (the URL Slack POSTs to).
+//   • Both routes live on the SAME channel object (one file → one channel name → ONE session
+//     namespace and ONE `send`). So forwarding `args` straight through gives slackChannel the
+//     exact `send`/continuation machinery it would get if mounted directly, AND our wake uses
+//     the same `send` → `slackContinuationToken(channel, thread)` continues the very session
+//     the mention started. That shared namespace is the whole reason (c) works.
+//
+// The front route:
+//   1. Buffers the RAW body ONCE (needed for BOTH signature verification AND forwarding).
+//   2. Verifies the Slack signature over that raw body (fail-closed 401). We re-implement the
+//      HMAC here because Eve's `verifySlackRequest` isn't a public export; slackChannel still
+//      re-verifies on the forward path (a fresh Request re-reads the body), so the mention
+//      path's auth is unchanged — we only ADD a gate, never weaken one.
+//   3. Classifies the envelope: url_verification / block_actions interaction → FORWARD to
+//      slackChannel's handler; message.im and message.mpim (the DM FAMILY) → divert into the
+//      surface's own standing DM window (OPE-351 stages 2 + 4), never forwarded; app_mention →
+//      FORWARD too, UNLESS either the single-window mention policy (unified-window.ts seam) says
+//      the unified window owns it — then the app_mention EVENT ITSELF is diverted to the unified
+//      supervisor as an addressed direct-mention wake (single-leg: ONE decision on ONE webhook),
+//      and its message.channels sibling is dropped exactly as always — or the mention landed in a
+//      GROUP DM, which the envelope does not say and a conversations.info read has to answer, in
+//      which case it diverts into that mpim's DM window and its message.mpim sibling is dropped;
+//      plain message.channels/groups → run the engagement wake (routeMessageEvent);
+//      member_joined_channel (the bot's own join) → the channel-join intro
+//      (routeChannelJoinEvent); a urlencoded `block_actions` payload whose actions carry an
+//      `oe_approval:` action id → OURS,
+//      handled locally via `handleApprovalPayload` and NEVER forwarded — every other
+//      urlencoded body (Eve's own `eve_input:` HITL clicks, view_submission, slash
+//      commands) still forwards exactly as before.
+//   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
+import { POST } from "eve/channels";
+import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
+import { slackContinuationToken } from "eve/channels/slack";
+import { callSlackWebApi } from "./slack-web-api.js";
+import { auditDmBotAuthorDrop, auditDmDriverAdmitted, dmDoorAdmitsDriver, parseMessageEvent, routeMessageEvent, liveDeps, routeNameDropEvent, liveNameDropDeps, parseChannelJoinEvent, routeChannelJoinEvent, liveChannelJoinDeps, parseSlackReactionEvent, routeReactionEvent, liveReactionDeps, routeSupervisorEvent, liveSupervisorDeps, supervisorFifoKey, bindableFor, bindableForJoin, bindableForReaction, slackSingleWindowMentionPolicy, slackDomainUsesUnifiedWindow, slackFrontTenantFenceDeclined, slackInteractivityTenantFenceDeclined, } from "./slack-events.js";
+import { slackInteractivityTenantIds } from "./slack-tenant-fence.js";
+import { EventDedupe, ThreadFifo, getOrCreateDmSeat as liveGetOrCreateDmSeat, touchDmSeat as liveTouchDmSeat, resolvePartition, domainKeyOf, isThreadEngaged, divertInboundToUnifiedWindow, isPrunedDeploymentWakeError, markUndeliveredAfterHeal, isUndeliveredAfterHeal, healPrunedDeploymentStrand, mintWakeId, slackVendorEventTime, spreadVendorTs, resolveWakeTrust, ambientSupervisorEnabled, getConfig, getOperationalStore, OE_APPROVAL_PREFIX, handleApprovalPayload as liveHandleApprovalPayload, OE_SETKEY_ACTION_PREFIX, OE_SETKEY_MODAL_CALLBACK, handleSetKeyClick as liveHandleSetKeyClick, handleSetKeyViewSubmission as liveHandleSetKeyViewSubmission, OE_CONNECT_ACTION_PREFIX, handleConnectClick as liveHandleConnectClick, OE_GRANT_ACTION_PREFIX, OE_INPUT_CLICK_PREFIX, handleGrantCardClick as liveHandleGrantCardClick, buildRecord, enqueue as enqueueLogRecord, flushLogShip, stampNonMemberChatAuth, externalPolicyIsInert, recordWakeTail, tailAuthorGrain, dmWindowRegistryKey, approvalCardRespondVia, } from "@open-everywhere/core/agent/adapter-api.js";
+import { renderWakeMessage, slackChannelFactsFor, slackAuthorIsMember, slackClickerIsGuest, slackWakeAuthorFacts, slackExternalPolicyForRoom, applySlackExternalPolicy, stripUnfencedSlackAttachments, slackEnterpriseIdFromEnvelope, _resetAuthorMemberCache, } from "./slack-events.js";
+import { buildSlackAuth, withForwardedSlackEnvelope } from "./slack-identity.js";
+import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
+import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
+import { handleSlackApprovalCardClick as liveHandleApprovalCardClick, } from "./slack-approval-card.js";
+import { parseSlackShortcutPayload, shortcutMessageEvent, shortcutWakeKey, } from "./slack-shortcut.js";
+/** The public URL Slack POSTs every subscribed event to (Event Subscriptions Request URL). */
+export const PUBLIC_SLACK_ROUTE = "/eve/v1/slack";
+/** The internal path the wrapped `slackChannel` is mounted at (never hit by Slack directly). */
+export const INTERNAL_SLACK_ROUTE = "/eve/v1/slack/mention";
+/**
+ * Best-effort decode of a urlencoded interactivity body into an `oe_approval:` block_actions
+ * payload — `undefined` for anything that isn't one (no `payload` field, unparseable JSON, a
+ * non-`block_actions` type, or a `block_actions` whose action ids are all someone else's, e.g.
+ * Eve's own `eve_input:` HITL buttons). Never throws: any parse failure just means "not ours".
+ */
+function parseOeApprovalPayload(rawBody) {
+    const raw = new URLSearchParams(rawBody).get("payload");
+    if (!raw)
+        return undefined;
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof payload !== "object" || payload === null)
+        return undefined;
+    const p = payload;
+    if (p.type !== "block_actions" || !Array.isArray(p.actions))
+        return undefined;
+    const isOurs = p.actions.some((a) => typeof a === "object" &&
+        a !== null &&
+        typeof a.action_id === "string" &&
+        a.action_id.startsWith(OE_APPROVAL_PREFIX));
+    return isOurs ? payload : undefined;
+}
+/** Decode the interactivity `payload` field into a plain object, or undefined if it isn't parseable
+ *  JSON-in-urlencoded. Shared by the setkey click + view_submission classifiers below. */
+function decodeInteractivityPayload(rawBody) {
+    const raw = new URLSearchParams(rawBody).get("payload");
+    if (!raw)
+        return undefined;
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    return typeof payload === "object" && payload !== null ? payload : undefined;
+}
+/**
+ * Best-effort decode of a urlencoded body into an `oe_setkey:` "Set API key" `block_actions`
+ * payload (credentials/intake.ts) — undefined for anything that isn't one. Never throws.
+ */
+function parseOeSetKeyClickPayload(rawBody) {
+    const p = decodeInteractivityPayload(rawBody);
+    if (!p || p.type !== "block_actions" || !Array.isArray(p.actions))
+        return undefined;
+    const isOurs = p.actions.some((a) => typeof a === "object" &&
+        a !== null &&
+        typeof a.action_id === "string" &&
+        a.action_id.startsWith(OE_SETKEY_ACTION_PREFIX));
+    return isOurs ? p : undefined;
+}
+/**
+ * Best-effort decode of a urlencoded body into an `oe_connect:` connector-card `block_actions` payload
+ * (connections/connector-card.ts) — undefined for anything that isn't one. Never throws.
+ */
+function parseOeConnectClickPayload(rawBody) {
+    const p = decodeInteractivityPayload(rawBody);
+    if (!p || p.type !== "block_actions" || !Array.isArray(p.actions))
+        return undefined;
+    const isOurs = p.actions.some((a) => typeof a === "object" &&
+        a !== null &&
+        typeof a.action_id === "string" &&
+        a.action_id.startsWith(OE_CONNECT_ACTION_PREFIX));
+    return isOurs ? p : undefined;
+}
+/**
+ * Best-effort decode of a urlencoded body into an `oe_grant:` credential-grant card `block_actions`
+ * payload (access/credential-grant-card.ts) — undefined for anything that isn't one. Never throws.
+ */
+function parseOeGrantClickPayload(rawBody) {
+    const p = decodeInteractivityPayload(rawBody);
+    if (!p || p.type !== "block_actions" || !Array.isArray(p.actions))
+        return undefined;
+    const isOurs = p.actions.some((a) => typeof a === "object" &&
+        a !== null &&
+        typeof a.action_id === "string" &&
+        a.action_id.startsWith(OE_GRANT_ACTION_PREFIX));
+    return isOurs ? p : undefined;
+}
+/**
+ * Best-effort decode of a urlencoded body into an `oe_input:` bridged-approval-card `block_actions`
+ * payload (core channels/approval-card.ts) — undefined for anything that isn't one. Never throws.
+ *
+ * 🔴 NOT eve's `eve_input:`, which still FORWARDS. The two prefixes are one character apart on
+ * purpose — both name an input request — and only one of them is ours. `startsWith` distinguishes
+ * them cleanly because neither is a prefix of the other, and the order of the two branches never
+ * matters: eve's clicks reach no branch here at all and fall to the urlencoded forward.
+ */
+function parseOeInputClickPayload(rawBody) {
+    const p = decodeInteractivityPayload(rawBody);
+    if (!p || p.type !== "block_actions" || !Array.isArray(p.actions))
+        return undefined;
+    const isOurs = p.actions.some((a) => typeof a === "object" &&
+        a !== null &&
+        typeof a.action_id === "string" &&
+        a.action_id.startsWith(OE_INPUT_CLICK_PREFIX));
+    return isOurs ? p : undefined;
+}
+/**
+ * Best-effort decode of a urlencoded body into OUR credential-intake `view_submission` (its
+ * `view.callback_id` is our modal's) — undefined for any other view_submission (Eve's own modals
+ * still forward). Never throws.
+ */
+function parseOeSetKeyViewSubmission(rawBody) {
+    const p = decodeInteractivityPayload(rawBody);
+    if (!p || p.type !== "view_submission")
+        return undefined;
+    const view = p.view;
+    return view?.callback_id === OE_SETKEY_MODAL_CALLBACK ? p : undefined;
+}
+/**
+ * The ids one already-decoded INTERACTIVITY payload names, for the tenant fence at the six click
+ * branches (OPE-1680). The tenant half comes from {@link slackInteractivityTenantIds}, which is the
+ * one reader of Slack's three Grid spellings; the room half is read here because only the fence's
+ * AUDIT ROW wants it — the admission decision never turns on a channel.
+ *
+ * A `view_submission` names no `channel` at all (it names a view), which is exactly why the row
+ * writer takes an optional channel rather than demanding one.
+ */
+function interactivityFenceIds(payload) {
+    const p = payload;
+    const obj = (v) => (typeof v === "object" && v !== null ? v : undefined);
+    const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+    const channelId = str(obj(p?.channel)?.id);
+    const userId = str(obj(p?.user)?.id);
+    return {
+        ...slackInteractivityTenantIds(payload),
+        ...(channelId === undefined ? {} : { channelId }),
+        ...(userId === undefined ? {} : { userId }),
+    };
+}
+/**
+ * Decide how the front route handles a raw inbound body. FORWARD is the fail-safe default:
+ * anything slackChannel owns (the challenge handshake, `app_mention`, a `block_actions`/slash
+ * interaction) or anything unrecognized goes to slackChannel unchanged. The DM FAMILY is ours:
+ * `message.im` (OPE-351 stage 2) and `message.mpim` (stage 4) classify `dm-wake` and are diverted
+ * into the surface's own standing window. The other events slackChannel drops route to us too: a
+ * plain channel/group `message` → the engagement wake, `member_joined_channel` → the channel-join
+ * intro, and a urlencoded `block_actions` payload carrying an `oe_approval:` action id → the
+ * approval-click handler (ours alone). A urlencoded SHORTCUT payload (`message_action` /
+ * `shortcut`, OPE-1376) is ours too — every OTHER urlencoded body, including Eve's `eve_input:`
+ * clicks, its view_submissions and slash commands, still forwards. No network I/O and NO side
+ * effects, so every branch is unit-tested. Classification decides what a request IS; nothing here
+ * may write process state, because every gate that decides whether the request WAKES anything runs
+ * later in the handler (OPE-1442). The absence of a lookup is also why the
+ * GROUP-DM app_mention leg is decided in the HANDLER and not here: it needs a Slack lookup, because
+ * an app_mention envelope carries no `channel_type` to classify on.
+ */
+export function classifyEnvelope(rawBody, contentType) {
+    // Interactions (button clicks, slash commands) arrive urlencoded (`payload=...`).
+    if (contentType.includes("application/x-www-form-urlencoded")) {
+        const approvalPayload = parseOeApprovalPayload(rawBody);
+        if (approvalPayload !== undefined) {
+            return { kind: "approval-click", reason: "block_actions oe_approval: click — ours, never forwarded", payload: approvalPayload };
+        }
+        const setKeyClick = parseOeSetKeyClickPayload(rawBody);
+        if (setKeyClick !== undefined) {
+            return { kind: "setkey-click", reason: "block_actions oe_setkey: click — ours, never forwarded", payload: setKeyClick };
+        }
+        const setKeySubmit = parseOeSetKeyViewSubmission(rawBody);
+        if (setKeySubmit !== undefined) {
+            return { kind: "setkey-submit", reason: "view_submission for our credential-intake modal — ours, never forwarded", payload: setKeySubmit };
+        }
+        const connectClick = parseOeConnectClickPayload(rawBody);
+        if (connectClick !== undefined) {
+            return { kind: "connect-click", reason: "block_actions oe_connect: click — ours, never forwarded", payload: connectClick };
+        }
+        const grantClick = parseOeGrantClickPayload(rawBody);
+        if (grantClick !== undefined) {
+            return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
+        }
+        const inputClick = parseOeInputClickPayload(rawBody);
+        if (inputClick !== undefined) {
+            return { kind: "input-click", reason: "block_actions oe_input: click — ours, never forwarded", payload: inputClick };
+        }
+        // A SHORTCUT (OPE-1376) — a `message_action` or `shortcut` payload. Ours, never forwarded; see
+        // the `shortcut` arm of FrontDecision for why a forward could not do anything with it. It is
+        // matched LAST among the urlencoded branches and cannot race any of them: every branch above
+        // reads a `block_actions` or a `view_submission`, and a shortcut is neither.
+        const shortcut = parseSlackShortcutPayload(decodeInteractivityPayload(rawBody));
+        if (shortcut) {
+            return { kind: "shortcut", reason: `${shortcut.kind} shortcut "${shortcut.callbackId}" — ours, never forwarded`, shortcut };
+        }
+        return { kind: "forward", reason: "urlencoded interaction/slash — slackChannel owns it" };
+    }
+    let env;
+    try {
+        env = JSON.parse(rawBody);
+    }
+    catch {
+        return { kind: "forward", reason: "unparseable body — let slackChannel ack it" };
+    }
+    if (env?.type === "url_verification") {
+        return { kind: "forward", reason: "url_verification challenge — slackChannel answers it" };
+    }
+    if (env?.type !== "event_callback") {
+        return { kind: "forward", reason: `outer type "${String(env?.type)}" — not an event we wake on` };
+    }
+    const eventType = typeof env.event?.type === "string" ? env.event.type : undefined;
+    if (eventType === "app_mention") {
+        // Not a bare "forward": the handler must first ask the single-window policy whether the
+        // unified window owns this mention (suppress the native forward) — the default answer is
+        // "forward to the mention path", byte-identical to before the branch existed.
