@open-everywhere/provider-slack 0.1.0

package/dist/agent/channels/slack.js

@@ -0,0 +1,1169 @@
+// The Slack surface. Wires Slack's webhook → an OpenEverywhere session, and — the point
+// of the "Slack-binding" slice — populates the session auth context with the REAL
+// Slack identity (team/channel/user ids + channel_type + is_private) so the
+// identity seam (agent/identity/binding.ts) resolves the actual workspace, surface,
+// mode (channel/dm/mpim), and visibility (public/private) instead of OE_* env
+// stand-ins. Everything downstream — memory partition, access resolver, routine
+// dispatch — then keys off real Slack identity with no further change.
+//
+// We override `onAppMention` / `onDirectMessage` only to attach our richer auth
+// (the defaults derive a thinner, workspace-scoped auth). The typing indicator shows
+// a random status VERB per update ("Tinkering…"), configurable per org/domain — see
+// statusVerb() below.
+//
+// Credentials: omitted here, so eve falls back to SLACK_BOT_TOKEN /
+// SLACK_SIGNING_SECRET (see .env.example). Swap the credential broker later without
+// touching identity. Capturing channel_type/is_private is a RAW-fact job; the
+// security-critical interpretation (fail-closed to private) lives in the binding.
+import { slackChannel, } from "eve/channels/slack";
+import { buildSlackAuth, channelFactsFromInfo, channelFactsFromRaw, forwardedSlackEnterpriseId, partnerFactsFromInfo, slackMode, } from "./slack-identity.js";
+import { resolvePartition, getOperationalStore, postOnce, outboundKey, statusVerbsFor, getConfig, finalMessageActionForTurn, NO_REPLY_SENTINEL_REASON, auditNoReplySentinelObserved, isBareStop, supervisorTextDelivery, isSupervisorProseLeak, capabilitiesForPlatform, consumeCardPostedThisTurn, consumeReactedThisTurn, consumeRepliedThisTurn, dropClosingProse, markThreadEngaged, disengageThread, getThreadEngagement, bumpThreadSilentStreak, WARM_SILENT_LIMIT, SURFACE, tierId, getProvider, providerById, writeMemoryTier, surfaceProvider, upsertUnderSection, bindFrom, authPrincipalId, isAllowedSlackDriver, planFor, extractPinnedInstructions, introMessage, instructionBullet, ONBOARDED_MARKER, STATUS_REACTION, renderPinned, isPinnedStatusMessage, classifyWakeMapping, unmappedWakeCopy, UNMAPPED_WAKE_DROP_REASON, admittedTenantsFromConfig, unadmittedTenantLog, UNADMITTED_TENANT_DROP_REASON, dmTrustTtlMs, swallowRoomOp, domainRoster, } from "@open-everywhere/core/agent/adapter-api.js";
+import { loadConversationContext } from "./slack-context.js";
+import { slackSpendGate } from "./slack-spend-gate.js";
+import { slackTenantAdmission } from "./slack-tenant-fence.js";
+import { holdRouteWork } from "./slack-route-hold.js";
+import { frontSlackChannel, INTERNAL_SLACK_ROUTE } from "./slack-front.js";
+import { admitSlackInputResponse } from "./slack-input-response.js";
+import { turnEffectsFor, botDisplayName, slackForm, isSupervisorReplyTurn, deliverSupervisorReply, dmWakeThreadOverride, replyThreadTsForState } from "./slack-events.js";
+import { markdownToSlackMrkdwn } from "./slack-mrkdwn.js";
+// WARM_SILENT_LIMIT (the warm-thread shed threshold) now lives in channels/engagement.ts so
+// Slack and Discord share ONE constant instead of each defining their own (which could drift).
+// --- Status UX (Thariq §11): glanceable state for the team -----------------
+// (a) ONE status-emoji reaction on the thread root — ⏳ working · ✅ done ·
+//     ❓ needs input · 🛑 blocked — only ever one at a time. (b) a self-maintained
+//     pinned message listing all in-flight work, fed from surface-tier memory
+//     (the cross-thread substrate the `update_status` tool writes).
+//
+// We touch only events with NO built-in default (session.completed/waiting) plus
+// session.failed (where we re-post the error the default would have), and set
+// "working" from the inbound handlers we already own — so the HITL approval UI
+// (input.requested), reply rendering (message.completed), and typing all stay intact.
+// --- status verbs (the fun bit) ----------------------------------------------
+// "Tinkering…" / "Untangling…" instead of a flat "Thinking…"/"Working…" — a random
+// pick per status update from the channel's effective vocabulary (framework defaults
+// ← org ← role ← domain, extend-or-replace; memory/domain.ts statusVerbsFor — a
+// domain's ROLE preset contributes its themed verbs as its own rung). Orgs add house
+// verbs, a team adds its in-jokes. Cosmetic only, so ANY failure falls back to a
+// plain verb — the status line must never take a turn down.
+/** The team a channel belongs to per THIS deploy's domain config (`slack/<team>/<channel>` entries),
+ *  or undefined when the channel is unmapped. Fail-soft: config errors read as "unknown", never
+ *  throw into the inbound path. Used only as the last leg of onInbound's teamId heal. */
+function teamIdFromDomainConfig(channelId) {
+    if (!channelId)
+        return undefined;
+    try {
+        const suffix = `/${channelId}`;
+        for (const d of getConfig().loadDomains()) {
+            for (const c of domainRoster(d)) {
+                if (c.startsWith("slack/") && c.endsWith(suffix)) {
+                    const team = c.split("/")[1];
+                    if (team)
+                        return team;
+                }
+            }
+        }
+    }
+    catch {
+        /* config unavailable → no heal */
+    }
+    return undefined;
+}
+function statusVerb(state) {
+    try {
+        const p = resolvePartition({
+            channel: { kind: "slack" },
+            session: { auth: { current: { attributes: { team_id: state.teamId ?? "", channel_id: state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
+        });
+        const cfg = getConfig();
+        const verbs = statusVerbsFor(p.surfaceKey, cfg.loadDomains(), cfg.loadRoles?.() ?? []);
+        return `${verbs[Math.floor(Math.random() * verbs.length)]}…`;
+    }
+    catch {
+        return "Working…";
+    }
+}
+// Shared by `reasoning.appended` and `actions.requested`: ALWAYS the clean status verb,
+// NEVER the model's own in-progress text. We used to show the model's pre-tool-call
+// preamble here (Tag-style, written for humans) — dropped 2026-07 (Tommy, live): that
+// text streams in mid-sentence, so it could flash a truncated fragment ("I'll go away and
+// look to setu…") for a moment before reverting to a verb, which read as broken. One
+// helper, one behaviour, so neither call site can drift back to surfacing partial text.
+async function refreshTypingStatus(channel) {
+    try {
+        await setWakeTyping(channel, statusVerb(channel.state));
+    }
+    catch {
+        /* typing indicator is best-effort */
+    }
+}
+// OPE-98: set / refresh / clear the assistant thinking-status on the turn's PER-WAKE thread. A DM
+// seat (OPE-90) is ONE per-channel eve session spanning many assistant threads, but `channel.thread`
+// is bound to the session's FROZEN `state.threadTs` (the first wake's thread), so for a wake that
+// landed in a DIFFERENT thread it would set/clear the spinner on the WRONG thread — the OPE-98
+// stuck-spinner. When there's a per-wake override (slack-events.ts dmWakeThreadOverride) we call
+// `assistant.threads.setStatus` host-side on the wake thread instead; an empty status clears it.
+// Every non-DM turn (and a same-thread DM wake) has no override ⇒ this is exactly
+// `channel.thread.startTyping(status)`, byte-identical to pre-OPE-98.
+async function setWakeTyping(channel, status) {
+    const override = dmWakeThreadOverride(channel.state);
+    const channelId = channel.state.channelId ?? undefined;
+    if (override && channelId) {
+        try {
+            const body = new URLSearchParams({ channel_id: channelId, thread_ts: override, status: status ?? "" });
+            await slackForm("assistant.threads.setStatus", body.toString());
+        }
+        catch {
+            /* thinking-status is best-effort */
+        }
+        return;
+    }
+    await channel.thread.startTyping(status);
+}
+// OPE-98 companion to setWakeTyping for POSTING text (an error notice) on the per-wake thread. With
+// a DM-seat override, post host-side to the wake thread so the message doesn't land in the frozen
+// session thread; otherwise eve's `channel.thread.post` (byte-identical for every non-DM path). The
+// normal reply post is the `reply` tool's, which resolves its own per-wake target from the binding.