+        return { kind: "mention", reason: "app_mention — the mention path owns it unless single-window suppresses", env };
+    }
+    if (eventType === "member_joined_channel") {
+        return { kind: "join", reason: "member_joined_channel — channel-join intro candidate", env };
+    }
+    if (eventType === "reaction_added" || eventType === "reaction_removed") {
+        // Inbound reactions: slackChannel drops them (no handler), so they're ours to ingest
+        // (reaction-ingest.ts — a feedback signal on the bot's own replies + volume telemetry).
+        return { kind: "reaction", reason: `${eventType} — reaction ingestion candidate`, env };
+    }
+    if (eventType !== "message") {
+        return { kind: "forward", reason: `event "${String(eventType)}" — not a message` };
+    }
+    const channelType = typeof env.event.channel_type === "string"
+        ? env.event.channel_type
+        : undefined;
+    if (channelType === "im") {
+        // OPE-351 stage 2: a 1:1 DM is no longer forwarded to eve's native `onDirectMessage`. Its seat is
+        // a first-class standing WINDOW (channels/dm-seat.ts), so the DM is diverted onto the `unified`
+        // channel exactly like the single-window app_mention above — one decision, one webhook.
+        return { kind: "dm-wake", reason: "message.im (DM) — the DM window seat owns it", env, dmKind: "im" };
+    }
+    if (channelType === "mpim") {
+        // OPE-351 stage 4: a GROUP DM joins the family. Its previous route was the engagement wake below,
+        // where `shouldNameDropWake` refused it outright on channel_type — so a non-mention message in a
+        // group DM woke NOTHING, and the room's only live path was an `app_mention` forwarded to eve's
+        // native per-thread session. Both halves move into the mpim's own standing window (the mention
+        // half in the `mention` branch of the handler, which has to ASK Slack what surface it landed on —
+        // an app_mention envelope carries no channel_type).
+        return { kind: "dm-wake", reason: "message.mpim (group DM) — the DM window seat owns it", env, dmKind: "mpim" };
+    }
+    // channels / groups — the plain reply slackChannel drops. Ours to wake.
+    return { kind: "wake", reason: `message.${channelType ?? "?"} — engagement wake candidate`, env };
+}
+/** The FIFO key a DM's wakes serialize on. Generation-INDEPENDENT (the same reasoning as
+ *  `supervisorFifoKey`): the FIFO's job is to serialize this DM's wakes, which must hold ACROSS a
+ *  rotation boundary too, so it keys on the channel and never on the generation-bearing token. Its
+ *  own namespace, so a DM's queue is never shared with a channel supervisor's or a thread's. */
+export function dmFifoKey(dmChannelId) {
+    return `${dmChannelId}:oe-dm`;
+}
+// --- signature verification (Slack HMAC) ------------------------------------
+const SLACK_MAX_SKEW_SECONDS = 60 * 5; // Slack's own replay window.
+/**
+ * Verify a Slack request signature over the RAW body (the exact bytes Slack signed).
+ * `v0=` HMAC-SHA256 of `v0:{timestamp}:{body}` keyed by the signing secret, constant-time
+ * compared, with a 5-minute replay window. Fail-closed: any missing header / secret, a stale
+ * timestamp, or a mismatch returns false. `nowMs` is injectable so the replay window is tested.
+ *
+ * The BASESTRING AND DIGEST are `channels/slack-signature.ts`'s (OPE-197), shared verbatim with the
+ * webhook-registry entry for this scheme — a difference there would be a signature that verifies on
+ * one route and 401s on the other. What stays HERE is what the two routes legitimately differ on:
+ * this one reads one env-homed secret and returns a bare boolean, because a Slack Request URL has no
+ * failure vocabulary to report into.
+ */
+export function verifySlackSignature(rawBody, headers, signingSecret, nowMs = Date.now()) {
+    const timestamp = headers.get(SLACK_TIMESTAMP_HEADER);
+    const signature = headers.get(SLACK_SIGNATURE_HEADER);
+    if (!signingSecret || !timestamp || !signature)
+        return false;
+    const ts = Number(timestamp);
+    if (!Number.isFinite(ts) || Math.abs(nowMs / 1000 - ts) > SLACK_MAX_SKEW_SECONDS)
+        return false;
+    return slackSignatureMatches(signingSecret, timestamp, rawBody, signature);
+}
+// --- retry de-dupe + per-thread FIFO: LIFTED to core (OPE-114 stage 4) ----------------------
+// EventDedupe and ThreadFifo are provider-neutral front-door plumbing (teams-front rides them
+// too) — they now live in core channels/front-queue.ts, imported through the barrel below and
+// re-exported here so bundle-internal import sites (slack-commands, tests) are unchanged.
+export { EventDedupe, ThreadFifo };
+// --- bot identity (mention suppression) -------------------------------------
+/**
+ * The bot's own Slack user id, resolved once via `auth.test` (cached). Needed because Slack
+ * fires BOTH `app_mention` AND `message.channels` for a message that @mentions the app; the
+ * mention path already owns the `app_mention`, so on the wake path we DROP a message whose
+ * AUTHORED text still carries `<@bot>` to avoid a double turn. Authored, not the parsed `text`:
+ * that now carries forwarded content too, and a forward quoting a bot mention must still wake
+ * (OPE-1374). Best-effort: if it can't be resolved
+ * (no token / API error) we don't suppress — an occasional double is better than dropping a
+ * genuine engaged reply. `SLACK_BOT_TOKEN` is already required for the bot to post at all, so
+ * in practice this resolves.
+ */
+let botIdentityPromise;
+export function resolveBotIdentity() {
+    if (!botIdentityPromise) {
+        botIdentityPromise = (async () => {
+            try {
+                // Via OE's `callSlackWebApi` (the 429-backoff seam); a missing token makes it throw, and any
+                // throw → {} (best-effort — we simply don't suppress on failure).
+                const json = (await callSlackWebApi({ botToken: undefined, operation: "auth.test", body: {} }));
+                return json.ok ? { userId: json.user_id, botId: json.bot_id } : {};
+            }
+            catch {
+                return {};
+            }
+        })();
+    }
+    return botIdentityPromise;
+}
+/** Reset the cached identity (tests only). */
+export function _resetBotIdentity() {
+    botIdentityPromise = undefined;
+}
+const OK = () => new Response("ok");
+/**
+ * The Enterprise Grid rung a forwarded delivery carries, paired with the message it describes
+ * (OPE-1559). `undefined` for an ordinary single-workspace install, for an interactivity body, and
+ * for anything this route could not parse — the native forward then stows nothing and `slack.ts`
+ * stamps no rung, exactly as before.
+ *
+ * The rung itself comes from {@link slackEnterpriseIdFromEnvelope}, the ONE reader of
+ * `enterprise_id`; this function only pairs it with the inner event's `(channel, ts)`, which is what
+ * lets `forwardedSlackEnterpriseId` (slack-identity.ts) answer for that message alone. A Grid
+ * envelope whose inner event names neither returns `undefined`: an unpairable rung is a rung this
+ * route will not carry.
+ */
+function forwardedEnvelopeOf(rawBody) {
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBody);
+    }
+    catch {
+        return undefined;
+    }
+    // `JSON.parse` answers `null` for the body `null`, and a scalar for `1` or `"x"` — none of which
+    // throws, and all of which would make the field reads below throw INSTEAD OF returning undefined.
+    // A throw here escapes `forwardNative` and turns a forward that used to ack 200 into a 500 that
+    // Slack retries, so the shape is checked rather than assumed.
+    if (parsed === null || typeof parsed !== "object")
+        return undefined;
+    const env = parsed;
+    const enterpriseId = slackEnterpriseIdFromEnvelope(env);
+    if (enterpriseId === undefined)
+        return undefined;
+    const event = env.event;
+    const channelId = typeof event?.channel === "string" ? event.channel : undefined;
+    const ts = typeof event?.ts === "string" ? event.ts : undefined;
+    if (!channelId || !ts)
+        return undefined;
+    return { enterpriseId, channelId, ts };
+}
+/** The event_id (retry-stable) or `(channel, ts)` key we de-dupe a wake candidate on.
+ *  Prefixed with the RECEIVING bot identity (constant "default" today): with N Slack apps
+ *  in one channel (item 27 tier 2) each app receives its own copy of every message, and
+ *  an un-prefixed key would swallow one app's copy as the other's retry — silently, per
+ *  message, maddening to debug. The TTL'd dedupe store self-heals across the change. */
+function wakeKey(env, channelId, ts, botIdentity = "default") {
+    const eventId = typeof env.event_id === "string" ? env.event_id : undefined;
+    return `${botIdentity}:${eventId ?? `${channelId}:${ts}`}`;
+}
+/**
+ * Resolve the 1:1 DM channel with one Slack member (OPE-1376's global-shortcut landing place).
+ *
+ * `conversations.open` is idempotent — repeated calls return the SAME `im` channel id — so there is
+ * no "already open" branch, and this opens no conversation a global shortcut's invoker did not
+ * themselves ask for by pressing the shortcut.
+ *
+ * FAIL-CLOSED and QUIET-ON-THE-WIRE: any failure (no token, a workspace without `im:write`, a user
+ * who cannot be DM'd) returns `undefined`, which the caller turns into "wake nothing, log why".
+ * Returning a guess would put a person's shortcut into a room they did not choose.
+ */
+async function liveOpenDirectMessageChannel(userId) {
+    try {
+        const opened = await callSlackWebApi({ botToken: undefined, operation: "conversations.open", body: { users: userId } });
+        if (opened?.ok !== true)
+            return undefined;
+        const channel = opened.channel;
+        return typeof channel?.id === "string" && channel.id.length > 0 ? channel.id : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Durable half of the retry dedupe: the in-memory seen-set only catches a retry landing
+// on the SAME instance; on serverless the redelivery often lands on a fresh one. FAIL-OPEN
+// by design — dedupe prevents an annoyance (a double reply), not a security hole, so a
+// store outage must never silence genuine wakes. TTL matches the in-memory set; Slack
+// stops retrying long before it expires.
+const DEDUPE_TTL_MS = 10 * 60_000;
+let warnedDedupeStore = false;
+async function liveMarkEventSeen(org, key, atIso) {
+    try {
+        return await getOperationalStore().markEventSeen(org, key, atIso, DEDUPE_TTL_MS);
+    }
+    catch (err) {
+        if (!warnedDedupeStore) {
+            warnedDedupeStore = true;
+            console.warn(`[open-everywhere:slack-front] durable dedupe unavailable — in-memory only: ${String(err)}`);
+        }
+        return true;
+    }
+}
+// Route decisions used to be silently discarded, which made a gate decline, a judged
+// NO_REPLY, and a broken path indistinguishable from the outside (bit us live: "the
+// name-drop didn't reply" had no way to tell WHY). One line per candidate event; the
+// posted reply itself is the positive signal, this line is the story when there isn't one.
+const logOutcome = (path, channelId, ts) => (outcome) => {
+    console.log(`[open-everywhere:slack-front] ${path} ${channelId}/${ts}: ${outcome.woke ? "woke" : "no wake"} — ${outcome.reason}`);
+};
+/**
+ * Turn a swallowed FIFO wake failure into a DURABLE, queryable signal (resilience S-1 / #551
+ * §3.4): a log-ship "error" record (the primary win — the failure survives the ~1h console
+ * retention) plus a best-effort `surface.wake_failed` audit row (mirrors recordQuietFailure's
+ * posture). The FIFO key encodes the channel (`${channelId}:${threadTs}` for a thread wake,
+ * `${channelId}:oe-sup` for a supervisor wake); team is unknown at this layer, so the audit
+ * partition falls back to the empty-team default exactly like recordQuietFailure's own
+ * `teamId ?? ""` — best-effort, never blocks. Never throws.
+ */
+/**
+ * Deliver a wake, and RE-DELIVER IT ONCE when the first attempt died on a pruned deployment
+ * (OPE-963, channels/stranded-seat.ts).
+ *
+ * The first attempt's failure is not wasted: `divertToUnifiedWindow` classified it and MARKED the
+ * seat's `channel_session` row for rotation before it rethrew. So the second attempt re-resolves the
+ * seat, `rotationTrigger` answers `operator-marked`, the seat takes its own rotate leg (fresh
+ * generation, carried tail), and eve opens a NEW run under the CURRENT deployment. Without this the
+ * member loses the message that hit the strand, even though the seat itself is healed.
+ *
+ * EXACTLY ONE retry, and only for this class. Every other failure rethrows untouched, straight to
+ * the FIFO's loud handler ({@link recordWakeFailure}). A second failure of the same class rethrows
+ * too — the seat could not be marked, so a third attempt would resume the same dead run.
+ *
+ * THE ROUTE FUNCTION MUST BE RE-RUNNABLE, and both wrapped routes are. Everything they do before
+ * the divert is a read or an idempotent write: TTL-cached `conversations.info` / `users.info`
+ * probes, a deterministic external-policy verdict (its private notice posts only on a verdict that
+ * RETURNS rather than throws, so a retry never reaches it), a read-only spend gate, and
+ * `markEngaged`, which upserts. `recordWakeTail` and `touchDmSeat`/`touchSession` all run AFTER the
+ * divert, so a failed attempt records nothing to duplicate. The wake id is minted fresh, which is
+ * correct — the retry is a new delivery.
+ *
+ * Applied only to the WINDOW-bearing routes — a thread seat has no `channel_session` row to mark,
+ * so a retry there could only resume the same dead run.
+ *
+ * OPE-970: when the RETRY ALSO throws, the seat is still healed for its NEXT wake — but THIS
+ * member's message got no answer, and that fact must not collapse into an ordinary send-failure
+ * row indistinguishable from a transient blip. The retry's error is tagged
+ * ({@link markUndeliveredAfterHeal}) before it rethrows, so {@link recordWakeFailure} can give the
+ * row its own reason.
+ */
+export async function deliverWithStrandRetry(deliver) {
+    try {
+        return await deliver();
+    }
+    catch (err) {
+        if (!isPrunedDeploymentWakeError(err))
+            throw err;
+        console.warn(`[open-everywhere:slack-front] wake hit a pruned deployment — seat marked for rotation, re-delivering once: ${String(err)}`);
+        try {
+            return await deliver();
+        }
+        catch (retryErr) {
+            markUndeliveredAfterHeal(retryErr);
+            throw retryErr;
+        }
+    }
+}
+export function recordWakeFailure(key, err) {
+    const channelId = key.split(":")[0] ?? key;
+    try {
+        enqueueLogRecord(buildRecord("error", "wake", "supervisor/thread wake delivery failed", { fields: { fifoKey: key, channelId }, err }));
+        void flushLogShip();
+    }
+    catch {
+        /* log-ship best-effort */
+    }
+    // Held on the route (OPE-1648): the FIFO promise this runs under is itself in `waitUntil`, but a
+    // `void`-ed write sits OUTSIDE that promise and so races the freeze after the 200 all the same.
+    void holdRouteWork((async () => {
+        try {
+            const p = resolvePartition({
+                channel: { kind: "slack" },
+                session: { auth: { current: { attributes: { team_id: "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+            });
+            // OPE-970: a retry that ALSO failed after the pruned-deployment heal gets its own reason —
+            // otherwise it is indistinguishable from any other send failure, and the only way to tell
+            // "the seat is fine now but this message was lost" from "a transient blip" was to read the
+            // raw message text and recognise the run-key sentence by eye.
+            const undeliveredAfterHeal = isUndeliveredAfterHeal(err);
+            await getOperationalStore().appendAudit({
+                ts: new Date().toISOString(),
+                org: p.org,
+                platform: p.platform,
+                workspace: p.workspace,
+                surface: p.surface,
+                action: "surface.wake_failed",
+                detail: {
+                    fifoKey: key,
+                    message: String(err instanceof Error ? err.message : err).slice(0, 500),
+                    ...(undeliveredAfterHeal
+                        ? { reason: "pruned-deployment-heal-retry-failed", remedy: "seat healed for its next wake; this message got no answer" }
+                        : {}),
+                },
+            });
+        }
+        catch {
+            /* audit is best-effort — the log-ship record above is the durable signal */
+        }
+    })());
+}
+/**
+ * Build the front route handler. Buffers the body once, verifies the signature, then forwards
+ * or wakes per {@link classifyEnvelope}. `innerHandler` is slackChannel's own POST handler,
+ * invoked with a FRESH Request (re-readable body) + the same {@link RouteHandlerArgs}, so
+ * slackChannel re-verifies and dispatches exactly as if it owned the URL.
+ */
+/**
+ * SINGLE-WINDOW diversion (channels/unified-window.ts): layer the cross-channel hop onto the
+ * supervisor deps. When routeSupervisorEvent minted a `window` for a wake (the domain's
+ * crossSurfaceWindow gates hold — the wakeId is already rendered into the envelope), deliver it
+ * through eve's cross-channel `to(...).send(...)` into the synthetic `unified` channel instead of the
+ * Slack send: the effective token becomes `unified:<raw>`, shared with every surface in the
+ * domain — ONE context window. The unified channel's `receive` registers the wakeId→origin map
+ * entry (durably, BEFORE the send) and re-checks the gates fail-closed. This wrapper lives HERE
+ * because only the route handler holds `args.to` (and slack-events.ts must not import
+ * unified.ts — unified.ts imports it). A window-less wake passes through untouched, so flag-off
+ * is byte-identical. A diversion failure PROPAGATES to the FIFO's loud catch (fail-closed: a
+ * wake whose reply map couldn't be written is not delivered into the shared window).
+ *
+ * THREAD-OWNERSHIP ingress routing (§S2): the divert goes through the INBOUND variant
+ * (unified.ts divertInboundToUnifiedWindow), which — only under delegation.oneshotAgent — consults the
+ * durable ownership index and dispatches a wake landing in an OWNED thread to the owning task/
+ * thread-seat session's token instead of the standing seat's. Flag-off, and on every unowned
+ * thread, the inbound variant is a byte-identical passthrough to divertToUnifiedWindow.
+ *
+ * OPE-971: the `!input.window` (NATIVE, flag-off) branch below is Slack's own un-windowed
+ * supervisor session — the send this domain takes when it never opted into windowing at all. That
+ * send was completely unwrapped: a pruned-deployment strand there stranded the seat silently,
+ * forever (see channels/stranded-seat.ts). `deps.wake`'s own registryKey for this branch IS
+ * `surfaceKey` (supervisorGrainFor returns `{unified:false, registryKey:surfaceKey}` flag-off — the
+ * exact row `liveSupervisorDeps`'s `getOrCreateSession` already rotates), so the heal is told that
+ * key directly rather than trying to parse it back out of the per-channel token.
+ */
+export function withSingleWindowDiversion(deps, to, surfaceKey) {
+    return {
+        ...deps,
+        async wake(input) {
+            if (!input.window) {
+                try {
+                    await deps.wake(input);
+                }
+                catch (err) {
+                    await healPrunedDeploymentStrand({
+                        token: input.token,
+                        registryKey: surfaceKey,
+                        surfaceKey,
+                        workspace: surfaceKey.split("/")[1] ?? "unknown",
+                        platform: "slack",
+                        atIso: new Date().toISOString(),
+                        err,
+                    });
+                    throw err;
+                }
+                return;
+            }
+            await divertInboundToUnifiedWindow(to, {
+                message: input.message,
+                // The seat wake's untrusted-wrapped side-channel context (the name-drop hydration,
+                // OPE-1725). Omitted on every other wake, so a context-less divert is byte-identical.
+                ...(input.context && input.context.length > 0 ? { context: input.context } : {}),
+                token: input.token,
+                window: input.window,
+                surfaceKey,
+                auth: input.auth,
+            });
+        },
+    };
+}
+// DM-PARTNER TRUST, front-route copy (OPE-351 stage 2). `dm_partner_trust` gates the DM's SHARED read
+// layer (internal partner ⇒ `dm` trust, external ⇒ `public`), so the diverted DM's auth must carry it
+// or every DM silently degrades to the external tier — a regression the native path would not have had.
+// The native path resolves it in slack.ts (`enrichDmPartner`) off `ctx.slack.request`, which does not
+// exist here (the front route holds no eve slack context, and slack.ts imports THIS module, so the
+// helper cannot simply be shared without a cycle).
+//
+// OPE-466: the PROBE ITSELF now lives in slack-events.ts (`slackAuthorIsMember`), because the same
+// question — is this person a full member of this workspace? — is what a CHANNEL author's wake tier
+// needs, and two caches of one answer drift. This function is the DM leg's reading of that verdict,
+// and it keeps the DM leg's own FAIL-CLOSED direction: an unresolvable probe leaves the attribute
+// unset and the binding fails closed to the external tier, unchanged from before.
+async function liveDmPartnerTrust(userId, teamId) {
+    const member = await slackAuthorIsMember(userId, teamId);
+    return member === undefined ? undefined : member ? "internal" : "external";
+}
+/** Reset the cached DM-partner trust (tests only). */
+export function _resetDmTrustCache() {
+    _resetAuthorMemberCache();
+}
+// `wrapDmSeatFrom` (OPE-90) is DELETED at OPE-351 stage 2. It existed to remap the address of eve's
+// NATIVE DM send onto a rotatable seat token — a bolt-on to a dispatch path a DM no longer takes. The
+// DM is now diverted onto the `unified` channel before the forward ever happens (`scheduleDmWake`
+// below), so the seat token is chosen at DISPATCH time by the same code every other standing seat
+// uses, and there is no native send left to intercept. What it carried forward, and where each part
+// lives now: the seat resolve → `resolveDmSeat` in `scheduleDmWake`; the fresh-generation tail
+// prepended as `context` → the divert's own `context` argument; the off-critical-path wake touch →
+// the same `waitUntil(touch…)` there. What it does NOT carry forward is its FAIL-OPEN fallback to the
+// native send: there is nothing honest to fall back TO, since eve's native DM dispatch would open a
+// session on an address the seat has no window row for. A DM whose seat cannot be resolved now fails
+// LOUDLY into the FIFO's catch (audited via recordWakeFailure) instead of silently answering from a
+// second, un-rotatable session — the same fail-closed posture every other divert has.
+/**
+ * Does this `message` event DUPLICATE an `app_mention` Slack also fires, so the wake path must drop it?
+ *
+ * Slack sends TWO events for a new message that @mentions the bot: the `app_mention`, which the
+ * front's own `mention` branch owns, and a sibling carrying the same text — `message.channels` in a
+ * channel, `message.mpim` in a group DM. Acting on both is a double turn, so both the channel wake
+ * path and the group-DM leg drop the sibling through this one rule.
+ *
+ * 🔴 AN EDIT IS NEVER A SIBLING, AND SUPPRESSING ONE IS A LOST WAKE (OPE-1673). Slack delivers an
+ * edit ONLY as `message` with `subtype: "message_changed"`; no `app_mention` accompanies it, and
+ * `parseMessageEvent` reads the POST-EDIT text — so a person who edits a message in an engaged
+ * thread to add `<@bot>`, or who corrects the wording of a mention that is already there, matched
+ * this rule and was answered by nothing at all. There is no second event to prefer. The exemption is
+ * narrow by construction: an edit cannot reach the `app_mention` branch, because the front classifies
+ * the envelope on its event TYPE and a `message_changed` always arrives as a `message`.
+ *
+ * UNVERIFIED, and stated rather than assumed: Slack's docs do not say whether an edit that ADDS a
+ * mention also raises a fresh `app_mention`. If it does, the cost of this exemption is an occasional
+ * double turn — the same trade the next paragraph already takes, for the same reason.
+ *
+ * MATCH THE AUTHOR'S OWN TEXT, NEVER THE MERGED ONE (OPE-1374). `ev.text` carries forwarded and
+ * quoted content, so testing it would suppress a forward whose QUOTED message mentions the bot.
+ * UNVERIFIED for the same reason as above: whether Slack fires an `app_mention` for a mention that
+ * lives inside an attachment. If it does NOT — the shape we expect — testing the merged text loses
+ * the wake outright, because no sibling ever arrives to deliver it. If it DOES, the cost is a double
+ * turn. We take the double: an occasional double beats a drop, and a deaf agent on a forward is the
+ * failure OPE-1374 exists to prevent.
+ *
+ * Pure, so both the suppression and its exemption are unit-testable without Slack or a store. An
+ * unresolved bot user id suppresses nothing — there is no needle to match, and inventing one would
+ * drop every message.
+ */
+export function mentionSiblingSuppressed(input) {
+    if (input.botUserId === undefined || input.botUserId.length === 0)
+        return false;
+    if (input.subtype === "message_changed")
+        return false;
+    return input.authoredText.includes(`<@${input.botUserId}>`);
+}
+export function buildFrontHandler(innerHandler, opts = {}) {
+    const dedupe = opts.dedupe ?? new EventDedupe();
+    const fifo = opts.fifo ?? new ThreadFifo(recordWakeFailure);
+    const getBotIdentity = opts.getBotIdentity ?? resolveBotIdentity;
+    const now = opts.now ?? (() => Date.now());
+    const signingSecret = () => opts.signingSecret ?? process.env.SLACK_SIGNING_SECRET;
+    const markEventSeen = opts.markEventSeen ?? liveMarkEventSeen;
+    // OPE-589 leg D: reuse the taint-marking member probe (slack-events.ts `slackClickerIsGuest`,
+    // itself `slackAuthorIsMember` inverted). Same `users.info` call and cache the channel-taint leg
+    // already pays for, so a clicker who recently posted a message in the same workspace is often a
+    // free lookup, not a new one.
+    const handleApproval = opts.handleApprovalPayload ??
+        ((payload, deps) => liveHandleApprovalPayload(payload, { clickerIsGuest: slackClickerIsGuest, ...(deps?.waitUntil ? { waitUntil: deps.waitUntil } : {}) }));
+    const handleSetKeyClick = opts.handleSetKeyClick ?? liveHandleSetKeyClick;
+    const handleSetKeyViewSubmission = opts.handleSetKeyViewSubmission ?? liveHandleSetKeyViewSubmission;
+    const handleConnectClick = opts.handleConnectClick ?? liveHandleConnectClick;
+    const handleGrantCardClick = opts.handleGrantCardClick ?? liveHandleGrantCardClick;
+    const handleApprovalCardClick = opts.handleApprovalCardClick ?? liveHandleApprovalCardClick;
+    const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
+    const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
+    const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
+    const openDirectMessageChannel = opts.openDirectMessageChannel ?? liveOpenDirectMessageChannel;
+    const resolveDmSeat = opts.resolveDmSeat ?? ((org, dm, atIso) => liveGetOrCreateDmSeat(org, dm, atIso));
+    const touchDmSeatFn = opts.touchDmSeatFn ?? liveTouchDmSeat;
+    const dmPartnerTrustFor = opts.dmPartnerTrustFor ?? liveDmPartnerTrust;
+    const channelFactsFor = opts.channelFactsFor ?? slackChannelFactsFor;
+    const authorFactsFor = opts.authorFactsFor ?? ((internal, userId, teamId) => slackWakeAuthorFacts(internal, userId, teamId));
+    // THE one single-window mention decision, shared by BOTH mention legs (the `app_mention`
+    // native-forward below and its `message.channels` sibling on the wake path) so they stay
+    // exactly complementary — never a double turn (native + unified), never a gap (neither). True ⇔
+    // the channel has a STANDING SEAT and the policy's privacy floor holds (channel POSITIVELY
+    // confirmed internal, fail-closed). Any error ⇒ false ⇒ the native split.
+    // 🔴 THE CHATTINESS PRECONDITION IS GONE (OPE-1695). Requiring `ambientSupervisor` here is what
+    // made a mention in an addressed-only room open eve's native per-thread session — the fallback
+    // the ruling deletes. Its complement moved with it: `scheduleUnownedWake` now takes the seat road
+    // for every addressed wake, so suppressing the native leg can no longer leave the mention with
+    // nowhere to land.
+    const singleWindowOwnsMention = async (channelId, surfaceKey) => (await mentionPolicyFor(channelId, surfaceKey)).suppressNative;
+    // 🔴 THE WHOLE HANDLER RUNS INSIDE THE ROUTE HOLD (OPE-1648). Every door below answers its 200 at
+    // once and finishes its work afterwards — this route through `args.waitUntil`, eve's native
+    // handler through the same `args` on the forward — so a `void`-ed audit write anywhere under here
+    // races the serverless freeze that follows the response and loses the row.
+    //
+    // 🔴 EVERY `waitUntil` THE DELIVERY REGISTERS IS QUIESCED FIRST, and that is what makes the hold
+    // reach the wake routes. eve snapshots its background-task array the instant this handler
+    // resolves, so a `waitUntil` called later — from an engagement route running inside one of the
+    // FIFO promises below, long after the 200 — lands in a list nobody awaits. Every such route runs
+    // INSIDE a promise registered here while the handler was still going, so handing the platform a
+    // promise that outlives that route's own writes is enough, and nothing extra is registered: a
+    // delivery that queues no background work still hands the platform nothing at all.
+    return (req, args) => withSlackRouteHold(() => {
+        // `Object.create`, not a spread: the route args are eve's object, and a spread would keep only
+        // its OWN enumerable properties. Shadowing one method on a prototype-linked copy leaves
+        // everything else — `from`, `to`, `attachSession`, `params` — resolving to eve's own.
+        const held = Object.assign(Object.create(args), {
+            waitUntil: (p) => args.waitUntil(routeHoldQuiesced(p)),
+        });
+        return handleFrontRequest(req, held);
+    });
+    async function handleFrontRequest(req, args) {
+        const rawBody = await req.text();
+        if (!verifySlackSignature(rawBody, req.headers, signingSecret(), now())) {
+            return new Response("unauthorized", { status: 401 });
+        }
+        const decision = classifyEnvelope(rawBody, req.headers.get("content-type") ?? "");
+        /**
+         * Hand this request to eve's native `slackChannel`, with the OPE-1374 attachment boundary
+         * applied to what eve is given (OPE-1380).
+         *
+         * 🔴 EVERY NATIVE FORWARD GOES THROUGH HERE, not just the `@mention` one. A fence on the mention
+         * path alone would be no fence at all — the same reasoning `slackWakeSpendGate` states for its
+         * own placement: an `im` message forwards natively too, and eve merges its attachments the same
+         * way. The click and view_submission fall-throughs carry no `event`, so for them this is the
+         * identity below and their forward stays byte-identical.
+         *
+         * 🔴 THE RE-SIGN IS WHAT MAKES A REWRITE POSSIBLE. The inner handler re-verifies the Slack
+         * signature over the body it receives, so a changed body needs a signature over those bytes. The
+         * secret is the one this route just VERIFIED the inbound signature with, so a deployment where
+         * the two secrets disagree would have 401'd above rather than reaching here.
+         *
+         * FAIL-SOFT TO TODAY'S BEHAVIOUR. If the body carried nothing to strip (the common path), or the
+         * signature cannot be reminted (no secret, no timestamp header), the ORIGINAL bytes and headers
+         * are forwarded. Losing the fence on a body we cannot re-sign is recoverable; dropping the
+         * message on a signature the inner handler then refuses is not.
+         *
+         * 🔴 IT ALSO CARRIES THE ENTERPRISE RUNG ACROSS THE FORWARD (OPE-1559). `enterprise_id` lives on
+         * the envelope, and eve hands its handler the INNER event only, so the rung would be lost here
+         * otherwise — and a Grid deployment that declared only the enterprise would resolve every native
+         * mention as an undeclared room. The stow wraps the WHOLE forward, including the fenced-body
+         * branch, because both branches end in the same inner handler. See
+         * {@link withForwardedSlackEnvelope} for why the carrier is async-scoped and message-matched.