+async function postWakeText(channel, text) {
+    const override = dmWakeThreadOverride(channel.state);
+    const channelId = channel.state.channelId ?? undefined;
+    if (override && channelId) {
+        const body = new URLSearchParams({ channel: channelId, text, thread_ts: override });
+        await slackForm("chat.postMessage", body.toString());
+        return;
+    }
+    await channel.thread.post(text);
+}
+/**
+ * The `chat.postMessage` form body for a channel-supervisor's host-side reply post (OPE-878).
+ *
+ * `deliverSupervisorReply`'s `post` callback bypasses the post-arm registry (slack-post-arm.ts) —
+ * it builds its own `slackForm` call rather than going through `dispatchSlackReply` — so it needs
+ * its OWN `markdownToSlackMrkdwn` conversion at the wire; that seam does not cover it. This is that
+ * ONE conversion point, extracted so a test can drive it without a live Slack call (the closure
+ * above cannot be invoked directly — it captures live session state).
+ */
+export function supervisorPostFormBody(channelId, threadTs, text) {
+    const body = new URLSearchParams({ channel: channelId, text: markdownToSlackMrkdwn(text) });
+    if (threadTs)
+        body.set("thread_ts", threadTs);
+    return body.toString();
+}
+// --- quiet failure for UNINVITED turns --------------------------------------
+// A name-drop wake barges into a conversation the agent was never asked into; until it
+// actually POSTS a reply it has no standing there, so a failed turn must leave the
+// surface untouched (no error post, no reaction) — observed live: a gateway outage
+// posted raw errors into threads that would otherwise have judged NO_REPLY. The
+// failure still goes to logs + the audit trail so the operator sees it. The flag rides
+// the wake's `state` (slack-events.ts sets oeUninvited) and is CLEARED the moment a
+// reply posts — a participating agent's failures go loud again.
+function isUninvited(state) {
+    return state?.oeUninvited === true;
+}
+async function recordQuietFailure(state, event, message) {
+    console.warn(`[open-everywhere:slack] ${event} on an uninvited turn — suppressed on-surface (${message})`);
+    try {
+        const p = resolvePartition({
+            channel: { kind: "slack" },
+            session: { auth: { current: { attributes: { team_id: state.teamId ?? "", channel_id: state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
+        });
+        await getOperationalStore().appendAudit({
+            ts: new Date().toISOString(),
+            org: p.org,
+            platform: p.platform,
+            workspace: p.workspace,
+            surface: p.surface,
+            action: "surface.quiet_fail",
+            detail: { event, threadTs: state.threadTs ?? undefined, message: message.slice(0, 500) },
+        });
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:slack] quiet-fail audit write failed: ${String(err)}`);
+    }
+}
+// Set the thread-root status reaction (best-effort). The bot's vocabulary is narrow by
+// design (status/status.ts header): 👀 while working, 🛑 on failure, and — the key move —
+// "none" REMOVES rather than replaces when work ends: absence is the done signal, the
+// posted reply is the result, and ✅ stays reserved for humans.
+async function setStatusReaction(slack, state, threadTsOverride) {
+    const channel = slack.channelId;
+    // OPE-98: on a DM seat the status emoji was SET on the wake thread's root (onInbound uses the
+    // wake-bound ctx.slack) but the handlers CLEAR via the session-bound `channel.slack` (the frozen
+    // seat thread) — so the ✕ lands on the wrong message and the eyes stay stuck. `threadTsOverride`
+    // (dmWakeThreadOverride, undefined for every non-DM turn ⇒ byte-identical) retargets the clear
+    // onto the same message the set used.
+    const timestamp = threadTsOverride ?? slack.threadTs;
+    if (!channel || !timestamp)
+        return;
+    // The shared egress exit (core's channels/egress-spoof.ts, OPE-1132). This glyph is a room post,
+    // and it is the ONE Slack write in this bundle that does not travel through core's Slack bridge —
+    // `slack.request` is eve's own channel handle, so the bridge's gate never sees it. Gated here for
+    // that reason alone; every other Slack write this deployment makes is already covered upstream.
+    if (swallowRoomOp("a slack status reaction"))
+        return;
+    for (const [s, name] of Object.entries(STATUS_REACTION)) {
+        try {
+            await slack.request(s === state ? "reactions.add" : "reactions.remove", { channel, name, timestamp });
+        }
+        catch {
+            /* already-reacted / no-reaction / missing-scope are all non-fatal */
+        }
+    }
+}
+// Mirror surface-tier STATUS.md to a single pinned Slack message (find it via a
+// stable header marker so we don't persist a message ts across sessions).
+async function syncPinnedStatus(channel) {
+    try {
+        const { channelId, teamId } = channel.state;
+        if (!channelId)
+            return;
+        // Resolve the surface partition from the channel's own ids (SessionContext
+        // here lacks `channel.kind`, so feed the binding a slack-shaped stand-in).
+        const stub = {
+            channel: { kind: "slack" },
+            session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+        };
+        const p = resolvePartition(stub);
+        // The SAME provider `update_status` wrote through (OPE-1051) — a DM channel id ("D…")
+        // resolves `mode: "dm"` here even with no `channel_type` attribute set (slackMode's id-prefix
+        // fallback), so this stays the DB-pinned personal silo's provider for a DM and the
+        // env-selected singleton for a real channel, exactly like the write side.
+        const files = await surfaceProvider(bindFrom(stub)).readTier(p, SURFACE);
+        const text = renderPinned(files["STATUS.md"]);
+        const slack = channel.slack;
+        const list = await slack.request("pins.list", { channel: channelId });
+        let ts;
+        const items = list.items;
+        if (list.ok && Array.isArray(items)) {
+            for (const it of items) {
+                const m = it?.message;
+                if (m && typeof m.text === "string" && isPinnedStatusMessage(m.text) && typeof m.ts === "string") {
+                    ts = m.ts;
+                    break;
+                }
+            }
+        }
+        if (ts) {
+            await slack.request("chat.update", { channel: channelId, ts, text });
+        }
+        else {
+            const posted = await slack.request("chat.postMessage", { channel: channelId, text });
+            const postedTs = posted.ts;
+            if (posted.ok && typeof postedTs === "string") {
+                await slack.request("pins.add", { channel: channelId, timestamp: postedTs });
+            }
+        }
+    }
+    catch {
+        /* status mirroring is best-effort, never fails the task */
+    }
+}
+// Best-effort: enrich an app_mention's facts with the public/private bit, which
+// the mention envelope doesn't carry, via conversations.info. On any failure we
+// leave is_private unknown — the binding fails closed (treats it as private).
+async function enrichVisibility(ctx, channelId, base) {
+    if (base.isPrivate !== undefined)
+        return base;
+    try {
+        const info = await ctx.slack.request("conversations.info", { channel: channelId });
+        return { ...base, ...channelFactsFromInfo(info) };
+    }
+    catch {
+        return base; // unknown -> fail closed in the binding
+    }
+}
+// Best-effort, TTL-cached: is the DM PARTNER an internal member? A DM's `trust` now gates its
+// SHARED read layer (internal partner → `dm`, external → `public`), so we positively determine it
+// via users.info. On any failure we leave it unset — the binding fails closed (external). Cached
+// per user (DMs repeat; users.info is rate-limited and membership changes rarely).
+const dmTrustCache = new Map();
+async function enrichDmPartner(ctx, message, base) {
+    const userId = message.author?.userId;
+    if (!userId)
+        return base; // no actor → unverified → fail closed
+    const hit = dmTrustCache.get(userId);
+    if (hit && Date.now() - hit.at < dmTrustTtlMs())
+        return { ...base, dmPartnerTrust: hit.trust };
+    try {
+        const info = await ctx.slack.request("users.info", { user: userId });
+        const { dmPartnerTrust } = partnerFactsFromInfo(info, message.teamId);
+        dmTrustCache.set(userId, { trust: dmPartnerTrust, at: Date.now() });
+        return { ...base, dmPartnerTrust };
+    }
+    catch {
+        return base; // lookup failed → unverified → fail closed in the binding
+    }
+}
+async function resolveFacts(ctx, message, isDm) {
+    return isDm
+        ? enrichDmPartner(ctx, message, { channelType: "im", isPrivate: true }) // DM is unambiguous; verify the partner
+        : enrichVisibility(ctx, message.channelId, channelFactsFromRaw(message.raw));
+}
+function authFromFacts(message, facts) {
+    const author = message.author;
+    if (!author)
+        return null; // system event with no actor — drop
+    // The Enterprise Grid rung (OPE-1508, carried onto this ingress by OPE-1559). This door is handed
+    // the INNER event, so the rung cannot come off `message` — the front route stows the envelope's
+    // `enterprise_id` around the forward and this is the read back. Spread conditionally, the same way
+    // every other wake route spreads it: a non-Grid delivery stamps no attribute, so its trust walk is
+    // byte-identical to what it was.