+         * EVERY native forward is wrapped for the same reason the attachment fence is: an `im` message
+         * forwards natively too, so a rung carried on the mention path alone would be half a rung.
+         */
+        const forwardNative = () => withForwardedSlackEnvelope(forwardedEnvelopeOf(rawBody), () => {
+            const fenced = stripUnfencedSlackAttachments(rawBody);
+            const ts = req.headers.get(SLACK_TIMESTAMP_HEADER);
+            const secret = signingSecret();
+            if (fenced === rawBody || !ts || !secret) {
+                return innerHandler(new Request(req.url, { method: "POST", headers: req.headers, body: rawBody }), args);
+            }
+            // A fresh Headers, because the inbound `content-length` describes the ORIGINAL bytes and the
+            // fenced body is shorter. Dropped rather than recomputed: `Request` sets it from the body.
+            const headers = new Headers(req.headers);
+            headers.set(SLACK_SIGNATURE_HEADER, slackSignature(secret, ts, fenced));
+            headers.delete("content-length");
+            console.log("[open-everywhere:slack-front] stripped an unfenced link-unfurl attachment before the native forward (OPE-1380)");
+            return innerHandler(new Request(req.url, { method: "POST", headers, body: fenced }), args);
+        });
+        // `liveDeps` types `send`'s auth as `unknown` on purpose (it doesn't import Eve's auth type);
+        // the cast bridges that gap — at runtime the payload/token/auth pass straight through. Hoisted
+        // because BOTH the single-window app_mention divert (mention branch) and the unowned-message
+        // wake path feed the same supervisor/name-drop dispatcher.
+        //
+        // eve 0.31 replaced the route's flat `send(payload, { continuationToken, … })` with
+        // `from(address).send(message, { … })` — the address is bound at `from()` time instead of
+        // riding in the options, and `context` moved out of the payload into the options. OE's own
+        // `WakeSend` (slack-events.ts) is UNCHANGED by design: it is an OE-authored adapter interface,
+        // not eve's, so the whole wake/name-drop/supervisor/join layer below stays byte-identical and
+        // the version-shaped difference is confined to this one adapter.
+        const send = ((input, opts) => args.from(opts.continuationToken).send(input.message, {
+            auth: opts.auth,
+            ...(opts.state === undefined ? {} : { state: opts.state }),
+            ...(input.context && input.context.length > 0 ? { context: input.context } : {}),
+        }));
+        // Two-layer idempotency (in-memory first, then the durable cross-instance store) shared by the
+        // wake path AND the single-window mention divert: a Slack RETRY (same event_id) must never
+        // double-wake. Returns false when the event was already handled (caller 200s and stops).
+        // Fail-open on an unresolvable partition — dedupe prevents a double reply, not a security hole.
+        /** The two-layer dedupe, keyed EXPLICITLY. Split out from {@link notYetSeen} for the shortcut
+         *  branch (OPE-1376), whose idempotency key is Slack's per-click `trigger_id` rather than an
+         *  Events API `event_id` — see `shortcutWakeKey` for why the message's own ts is wrong there. */
+        const notYetSeenKey = async (key, ev) => {
+            if (dedupe.seen(key, now()))
+                return false;
+            dedupe.mark(key, now());
+            try {
+                const org = resolvePartition(bindableFor(ev)).org;
+                if (!(await markEventSeen(org, key, new Date(now()).toISOString())))
+                    return false;
+            }
+            catch {
+                /* unresolvable partition → in-memory dedupe only (fail-open, see liveMarkEventSeen) */
+            }
+            return true;
+        };
+        /** The Events API form: key one `event_id` (falling back to `channel:ts`). Every existing wake
+         *  route reads this one; only the shortcut branch keys itself. */
+        const notYetSeen = (env, ev) => notYetSeenKey(wakeKey(env, ev.channelId, ev.ts), ev);
+        // UNOWNED message dispatch (top-level, or in-thread but not engaged): today's default is the
+        // name-drop path (per-domain opt-in, fail-closed). When the channel's domain opts into
+        // ambientSupervisor, the SAME unowned traffic routes to the channel-supervisor session instead
+        // (slack-events.ts routeSupervisorEvent) — the "always-on teammate" leg. `directMention` is the
+        // SINGLE-WINDOW addressed-mention divert (an app_mention event routed here from the mention
+        // branch): it forces the supervisor path (the only road into the unified window) and renders an
+        // addressed `direct-mention` wake. The supervisor wake serializes on its OWN FIFO key (the
+        // supervisor token), never shared with a thread FIFO. Fail-closed: any partition/config error,
+        // or the flag off, falls through to the UNCHANGED name-drop dispatch — so ambientSupervisor-off
+        // is byte-identical to today. Parametrised on `ev` so both the app_mention divert and a plain
+        // message.channels wake feed one dispatcher.
+        // `onWake` runs SYNCHRONOUSLY, once, immediately before a wake is scheduled — and never on the
+        // addressed-drop path below. The shortcut route (OPE-1442) uses it to seed the attachment
+        // registry only for a click that actually wakes something; every other caller omits it.
+        const scheduleUnownedWake = (ev, label, directMention = false, onWake, seatEngaged = false) => {
+            let ambient = false;
+            let surfaceKey;
+            try {
+                surfaceKey = resolvePartition(bindableFor(ev)).surfaceKey;
+                ambient = ambientEnabledFor(surfaceKey);
+            }
+            catch {
+                ambient = false; // unresolvable partition / config load → today's name-drop path
+            }
+            // 🔴 AN ADDRESSED WAKE TAKES THE SEAT ROAD, WHATEVER THE CHATTINESS FLAG SAYS (OPE-1695). The
+            // drop that stood here refused an addressed wake on an ambient-off channel, because the seat
+            // itself only existed where ambient was on — so a mention and a channel-message shortcut both
+            // died there. Seats are universal now: the flag decides whether UNADDRESSED talk wakes the
+            // seat, and addressing decides nothing about the session's shape. A mention in an
+            // addressed-only room therefore lands in that room's own seat, with the earlier exchange in
+            // context, instead of opening eve's native per-thread session (the fallback this ruling
+            // deletes) or being dropped.
+            // 🔴 THE DROP SURVIVES WHERE THERE IS NO SEAT, AND THAT KEEPS FLAG-OFF BYTE-IDENTICAL. With the
+            // standing-seat capability unarmed there is no seat road at all, so an addressed wake that fell
+            // through here would take the NAME-DROP path — a silently mis-judged wake, which is exactly what
+            // the old drop existed to prevent. The mention route never reaches it (its own policy leaves the
+            // native leg in charge when nothing windows); the SHORTCUT route does, and on such a deployment
+            // it is dropped loudly, exactly as before.
+            // An unresolvable partition leaves no surface key, so there is no seat to ask about: that
+            // reads as UNSEATED, which keeps the drop — the fail-closed direction the old branch had.
+            const seated = surfaceKey !== undefined && seatedSurface(surfaceKey);
+            if (directMention && !ambient && !seated) {
+                console.warn(`[open-everywhere:slack-front] ${label} ${ev.channelId}/${ev.ts}: addressed wake with no standing seat and ambient off — dropped (no road to a seat)`);
+                return;
+            }
+            // 🔴 `seatEngaged` IS NOT `directMention`, and the distinction is load-bearing. An ENGAGED
+            // thread's follow-up must reach the seat that is holding the conversation even in an
+            // addressed-only room — otherwise the seat answers a mention once and goes deaf on the very
+            // thread it opened. But it must NOT be treated as an address: `directMention` also lifts the
+            // app_mention/channel_type disqualifiers AND bypasses the stood-down suppression
+            // (slack-events.ts routeSupervisorEvent, `ev.threadTs && !directMention && engRow?.stopped`),
+            // so passing it here would make `stand_down` stop working in threads. It only says "there is a
+            // seat road for this message", which is what the chattiness flag would otherwise have said.
+            const addressedOrAmbient = directMention || ambient || seatEngaged;
+            onWake?.();
+            if (addressedOrAmbient) {
+                // Generation-INDEPENDENT FIFO key (T1.5): the FIFO's job is to serialize supervisor
+                // wakes for this CHANNEL, which must hold ACROSS a rotation boundary too — keying on
+                // the generation-bearing token (the old hardcoded gen-1 assumption) would split one
+                // channel's serialized queue in two the instant a rotation minted a new generation.
+                // supervisorFifoKey needs no store read either, so it stays a stable, synchronous key
+                // on the hot path exactly like the token-based key did.
+                const supKey = supervisorFifoKey(ev.channelId);
+                args.waitUntil(fifo.enqueue(supKey, () => deliverWithStrandRetry(() => routeSupervisorEvent(ev, withSingleWindowDiversion(liveSupervisorDeps(send), args.to, surfaceKey), directMention ? { directMention: true } : undefined).then(logOutcome(`${label}-supervisor`, ev.channelId, ev.ts)))));
+                return;
+            }
+            // 🔴 A NAME-DROP WAKES THE ROOM'S STANDING SEAT (OPE-1725). `routeNameDropEvent` stays the
+            // JUDGE — the name match, the domain's `nameDropWake` opt-in, the internal confirmation, the
+            // wake arm — and on a SEATED surface its `seatRoute` hands the judged wake to that seat instead
+            // of opening eve's native per-thread session. Addressing decides what the seat is owed; it
+            // never decides the shape of the session, so the same seat an @mention reaches answers a
+            // name-drop, with the room's earlier exchange already in its context.
+            // UNSEATED ⇒ no `seatRoute`, and the native per-thread wake is byte-identical to today. That
+            // arm is the whole pre-seat deployment, so the fallback is not a corner case.
+            //
+            // 🔴 THE JUDGE RUNS OUTSIDE THE SEAT'S FIFO, and only a message it ADMITS enters one. Putting
+            // the judge inside would make every unaddressed message in a seated room occupy the channel's
+            // serialized queue for the length of a decision that almost always declines — a real cost on a
+            // busy room, and it would hold a genuine seat wake behind it. `fifo.enqueue` resolves void and
+            // SWALLOWS a failure, so the outcome is captured in the closure and the default stays the
+            // honest "did not wake" for a delivery that threw.
+            // 🔴 THE HYDRATOR RIDES ACROSS THE HAND-OFF (OPE-1725). The judge fetches the room's
+            // surrounding conversation for the wake it admits, and the SEAT wake must carry that same
+            // block — withheld by the same transform — or a seated deployment quietly stops hydrating
+            // name-drops at all. It is passed as a thunk, so the seat road pays for the history page only
+            // after its own tenant fence, spend gate and external-participant policy admit the wake.
+            const seatRoute = seated
+                ? async (hydrateContext) => {
+                    let outcome = { deliver: false, reason: "seat wake delivery failed", woke: false };
+                    await fifo.enqueue(supervisorFifoKey(ev.channelId), async () => {
+                        outcome = await deliverWithStrandRetry(() => routeSupervisorEvent(ev, withSingleWindowDiversion(liveSupervisorDeps(send), args.to, surfaceKey), {
+                            nameDrop: true,
+                            nameDropContext: hydrateContext,
+                        }));
+                    });
+                    return outcome;
+                }
+                : undefined;
+            args.waitUntil(routeNameDropEvent(ev, { ...liveNameDropDeps(send), ...(seatRoute ? { seatRoute } : {}) }).then(logOutcome(seatRoute ? `${label}-name-drop-seat` : label, ev.channelId, ev.ts)));
+        };
+        /**
+         * THE DM WAKE (OPE-351 stage 2; group DMs at stage 4) — a `message.im` or `message.mpim` diverted
+         * into its own first-class standing window, the DM analogue of the single-window app_mention
+         * divert above. `dmKind` names which family member it is; everything the two differ in is
+         * called out below, and nothing else does.
+         *
+         * 🔴 IT DELIBERATELY BYPASSES routeSupervisorEvent, engagementTierFor AND THE NAME-DROP JUDGE.
+         * Every one of those exists to answer "was the agent addressed, and is this worth replying to?"
+         * — a question a 1:1 DM has already answered. A DM IS ALWAYS ANSWERED; routing it through a
+         * silence-biased judge would let the agent ignore someone talking to it directly, which is the
+         * one place it must never be quiet. So this path renders an ADDRESSED wake (`slackDmWake`,
+         * `addressing:"direct-mention"`) and dispatches it, full stop. The spend gate is NOT bypassed:
+         * `divertToUnifiedWindow`'s own attended-arrival gate (windowSpendGate) runs on this wake exactly
+         * as it does on a mention, which is what replaces the native door's gate.
+         *
+         * A GROUP DM WAKES ON THE SAME UNCONDITIONAL RULE, AND THAT IS A REAL WIDENING — its previous
+         * route (`shouldNameDropWake`) refused every non-mention message on channel_type, so the room woke
+         * only on an @mention. The justification is not that every message in a group DM is addressed to
+         * the agent (it plainly is not), but that a closed room the agent was added to person-by-person is
+         * a conversation it is IN, and the judgement of whether to speak belongs to the model, which has
+         * the text, rather than to a front-door gate keyed on a channel type. What carries that is the
+         * wake's own silence escape plus the GROUP opening of the `[direct]` preamble
+         * (channels/normalized-wake.ts), which says the room holds other people and tells the seat to stay
+         * out of what is not asked of it. The COST of the widening lands on the spend gate above, not on
+         * a judge: a chatty group DM is a budget question, and it is already answered by one.
+         *
+         * THE ENVELOPE IS MINIMAL, ON PURPOSE — no backscroll. The native DM path deliberately skipped
+         * `loadConversationContext` (slack.ts: "DMs are skipped — the 1:1 history IS the conversation and
+         * the durable session already carries it"), and that reasoning survives the re-seat unchanged: the
+         * seat is one long-lived session over the whole DM, so injecting history would duplicate what the
+         * session already holds. The one thing a FRESH generation carries is the recorded tail of the
+         * generation it replaced (OPE-794) — the case that argument does not cover, since a rotation is
+         * exactly when the session stops holding it.
+         *
+         * A STRICT IMPROVEMENT IN FENCING: eve's native DM dispatch delivered the human's text as the raw
+         * turn body. Going through the shared wake renderer means a DM body is now `wrapUntrusted`-fenced
+         * like every other surface's — a DM was the last inbound text that was not.
+         *
+         * FAIL-CLOSED, unlike the OPE-90 remap it replaces: no seat, no partition or no dispatch means the
+         * wake FAILS into the FIFO's loud catch (audited by recordWakeFailure) rather than falling back to
+         * a native send, which would answer the human from a second session with no window row behind it.
+         */
+        const scheduleDmWake = async (ev, dmKind, 
+        /** The DM door admitted this bot author as the deployment's named e2e driver (OPE-1023).
+         *  Defaults FALSE, so every existing call site is unchanged. */
+        driverAdmitted = false) => {
+            // 🔴 THE TENANT FENCE, AND THIS IS ITS CHOKEPOINT FOR THE WHOLE DM FAMILY (OPE-1644). Before
+            // this line `slack-front.ts` consulted the fence NOWHERE, while the mention door, the four
+            // dispatching engagement routes, the channel-join door and the `/oe` slash door all did — so a
+            // DM from a workspace this deployment never declared woke the DM seat. That seat is the
+            // LARGEST grant the deployment makes: it holds a window token, delegation and memory, and a
+            // DM is exactly where a colliding `U…` id resolves somebody's PERSONAL credentials.
+            //
+            // EVERY road into a DM window passes through here — the `message.im`/`message.mpim` branch,
+            // the DM-shaped shortcut and the group-DM mention divert — so the fence is placed here rather
+            // than at each of the three, and no road can be added that skips it. The two callers that CAN
+            // decide earlier do (the DM branch and the shortcut branch below), because a refusal there
+            // also spares the deployment a foreign workspace's attachment fetch and dedupe write; this
+            // check is what makes those an optimisation rather than the fence itself.
+            //
+            // SILENT, like every other door: nothing is posted back into the DM. We cannot safely identify
+            // anybody in an unadmitted workspace, and a foreign tenant learning it reached a live
+            // deployment is more than it needs to know. The audit row and the operator log line are the
+            // whole signal.
+            if (slackFrontTenantFenceDeclined(ev, `dm-${dmKind}`, "scheduleDmWake"))
+                return;
+            const p = resolvePartition(bindableFor(ev));
+            const atIso = new Date(now()).toISOString();
+            const isGroup = dmKind === "mpim";
+            // 🔴 WHERE THE SURFACE'S TRUST COMES FROM, and why the two families differ.
+            //   • 1:1 — the DM PARTNER, via users.info. It rides BOTH the delivery auth (`dm_partner_trust`
+            //     gates the DM's shared read layer) and the envelope's trust tier, so one lookup answers
+            //     both. Fail-closed to `external`/`unauth`.
+            //   • GROUP — there is no partner. `dm_partner_trust` is a singular fact about "the other person
+            //     in this DM", a question an mpim does not have an answer to, and `bindSlack` ignores the
+            //     attribute for `mode:"mpim"` anyway (its trust comes from `slackTrust`). Stamping one would
+            //     be inventing a fact. What stands in for the WAKE tier is the surface's own confirmed-
+            //     internal verdict — the same substitution routeSupervisorEvent makes for a channel — read
+            //     from the TTL-cached conversations.info the mention leg already needs. Fail-closed: an
+            //     unresolvable lookup (a workspace without `mpim:read`) leaves every author `unauth`, which
+            //     renders the reference-only system note rather than dropping the wake. The group's AUTHOR
+            //     is a separate probe, resolved just below — the room says nothing about who wrote here.
+            const partnerTrust = !isGroup && ev.userId ? await dmPartnerTrustFor(ev.userId, ev.teamId) : undefined;
+            const roomFacts = isGroup ? await channelFactsFor(ev.channelId) : undefined;
+            const surfaceInternal = isGroup ? roomFacts?.internal === true : partnerTrust === "internal";
+            // ── THE AUTHOR LEG (OPE-1486, Tommy's 2026-09-07 ruling) ────────────────────────────────────
+            //
+            // 🔴 A GROUP DM IS A ROOM, SO ITS AUTHOR IS PROBED LIKE A CHANNEL'S. `partnerTrust` answers a
+            // 1:1's author (`dmPartnerTrustFor` probes `ev.userId` — the writer, not some third party), so
+            // the 1:1 leg has always carried a real refutation. An mpim resolved none at all, which left
+            // `oe_chat_nonmember` ABSENT on a turn a guest's own bytes opened. That is an INGESTION-grain
+            // hole under the 2026-08-13 ruling: taint keys on whose words entered the context.
+            //
+            // The probe is `slackWakeAuthorFacts` — the SAME `users.info` verdict every channel route
+            // reads, TTL-cached, so a person who wrote in this workspace recently costs no new call. It
+            // fails OPEN: an unresolvable probe refutes nobody.
+            //
+            // 🔴 PRESENCE MARKS NOTHING. This asks who WROTE the trigger, never who sits in the room. No
+            // roster is read here and none should be: a guest who has not spoken has put no bytes in the
+            // context, and marking the turn for them would refuse the member plane on a room's occupancy.
+            //
+            // 🔴 THE WAKE TIER IS DELIBERATELY NOT NARROWED, AND THE FENCE IS CARRIED SEPARATELY. This is
+            // the explicit decision the ticket asked for rather than an inherited one, and the two halves
+            // of what the tier controls are what make it safe:
+            //   • the tier decides the RENDER — a `peer`/`principal` body is delivered unfenced, and only
+            //     `unauth` adds the reference-only system note. It does NOT decide whether the wake fires:
+            //     an mpim whose room cannot be confirmed already wakes at `unauth` rather than dropping;
+            //   • so the refutation rides to the render on its own field (`triggerRefuted` →
+            //     `WakeMessageInput.refuted`), which is a ONE-WAY FENCE BACKSTOP: it fences a refuted
+            //     author's body without touching the tier or the note.
+            // What that buys, against folding the refutation into `surfaceInternal` as a channel does: a
+            // guest the operator's own people invited into an addressed room still gets the addressed
+            // envelope and an answer, while their bytes still reach the model INSIDE the fence and the
+            // member plane still refuses a personal credential on the turn. Narrowing the tier as well
+            // would add only the demotion of the envelope itself, which no part of this ruling asks for.
+            const authorRefuted = isGroup ? (await authorFactsFor(surfaceInternal, ev.userId, ev.teamId)).refuted : partnerTrust === "external";
+            const wakeTrust = resolveWakeTrust({
+                // 🔴 THE ADMITTED DRIVER IS NOT A BOT AUTHOR HERE (OPE-1023) — the same expression the
+                // engagement and mention doors already use (`Boolean(ev.botId) && !isAllowedSlackDriver(…)`),
+                // applied to the DM door's own narrower lever. Left as a plain `Boolean(ev.botId)`, an
+                // admitted driver would wake at the `relay` floor and the DM legs would exercise a trust tier
+                // no human DM ever produces — which is not the real front door the carve-out exists to open.
+                //
+                // NO TRUST IS INVENTED. The driver posts through a human `xoxp` token, so `ev.userId` is a
+                // REAL member id and the tier below is resolved from that human by the ordinary rules (an
+                // unvouched surface still lands `unauth`, the admin roster still decides `principal`). What
+                // the flag removes is only the machine floor that Slack's `bot_id` stamp would otherwise
+                // impose on a message a person actually wrote.
+                authorIsBot: Boolean(ev.botId) && !driverAdmitted,
+                authorId: ev.userId,
+                surfaceInternal,
+                channelKey: p.surfaceKey,
+            });
+            // ── THE EXTERNAL-PARTICIPANT POLICY (OPE-507 author grain) ──────────────────────────────────
+            //
+            // A DM is ALWAYS addressed, so an excluded sender here is owed BEHAVIOUR 1: the private notice
+            // and nothing else. The notice posts back into this very DM — it is already private, so there
+            // is no `conversations.open` to make and no room to disclose anything to.
+            //
+            // 🔴 IT SITS ABOVE `resolveDmSeat`, WHICH IS WHY THE TRUST BLOCK MOVED UP. A suppressed DM must
+            // mint no seat, rotate no generation and consume no tail. The probe above is the same
+            // one the seat path needed anyway, so the reorder costs nothing.
+            //
+            // A DM contributes NO ROOM LEG — on a DM the trust plane asks about the PARTNER, not about the
+            // room — so only the AUTHOR grain can suppress here.
+            //
+            // 🔴 A GROUP DM IS SUPPRESSIBLE ON THE AUTHOR GRAIN TOO (OPE-1486). It was not before, because
+            // an mpim resolved no refutation at all — the limit the old note here recorded. The author leg
+            // above now resolves one from the same probe a channel uses, so an operator who set
+            // `externalPolicy.authorGrain: "withhold"` gets that rule in a group DM as well. Nothing moves
+            // on the SUPPRESSION PATH for a default deployment: `withholdsBody` is inert under the shipped
+            // `taint` grain, so only a deployment that explicitly excluded refuted authors is suppressed
+            // here — which is the rule it asked for. That is a claim about SUPPRESSION alone: on `taint`
+            // the same refutation still newly stamps `oe_chat_nonmember` and still newly fences the body,
+            // which is the fix. The room leg stays off for the whole DM family by the note above: on a DM
+            // the trust plane asks about the PARTNER, not about the room.
+            {
+                // `authorRefuted` is already resolved above, from ONE probe per family — the 1:1's partner
+                // lookup or the group's author lookup — so this gate makes no second call.
+                const verdict = await applySlackExternalPolicy(ev, p, { trust: wakeTrust, refuted: authorRefuted }, "scheduleDmWake");
+                if (verdict !== "proceed") {
+                    console.log(`[open-everywhere:slack-front] dm ${p.surfaceKey}: suppressed — externalPolicy verdict "${verdict}"`);
+                    return;
+                }
+            }
+            // `channelId` is what the ROTATION distiller fetches history with (always supplied);
+            // `legacyChannelId` is the one-time adopt-from-OPE-90 probe and is 1:1-ONLY. OPE-90 never minted
+            // an `oe-dm-seat::<id>` row for a group DM, so probing for one could only ever miss — and a miss
+            // that cannot be distinguished from a store outage is worse than no probe, because the OPE-346
+            // note-loss audit row exists precisely to tell those two apart.
+            const seat = await resolveDmSeat(p.org, { surfaceKey: p.surfaceKey, channelId: ev.channelId, ...(isGroup ? {} : { legacyChannelId: ev.channelId }) }, atIso);
+            const wakeId = mintWakeId();
+            // buildSlackAuth's DM attributes VERBATIM — including the rootDmGrainAttrs `oe_grain:"standing"`
+            // stamp, which is what narrows a DM-family root's hands (window-tool-gating §D-DM, which already
+            // covered mpim). `isPrivate:true` holds for both: a 1:1 is unambiguous, and a group DM has no
+            // public form. `channelType` is the dmKind verbatim, so `slackMode` binds `dm` / `mpim` and every
+            // mode-keyed carve-out (the lean-seat identity trio, the memory route, the skills refusal) sees
+            // the SAME mode it saw on the native token.
+            //
+            // OPE-466 CARRIAGE: a DM/group-DM wake ingests exactly one message, so the join runs over the
+            // trigger's own tier. The 1:1 leg already resolves `unauth` for a guest or Connect stranger
+            // (the partner probe above IS the membership probe); the group leg keeps the ROOM's tier and
+            // carries its author's refutation separately — see the author-leg note above for why the two
+            // are not folded together on an mpim.
+            const auth = stampNonMemberChatAuth(buildSlackAuth({
+                userId: ev.userId ?? "",
+                teamId: ev.teamId,
+                // The Grid rung (OPE-1508), the same conditional spread `authForEvent` uses: a group DM
+                // in an Enterprise Grid carries the enterprise the operator's declaration is written at,
+                // and a non-Grid event stamps nothing.
+                ...(ev.enterpriseId === undefined ? {} : { enterpriseId: ev.enterpriseId }),
+                channelId: ev.channelId,
+                threadTs: ev.threadTs,
+                channelType: dmKind,
+                isPrivate: true,
+                ...(partnerTrust ? { dmPartnerTrust: partnerTrust } : {}),
+                // 🔴 THE GROUP DM CARRIES THE PLATFORM'S OWN SHARING VERDICT (OPE-1486), which is what a
+                // channel wake has always stamped (`authForEvent`) and an mpim wake never did. `bindSlack`
+                // reads the pair through `slackTrust`, so this is the binding's only route to the fact
+                // that a group DM spans another organisation — and `binding.trust` is the DEMOTION half of
+                // the member plane's G4b vouch. Without it a Slack Connect group DM was vouched internal
+                // under a workspace-wide declaration, because `slackTrust` graded every mpim `internal`.
+                //
+                // POSITIVE-ONLY, and both halves are spread conditionally for it: a workspace without
+                // `mpim:read` resolves neither fact, stamps neither attribute, and keeps today's verdict.
+                // Absence of an answer must never demote a room — only the platform SAYING so does.
+                ...(roomFacts?.extShared === undefined ? {} : { isExternal: roomFacts.extShared }),
+                ...(roomFacts?.trustChecked === undefined ? {} : { trustChecked: roomFacts.trustChecked }),
+            }), 
+            // OPE-489: the author leg reads the POSITIVE refutation. On a 1:1 that is exactly the
+            // partner probe's `external` verdict — the same users.info answer, so no second lookup.
+            // OPE-1486: a GROUP DM resolves the same refutation from the same probe a channel's author
+            // leg uses, so a guest or Connect stranger who WRITES here marks the turn. The ROOM leg is
+            // still off for the whole DM family — `dm: true` puts it out of scope for the `public` tier,
+            // because on a DM `trust` asks about the PARTNER, not about the room.
+            [{ trust: wakeTrust, refuted: authorRefuted }], { dm: true });
+            // OPE-794 — a fresh DM generation opens with the OUTGOING generation's RECORDED TAIL as its
+            // backscroll, in place of the deleted handoff note. The DM envelope is otherwise still minimal
+            // by design (the seat is one long-lived session over the whole DM, so replaying history a live
+            // session already holds would duplicate it) — the tail is exactly the case that reasoning does
+            // not cover, because a rotation is when the session stops holding it.
+            const message = renderWakeMessage(ev, () => atIso, {
+                dm: true,
+                trust: wakeTrust,
+                // The FENCE BACKSTOP for the whole DM family (OPE-1486) — the SAME refutation the taint stamp
+                // and the policy gate read, so the three cannot disagree about one author. On a 1:1 it is a
+                // no-op in practice (a refuted partner is already `unauth`, and `unauth` is already fenced);
+                // on a GROUP DM it is what fences a refuted author whose tier the room keeps at member grade.
+                triggerRefuted: authorRefuted || undefined,
+                wakeId,
+                ...(seat.freshGeneration && seat.tail.length > 0 ? { backscroll: seat.tail } : {}),
+            });
+            // 🔴 NO `replyAnchorTs` ON A TOP-LEVEL DM — the reply stays FLAT in the conversation. The
+            // CHANNEL divert DOES set one (slack-events.ts), because threading an answer under its trigger
+            // keeps a busy shared channel tidy; the slack post arm reads `threadTs ?? replyAnchorTs`
+            // as its thread target, so setting it here would thread EVERY DM answer under the message that
+            // asked — shattering a 1:1 conversation into a pile of one-reply threads. That is also not what
+            // the native path did: eve replied to the wake's own `thread_ts` (OPE-98's per-wake anchor), which
+            // is absent on a top-level DM message, so the answer posted flat. Behaviour preserved deliberately.
+            // A DM message that genuinely IS in a thread still carries its threadTs and is answered in it.
+            //
+            // 🔴 A GROUP DM IS FLAT TOO — and here that DEPARTS from the native behaviour rather than
+            // preserving it, so the reasoning has to stand on its own. Today an mpim @mention is answered by
+            // eve's native path, which anchors on the wake's own `thread_ts` and therefore THREADS under the
+            // mention. Keeping that would put two reply geometries in one room served by one seat: the
+            // mention-carried wake threaded, every other message in the same conversation flat — the
+            // placement flipping on whether the human happened to type `<@bot>`. Between "match what mpim did
+            // yesterday" and "one seat, one room, one placement", the second wins: the seat is a single
+            // long-lived session over the WHOLE group DM (the same property that makes a 1:1 flat), and a
+            // Slack group DM is capped at nine people, so it has none of the tidiness problem threading
+            // solves in a busy channel. A genuinely threaded mpim message still carries its threadTs and is
+            // still answered inside that thread, exactly as in a 1:1.
+            const origin = { platform: "slack", channelId: ev.channelId, ...(ev.threadTs ? { threadTs: ev.threadTs } : {}) };
+            // THE OWNED-THREAD INGRESS SEAM (§2.6, OPE-1719), on the DM leg too — and the reason is the
+            // `threadTs` two comment blocks above. A Slack DM CAN hold a thread, so a DM thread can be
+            // owned: the DM seat runs on a standing window token, `spawn_thread_session` mounts on it, and
+            // a seat spawned inside a DM thread records a real ownership row. On the raw divert that row
+            // was never read, so the seat was orphaned until its TTL — the exact defect this ticket closes,
+            // on the one surface whose DM carries a thread signal at all. Discord's and Teams' DM legs stay
+            // on the raw divert because THEIR DM origins carry none, not because a DM is special.
+            // A top-level DM message has no `threadTs`, so it is not thread-scoped and goes standing with
+            // no store read — flat DM behaviour is byte-unchanged.