+    const enterpriseId = forwardedSlackEnterpriseId(message);
+    return buildSlackAuth({
+        userId: author.userId,
+        teamId: message.teamId,
+        ...(enterpriseId === undefined ? {} : { enterpriseId }),
+        channelId: message.channelId,
+        threadTs: message.threadTs,
+        channelType: facts.channelType,
+        isPrivate: facts.isPrivate,
+        isExternal: facts.isExternal,
+        trustChecked: facts.trustChecked,
+        dmPartnerTrust: facts.dmPartnerTrust,
+    });
+}
+// First-act onboarding for a real channel: post an intro, and adopt the channel's
+// pinned instructions as STANDING INSTRUCTIONS in its memory. Runs once per surface
+// (gated by a marker on the operational SURFACE tier), pre-dispatch — so the adopted
+// instructions are synced into THIS session's sandbox at session.started. Best-effort.
+//
+// The marker is per-surface operational state (alongside STATUS.md); adopted
+// instructions go to the channel's WRITABLE memory target (its domain's silo). A
+// channel with no domain memory (or an externally-shared one) still gets the intro,
+// just no adopted instructions — there's nowhere durable for them to live.
+//
+// 🔴 THE ENV-SELECTED `getProvider()` HERE IS CORRECT, NOT THE OMISSION OPE-1051 FOUND (below).
+// The one call site (`if (mode === "channel") await maybeOnboard(…)`, further down this file)
+// gates this function to real channels only — never a DM, never a group DM — so its SURFACE-tier
+// marker never collides with the DM personal silo's DB pin. If a future caller ever invokes this
+// for a DM, route it through `surfaceProvider(bindFrom(where))` first, the same fix `update_status`
+// and `syncPinnedStatus` got.
+async function maybeOnboard(ctx, where) {
+    try {
+        const p = resolvePartition(where);
+        const marker = await getProvider().ensureTier(p, SURFACE); // operational marker tier (registered provider — see syncPinnedStatus)
+        if (marker[ONBOARDED_MARKER] !== undefined)
+            return; // already onboarded
+        let adopted = false;
+        try {
+            const pins = await ctx.slack.request("pins.list", { channel: ctx.slack.channelId });
+            const instructions = extractPinnedInstructions(pins);
+            const target = instructions ? planFor(bindFrom(where), p).writes[0] : undefined;
+            if (instructions && target) {
+                const provider = providerById(target.silo.provider);
+                const mem = await provider.ensureTier(p, target.tier, target.silo, target.access);
+                const date = new Date().toISOString().slice(0, 10);
+                mem["MEMORY.md"] = upsertUnderSection(mem["MEMORY.md"] ?? "", "Standing instructions", instructionBullet(instructions, date));
+                // THE ONE ROAD (OPE-1873). Adopting a channel's pinned instructions puts CONTENT into a
+                // silo's MEMORY.md, so it is a `memory.write` like any other remembered fact — before this
+                // it wrote the silo and left no row at all.
+                await writeMemoryTier({
+                    provider,
+                    partition: p,
+                    tier: target.tier,
+                    files: mem,
+                    message: `adopt pinned instructions [${tierId(target.tier)}]`,
+                    silo: target.silo,
+                    access: target.access,
+                    road: "pinned-instructions",
+                });
+                adopted = true;
+            }
+        }
+        catch {
+            /* pins unavailable / no writable memory — still post the intro and mark onboarded */
+        }
+        marker[ONBOARDED_MARKER] = new Date().toISOString();
+        // THE ONE ROAD (OPE-1873), as an OPERATIONAL write — the marker is bookkeeping, not a fact.
+        await writeMemoryTier({
+            provider: getProvider(),
+            partition: p,
+            tier: SURFACE,
+            files: marker,
+            message: `onboarding ${p.surfaceKey}`,
+            road: "onboarding-marker",
+            kind: "operational",
+        });
+        try {
+            // Introduce as the bot's actual workspace name (fail-soft → product-name fallback).
+            await ctx.thread.post(introMessage(adopted, await botDisplayName()));
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    catch {
+        /* onboarding never blocks the task */
+    }
+}
+// A BindableContext for an inbound message, BEFORE the session (and its auth) exist —
+// built from the message's own ids + facts via the same binding the session would use.
+// Carries the external/trust facts so the trust gate resolves correctly pre-dispatch.
+function bindableForMessage(message, facts) {
+    const attributes = {
+        team_id: message.teamId ?? "",
+        channel_id: message.channelId,
+        channel_type: facts.channelType ?? "",
+    };
+    if (typeof facts.isExternal === "boolean")
+        attributes.is_ext_shared = String(facts.isExternal);
+    if (typeof facts.trustChecked === "boolean")
+        attributes.trust_checked = String(facts.trustChecked);
+    if (facts.dmPartnerTrust)
+        attributes.dm_partner_trust = facts.dmPartnerTrust;
+    return {
+        channel: { kind: "slack" },
+        session: { auth: { current: { attributes, principalId: message.author?.userId ?? "", principalType: "slack-user" } } },
+    };
+}
+function partitionForMessage(message, facts) {
+    return resolvePartition(bindableForMessage(message, facts));
+}
+/**
+ * THE DROP. Returning `{ auth: null }` from `onAppMention`/`onDirectMessage` does **not** drop the
+ * wake — eve dispatches the turn anyway, just auth-less. From eve's own type docs
+ * (`SlackMentionResult`): *"Return an object (auth may be `null`) to dispatch a turn, or `null` to
+ * drop the inbound message."* Verified against the compiled 0.27.5 channel 2026-07-25: a handler
+ * returning `{ auth: null }` still reaches `deliverSlackMessage` → `send({auth: null})` → a full
+ * model turn on an auth-less session (`slack/dev/default`, no principal, guest).
+ *
+ * That counterfeit drop is what defeated the spend cap (OPE-33): the bot-author leg below "dropped"
+ * a non-allowlisted bot mention with `{ auth: null }` — ABOVE the spend gate — so the turn ran
+ * having never consulted a budget, and the capped surface kept spending with zero `spend.gate`
+ * rows to show for it. The declined-by-cap and stop-request legs had the same hole: the refusal
+ * posted (or the stop was acked) and the model answered anyway.
+ *
+ * Every "no turn" exit therefore returns THIS constant. `slack-spend-gate-test.ts` scans this file
+ * for the counterfeit shape so the class of bug can't come back.
+ */
+const DROP = null;
+/**
+ * Make a dropped wake OBSERVABLE. The webhook function's console output never reaches
+ * `vercel logs` (only workflow-process invocations stream), so a `console.log` on a drop is
+ * invisible in production — which is most of why the OPE-33 diagnosis was a day of guessing at
+ * an absence. One tiny `surface.wake_dropped` row per drop puts the reason on the audit trail
+ * the control API can read. Best-effort by contract: never throws, never changes the decision —
+ * and the drop path AWAITS it, so the row lands before the hook returns. Volume is negligible
+ * (bot mentions only), and a drop is by definition a turn nobody is waiting on.
+ *
+ * 🔴 IT RETURNS ITS PROMISE, AND EVERY CALL SITE HOLDS IT (OPE-1648). This used to be a bare
+ * `void (async () => …)`. The events route answers its 200 at once — eve returns the response and
+ * dispatches this hook in the route's `waitUntil` — so on Vercel the invocation can freeze behind
+ * the response and a fire-and-forget write loses the row this function calls the only durable
+ * signal a drop has. Each call site AWAITS it before returning `DROP`, which keeps eve's own
+ * dispatch promise pending until the row lands — and that promise is in the snapshot the platform
+ * waits on. `holdRouteWork` additionally tracks it on the delivery's keepalive
+ * (slack-route-hold.ts), which is what covers a writer no caller can await.
+ */
+function auditWakeDropped(message, reason, detail = {}) {
+    return holdRouteWork((async () => {
+        try {
+            const p = resolvePartition({
+                channel: { kind: "slack" },
+                session: { auth: { current: { attributes: { team_id: message.teamId ?? "", channel_id: message.channelId }, principalId: "", principalType: "slack-user" } } },
+            });
+            await getOperationalStore().appendAudit({
+                ts: new Date().toISOString(),
+                org: p.org,
+                platform: p.platform,
+                workspace: p.workspace,
+                surface: p.surface,
+                action: "surface.wake_dropped",
+                detail: { reason, channel: message.channelId, ts: message.ts, ...detail },
+            });
+        }
+        catch {
+            /* observability only */
+        }
+    })());
+}
+async function onInbound(ctx, message, isDm, 
+/** Set by the spend-gate consult below; {@link admitInbound} refuses to admit a turn without it. */
+consult) {
+    // TEAM-ID HEAL (live-caught 2026-07-25): app-authored message events carry NO inner `team`
+    // field, so message.teamId arrives undefined for any driver/app-posted mention. Left unhealed,
+    // EVERY downstream derivation quietly degrades — the workspace binds the "dev" fallback, the
+    // spend gate keys "slack/dev/…" (a capped surface never matches ⇒ the cap silently never
+    // trips), and the session binds memoryless/guest. The thread handle knows the installed team;
+    // backfill once here so facts, the spend gate, partition and auth all scope the real workspace.
+    if (!message.teamId) {
+        const threadTeam = ctx.thread.teamId;
+        const healed = typeof threadTeam === "string" && threadTeam.length > 0
+            ? threadTeam
+            : // Pre-dispatch the thread handle's state isn't hydrated (teamId null — live-observed), so
+                // fall back to the deploy's own config: a mapped channel is declared fully-qualified as
+                // `slack/<team>/<channel>` in domains.ts, which names the team authoritatively. An
+                // unmapped channel in a message with no team stays unhealed (same degraded posture as
+                // before — nothing to invent).
+                teamIdFromDomainConfig(message.channelId);
+        if (healed)
+            message = { ...message, teamId: healed };
+    }
+    // Bot-author gate (loop safety, mirrors the Discord gateway's drop). Eve's DM leg
+    // already filters bot_id, but its app_mention leg does NOT (verified in the compiled
+    // channel, 2026-07-07) — so without this, another bot @mentioning ours is an un-gated
+    // wake: burned inference at best, a mention ping-pong at worst. Our own engagement and
+    // name-drop wake paths drop bot authors too (slack-events.ts authorIsBot); this closes
+    // the one remaining leg. ONE carve-out, same as the Discord gateway: an allowlisted e2e
+    // driver (OE_TEST_DRIVER_IDS `teamId:botId`). The driver posts with a USER token, but
+    // Slack stamps app-authored posts with the app's bot_id regardless (live 2026-07-07 —
+    // the plan's "xoxp needs no seam" premise was wrong). Fail-closed, guild^Wteam-pinned,
+    // exact-id, loud — see testing/driver-allowlist.ts for the full posture.
+    //
+    // CORRECTION (OPE-33, 2026-07-25): this used to `return { auth: null }` and note that doing so
+    // "doesn't even DROP the wake — eve still runs the mention with no attributes, so the session
+    // binds fail-closed external and memoryless". That was the bug, not a tolerable degradation:
+    // an un-gated model turn ran on every non-allowlisted bot mention, ABOVE the spend gate, so a
+    // capped surface kept spending. It is now a REAL drop (see DROP). Note the consequence for the
+    // e2e driver: if its `teamId:botId` isn't in OE_TEST_DRIVER_IDS, its mentions no longer produce
+    // a degraded reply — they produce NO reply plus a `surface.wake_dropped` audit row saying so.
+    if (message.author?.isBot) {
+        const rawBotId = typeof message.raw?.bot_id === "string" ? message.raw.bot_id : undefined;
+        if (!isAllowedSlackDriver(message.teamId, rawBotId)) {
+            // A REAL drop (was `{ auth: null }`, which eve dispatches anyway — see DROP). This leg sat
+            // ABOVE the spend gate, so the counterfeit drop admitted an un-gated, auth-less model turn
+            // for every non-allowlisted bot mention: the OPE-33 live signature (a reply, a guest
+            // `slack/dev/default` session, and zero `spend.gate` rows).
+            console.log(`[open-everywhere:slack] bot-authored mention dropped — no turn (bot ${rawBotId ?? "?"} in team ${message.teamId ?? "?"} is not an allowlisted e2e driver)`);
+            await auditWakeDropped(message, "bot author is not an allowlisted driver", { botId: rawBotId ?? null, team: message.teamId ?? null });
+            return DROP;
+        }
+        console.log(`[open-everywhere:slack] e2e driver accepted: bot-authored mention from ${rawBotId} in team ${message.teamId} (allowlisted)`);
+    }
+    const facts = await resolveFacts(ctx, message, isDm);
+    const mode = slackMode(facts.channelType, message.channelId);
+    // UNMAPPED-CHANNEL GUARD (OPE-119) — the TENANT floor, above the spend gate because a wake with
+    // no workspace can't even be keyed for a cap ("slack/dev/…" matches nothing). The heal above is
+    // the only chance this wake had to learn its team; if it still has none, the channel is in no
+    // domain and NOTHING downstream can recover — the binding files the session under the env
+    // stand-in workspace, trust fails closed with no principal, and the read/memory tools refuse one
+    // by one. That turn is un-answerable, so it does not run: post the config nudge and DROP.
+    // Rationale + scope (channels only, real platforms only, and why this is NOT "the channel has no
+    // domain") in access/wake-mapping.ts.
+    // TENANT FENCE (OPE-309 phase 0c) — the unmapped guard's sibling, one question further along:
+    // that one asks "did this wake resolve a team at all", this asks "is it a team this deployment
+    // ADMITS". Above the spend gate for the same reason, and BEFORE the unmapped guard's nudge
+    // because a foreign workspace must not be handed our config-hole copy. DMs included, no
+    // exemption: a Slack DM carries its own team_id, and a DM is exactly where a colliding id
+    // resolves somebody's PERSONAL credentials. Rationale + the four proceed-paths (including why an
+    // undeclared deployment stays inert) live in access/tenant-admission.ts.
+    // THE GRID RUNG (OPE-1645) — the mention door reads its `enterprise_id` off the carrier the front
+    // route stows, exactly as `authFromFacts` does below, because eve hands this hook the INNER event
+    // and the envelope that named the Grid is gone by then. A single-workspace install carries none
+    // and the fence then judges the workspace alone, as before.
+    const mentionEnterpriseId = forwardedSlackEnterpriseId(message);
+    if (slackTenantAdmission(message.teamId, mentionEnterpriseId) === "unadmitted") {
+        console.log(unadmittedTenantLog("slack", message.teamId, admittedTenantsFromConfig("slack"), mentionEnterpriseId));
+        await auditWakeDropped(message, UNADMITTED_TENANT_DROP_REASON, {
+            door: "mention",
+            team: message.teamId ?? null,
+            enterprise: mentionEnterpriseId ?? null,
+        });
+        return DROP;
+    }
+    if (classifyWakeMapping({ platform: "slack", mode, workspaceId: message.teamId }) === "unmapped") {
+        console.log(`[open-everywhere:slack] unmapped-channel wake dropped — no turn (channel ${message.channelId} resolved no team; map it in agent/memory/config/domains.ts)`);
+        await auditWakeDropped(message, UNMAPPED_WAKE_DROP_REASON, { door: "mention", channelType: facts.channelType ?? null });
+        try {
+            await ctx.thread.post(unmappedWakeCopy("slack", message.channelId));
+        }
+        catch {
+            /* best-effort — a lost nudge must not turn the drop into a turn */
+        }
+        return DROP;
+    }
+    // Spend cap — MENTION DOOR, and the ADMISSION CHOKEPOINT for it: every path from here on either
+    // returns DROP or admits a turn, and admitInbound refuses to admit unless this consult ran. The
+    // ENGAGEMENT door (slack-events.ts slackWakeSpendGate — three routes, one helper) is the other
+    // chokepoint. One gate, two doors (OPE-33). DMs are gated too since OPE-267 (an ORG ADMIN still
+    // gets through, via the audited spend/bypass.ts escape the gate consults); no-op until caps are
+    // configured. Decision table, refusal copy, admin-bypass semantics and the audit row all live in
+    // slack-spend-gate.ts.
+    //
+    // The refusal posts through `ctx.thread`, whose binding eve rooted at `message.threadTs` — and
+    // eve's parser reads that as `thread_ts || ts`, so a TOP-LEVEL mention roots on its own ts. The
+    // refusal therefore lands as a THREADED reply under the wake's root message, which is what a
+    // `conversations.replies` poll on the mention's ts (the S10 driver) can see.
+    const gate = await slackSpendGate({
+        bindable: bindableForMessage(message, facts),
+        mode,
+        principalId: message.author?.userId,
+        teamId: message.teamId,
+        door: "mention",
+        post: async (text) => {
+            await ctx.thread.post(text);
+        },
+    });
+    consult.gated = true;
+    if (gate === "declined") {
+        // A REAL drop (was `{ auth: null }`): the refusal used to post AND the model answered anyway,
+        // which is precisely the "NO model turn follows the refusal" guarantee S10 asserts. (No status
+        // reaction to clear — the gate runs before the 👀 is set.)