+            await divertInboundToUnifiedWindow(args.to, {
+                message,
+                token: seat.token,
+                // `vendorTs` (OPE-1716): the trigger's OWN ts, which on Slack is its send time — the first
+                // latency anchor, recorded on the ingress row and acted on by nothing.
+                window: { wakeId, origin, addressing: "direct-mention", ...spreadVendorTs(slackVendorEventTime(ev.ts)) },
+                surfaceKey: p.surfaceKey,
+                auth,
+            });
+            // Record the wake off the critical path (best-effort — a touch failure never affects the reply).
+            args.waitUntil(touchDmSeatFn(p.org, p.surfaceKey, atIso).catch(() => { }));
+            // OPE-794 — file this DM wake on the live seat generation's tail ring, AFTER it landed, and only
+            // the TRIGGER. The registry key is the DM window key, the same row the seat itself lives in.
+            args.waitUntil(recordWakeTail(p.org, dmWindowRegistryKey(p.surfaceKey), seat.token, {
+                kind: "wake",
+                at: atIso,
+                from: "human",
+                trust: wakeTrust,
+                // THE AUTHOR GRAIN (OPE-1747) — the same `authorRefuted` the DM's own taint join and
+                // external-policy verdict above read, through the one core road.
+                ...tailAuthorGrain({ trust: wakeTrust, refuted: authorRefuted }),
+                author: ev.userId ?? "unknown",
+                ...(ev.userId ? { authorId: ev.userId } : {}),
+                ...(ev.ts ? { id: ev.ts } : {}),
+                platform: "slack",
+                container: p.surfaceKey,
+                text: ev.text ?? "",
+            }));
+        };
+        // THE IN-MEMORY ATTACHMENT REGISTRY, seeded from an event whose files the front door has already
+        // ADMITTED. Every Events API path gets this inside `parseMessageEvent`, beside its own
+        // `parseSlackFiles` call. The SHORTCUT route cannot (OPE-1442): its files must clear the
+        // readability gate and the wake gates first, and both of those live here rather than in the
+        // parser, so that route seeds through this helper instead. Image-only, matching what
+        // `describe_image` resolves; the durable half for another process is `persistAttachments` below.
+        const registerAttachments = (ev) => {
+            for (const a of ev.attachments ?? []) {
+                if (a.kind === "image" && a.id && a.url) {
+                    registerSlackAttachment(a.id, { urlPrivate: a.url, mimeType: a.mimeType, name: a.name, ...(ev.teamId ? { teamId: ev.teamId } : {}) });
+                }
+            }
+        };
+        // DURABLE ATTACHMENT REGISTRY (task #107): mirror this message's uploads into the durable
+        // operational store so a DELEGATED worker — a one-shot task in a SEPARATE process from this
+        // seat — can resolve a file id the seat saw (the in-memory registry is process-local). Trusted
+        // provenance: the url_private is the EVENT-supplied string (never a model string), org resolved
+        // from the same event. Off the hot path (waitUntil); fail-open on an unresolvable partition (the
+        // in-memory registry still serves the same-process seat). Persists NON-IMAGE files too, which the
+        // image-only in-memory registry never records — the raw-bytes read path (read_file_upload) needs them.
+        const persistAttachments = (ev) => {
+            const atts = ev.attachments;
+            if (!atts || atts.length === 0)
+                return;
+            let org;
+            try {
+                org = resolvePartition(bindableFor(ev)).org;
+            }
+            catch {
+                return; // unresolvable partition → in-memory registry only (fail-open)
+            }
+            for (const a of atts) {
+                if (a.id && a.url) {
+                    args.waitUntil(persistSlackAttachment(a.id, { urlPrivate: a.url, mimeType: a.mimeType, name: a.name, teamId: ev.teamId }, org));
+                }
+            }
+        };
+        // 🔴 A TENANT REFUSAL STILL HAS TO HAND THE PLATFORM ITS WRITES (cold review, 2026-09-10).
+        // The fence tracks its `surface.wake_dropped` row with `holdRouteWork`, which only pushes the
+        // promise into THIS delivery's pending bag (slack-route-hold.ts). The bag is drained by
+        // `routeHoldQuiesced`, and the one place that runs it is the wrapped `waitUntil` this handler was
+        // given (see `held` in the route builder above). So a branch that refuses and returns 200 WITHOUT
+        // calling `args.waitUntil` hands the platform nothing: the serverless invocation freezes the
+        // moment the response is written and the row never lands. The refusal itself is unaffected — it
+        // is decided before any of this — but the audit row is the drop's ONLY durable signal, because a
+        // webhook function's console output does not reach the operator. One empty `waitUntil` is enough:
+        // the wrapper quiesces the whole tracked bag, not just the promise handed to it.
+        const fencedAck = (res) => {
+            args.waitUntil(Promise.resolve());
+            return res;
+        };
+        if (decision.kind === "forward") {
+            // A fresh Request so slackChannel can re-read the body and re-verify the signature — and, on a
+            // body carrying an unfenced attachment, one built over the fenced bytes. See `forwardNative`.
+            return forwardNative();
+        }
+        if (decision.kind === "dm-wake") {
+            // A DM-FAMILY message — a 1:1 (OPE-351 stage 2) or a group DM (stage 4). OURS, UNCONDITIONALLY:
+            // diverted into the surface's own standing window rather than forwarded to eve's native
+            // `onDirectMessage` (1:1) or handed to the engagement gate that refused it (group DM). The
+            // `OE_DM_SEAT_ROTATION=0` escape hatch that used to short-circuit to a native forward here is
+            // gone (OPE-368) — it was the last supported way to leave a DM un-windowed, i.e. un-wakeable by
+            // a delegated worker's completion, which is precisely the seat class the retired OPE-306
+            // delegation anchor existed to serve.
+            const dev = parseMessageEvent(decision.env);
+            // An unparseable envelope has nothing to wake on — a no-op 200. It carries no channel and no
+            // ts, so it cannot be keyed to a surface and gets a log line rather than an audit row.
+            if (!dev) {
+                console.log(`[open-everywhere:slack-front] ${decision.dmKind} wake dropped — the envelope parsed to no channel/ts`);
+                return OK();
+            }
+            // 🔴 THE TENANT FENCE, AS EARLY AS THIS BRANCH CAN ASK IT (OPE-1644). `scheduleDmWake` below
+            // is the chokepoint and refuses the same delivery on its own, so this is not the fence — it is
+            // what keeps an unadmitted workspace from spending THESE on the way there: the bot-author
+            // probe's audit rows, `persistAttachments` (which registers a FOREIGN workspace's
+            // `url_private` files for a delegated worker to fetch) and a durable dedupe write all sit
+            // between here and it. The parse above has already seeded the in-memory attachment LRU, which
+            // is the one cost no placement in this branch avoids.
+            if (slackFrontTenantFenceDeclined(dev, `dm-${decision.dmKind}`, "front-dm-branch"))
+                return fencedAck(OK());
+            // A bot-authored DM is never a wake — a no-op 200. NOT a forward: forwarding a bot_message
+            // would hand eve's native door a turn the DM window is meant to own.
+            //
+            // 🔴 THE DROP IS COUNTED (OPE-1022). This used to be a bare `return OK()`, which made the DM
+            // door the one wake path in the deployment that could swallow a real, well-formed event with
+            // no audit row and no log line. Slack stamps `bot_id` on every Web-API post, a user token
+            // included, so any script-driven probe lands here — and on 2026-08-23 that silence read as a
+            // dead Slack surface for a drop that was working exactly as designed. Our own reply echo is
+            // excluded inside the helper, so the row means "somebody else's bot spoke here", not chatter.
+            //
+            // 🔴 NAMED EXCEPTIONS ONLY (OPE-1023, OPE-1739, OPE-1754). `wake.e2eDrivers` lists the
+            // deployment's e2e driver identities across every surface, and this door reads its `slack`
+            // entries alone — each a `teamId:botId` pair. A LISTED identity's DM is admitted and woken
+            // like a human's. Nothing but a whole-pair match is admitted. Empty is the
+            // shipped value, and an empty list matches nothing in `isE2eDriver`, so an unconfigured
+            // deployment reaches the drop below with the same verdict and the same row it always had.
+            // `getBotIdentity()` is only awaited AFTER a pair matches, which is why the hot echo leg
+            // gains no lookup.
+            //
+            // The self-check is the loop guard: an operator who wrote OUR OWN bot record into the setting
+            // would otherwise have every reply re-wake the seat forever. Refusing the match costs nothing
+            // (the identity read is a cached promise) and removes the only configuration that could loop.
+            //
+            // The leading `dev.botId` test is what keeps the HUMAN path free: without it every human DM
+            // would resolve the settings object to ask a question only a bot author can answer.
+            const driverAdmitted = Boolean(dev.botId) && dmDoorAdmitsDriver(dev) && dev.botId !== (await getBotIdentity()).botId;
+            if (driverAdmitted) {
+                // LOUD, not silent: the row is what lets a soak review tell an admitted driver DM from a
+                // human DM. It rides `waitUntil` for the same reason the drop's row does — the route 200s
+                // and wakes before the write would land.
+                args.waitUntil(auditDmDriverAdmitted(dev, decision.dmKind).catch(() => {
+                    /* observability only — never block or change the decision */
+                }));
+                console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: bot-authored DM ADMITTED — the named e2e driver identity (bot ${dev.botId} in team ${dev.teamId ?? "?"})`);
+                // …and then FALLS THROUGH to the ordinary DM path below. No separate wake: the whole point
+                // is that the driver's DM takes the same route a human's does.
+            }
+            else if (dev.botId) {
+                // The identity read and the audit write both ride `waitUntil`, so neither delays the 200.
+                // That matters most on the echo leg: Slack re-delivers every reply the bot posts, so this
+                // is the hottest path through the DM door, and it must stay as fast as the bare drop was.
+                // `.catch` because an unhandled rejection inside `waitUntil` can fail the invocation, and
+                // an observability write must never change what the route does.
+                args.waitUntil((async () => {
+                    const { botId: selfBotId } = await getBotIdentity();
+                    if (await auditDmBotAuthorDrop(dev, decision.dmKind, selfBotId)) {
+                        console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: bot-authored DM dropped — no turn (bot ${dev.botId} in team ${dev.teamId ?? "?"}; the DM door admits no bot author)`);
+                    }
+                })().catch(() => {
+                    /* observability only — never block or change the decision */
+                }));
+                return OK();
+            }
+            // 🔴 MENTION-SIBLING SUPPRESSION, GROUP DM ONLY. Slack fires BOTH an `app_mention` and a
+            // `message.mpim` for a group-DM message that @mentions the bot, and the mention branch below
+            // diverts the app_mention into this same seat — so without this drop the room would answer
+            // twice. It is the exact rule the channel wake path applies to a `message.channels` sibling,
+            // applied here because the DM branch returns before ever reaching that code.
+            //
+            // …AND DELIBERATELY NOT FOR A 1:1, where it would be the more dangerous mistake. The mention
+            // branch does not divert an `im` (see there), so nothing else owns a 1:1's mention-bearing
+            // message; suppressing it would turn "@bot are you there?" in a DM into total silence. Whether
+            // Slack even fires app_mention inside an `im` is unmeasured here, and a rule whose failure mode
+            // is a DEAF DM is not the place to bet on a vendor behaviour nobody has checked. Fail-open on an
+            // unresolvable bot identity (same posture as the channel path): an occasional double beats a drop.
+            //
+            // 🔴 AND NOT FOR AN EDIT, for the reason {@link mentionSiblingSuppressed} states in full: Slack
+            // raises no `app_mention` for a `message_changed`, so there is no second event to prefer and
+            // the drop is total silence. The rule is the SHARED helper rather than a copy — this leg and
+            // the channel leg refused the same edit for the same wrong reason, and a second copy is how
+            // the next exemption reaches only one of them.
+            if (decision.dmKind === "mpim") {
+                const { userId: dmBotUserId } = await getBotIdentity();
+                if (mentionSiblingSuppressed({
+                    authoredText: dev.authoredText,
+                    ...(dev.subtype === undefined ? {} : { subtype: dev.subtype }),
+                    ...(dmBotUserId === undefined ? {} : { botUserId: dmBotUserId }),
+                })) {
+                    return OK();
+                }
+            }
+            persistAttachments(dev); // durable upload registry (task #107) — so a delegated worker can read this DM's files
+            // Same two-layer idempotency as every other wake candidate: a Slack RETRY must not double-wake.
+            if (!(await notYetSeen(decision.env, dev)))
+                return OK();
+            // Serialized on the surface's OWN FIFO key — a DM's bursts must not interleave, and its queue is
+            // never shared with a channel supervisor's or a thread's. The mention-carried divert below
+            // enqueues on the SAME key, so a group DM's two legs can never run concurrently on one seat.
+            args.waitUntil(fifo.enqueue(dmFifoKey(dev.channelId), async () => {
+                await deliverWithStrandRetry(() => scheduleDmWake(dev, decision.dmKind, driverAdmitted));
+                console.log(`[open-everywhere:slack-front] ${decision.dmKind} ${dev.channelId}/${dev.ts}: woke — diverted to the DM window seat`);
+            }));
+            return OK();
+        }
+        if (decision.kind === "shortcut") {
+            // 🔴 A SHORTCUT IS AN ADDRESSED WAKE. Somebody pressed a named button aimed at this app, so
+            // there is nothing to judge: it takes the `direct-mention` road, exactly like a single-window
+            // @mention and a DM, and never the engagement or name-drop judge that exists to answer "was
+            // the agent addressed?". What it does NOT bypass is any gate: the shortcut is mapped onto the
+            // ordinary ParsedMessageEvent and handed to the SAME dispatchers, so the partition, seat,
+            // window, spend gate, external-participant policy and wake-trust tier are all derived by the
+            // code a mention already goes through. This branch adds a wake ORIGIN, not a plane.
+            const sc = decision.shortcut;
+            // A GLOBAL shortcut names no conversation, so the invoker's own DM window is where it lands —
+            // the one room the person unambiguously chose by pressing a button with no message in scope.
+            // A message shortcut lands in the conversation the message lives in.
+            const shortcutChannelId = sc.kind === "message" ? sc.channelId : await openDirectMessageChannel(sc.userId);
+            if (!shortcutChannelId) {
+                // Fail-closed, and NAMED: this is the one degradation an operator can act on (grant
+                // `im:write` and reinstall). Slack still gets its fast ack — a shortcut that wakes nothing
+                // must not also look like a broken endpoint.
+                console.log(`[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}" from ${sc.userId}: no channel to wake in ` +
+                    `(a global shortcut opens the invoker's DM, which needs the im:write bot scope) — nothing woken`);
+                return new Response(null, { status: 200 });
+            }
+            // A message shortcut can be invoked anywhere the app can see a message, so two facts have to
+            // be ASKED for — a `message_action` payload carries neither. A global shortcut skips the
+            // lookup: its channel is the `im` we just opened, so both answers are already known.
+            //   • `channelType` picks the road (DM window vs channel supervisor). It is the same gap an
+            //     `app_mention` envelope has;
+            //   • `appCanRead` says whether this app is in the room at all, which gates the target
+            //     message's FILES below.
+            const shortcutFacts = sc.kind === "global"
+                ? { channelType: "im", appCanRead: true }
+                : await channelFactsFor(shortcutChannelId)
+                    .then((f) => ({ channelType: f.channelType, appCanRead: f.appCanRead === true }))
+                    .catch(() => ({ channelType: undefined, appCanRead: false }));
+            const shortcutChannelType = shortcutFacts.channelType;
+            if (!shortcutChannelType) {
+                // 🔴 AN UNRESOLVED CHANNEL TYPE DROPS (OPE-1442). This used to fall through to the channel
+                // road, which is wrong for the case that actually produces an unresolved type: a DM or a
+                // group DM whose `conversations.info` blipped. A shortcut is ADDRESSED, so the channel road
+                // carries `directMention` into the CHANNEL-SUPERVISOR session for this id — and a DM's
+                // content would land in a channel-shaped seat on a transient API failure. There is no
+                // reading of "I could not tell what room this is" that justifies routing it anyway.
+                console.warn(`[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}" in ${shortcutChannelId}: ` +
+                    `conversations.info resolved no channel type — dropped (a shortcut never routes on an unresolved room)`);
+                return new Response(null, { status: 200 });
+            }
+            // 🔴 THE FILE GATE (OPE-1442). Slack delivers a `message_action` for a room the app is NOT in,
+            // and the payload carries that message's `url_private`. Registering it would let the bot token
+            // download bytes out of a room the agent's own channel reads refuse, through a door the
+            // channel-read allowlist never sees. So the files ride only on a POSITIVE readability answer;
+            // otherwise the references are dropped from the event as well, and the wake carries the
+            // message's text alone. The wake itself still happens — the invoker is the principal and the
+            // body is fenced, so the TEXT crossing is the ruled Slack-forward precedent. The BYTES are not.
+            if (sc.kind === "message" && !shortcutFacts.appCanRead && (sc.message?.attachments?.length ?? 0) > 0) {
+                console.warn(`[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}" in ${shortcutChannelId}: ` +
+                    `withheld ${sc.message?.attachments?.length} file reference(s) — the app cannot read that conversation`);
+            }
+            const sev = shortcutMessageEvent(sc, shortcutChannelId, shortcutChannelType, now(), { admitAttachments: shortcutFacts.appCanRead });
+            // 🔴 THE TENANT FENCE AT THE INTERACTIVITY INGRESS (OPE-1644 / OPE-1645). Both roads out of
+            // this branch are fenced further down — a DM-shaped shortcut by `scheduleDmWake`, a channel
+            // shortcut by `routeSupervisorEvent` — so this refuses the delivery before either, and before
+            // the attachment registry is seeded from it. It is also the door the ORG-WIDE Grid payload
+            // arrives at: such a payload names an enterprise and NO workspace, which `sev` carries as
+            // `enterpriseId` with `teamId` absent, and which the fence now judges on the enterprise
+            // instead of admitting as "names no tenant".
+            //
+            // IT SITS BELOW THE TWO LOOKUPS ABOVE, not above them, because it needs `sev` to write a row
+            // keyed to a surface. Those lookups cost an unadmitted workspace one `conversations.open` or
+            // `conversations.info` on OUR OWN bot token, which answers `user_not_found` /
+            // `channel_not_found` for a foreign id and discloses nothing.
+            if (slackFrontTenantFenceDeclined(sev, `${sc.kind}-shortcut`, "front-shortcut-branch"))
+                return fencedAck(new Response(null, { status: 200 }));
+            // Keyed on the click, not the message — a person may invoke the same shortcut on the same
+            // message twice on purpose, and only Slack's redelivery of ONE click is a duplicate.
+            if (!(await notYetSeenKey(shortcutWakeKey(sc), sev)))
+                return new Response(null, { status: 200 });
+            // BOTH halves of the attachment registry, seeded ONLY on a click that reaches a DISPATCHER —
+            // the in-memory one for this process's seat, the durable one for a delegated worker in
+            // another. (A dispatcher can still refuse further down, as `routeSupervisorEvent`'s own
+            // fail-closed internal confirmation does; that residual click touches the LRU.)
+            // They sit behind every gate above for the reason `parseSlackShortcutPayload`'s header states:
+            // the in-memory map is a 1000-entry LRU shared with every real upload, so seeding it from
+            // clicks that wake nothing evicts records `describe_image` needs.
+            const seedAttachments = () => {
+                registerAttachments(sev);
+                persistAttachments(sev);
+            };
+            if (shortcutChannelType === "im" || shortcutChannelType === "mpim") {
+                seedAttachments();
+                args.waitUntil(fifo.enqueue(dmFifoKey(shortcutChannelId), async () => {
+                    await deliverWithStrandRetry(() => scheduleDmWake(sev, shortcutChannelType));
+                    console.log(`[open-everywhere:slack-front] ${sc.kind} shortcut "${sc.callbackId}": woke the ${shortcutChannelType} window ${shortcutChannelId}`);
+                }));
+                return new Response(null, { status: 200 });
+            }
+            // A CHANNEL shortcut takes the addressed single-window road. On a deployment whose domain does
+            // NOT run the unified window there is no road into a channel seat for anything but a native
+            // @mention, which a shortcut cannot become — `scheduleUnownedWake` refuses a `directMention`
+            // it cannot deliver with a loud warn rather than falling through to the silence-biased
+            // name-drop judge, and that refusal is the honest outcome here too. See the runbook.
+            scheduleUnownedWake(sev, `${sc.kind}-shortcut`, true, seedAttachments);
+            return new Response(null, { status: 200 });
+        }
+        if (decision.kind === "mention") {
+            // An `app_mention`. Default: forward to eve's native slackChannel exactly as before —
+            // byte-identical for every non-single-window domain. SINGLE-WINDOW (SINGLE-LEG divert): when
+            // the shared seam says the unified window owns mentions on this POSITIVELY-internal channel,
+            // we divert the app_mention EVENT ITSELF into the supervisor as an addressed direct-mention
+            // wake and NEVER forward. ONE decision on ONE webhook: the `message.channels` sibling is
+            // ALWAYS dropped (wake path below, unchanged from today), so nothing depends on it — there is
+            // no separate suppress-leg / deliver-leg pair that could disagree across a webhook, TTL
+            // eviction, or a cold instance, so neither a lost-mention nor a double-answer is possible.
+            // It also handles a public-channel app_mention that fires NO sibling at all. Fail-closed: an
+            // unparseable event, unresolvable partition, or any policy error ⇒ forward (today's path).
+            const mev = parseMessageEvent(decision.env);
+            if (mev)
+                persistAttachments(mev); // durable upload registry (task #107) — before the owned/forward branch
+            let owned = false;
+            if (mev) {
+                try {
+                    owned = await singleWindowOwnsMention(mev.channelId, resolvePartition(bindableFor(mev)).surfaceKey);
+                }
+                catch {
+                    owned = false; // fail-closed → the native mention path keeps ownership
+                }
+            }
+            if (owned && mev) {
+                // Idempotency on the app_mention's own event_id (a Slack retry must not double-wake).
+                if (!(await notYetSeen(decision.env, mev)))
+                    return OK();
+                console.log(`[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: single-window — diverting to the unified supervisor (native forward suppressed)`);
+                // The supervisor route lifts the app_mention/channel_type disqualifiers for this
+                // directMention path (slack-events.ts routeSupervisorEvent) and re-checks its own
+                // fail-closed internal confirmation — the SAME process-local TTL-cached conversations.info
+                // the policy just populated, so the two reads on this one webhook are cache-coherent.
+                scheduleUnownedWake(mev, "single-window-mention", true);
+                return OK();
+            }
+            // 🔴 THE GROUP-DM MENTION LEG (OPE-351 stage 4). An @mention is how a human addresses the bot in
+            // a multi-party room, so it is the MOST common way an mpim wakes — and left forwarding it would
+            // have split the group DM in two: mentions answered by a native, un-wakeable, per-thread eve
+            // session, everything else by the standing window this stage just gave the room. That split is
+            // not a cosmetic inconsistency; the native session is exactly the seat OPE-351 exists to
+            // abolish, so shipping the message leg alone would leave the headline defect (a seat that
+            // delegates and can never be told the answer arrived) unfixed for the room's main entrance.
+            //
+            // IT COSTS A LOOKUP, because a raw `app_mention` envelope carries NO `channel_type` — the front
+            // route genuinely cannot tell a group DM's mention from a channel's without asking Slack. The
+            // read is the shared TTL-cached `conversations.info` (see slackChannelFactsFor for why that is
+            // cheaper than the uncached read the forward it replaces triggers inside eve).
+            //
+            // SCOPED TO `mpim`, NOT TO "DM-FAMILY": an `im` mention still forwards, byte-identically to
+            // stage 2. The 1:1 message leg does not suppress its mention-bearing sibling (see the dm-wake
+            // branch), so diverting an `im` app_mention as well would double-answer every DM in which
+            // somebody typed the bot's name. Fail-closed everywhere: an unresolved channelType (a workspace
+            // without `mpim:read`) or any error ⇒ the native forward below, which is precisely pre-stage-4
+            // behaviour. 🔴 THAT RESIDUAL FORWARD IS THE ONE REMAINING WAY A DM-FAMILY MESSAGE REACHES A
+            // NATIVE-TOKEN SEAT (OPE-368 removed the deliberate `OE_DM_SEAT_ROTATION=0` route). Such a seat
+            // has no window token, so `canDelegateFromSeat` is false, `agent` does not mount, and the memory
+            // index says `"none"` — the honest pre-OPE-306 posture, not a dead affordance.
+            if (mev) {
+                const mentionChannelType = await channelFactsFor(mev.channelId)
+                    .then((f) => f.channelType)
+                    .catch(() => undefined);
+                if (mentionChannelType === "mpim") {
+                    if (!(await notYetSeen(decision.env, mev)))
+                        return OK();
+                    console.log(`[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: group DM — diverting to the mpim window seat (native forward suppressed)`);
+                    // The event's own `channel_type` is absent, so the divert is TOLD it is an mpim rather than
+                    // re-reading a field that was never there; `scheduleDmWake` stamps it onto the wake auth,
+                    // which is what makes `bindSlack` bind mode `mpim` on this leg exactly as on the other.
+                    args.waitUntil(fifo.enqueue(dmFifoKey(mev.channelId), async () => {
+                        await deliverWithStrandRetry(() => scheduleDmWake({ ...mev, channelType: "mpim" }, "mpim"));
+                    }));
+                    return OK();
+                }
+                if (mentionChannelType === undefined) {
+                    // NAMED, not silent: this is the one degradation an operator can act on (grant `mpim:read`
+                    // and reinstall). Everything else about the mention is unchanged, so it is a log line, not
+                    // a failure — a channel mention reaches here too whenever conversations.info is unavailable.
+                    console.log(`[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: channel type unresolved (conversations.info unavailable; a group-DM mention needs the mpim:read scope) — forwarding to the native mention path`);
+                }
+            }
+            // ── THE EXTERNAL-PARTICIPANT POLICY, ON THE NATIVE FORWARD (OPE-507 / OPE-504) ──────────────
+            //
+            // 🔴 THIS IS THE LAST UNGATED SLACK WAKE, AND IT IS THE MOST LIKELY ONE. The three wake routes
+            // in slack-events.ts and the DM seat above all read the policy — but an `app_mention` in an
+            // ordinary NON-single-window channel takes none of them: it is handed to eve's native
+            // `slackChannel`, which owns the turn end to end and has no seam the policy could reach. So the
+            // gate has to sit HERE, above the forward, exactly where teams-front.ts puts its own.
+            //
+            // 🔴 IT COSTS A PROBE, SO IT IS SKIPPED WHEN IT CANNOT MATTER. Unlike the three routes, this
+            // leg resolves no author facts of its own, so gating it means one `users.info` call. The inert
+            // check runs first: on the shipped `taint` / `engage` pair no evidence is resolved at all and
+            // this whole block is a single config read. The probe is TTL-cached per author on top of that.
+            //
+            // FAIL-OPEN on anything unreadable — an unparseable event, an unresolvable partition, a probe
+            // that cannot answer. Every carriage leg in this plane fails open, and a policy error must not
+            // be the thing that takes a workspace's mentions off the air.
+            if (mev) {
+                try {
+                    const p = resolvePartition(bindableFor(mev));
+                    const roomKey = domainKeyOf(p);
+                    if (!externalPolicyIsInert(slackExternalPolicyForRoom(roomKey))) {
+                        const internal = (await channelFactsFor(mev.channelId).catch(() => ({ internal: false }))).internal;
+                        const facts = await authorFactsFor(internal, mev.userId, mev.teamId);
+                        const wakeTrust = resolveWakeTrust({
+                            authorIsBot: Boolean(mev.botId),
+                            authorId: mev.userId,
+                            surfaceInternal: facts.surfaceInternal,
+                            channelKey: roomKey,
+                        });
+                        const verdict = await applySlackExternalPolicy(mev, p, { trust: wakeTrust, refuted: facts.refuted }, "native-mention-forward");
+                        if (verdict !== "proceed") {
+                            console.log(`[open-everywhere:slack-front] app_mention ${mev.channelId}/${mev.ts}: suppressed — externalPolicy verdict "${verdict}" (native forward withheld)`);
+                            return OK();
+                        }
+                    }
+                }
+                catch {
+                    // fail-open → the native forward below keeps today's behaviour
+                }
+            }
+            return forwardNative();
+        }
+        if (decision.kind === "approval-click") {
+            // 🔴 THE TENANT FENCE AT THE INTERACTIVITY INGRESS (OPE-1680). ABOVE the handler, because the
+            // handler is the whole consequence: it loads the pending row, CASes a decision, tests the
+            // clicker against the config-as-code admin roster and EXECUTES the approved act. A foreign
+            // workspace's `U…` reaching that is the aliasing the fence exists for — most sharply on a
+            // payload naming NO workspace (an org-wide Grid install), where `handleApprovalPayload` passes
+            // no `clickContext` and `resolveApprovalClick` then reads the clicker's tenant off the CARD's
+            // own room, i.e. off the ADMITTED workspace. See `slackInteractivityTenantFenceDeclined`.
+            if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "approval-click", "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // Ours: handled entirely by our code (load → CAS decide → approver check → execute →
+            // chat.update), never Eve's. Fast empty 200 — Slack interactivity wants a quick ack,
+            // not a rendered reply.
+            //
+            // 🔴 `args.waitUntil` RIDES ALONG (OPE-1709), and it is the HELD one (see the route hold
+            // above), so the deferred work is quiesced before the delivery's own promise resolves. What
+            // it moves off this path is the session-grant release: an "Approve for session" click on a
+            // fan-out decides and EXECUTES the sibling cards the grant already covers, and that loop has
+            // no business inside Slack's three-second interactivity budget.
+            if (await handleApproval(decision.payload, { waitUntil: args.waitUntil })) {
+                return new Response(null, { status: 200 });
+            }
+            // Defensive: classification said "ours" but the handler disagreed (a mismatch, e.g. a
+            // stale/foreign action_id shape) — fall through to forwarding so the click is never
+            // silently swallowed.
+            return forwardNative();
+        }
+        if (decision.kind === "setkey-click") {
+            // THE TENANT FENCE (OPE-1680), above the handler for the same reason the approval branch states.
+            // The intake's owner check is over a bare per-workspace member id, so an unadmitted workspace's
+            // click is a claim on somebody else's credential intake.
+            if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "setkey-click", "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // Ours (credentials/intake.ts): verify the clicker owns the intake, then views.open the modal —
+            // the trigger_id lives in the payload we already classified. Fast empty 200 (Slack wants a quick
+            // interactivity ack; the modal opens via the views.open API call, not this response body).
+            if (await handleSetKeyClick(decision.payload)) {
+                return new Response(null, { status: 200 });
+            }
+            return forwardNative();
+        }
+        if (decision.kind === "connect-click") {
+            // THE TENANT FENCE (OPE-1680), above the handler. This branch MINTS AN OAUTH URL against a
+            // connector, so an unadmitted workspace reaching it is a foreign tenant driving this
+            // deployment's connector plane on our own credentials.
+            if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "connect-click", "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // Ours (connections/connector-card.ts): re-verify standing host-side, then mint an ephemeral
+            // OAuth URL / open the api-key intake. Fast empty 200 (Slack wants a quick interactivity ack;
+            // the ephemeral URL / intake button is posted via a separate API call, not this response body).