+        return DROP;
+    }
+    // First-act onboarding (real channels only — not DMs / execution-only group DMs).
+    if (mode === "channel") {
+        await maybeOnboard(ctx, bindableForMessage(message, facts));
+    }
+    try {
+        await ctx.thread.startTyping(statusVerb({ channelId: message.channelId, teamId: message.teamId }));
+    }
+    catch {
+        /* typing indicator is best-effort */
+    }
+    // 👀 — seen it, working on it. Removed when the turn ends (absence = done).
+    await setStatusReaction(ctx.slack, "working");
+    // Component 2's STOP LEG USED TO BE HERE and is deleted (OPE-418). It ran a regex over the
+    // mention body and, on a match, disengaged the thread and posted a fixed sentence — before any
+    // model call, which is why it existed at all. Standing down is now judged BETWEEN turns by the
+    // agent itself (`stand_down`), because the phrasing is unbounded and a pattern over it produces
+    // false positives at about the rate it produces true ones ("don't stop the deploy" was one
+    // careful clause away from disengaging the thread). The thing this leg was genuinely good at —
+    // being FREE — is preserved where it actually matters, on the CANCEL affordance (✋ / `/oe stop`),
+    // which is pre-model by construction.
+    // Component 1: inject the surrounding conversation so the agent understands what's
+    // happening in the channel/thread, not just the bare mention. DMs are skipped — the
+    // 1:1 history IS the conversation and the durable session already carries it. The
+    // context is untrusted-wrapped inside loadConversationContext; best-effort (never
+    // blocks the turn). Mark the thread engaged so later non-mention replies route back
+    // (Component 2 wake path) without a re-tag.
+    let context;
+    if (!isDm) {
+        context = await loadConversationContext(ctx, message);
+        // An @mention is an INVITATION → participating:true (promotes a warm thread + clears
+        // its silent streak, and exempts it from warm auto-disengage).
+        await markThreadEngaged(partitionForMessage(message, facts), message.threadTs, new Date().toISOString(), { participating: true });
+    }
+    return { auth: authFromFacts(message, facts), context };
+}
+/**
+ * THE WAKE-ADMISSION CHOKEPOINT for eve's native mention/DM door (OPE-33) — the only thing wired
+ * into `onAppMention`/`onDirectMessage`.
+ *
+ * A returned turn is a spend commitment, so this wrapper enforces the invariant that inspection
+ * kept failing to hold: **nothing is admitted unless the spend gate was consulted for THIS
+ * message**. Fail-CLOSED — an admission with no consult (a future early-return added above the
+ * gate, exactly the shape that broke it) is downgraded to a real DROP and said out loud, rather
+ * than quietly spending. A DROP passes straight through (nothing to gate: no turn, no spend).
+ *
+ * The refusal itself is posted by the gate, so a declined wake is still visible in-thread; this
+ * wrapper only decides whether a MODEL TURN follows.
+ */
+export async function admitInbound(ctx, message, isDm, run = (consult) => onInbound(ctx, message, isDm, consult)) {
+    const consult = { gated: false };
+    const outcome = await run(consult);
+    if (outcome === DROP)
+        return DROP;
+    if (!consult.gated) {
+        console.warn(`[open-everywhere:slack] wake admitted without a spend-gate consult — dropped fail-closed (${message.channelId}/${message.ts})`);
+        await auditWakeDropped(message, "admitted without a spend-gate consult — fail-closed");
+        return DROP;
+    }
+    return outcome;
+}
+// The mention/DM/interaction pipeline, wrapped at an INTERNAL route so our engagement front
+// route (slack-front.ts) can own the PUBLIC Slack URL and forward to this handler. Both live
+// on ONE channel → one session namespace, so a non-mention wake continues the mention's
+// session).
+const slackMentionChannel = slackChannel({
+    route: INTERNAL_SLACK_ROUTE,
+    // 🔴 QUEUE, NEVER STEER (OPE-412). eve's own default is `steer`, and a steer delivery carrying
+    // a message CANCELS the turn in flight — rolling session history back to the last completed
+    // model call while that call's tool side effects (posts, PRs, writes) stay real and unrecorded.
+    // OE's internal wakes ride this same send path (channels/unified.ts): a task-completion wake, an
+    // auto-redrive or a cross-surface divert landing mid-turn would cancel the turn that spawned it.
+    turnPolicy: "queue",
+    // Both hooks go through the ADMISSION CHOKEPOINT, never onInbound directly (OPE-33).
+    onAppMention: (ctx, message) => admitInbound(ctx, message, false),
+    onDirectMessage: (ctx, message) => admitInbound(ctx, message, true),
+    // 🔴 WHO MAY ANSWER A PARKED QUESTION (OPE-574). Omitting this hook is not "no policy" — it is
+    // eve's `defaultOnInputResponse`, which accepts the submitting user and compares them to nothing,
+    // so any workspace member who could see the thread could answer `ask_question` and the
+    // session-limit prompt. The admission runs the SAME room floor the approval click runs
+    // (approvals/clicker-floor.ts); see channels/slack-input-response.ts for the shape.
+    onInputResponse: (ctx, submission) => admitSlackInputResponse(ctx, submission),
+    events: {
+        // Snapshot the supervisor's REAL per-turn reply target, then run eve's default
+        // turn.started body. eve wraps turn.started specially (verified in the compiled
+        // slackChannel): it always sets `triggeringUserId` from the auth, THEN calls the
+        // authored handler IN PLACE OF `defaultEvents["turn.started"]` — so authoring this
+        // handler REPLACES the default's state-clear + "Working…" typing. We therefore
+        // replicate that default body verbatim below so NON-supervisor turns stay
+        // byte-identical to today; the supervisor snapshot is the only addition, gated on the
+        // `oeSupervisor` flag (T1.3's wake state).
+        //
+        // Why snapshot here (T1.4 / C1): a supervisor session's `state.threadTs` is a NON-EMPTY
+        // sentinel (amendment A), so it can't carry the turn's real target. But eve rewrites
+        // `session.auth.current` from the DELIVERY's auth on every delivery, and Slack auth
+        // attributes carry `channel_id`/`thread_ts` — so at turn.started they are THIS turn's
+        // real trigger. We copy them into `channel.state.oeReplyTarget` for message.completed to
+        // post to. `thread_ts` present ⇔ the trigger was threaded (buildSlackAuth only sets it
+        // when the message had a thread_ts); absent ⇔ a top-level channel message.
+        "turn.started": async (_data, channel, ctx) => {
+            // Supervisor target snapshot FIRST — must not depend on the typing call succeeding.
+            if (isSupervisorReplyTurn(channel.state)) {
+                const attrs = ctx?.session?.auth?.current?.attributes;
+                const channelId = typeof attrs?.channel_id === "string" ? attrs.channel_id : undefined;
+                const threadTs = typeof attrs?.thread_ts === "string" ? attrs.thread_ts : undefined;
+                // channelId missing ⇒ leave no stale target from a prior turn (fail safe: no target
+                // means message.completed posts NOTHING, never to a guessed channel).
+                channel.state.oeReplyTarget = channelId
+                    ? { channelId, threadTs }
+                    : undefined;
+            }
+            // OPE-645: REPLY PRINCIPAL snapshot — same T1.4 pattern as the supervisor target above, for the
+            // same reason: message.completed has no live auth ctx, so the canonical row it writes cannot
+            // derive WHO from ctx at that point. Since OPE-2006 that row is the DROP row, never a
+            // `reply.post`. authPrincipalId(ctx) is the exact read bindFrom(ctx).principalId falls back to
+            // for an ordinary human turn (identity/binding.ts) — snapshotting it here means the drop row
+            // names the same person the turn's egress.policy rows already do.
+            channel.state.oeReplyPrincipalId = authPrincipalId(ctx);
+            // OPE-98: DM-SEAT per-wake anchor. A DM seat (OPE-90) is ONE per-channel eve session spanning
+            // many assistant threads, but eve freezes the session's reply target to the FIRST wake's
+            // thread (`state.threadTs`, seeded once at session birth — see slack-events.ts's
+            // dmWakeThreadOverride header). Snapshot THIS wake's thread from the delivery auth (rewritten
+            // per delivery ⇒ the waking message's thread) so the reply + thinking-status ride it. SCOPED
+            // to `im` DMs — every channel/supervisor/mpim turn leaves `oeWakeThreadTs` unset, so their
+            // targeting stays byte-identical.
+            {
+                const attrs = ctx?.session?.auth?.current?.attributes;
+                if (attrs?.channel_type === "im") {
+                    channel.state.oeWakeThreadTs =
+                        typeof attrs.thread_ts === "string" ? attrs.thread_ts : undefined;
+                }
+            }
+            // eve's default turn.started body, byte-preserved (see header above).