+            if (await handleConnectClick(decision.payload)) {
+                return new Response(null, { status: 200 });
+            }
+            return forwardNative();
+        }
+        if (decision.kind === "grant-click") {
+            // THE TENANT FENCE (OPE-1680), above the handler — and above the vendor round trip below, which
+            // is the most expensive thing an unadmitted workspace could make this deployment spend: the
+            // approve leg opens a session under the OWNER's account (a consent probe, a token mint, an MCP
+            // handshake and a `tools/list`) before it CASes.
+            if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "grant-click", "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // Ours (access/credential-grant-card.ts): the OWNER answered a credential-grant ask in their
+            // own DM. Core verifies the signed payload's `user.id` IS that ask's owner, then approves or
+            // declines and answers the owner ephemerally through a separate API call.
+            //
+            // 🔴 ACK BEFORE THE VENDOR READ. An approval opens the owner's MCP connection before its
+            // CAS — consent probe, token mint, handshake and `tools/list` — and a healthy cold catalogue
+            // can cross Slack's three-second interactivity deadline. Classification and the tenant fence
+            // have already proved this is our signed `oe_grant:` action, so the empty 200 goes out now and
+            // the route's held `waitUntil` keeps exactly one resolution alive afterwards. The approve CAS
+            // remains the exactly-once decider if Slack redelivers a click whose first ACK was lost.
+            //
+            // A handler disagreement is an invariant violation after classification, not a reason to
+            // forward after acknowledging: eve does not own `oe_grant:` and cannot answer it. Keep it loud
+            // without rejecting the host's background promise or changing the already-sent response.
+            args.waitUntil(Promise.resolve()
+                .then(async () => {
+                if (!(await handleGrantCardClick(decision.payload))) {
+                    console.warn("[open-everywhere:slack-front] classified grant click was not claimed by the grant handler");
+                }
+            })
+                .catch(() => {
+                // The handler is total in production. Keep an impossible injected/runtime rejection
+                // visible without putting vendor or credential-bearing error text into the route log.
+                console.warn("[open-everywhere:slack-front] grant click failed after acknowledgement");
+            }));
+            return new Response(null, { status: 200 });
+        }
+        if (decision.kind === "input-click") {
+            // THE TENANT FENCE (OPE-1680), above the handler, for the same reason every other interactivity
+            // branch carries it: a tap RESUMES a parked turn, which is this deployment spending on a scope
+            // an unadmitted workspace never had standing to decide.
+            if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "input-click", "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // Ours (core channels/approval-card.ts): somebody tapped a bridged eve approval this
+            // deployment posted onto a unified origin. The handler resolves the ticket, admits the tap
+            // through the SAME floor the typed answer takes, and delivers `respond([{requestId, optionId}])`
+            // to the parked WINDOW session.
+            //
+            // 🔴 THE DELIVERY GOES BY SESSION ID (OPE-1863). `args.from` is CHANNEL-LOCAL — on this route
+            // it addresses `slack:<token>`, while the parked session lives at `unified:<token>` — so the
+            // settle threw "the target session was not found" and every tap left the approval parked.
+            // `args.attachSession` dispatches by durable session id from any channel, and
+            // `approvalCardRespondVia` is the one road every surface binds. Bound HERE and injected because
+            // the route handler is the only place eve hands out either primitive.
+            //
+            // The 200 goes out AFTER the settle, deliberately, and the cost is stated rather than hidden:
+            // Slack expects this endpoint to answer in about three seconds, and a settle that runs longer
+            // leaves the tapper waiting on whatever Slack does then. Acking first and settling in the
+            // background would fix the delay and WIDEN the handler's own non-atomic window — see the
+            // "THE LIMIT OF THAT" paragraph in `slack-approval-card.ts`, which also records that the
+            // past-deadline behaviour is unmeasured here.
+            const respondToApproval = approvalCardRespondVia(args.attachSession);
+            const tap = await handleApprovalCardClick(decision.payload, respondToApproval);
+            console.log(`[open-everywhere:slack] oe_input: tap — ${tap.reason}`);
+            // `handled:false` means the payload carried our prefix but not a shape the handler could read.
+            // Forward it rather than swallow it, the same defensive shape the grant and setkey branches
+            // take: a click this deployment cannot act on is better handed on than silently dropped.
+            if (!tap.handled)
+                return forwardNative();
+            return new Response(null, { status: 200 });
+        }
+        if (decision.kind === "setkey-submit") {
+            // THE TENANT FENCE (OPE-1680), above the handler — this is the branch that WRITES A SECRET into
+            // this deployment's store, keyed to the intake the payload names. A `view_submission` carries
+            // no `channel`, which is the case the fence's row writer keys to `SLACK_INTERACTIVITY_SURFACE`.
+            // The refusal answers with the SAME empty 200 a successful close does, never the `errors`
+            // object: an inline validation message would tell a foreign tenant it reached a live modal.
+            if (slackInteractivityTenantFenceDeclined(interactivityFenceIds(decision.payload), "setkey-submit", "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // Ours: encrypt + store the pasted value host-side (the model never sees it). A view_submission
+            // must answer with a JSON body — empty ⇒ Slack closes the modal (success), an `errors` object ⇒
+            // inline validation (expired/used/blank). `handled:false` (a callback_id we don't own slipped
+            // through) falls through to forwarding.
+            const result = await handleSetKeyViewSubmission(decision.payload);
+            if (result.handled) {
+                return result.response
+                    ? new Response(JSON.stringify(result.response), { status: 200, headers: { "content-type": "application/json" } })
+                    : new Response(null, { status: 200 });
+            }
+            return forwardNative();
+        }
+        if (decision.kind === "join") {
+            // Channel-join intro. Only the BOT's own join is an invitation — a human joining a
+            // channel we're in fires the same event and must be dropped. Fail-CLOSED here, the
+            // opposite polarity from the mention suppression below: unresolved identity means we
+            // can't prove the joiner is us, so nobody wakes (vs. "an occasional double is better
+            // than a dropped reply" for suppression).
+            const jev = parseChannelJoinEvent(decision.env);
+            if (!jev)
+                return OK();
+            const { userId: joinBotUserId } = await getBotIdentity();
+            if (!joinBotUserId || jev.userId !== joinBotUserId)
+                return OK();
+            // Same two-layer idempotency as the message wake: Slack retries a slow ack, and a
+            // double intro is exactly the annoyance the durable half exists to prevent.
+            const joinKey = wakeKey(decision.env, jev.channelId, jev.ts);
+            if (dedupe.seen(joinKey, now()))
+                return OK();
+            dedupe.mark(joinKey, now());
+            try {
+                const org = resolvePartition(bindableForJoin(jev)).org;
+                if (!(await markEventSeen(org, joinKey, new Date(now()).toISOString())))
+                    return OK();
+            }
+            catch {
+                /* unresolvable partition → in-memory dedupe only (fail-open, see liveMarkEventSeen) */
+            }
+            const joinSend = send; // the same 0.31 `from(address).send(…)` adapter built above
+            // A fresh join can't contend with an existing thread FIFO (its thread root is the
+            // join notice itself), so no queueing — same reasoning as the name-drop wake.
+            args.waitUntil(routeChannelJoinEvent(jev, liveChannelJoinDeps(joinSend)).then(logOutcome("channel-join", jev.channelId, jev.ts)));
+            return OK();
+        }
+        if (decision.kind === "reaction") {
+            // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
+            const rev = parseSlackReactionEvent(decision.env);
+            if (!rev)
+                return OK();
+            // 🔴 THE TENANT FENCE (OPE-1680), and this branch is on the fence's list for a reason the other
+            // five do not share: the ✋ STOP arm reaches `args.attachSession`, eve's I/O-free CANCEL door,
+            // so an unadmitted workspace's reaction can HALT a running session in the admitted one. The
+            // rest of the branch also writes a durable dedupe row and records feedback against our own
+            // replies. A reaction arrives on the Events API rather than the interactivity URL, so its
+            // workspace is the one the PARSER already read off the envelope, and its Grid rung comes from
+            // `slackEnterpriseIdFromEnvelope` — the same two fields `fenceDeclined` reads for a message.
+            //
+            // IT SITS BELOW THE PARSE, not above it: the parse is pure and free, and it is what lets the
+            // refusal row name the channel the reaction happened in rather than a placeholder.
+            const reactionEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+            if (slackInteractivityTenantFenceDeclined({
+                ...(rev.teamId === undefined ? {} : { teamId: rev.teamId }),
+                ...(reactionEnterpriseId === undefined ? {} : { enterpriseId: reactionEnterpriseId }),
+                channelId: rev.channelId,
+                userId: rev.reactorId,
+            }, "reaction", "front-reaction-branch")) {
+                return fencedAck(OK());
+            }
+            // Same two-layer idempotency as every other wake candidate: a Slack RETRY (same
+            // event_id) must not double-record a reaction. In-memory first, then the durable store
+            // (a retry usually lands on a fresh serverless instance). Fail-open on an unresolvable
+            // partition — dedupe prevents a double row, not a security hole.
+            const rkey = wakeKey(decision.env, rev.channelId, rev.messageTs);
+            if (dedupe.seen(rkey, now()))
+                return OK();
+            dedupe.mark(rkey, now());
+            try {
+                const org = resolvePartition(bindableForReaction(rev)).org;
+                if (!(await markEventSeen(org, rkey, new Date(now()).toISOString())))
+                    return OK();
+            }
+            catch {
+                /* unresolvable partition → in-memory dedupe only (fail-open, see liveMarkEventSeen) */
+            }
+            // Resolve the bot identity once (cached) so the route can tell the bot's own reaction
+            // from a human's and whether the target is the bot's own reply. A reaction can't
+            // contend with any thread FIFO (it starts no turn), so no queueing — just fire it.
+            // `args.attachSession` rides in for the ✋ STOP arm (OPE-418): it is eve's I/O-free cancel
+            // door, and handing it in here is what lets a stop happen PRE-DISPATCH — no session mint,
+            // no model call, and therefore no spend and no cap to be over.
+            const identity = await getBotIdentity();
+            args.waitUntil(routeReactionEvent(rev, liveReactionDeps(identity, args.attachSession)).then((o) => console.log(`[open-everywhere:slack-front] reaction ${rev.channelId}/${rev.messageTs}: ${o.recorded ? "recorded" : "not recorded"} — ${o.reason}`)));
+            return OK();
+        }
+        // Wake path. Parse the message; a non-message or id-less envelope is a no-op 200.
+        const ev = parseMessageEvent(decision.env);
+        if (!ev)
+            return OK();
+        persistAttachments(ev); // durable upload registry (task #107) — so a delegated worker can read this message's files
+        // Mention-sibling suppression — see {@link mentionSiblingSuppressed} for the whole rule and for
+        // why an EDIT is exempt from it.
+        const { userId: botUserId } = await getBotIdentity();
+        if (mentionSiblingSuppressed({ authoredText: ev.authoredText, ...(ev.subtype === undefined ? {} : { subtype: ev.subtype }), ...(botUserId === undefined ? {} : { botUserId }) })) {
+            return OK();
+        }
+        // Idempotency: a retried (or duplicated) event must not double-wake. In-memory first (free,
+        // same-instance), then the durable store (cross-instance — a Slack retry usually lands on a
+        // fresh serverless instance). One small statement, well inside Slack's 3s ack window.
+        if (!(await notYetSeen(decision.env, ev)))
+            return OK();
+        if (!ev.threadTs) {
+            // TOP-LEVEL message: never an engagement wake — but possibly a name-drop candidate
+            // (per-domain opt-in, fail-closed; slack-events.ts routeNameDropEvent), or — when
+            // ambientSupervisor is on for this domain — a supervisor wake. The reply thread it may
+            // start is rooted at this message's ts, so a name-drop can't contend with any existing
+            // FIFO chain; the supervisor wake serializes on the supervisor token instead.
+            scheduleUnownedWake(ev, "name-drop");
+            return OK();
+        }
+        // SEATED-CHANNEL short-circuit (task #100): where the channel has a standing seat, that seat owns
+        // ALL in-thread traffic. A mention was diverted into it (no native per-thread session exists), so
+        // an engaged thread's follow-up must ride the seat, NEVER the native per-thread token below
+        // (routeMessageEvent), or it would wake a fresh empty session off the wrong token. The seat's own
+        // deterministic stop leg (slack-events.ts routeSupervisorEvent) honours the engagement row a
+        // diverted mention enrolls.
+        //
+        // 🔴 THE ENGAGEMENT READ IS BACK, AND OPE-1695 IS WHY. This branch used to fire only on a WINDOW
+        // domain, which implied `ambientSupervisor`, so reaching the seat road was guaranteed. Every
+        // channel is seated now, so in an ADDRESSED-ONLY room the same call would fall through to the
+        // name-drop judge and answer nothing — the seat would reply to a mention and then go deaf on its
+        // own thread. The read says which it is: an ENGAGED thread (the seat is holding this
+        // conversation) takes the seat road whatever the chattiness flag says; a thread nobody engaged is
+        // ordinary room traffic and still obeys the flag. Fail-closed: an unreadable row is NOT engaged.
+        const p = resolvePartition(bindableFor(ev));
+        if (seatedSurface(p.surfaceKey)) {
+            const seatEngaged = await isThreadEngaged(p, ev.threadTs).catch(() => false);
+            scheduleUnownedWake(ev, "in-thread-window", false, undefined, seatEngaged);
+            return OK();
+        }
+        // In-thread branch (one engagement read decides it): an ENGAGED thread takes the
+        // delivery path (rolled-in reply); a NON-engaged in-thread message runs the trigger
+        // check instead — a name-drop can now pull the bot into a live sub-thread it wasn't in
+        // (slack-events.ts shouldNameDropWake no longer disqualifies inThread).
+        // Fail-closed isThreadEngaged reads an error as NOT engaged → the hard-gated trigger
+        // path, never a spurious delivery.
+        const engaged = await isThreadEngaged(p, ev.threadTs);
+        if (!engaged) {
+            // Trigger-check path: like the top-level name-drop it roots on the existing thread
+            // and can't contend with a FIFO chain, so it follows the same non-queued waitUntil
+            // shape rather than the per-thread queue (the supervisor branch enqueues on its own key).
+            scheduleUnownedWake(ev, "name-drop-thread");
+            return OK();
+        }
+        // Per-thread FIFO: serialize this thread's bursts; hand the promise to waitUntil so the
+        // route returns 200 now while the wake continues in the background. (The FIFO is
+        // deliberately per-instance: cross-instance ORDERING would need a lease/queue, and the
+        // failure mode — two burst replies racing — is cosmetic, unlike the duplicate-delivery
+        // problem the durable dedupe above closes.)
+        const threadKey = slackContinuationToken(ev.channelId, ev.threadTs);
+        args.waitUntil(fifo.enqueue(threadKey, () => routeMessageEvent(ev, liveDeps(send)).then(logOutcome("engaged-thread", ev.channelId, ev.threadTs))));
+        return OK();
+    }
+}
+/**
+ * Compose the engagement front route with a wrapped `slackChannel`. `inner` must have been
+ * built with `route: INTERNAL_SLACK_ROUTE`. Returns the SAME channel value (preserving Eve's
+ * internal `__kind`/adapter/receive) with the public front route prepended — so Slack's URL
+ * hits us, and both routes share one channel name → one session namespace.
+ */
+export function frontSlackChannel(inner, opts = {}) {
+    const innerPost = inner.routes.find((r) => r.method === "POST" && r.path === INTERNAL_SLACK_ROUTE);
+    if (!innerPost) {
+        throw new Error(`frontSlackChannel: wrapped slackChannel must be built with route: "${INTERNAL_SLACK_ROUTE}" ` +
+            `(found paths: ${inner.routes.map((r) => r.path).join(", ")})`);
+    }
+    const front = buildFrontHandler(innerPost.handler, opts);
+    return { ...inner, routes: [POST(PUBLIC_SLACK_ROUTE, front), ...inner.routes] };
+}
+//# sourceMappingURL=slack-front.js.map