+            channel.state.pendingToolCallMessage = null;
+            channel.state.lastReasoningTypingAtMs = null;
+            channel.state.lastReasoningTypingStatus = null;
+            await setWakeTyping(channel, "Working...");
+        },
+        // Keep the model's REASONING out of the channel. GLM-5.2 runs with reasoning:"medium",
+        // and Eve's default `reasoning.appended` handler pipes the chain-of-thought straight into
+        // the Slack typing-status line (startTyping(reasoningText)). That leaks internal thinking
+        // into the surface. We override it to refresh a GENERIC status instead — the indicator
+        // stays alive (so a long reasoning phase doesn't look stalled) without echoing the
+        // reasoning itself. Throttled to the default's ~5s cadence to avoid spamming startTyping.
+        // The clean final answer leaves by the `reply` TOOL and by nothing else: this channel authors
+        // its own `message.completed`, and since OPE-2006 that handler DROPS the turn's closing prose
+        // and records it (`channels/closing-prose-drop.ts`). Re-delegating to eve's default poster here
+        // would re-open the road this ticket removed, on the surface OPE-771 measured the loss on.
+        "reasoning.appended": async (_data, channel) => {
+            const now = Date.now();
+            const last = channel.state.lastReasoningTypingAtMs;
+            if (last != null && now - last >= 0 && now - last < 5000)
+                return;
+            channel.state.lastReasoningTypingAtMs = now;
+            await refreshTypingStatus(channel);
+        },
+        // Eve's default falls back to "Running bash, read_channel..." for a tool-call
+        // step, which means nothing to non-engineers and advertises the toolbox to the whole
+        // channel — so we override with a generic status. We ALSO used to show the model's own
+        // preamble text here (its line before the tool call, written for humans, Tag-style) —
+        // dropped 2026-07 (Tommy, live): that text streams in mid-sentence, so the typing
+        // indicator would flash a truncated fragment ("I'll go away and look to setu…") for a
+        // moment before reverting, which read as broken. Always the clean status verb now,
+        // same as reasoning.appended.
+        "actions.requested": async (_data, channel) => {
+            await refreshTypingStatus(channel);
+        },
+        // Override the reply-posting handler for TWO additions: (1) a woken (non-mention) turn
+        // is told to judge whether a reply is warranted and to end with NO_REPLY when it isn't
+        // (slack-events.ts renderWakeMessage) — that sentinel must be swallowed, not posted;
+        // (2) a turn where a propose tool already posted a code-rendered approval card
+        // (approvals/flow.ts's requestApproval, signalled via approvals/card-signal.ts)
+        // suppresses the model's redundant text — the card already said it (Tommy, live: "the
+        // card should suffice"). Everything else mirrors Eve's default handler byte-for-byte
+        // (tool-calls is an intermediate step with no turn-final effects; empty final message
+        // posts nothing), via the pure, unit-tested finalMessageAction()/turnEffectsFor().
+        "message.completed": async (data, channel, ctx) => {
+            // The eve session id for this turn — stamped into the terminal audit rows below so an
+            // audited reply/silence/dropped-prose joins back to its transcript (control-read transcript).
+            const sessionId = ctx?.session?.id;
+            // OPE-1647: the TURN ID, so the stand-down silence mark (channels/stand-down-silence.ts) can
+            // prove it belongs to THIS turn. Same extraction idiom this file already uses for the §POSTED
+            // consume below.
+            // 🔴 SINCE OPE-2006 IT SERVES THE SILENCE DECISION ALONE. It is read once here and handed to
+            // `finalMessageActionForTurn`, whose `consumeStandDownSilenceThisTurn(turnId)` is its only
+            // reader on this path. There is no reply audit below to stamp it onto: this surface DROPS its
+            // closing prose, so the durable latch that guarded the old post has no door left to shut here.
+            const turnId = ctx?.session?.turn?.id;
+            const action = finalMessageActionForTurn(data.finishReason, data.message, turnId);
+            if (action.kind === "buffer-tool-status") {
+                // An intermediate tool-call step, not the turn's end — nothing to decide yet. In
+                // particular: don't read the card-posted flag here, the tool this step is about to
+                // run may be the one that posts the card.
+                return;
+            }
+            // Read-and-reset whether an approval card already posted THIS turn — consumed once,
+            // right before the turn's terminal effects are decided, so the next turn always
+            // starts clean (mirrors how oeSilentTurn/oeUninvited below are REASSIGNED on every
+            // terminal call rather than cleared as a separate step).
+            const cardPostedThisTurn = consumeCardPostedThisTurn();
+            // Same read-and-reset contract, for the bare-stop check right below. A turn that
+            // reacted OR posted mid-turn via the reply-tool family (reply-signal.ts) acted, so
+            // both signals are consumed here and OR'd into the bare-stop input.
+            const reactedThisTurn = consumeReactedThisTurn();
+            // TURN-ID KEYED (OPE-805): a bare read-and-reset let a mark this turn never consumed answer a
+            // LATER turn's read — see reply-signal.ts's header.
+            const repliedThisTurn = consumeRepliedThisTurn(ctx?.session?.turn?.id);
+            if (action.kind === "silent") {
+                // Remember the turn ended silent so session.waiting doesn't stamp a ❓ status
+                // reaction on a conversation the agent chose NOT to join (live-observed: a
+                // judged-silent name-drop left a ❓ on the triggering message).
+                channel.state.oeSilentTurn = true;
+                // Silence is designed to leave no trace ON THE SURFACE — but the operator
+                // needs to distinguish "judged NO_REPLY" from "never woke" (bit us live).
+                // action.reason distinguishes the sentinel route from the no_reply TOOL route
+                // (finalMessageActionForTurn folds both into "silent").
+                console.log(`[open-everywhere:slack] judged silence (${action.reason}) — nothing posted (${channel.state.channelId ?? "?"}/${channel.state.threadTs ?? "?"})`);
+                // ACTIONS-ONLY posture (audit-wedge build plan §1c, 2026-07-14): a judged silence on an
+                // ambient chat surface is NOT an audited action — an agent meant to reply to ~1% of channel
+                // messages would otherwise produce a table that is ~99% silence rows. "Why did it stay
+                // quiet?" is answered by the session transcript (GET /control/v1/session/:id/transcript),
+                // not the audit log. The console line above stays (operator-legible, free); the bare-stop
+                // row below stays (an ANOMALY — a judgment went missing — not a judged silence).
+                //
+                // ONE exception (OPE-890): the model ended the turn on the bare NO_REPLY sentinel — the
+                // TOOL route already carries an always-on `reply.no_reply_observed` row (tools/no_reply.ts,
+                // OPE-649); this is the sentinel route's twin, same action name, best-effort.
+                if (action.reason === NO_REPLY_SENTINEL_REASON) {
+                    try {
+                        const p = resolvePartition({
+                            channel: { kind: "slack" },
+                            session: { auth: { current: { attributes: { team_id: channel.state.teamId ?? "", channel_id: channel.state.channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
+                        });
+                        await auditNoReplySentinelObserved(p, sessionId);
+                    }
+                    catch (err) {
+                        console.warn(`[open-everywhere:slack] sentinel no_reply audit write failed: ${String(err)}`);
+                    }
+                }
+                // Bare-stop enforcement (feature 2's investigation — see slack-events.ts's
+                // isBareStop header for why this is DETECT-AND-LOG, not a hard gate): a turn
+                // that went silent with NO explanation (no sentinel, no no_reply tool) and
+                // NO react either did, as far as anyone can tell, nothing at all. Loud warn
+                // + a best-effort audit row; never a post — silence stays silence.
+                if (isBareStop(action, reactedThisTurn || repliedThisTurn)) {
+                    const channelId = channel.state.channelId ?? undefined;
+                    const threadTs = channel.state.threadTs ?? undefined;
+                    console.warn(`[open-everywhere:slack] BARE STOP — turn ended with no reply, no react, and no no_reply ` +
+                        `(${channelId ?? "?"}/${threadTs ?? "?"}) — this usually means a judgment call went missing, not that one was made.`);
+                    try {
+                        const p = resolvePartition({
+                            channel: { kind: "slack" },
+                            session: { auth: { current: { attributes: { team_id: channel.state.teamId ?? "", channel_id: channelId ?? "" }, principalId: "", principalType: "slack-user" } } },
+                        });
+                        await getOperationalStore().appendAudit({
+                            ts: new Date().toISOString(),
+                            org: p.org,
+                            platform: p.platform,
+                            workspace: p.workspace,
+                            surface: p.surface,
+                            action: "turn.bare_stop",
+                            detail: { threadTs, ...(sessionId ? { sessionId } : {}) },
+                        });
+                    }
+                    catch (err) {
+                        console.warn(`[open-everywhere:slack] bare-stop audit write failed: ${String(err)}`);
+                    }
+                }
+                // Warm auto-disengage: a WARM (non-participating) thread that keeps judging silence
+                // is shed after WARM_SILENT_LIMIT turns, so a one-off name-drop doesn't leave the
+                // bot quietly following forever. PARTICIPATING threads are exempt — they're sticky,
+                // only an explicit stop disengages them — so a missing record OR participating:true
+                // is a no-op here. Build the partition exactly like the post branch does; all
+                // best-effort, engagement bookkeeping never throws out of the handler.
+                try {
+                    const { channelId, teamId, threadTs } = channel.state;
+                    if (channelId && threadTs) {
+                        const p = resolvePartition({
+                            channel: { kind: "slack" },
+                            session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+                        });
+                        const rec = await getThreadEngagement(p, threadTs);
+                        if (rec && rec.participating !== true) {
+                            const streak = await bumpThreadSilentStreak(p, threadTs);
+                            if (streak >= WARM_SILENT_LIMIT) {
+                                await disengageThread(p, threadTs);
+                                console.log(`[open-everywhere:slack] warm thread shed after ${streak} silent turns — disengaged (${channelId}/${threadTs})`);
+                            }
+                        }
+                    }
+                }
+                catch (err) {
+                    console.warn(`[open-everywhere:slack] warm silent-streak bookkeeping failed: ${String(err)}`);
+                }
+                try {
+                    await setWakeTyping(channel);
+                }
+                catch {
+                    /* typing reset is best-effort */
+                }
+                return;
+            }
+            // action.kind === "post" here — the pure decision (unit-tested in slack-events.ts)
+            // gates ONLY whether the text itself posts; every other effect below is unconditional.
+            const effects = turnEffectsFor(action, cardPostedThisTurn);
+            if (effects.kind !== "reply") {
+                // Unreachable: turnEffectsFor only returns "silent" for a "silent" input action,
+                // and action.kind === "post" is established above. Kept as a narrowing guard.
+                return;
+            }
+            channel.state.oeSilentTurn = false;
+            // --- SUPERVISOR host-side reply targeting (T1.4 / C1 workaround) ----------------
+            // A channel-supervisor session's `state.threadTs` is a NON-EMPTY sentinel (T1.3 /
+            // amendment A), so eve's default `channel.thread.post` (bound to state.threadTs) would
+            // post the answer INTO the sentinel pseudo-thread — a leak. The supervisor MUST post
+            // host-side via `slackForm` to the REAL per-turn target snapshotted at turn.started,
+            // and MUST NEVER call `channel.thread.post` (that path also re-anchors an empty binding).
+            // Gated strictly on `oeSupervisor` (isSupervisorReplyTurn) so non-supervisor turns fall
+            // through to the byte-identical default path below. NO_REPLY/no_reply/react/card are all
+            // upstream (the `silent` branch already returned; a supervisor NO_REPLY posts nothing,
+            // same as today). FAIL SAFE: no resolvable target ⇒ deliverSupervisorReply posts NOTHING.
+            //
+            // UNIFIED cross-surface note (formerly TODO(unified-reply) — the non-Slack legs are wired,
+            // 2026-07-11): this leg is Slack-specific (posts host-side via slackForm to a Slack target)
+            // and that is CORRECT — each surface's own completion handler fires for its own deliveries
+            // (eve namespaces continuation tokens per channel, so a GitHub/Linear/Notion wake completes
+            // on THAT channel's message.completed, which posts via its own arm to its own per-wake
+            // snapshot: github.ts / linear.ts / notion.ts supervisor branches, all behind the same
+            // message-tool-only gate). See unified-supervisor.ts's cross-surface-reply header for the
+            // whole model + the per-platform session-namespacing caveat pending a live run.
+            if (isSupervisorReplyTurn(channel.state)) {
+                const target = channel.state.oeReplyTarget;
+                // The channel/org is always known (the supervisor owns one channel) — build its
+                // partition from the session state, independent of whether a reply target resolved.
+                const channelId = channel.state.channelId ?? undefined;
+                const teamId = channel.state.teamId;
+                const partition = channelId
+                    ? resolvePartition({
+                        channel: { kind: "slack" },
+                        session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+                    })
+                    : undefined;
+                // --- MESSAGE-TOOL-ONLY hard-silence gate (OpenClaw steal, slack-events.ts) -----------
+                // A supervisor's terminal completion text is NOT a reply: a visible reply must come from
+                // the `reply` tool (which posted mid-turn via reply-post.ts + marked repliedThisTurn).
+                // Force-drop the terminal prose so a judge that emits stray narration leaks NOTHING to the
+                // watched channel; binding below is unaffected (deliverSupervisorReply binds regardless of
+                // postText). Fail-open only where the surface has no reply tool (never true for Slack).
+                const delivery = supervisorTextDelivery(true /* action.kind==="post" ⇒ non-empty prose */, capabilitiesForPlatform("slack").midTurnPost);
+                if (delivery.droppedProse && isSupervisorProseLeak(true, repliedThisTurn, cardPostedThisTurn)) {
+                    // The load-bearing leak case: the judge produced terminal prose but took NO positive
+                    // action to post it (no `reply`, no card). Drop it (never post), but make the silence
+                    // auditable — mirrors OpenClaw's suppressed-delivery metadata (`didSendViaMessagingTool:
+                    // false`) so "why did the judge go quiet on prose it wrote" always has an answer.
+                    console.warn(`[open-everywhere:slack] supervisor message-tool-only: DROPPED terminal prose (judge emitted text without calling reply) — nothing posted (${channelId ?? "?"}/${target?.threadTs ?? "top-level"})`);
+                    if (partition) {
+                        try {
+                            await getOperationalStore().appendAudit({
+                                ts: new Date().toISOString(),
+                                org: partition.org,
+                                platform: partition.platform,
+                                workspace: partition.workspace,
+                                surface: partition.surface,
+                                action: "turn.supervisor_prose_dropped",
+                                detail: { threadTs: target?.threadTs, chars: action.text.length, ...(sessionId ? { sessionId } : {}) },
+                            });
+                        }
+                        catch (err) {
+                            console.warn(`[open-everywhere:slack] supervisor prose-dropped audit write failed: ${String(err)}`);
+                        }
+                    }
+                }
+                await deliverSupervisorReply({
+                    postText: delivery.postText,
+                    text: action.text,
+                    target,
+                    async post(cid, tts, text) {
+                        // Idempotency (operational/post-once.ts): this raw supervisor-reply post bypasses
+                        // eve's durable reply primitive, so a `deliver`-step re-run after it lands would
+                        // double-post. postOnce (org-partitioned, short TTL) skips the resume duplicate. No
+                        // stableId — a deliver hook has no eve callId — so the key is channel+thread+text.
+                        // Fail-open (incl. an unresolved partition ⇒ undefined org): still posts.
+                        await postOnce({
+                            org: partition?.org,
+                            key: outboundKey({ surface: "slack", channel: cid, threadTs: tts, action: "slack.supervisor-reply", payload: text }),
+                            run: async () => {
+                                await slackForm("chat.postMessage", supervisorPostFormBody(cid, tts, text));
+                            },
+                        });
+                    },
+                    async resolveOwnerToken() {
+                        if (!partition)
+                            return undefined;
+                        try {
+                            return (await getOperationalStore().getChannelSession(partition.org, partition.surfaceKey))?.token;
+                        }
+                        catch {
+                            return undefined;
+                        }
+                    },
+                    async bind(tts, ownerToken) {
+                        if (!partition)
+                            return;
+                        // ownerToken = the supervisor's registry token → the thread is now owned by the
+                        // supervisor session (Tag: "the channel session answers a cheap thread and now
+                        // owns it"). markThreadEngaged is best-effort (never fails a delivered reply).
+                        // `byOwnPost` for the same reason as the delivery promotion below (OPE-1669): the
+                        // trigger here is the agent's own delivered reply, never a person inviting it back, so
+                        // it must not lift a stand-down. The ownership bind itself is unaffected.
+                        await markThreadEngaged(partition, tts, new Date().toISOString(), { participating: true, ownerToken, byOwnPost: true });
+                    },
+                });
+                // Clear the uninvited flag only on ACTUAL participation — the supervisor replied via the
+                // `reply` tool, or a card narrated for it. Under message-tool-only the terminal text is
+                // dropped, so stray prose is NOT participation and must not promote the session (a judge
+                // that leaked prose it never posted stays uninvited, so its later errors keep quiet).
+                if (repliedThisTurn || cardPostedThisTurn) {
+                    channel.state.oeUninvited = false;
+                }
+                return; // NEVER fall through to channel.thread.post — that would post into the sentinel.
+            }
+            if (effects.postText) {
+                // 🔴 THE CLOSING PROSE IS DROPPED, NOT POSTED (OPE-2006). This branch used to route the
+                // engaged-thread terminal reply through `postTerminalProse`, with a raw `channel.thread.post`
+                // fallback for a state that named no channel. Both are gone: the `reply` tool is the only
+                // channel a seat's words leave by, so a turn that ended in prose and never called `reply`
+                // has said nothing here. The row is the record — no re-send, no queue, no host-side re-post.
+                // WHAT TELLS THE MODEL is the seat prompt, not this handler: Slack declares
+                // `closingProseDropped`, so a conversational seat here reads the `reply-only` delivery arm,
+                // whose copy states that the turn-final text is discarded. It reaches a supervisor-shaped
+                // seat inside its persona and a `native`-grain @mention thread — the seat this branch mostly
+                // serves — through the `delivery` slot (instructions/access.ts `renderDeliverySlot`).
+                const channelId = channel.state.channelId ?? undefined;
+                const replyThreadTs = replyThreadTsForState(channel.state);
+                if (channelId) {
+                    const p = resolvePartition({
+                        channel: { kind: "slack" },
+                        session: { auth: { current: { attributes: { team_id: channel.state.teamId ?? "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+                    });
+                    await dropClosingProse({
+                        row: {
+                            org: p.org,
+                            platform: p.platform,
+                            workspace: p.workspace,
+                            surface: p.surface,
+                            principalId: channel.state.oeReplyPrincipalId,
+                        },
+                        chars: action.text.length,
+                        ...(sessionId ? { sessionId } : {}),
+                        // OPE-98: the PER-WAKE thread (dmWakeThreadOverride ?? state.threadTs) — the anchor the
+                        // post would have used, so the row names the conversation the answer was owed to.
+                        anchor: { threadTs: replyThreadTs ?? null },
+                        log: (m) => console.warn(`[open-everywhere:slack] ${m} (${channelId}/${replyThreadTs ?? "?"})`),
+                    });
+                }
+                else {
+                    // 🔴 NO CHANNEL ID, SO NO PARTITION TO FILE IT UNDER, SO NO ROW. `resolvePartition` answers
+                    // `surface: "default"` for a blank channel, and a lost answer filed against a surface that
+                    // names no room pollutes the drop count for everything else that resolves to `default`.
+                    // The drop still happens and the log line is the whole record — the same honest degradation
+                    // the three sibling handlers take, and the same one the deleted poster's fallback took.
+                    console.warn(`[open-everywhere:slack] closing prose DROPPED (${action.text.length}c) — nothing posted, and no partition to audit it under (?/${replyThreadTs ?? "?"})`);
+                }
+            }
+            else {
+                // A card already posted this turn — suppress the redundant narration, but this is
+                // STILL a participating reply for everything below (👀 clears, thread engages,
+                // oeUninvited clears), same as an ordinary post.
+                console.log(`[open-everywhere:slack] approval card already posted this turn — suppressing the redundant text reply (${channel.state.channelId ?? "?"}/${channel.state.threadTs ?? "?"})`);
+            }
+            // DID THIS TURN ACTUALLY DELIVER ANYTHING? Since OPE-2006 the closing prose is dropped, so
+            // reaching this point no longer means a message left. Only a `reply` tool call or an approval
+            // card put bytes in the room, and the two promotions below are what a delivery earns.
+            // 🔴 IT IS THE RULE THE SUPERVISOR BRANCH ABOVE ALREADY STATES — "stray prose is NOT
+            // participation and must not promote the session" — applied to the seat that used to be the
+            // exception because its prose posted. A turn whose only output was dropped prose stays
+            // uninvited and leaves the thread's engagement exactly as it found it.
+            const deliveredThisTurn = repliedThisTurn || cardPostedThisTurn;
+            // The agent is now a PARTICIPANT: an uninvited (name-drop) session that posts
+            // earns normal standing, so later failures go loud like any engaged thread's.
+            if (deliveredThisTurn)
+                channel.state.oeUninvited = false;
+            // Remove the 👀 WITH the reply, not at park: session.waiting fires a workflow
+            // step later and can lag the post by many seconds (live-observed), leaving a
+            // stale "working" mark on an already-answered message. The waiting/completed
+            // removals below stay as the idempotent safety net (e.g. for turns whose final
+            // delivery goes through a path that skips this handler).
+            await setStatusReaction(channel.slack, "none", dmWakeThreadOverride(channel.state));
+            // A posted reply = the agent is participating in this thread → follow it. For
+            // mention threads this is an idempotent refresh (onInbound already engaged); for a
+            // name-drop reply it's what ESTABLISHES engagement, so follow-ups flow without a
+            // mention. Best-effort — engagement must never fail a delivered reply.
+            try {
+                const { channelId, teamId, threadTs } = channel.state;
+                if (deliveredThisTurn && channelId && threadTs) {
+                    const p = resolvePartition({
+                        channel: { kind: "slack" },
+                        session: { auth: { current: { attributes: { team_id: teamId ?? "", channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+                    });
+                    // A posted reply PROMOTES the thread: participating:true so a warm (name-drop)
+                    // thread becomes an invited participant (sticky, streak cleared, failures loud).
+                    // 🔴 `byOwnPost` IS WHAT KEEPS A STAND-DOWN STOOD DOWN (OPE-1669). This promotion carries
+                    // no promoter id, so without the flag it CLEARS the durable `stopped` marker — and the
+                    // acknowledgement `stand_down` asks for travels by the agent's own `reply`, so it reaches
+                    // this promotion and would lift the very stop it was acknowledging. See
+                    // channels/engagement.ts.
+                    await markThreadEngaged(p, threadTs, new Date().toISOString(), { participating: true, byOwnPost: true });
+                }
+            }
+            catch {
+                /* best-effort */
+            }
+        },
+        // Safe to own (no built-in default): turn's over → REMOVE the 👀 (absence = done;
+        // the reply is the result). Silent turns skip entirely — no trace, no API calls, on
+        // a conversation the agent declined to join.
+        "session.completed": async (_data, channel) => {
+            if (channel.state.oeSilentTurn !== true) {
+                await setStatusReaction(channel.slack, "none", dmWakeThreadOverride(channel.state));
+            }
+            await syncPinnedStatus(channel);
+        },
+        // Parked waiting for the next human message — same removal: a parked session is the
+        // steady state of a durable thread, not a "needs input" condition worth a ❓.
+        "session.waiting": async (_data, channel) => {
+            if (channel.state.oeSilentTurn === true)
+                return;
+            await setStatusReaction(channel.slack, "none", dmWakeThreadOverride(channel.state));
+        },
+        // Eve's default posts "I hit an error while handling your request…" into the
+        // thread. Keep that for INVITED turns (failures must stay visible to whoever asked)
+        // but suppress it for uninvited ones — a name-drop turn that would have judged
+        // NO_REPLY must not spam the conversation with an error instead (log + audit only).
+        "turn.failed": async (data, channel) => {
+            if (isUninvited(channel.state)) {
+                await recordQuietFailure(channel.state, "turn.failed", data.message);
+                return;
+            }
+            await setStatusReaction(channel.slack, "blocked", dmWakeThreadOverride(channel.state));
+            try {
+                await postWakeText(channel, `:octagonal_sign: I hit an error while handling your request (${data.message}). Please try again or rephrase.`);
+            }
+            catch {
+                /* best-effort */
+            }
+        },
+        // Override carefully: 🛑 blocked + re-post the error the default would have,
+        // so failures stay visible. Same uninvited-turn suppression as turn.failed.
+        "session.failed": async (data, channel) => {
+            if (isUninvited(channel.state)) {
+                await recordQuietFailure(channel.state, "session.failed", data.message);
+                return;
+            }
+            await setStatusReaction(channel.slack, "blocked", dmWakeThreadOverride(channel.state));
+            try {
+                await postWakeText(channel, `:octagonal_sign: Task failed: ${data.message}`);
+            }
+            catch {
+                /* best-effort */
+            }
+            await syncPinnedStatus(channel);
+        },
+    },
+});
+// Front the public Slack URL with the engagement route so plain (non-mention) thread replies
+// wake the engaged thread's session, while everything slackChannel owns is forwarded through.
+export default frontSlackChannel(slackMentionChannel);
+//# sourceMappingURL=slack.js.map